By CRYPTOVERSE Legal Consultancy
Your crypto asset protection UAE business may need FCA registration, authorisation or additional permissions depending on what it does, which assets it handles and its connection to the UK. Incorporating a company, holding an overseas licence or describing a service as “non-custodial” does not answer that question.
The assessment must also distinguish current obligations from requirements under the expanded cryptoasset regime commencing on 25 October 2027. The FCA’s authorisation application period opened on 30 September 2026 and closes on 28 February 2027.
For founders searching “Do I need an FCA crypto licence?”, the practical starting point is a regulatory perimeter assessment: a structured analysis of the business’s functions, assets, customers and territorial connections.
There Is No Single Answer for Every Crypto Business
Two companies can use the same commercial description while requiring different regulatory treatment.
Consider two businesses calling themselves “crypto wallet providers”.
One supplies software through which users independently control their assets. The other can approve withdrawals, recover access and transfer assets through an MPC signing arrangement.
Those differences matter. The assessment concerns actual contractual and technical control, including functions performed jointly with other parties. FCA guidance addresses safeguarding, relevant control and specific exclusions.
Similarly, a “broker” may act as the customer’s counterparty, execute as agent, arrange transactions or combine those functions.
A legal assessment should start with the transaction journey rather than the brand description.
Step 1: Identify What the Business Actually Does
Map each service from customer instruction to settlement.
Ask:
- Who receives the instruction?
- Who selects the counterparty and sets the price?
- Who enters into the transaction?
- Who controls assets before and after execution?
- Who receives fees?
- Which legal entity performs each function?
Under the expanded framework, the principal cryptoasset activities include:
| Function requiring assessment | Relevant Regulated Activities Order provision |
| Issuing a qualifying stablecoin | Article 9M |
| Safeguarding relevant cryptoassets | Article 9N(1)(a) |
| Arranging safeguarding | Article 9N(1)(b) |
| Operating a qualifying cryptoasset trading platform | Article 9S |
| Dealing in qualifying cryptoassets as principal | Article 9T |
| Dealing in qualifying cryptoassets as agent | Article 9W |
| Bringing about deals | Article 9Y(1) |
| Making arrangements with a view to transactions | Article 9Y(2) |
| Arranging qualifying cryptoasset staking | Article 9Z6 |
These provisions have defined scopes and exclusions. The FCA lists the activities and relevant asset categories in its perimeter guidance.
A commercial model may engage several provisions. Conversely, participation in a crypto market does not automatically establish that every participant carries on a regulated business.
Step 2: Assess Whether the Activity Is Carried On by Way of Business
The business test is an essential part of the analysis.
Relevant considerations must be applied to the particular activity. The FCA’s guidance distinguishes a business model involving the activity from participation merely as an end-user.
Does Proprietary Crypto Trading Require Authorisation?
Buying cryptoassets for a company’s investment portfolio does not automatically resolve into a regulated dealing business.
The assessment should examine whether the firm:
- Quotes prices to customers;
- Makes markets;
- Buys assets with a view to selling them as a business;
- Executes customer transactions;
- Trades for other entities; or
- Operates a broader financial service.
Applicable dealing exclusions must then be considered. The FCA’s intermediary guidance addresses the distinction between market participation and holding oneself out as conducting a relevant business.
“Trading our own money” is useful information, but insufficient as the entire legal analysis.
Step 3: Classify the Tokens and Instruments
Virtual asset lending and borrowing services permission analysis depends on the assets involved.
A business should examine token rights and features, including:
- Transferability and fungibility;
- Claims against an issuer;
- Ownership, repayment or profit rights;
- Redemption rights;
- Reference currencies and backing assets; and
- Access to goods or services.
Relevant classifications may include qualifying cryptoassets, qualifying stablecoins, existing specified investments and electronic money. The FCA’s PERG 18.4 addresses the new investment definitions and their boundaries.
Does Calling a Token a Utility Token Make It Unregulated?
No conclusion should be based solely on that label.
The contractual rights and actual arrangements must be assessed. The same applies to “NFT”, “governance token” and “real-world asset token”.
An asset outside one definition may still engage another regime.
Does Issuing a Token Always Require a Stablecoin Permission?
The analysis must distinguish qualifying stablecoin issuance from issuing other tokens.
It should separately examine any dealing, arranging, offer, admission or promotion functions. A token launch can create regulatory questions beyond the issuer’s preferred classification.
Step 4: Establish the UK Connection
An overseas location does not, by itself, settle UK regulatory exposure.
The assessment should identify:
- Customer locations and types;
- UK offices, staff, agents and contractors;
- Where decisions and activities occur;
- Which entity contracts with customers;
- UK distribution and service arrangements; and
- The territorial provisions relevant to each activity.
FCA PERG 18.3 addresses territorial application, including specific treatment of UK consumers and reverse solicitation.
Does Having UK Customers Automatically Require MLR Registration?
Under the current MLR framework, the FCA explains that allowing UK customers to use an overseas exchange does not automatically mean the business is carried on in the UK. The operational facts matter.
That position should not be carried across automatically to every activity under the expanded FSMA perimeter.
Can We Rely on Reverse Solicitation?
A customer approaching the business independently should not be treated as a general exemption from UK cryptoasset authorisation.
Record the facts and assess the relevant territorial provisions. Financial promotions exposure also needs separate consideration.
Does a VARA or MiCA Licence Cover the UK?
An overseas approval may provide useful evidence of the business’s governance and regulatory history. UK requirements nevertheless need an independent assessment against the actual UK-facing model.
Step 5: Check Exclusions and Exemptions
An exclusion must be supported by its conditions.
The assessment should record:
- The precise provision relied upon;
- The facts satisfying each condition;
- Supporting contracts and technical evidence;
- The limits of the conclusion; and
- Changes that would require reassessment.
Statements such as “technology only”, “temporary custody” or “intra-group” should be examined carefully.
For technology services, the FCA asks whether the firm merely supplies functionality or participates in arrangements facilitating transactions. The legal conclusion should follow the actual service.
Step 6: Identify the Correct Application Route
Once the perimeter is understood, assess the firm’s existing status.
| Position | Route to assess |
| In-scope services before the expanded regime | Current MLR registration requirements |
| Relevant activities without existing Part 4A authorisation | New FSMA authorisation |
| Existing Part 4A-authorised firm adding crypto activities | Variation of permission |
| Payment or electronic money firm | Its precise status and required crypto permissions |
| Activities outside the assessed crypto perimeter | Other applicable regimes and promotion obligations |
The FCA confirms that MLR registration does not automatically convert into authorisation. Payment services and electronic money status also do not automatically resolve the new permission requirements.
For a launch before October 2027, current requirements must be addressed separately from the future application strategy.
Step 7: Assess Marketing Separately
A business may face UK financial promotion requirements even where its service assessment produces a different territorial conclusion.
FSMA section 21 addresses financial promotions; section 19 addresses carrying on regulated activities.
The cryptoasset financial promotions framework reaches firms marketing to UK consumers, including overseas firms.
Review websites, applications, social media, affiliates and linked customer journeys. Describing communications as “educational” does not settle whether their substance invites or induces investment activity.
What Should a Regulatory Assessment Deliver?
Management needs a usable conclusion, not merely a collection of legal provisions that provides Regulatory compliance advisory services .
A written assessment should identify:
- The entities and services covered;
- Token classification conclusions;
- Relevant activities and territorial tests;
- Supported exclusions and material uncertainties;
- Current registration and future permission requirements;
- Marketing and distribution issues; and
- Actions required before launch or expansion.
The accompanying permissions matrix should show which entity needs what, why and by when.
How Can CRYPTOVERSE Help?
CRYPTOVERSE provides specialist legal and regulatory support for UK FCA cryptoasset authorisation.
Our perimeter assessments examine business functions, token rights, asset control, customers and UK connections. We translate the findings into an application route, permissions matrix and practical next steps.
Where authorisation is required, support can extend to readiness assessments, business plans, agreed compliance documentation and application preparation.
Before launching, accepting UK customers or adding a new crypto service, request a UK regulatory perimeter assessment from CRYPTOVERSE.
FAQs
1. Does every crypto startup need FCA authorisation?
No. The answer depends on activities, assets, business and territorial tests, exclusions and timing.
2. Does a non-custodial label avoid custody requirements?
Not automatically. Actual control, recovery and signing arrangements must be examined.
3. Is crypto lending a separate licence category?
Assess the underlying functions and instruments rather than assuming a standalone permission from the product name.
4. Can an application permit us to start trading?
Submission alone is insufficient. Identify the current legal basis and any applicable saving or transitional conditions.
5. When should we obtain a perimeter assessment?
Before committing to the operating structure, customer contracts or launch plan, and again when material features change.