A crypto exchange’s FCA authorisation requirements depend on how it operates: how trading interests interact, who executes transactions, which entity contracts with customers and who safeguards their assets.
“Crypto exchange” is a commercial description. It does not identify the complete set of permissions a business needs.
For founders and management, the starting question is:
What does each entity do throughout the customer’s transaction, and which permissions and controls support those activities?
This article explains how to assess the application route, prepare the operating model and assemble supporting evidence.
1. Distinguish MLR Registration From FSMA Authorisation
The FCA’s crypto authorization gateway opened on 30 September 2026. The relevant application period currently closes on 28 February 2027, ahead of the expanded regime commencing on 25 October 2027.
Existing cryptoasset registration under the Money Laundering Regulations does not automatically convert into FSMA authorisation. Firms already authorised under FSMA need to apply to vary their permissions where appropriate. Applications are submitted through Connect. FCA
An exchange preparing its application should distinguish:
- Its current activities and obligations.
- Its proposed activities under the expanded regime.
- The applicant’s existing permissions.
- Any changes to entities, contracts or transaction flows.
- The arrangements supporting business continuity during transition.
Application timing and transitional eligibility require a separate assessment. A pending application should not be treated as a general permission to operate.
2. Determine Whether the Business Operates a Trading Platform
PERG 18.7.1G explains the qualifying cryptoasset trading platform—or QCATP—definition. It concerns a system bringing together multiple third-party buying and selling interests in qualifying cryptoassets, interacting within the system in a way that results in a contract.
The assessment is technology-neutral. Providing software or a website alone does not establish that a person operates a QCATP. The system’s features, use and operator’s role matter. handbook.fca.org.uk
For practical analysis, document:
- How interests enter the system.
- Who can interact with them.
- How prices and transaction terms are determined.
- How contracts arise.
- Who operates the relevant rules and processes.
- Which cryptoassets are involved.
An order book is one possible model. Other systems need assessment on their actual features.
3. Map Additional Activities and Permissions
Platform operation may be only part of the business.
| Business feature | Issue to assess |
| Trading against the firm | Principal dealing and applicable restrictions |
| Executing for customers | Agency dealing or other relevant activities |
| Routing transactions elsewhere | Arranging or execution activities |
| Customer wallets | Safeguarding or arranging safeguarding |
| Staking services | Arranging qualifying cryptoasset staking |
| Stablecoin issuance | Issuance activity and associated requirements |
| Other instruments | Whether a separate regulatory framework applies |
Under PERG 18.7.2G, platform permission does not cover safeguarding before or after a transaction. Arranging conducted entirely as part of platform operation benefits from the identified exclusion. Matched principal execution on the operator’s platform requires principal-dealing permission with the appropriate limitation. handbook.fca.org.uk
These distinctions should be reflected consistently in the permission analysis, business plan, contracts and financial model.
4. Explain the Complete Transaction Lifecycle
A useful application description follows the customer’s transaction from beginning to end.
Identify:
- Customer onboarding and contractual arrangements.
- Deposits and allocation of balances.
- Order submission and validation.
- Matching, execution or routing.
- Settlement and ledger updates.
- Reconciliation.
- Withdrawal.
At each stage, identify the responsible entity, systems, providers and customer-facing disclosures.
For an international group, explain which entity performs each function. A branded customer interface may conceal several legal relationships that need to be made explicit.
Pay particular attention to internal ledgers, pooled wallets and settlement arrangements. Describe what changes when a trade executes and how the records correspond to assets held.
5. Prepare Clear Platform Rules
For practical readiness, the platform’s operating rules should explain how participants use the service and how the operator handles exceptional situations.
Subjects to address may include:
- Participant access.
- Permitted order types.
- Matching logic and priority.
- Cancellation.
- Trading interruptions.
- Erroneous transactions.
- Settlement failures.
- Suspension and termination.
- Fees and charges.
Check the applicable requirements in PS26/11, which contains the final rules for regulated cryptoasset activities. fca.org.uk
Then test whether the written rules match the system.
For example, if documents describe time priority, retain testing that shows how orders with different timestamps are processed. Explain any discretion the operator retains and who can exercise it.
6. Assess Execution and Order Handling Requirements
A firm’s execution obligations depend on its role and the applicable provisions.
CRYPTO 5.4 addresses execution and order handling, including the factors used to obtain the best possible results for clients where the obligation applies. Its application includes qualifications: the rules distinguish, for example, matched principal execution under the non-discretionary rules of a platform the firm operates. fca.org.uk
For application preparation, assess:
- The capacity in which the firm acts.
- Its contractual or agency obligations.
- Execution venues and routing decisions.
- Prices, costs and other relevant factors.
- Conflicts and incentives.
- Failed or partially executed orders.
- Evidence supporting the selected arrangements.
Avoid applying one generic “best execution policy” to every service without checking its scope.
7. Prepare Admission and Market Integrity Arrangements
Token admission and market integrity require distinct attention.
PS26/9 contains the final framework for admissions and disclosures and the market abuse regime for cryptoassets, including the related CRYPTO 3 and CRYPTO 4 provisions. fca.org.uk
For practical preparation, develop an assessment of:
- Admission criteria and decision-making.
- Information reviewed before admission.
- Required disclosure arrangements.
- Continuing review.
- Suspension or removal.
- Trading surveillance.
- Investigation and escalation.
- Relevant reporting obligations.
Consider conflicts involving issuers, founders, affiliates and liquidity providers.
A listing fee, commercial relationship or group interest should be identified in the decision record and addressed through the applicable controls.
8. Explain Safeguarding and Withdrawal Control
Where the business safeguards customer cryptoassets, coordinate the custody analysis with the platform application.
The FCA’s final package places cryptoasset safeguarding requirements in CASS 17. Other asset types and associated money require their own assessment rather than an assumption that one custody framework covers everything. FCA
A practical custody description should identify:
- Wallet structure.
- Key and signing arrangements.
- Access permissions.
- Withdrawal approval.
- Customer records.
- Reconciliation.
- Third-party dependencies.
- Recovery and incident response.
Test who can actually move assets, change permissions or initiate recovery.
The application should explain the allocation of control accurately, including any overseas group involvement.
9. Address Conflicts Across the Business
An exchange may combine platform operation, customer execution, custody and relationships with liquidity providers.
Prepare an assessment of actual conflicts, including:
- Affiliate trading.
- Listing decisions.
- Access to pending orders.
- Fee incentives.
- Preferential arrangements.
- Staff trading.
- Commercial pressure on control functions.
For each conflict, record the responsible owner, proposed safeguard and monitoring method.
The final activity rules expressly address misuse of information relating to pending client orders. fca.org.uk
Internal preparation should also test whether staff understand the restrictions and whether system access supports them.
10. Demonstrate Operational and Financial Readiness
A platform application should connect its proposed scale with the resources supporting it.
Suggested readiness exercises include:
- Capacity and stress testing.
- Access-control reviews.
- Recovery tests.
- Withdrawal and reconciliation tests.
- Provider outage scenarios.
- Financial crime investigations.
- Customer complaint exercises.
- Adverse financial scenarios.
Clearly distinguish completed tests from future work.
For financial planning, assess the prudential treatment of all proposed permissions and model the effect of expenditure, growth and losses. Platform permission should not be treated as settling the capital implications of additional activities.
Management should understand significant unresolved dependencies and their effect on launch readiness.
11. Assemble a Consistent Application Pack
The FCA has published an information document covering general authorisation questions and crypto-specific sections driven by the applicant’s business model. The document supports preparation; the application itself is submitted through Connect. fca.org.uk
A practical evidence pack may include:
| Document or evidence | Purpose |
| Permission and territorial analysis | Explain the proposed regulatory route |
| Regulatory business plan | Describe the applicant and operating model |
| Transaction and asset flows | Identify entities, systems and control |
| Platform rules | Explain access, trading and exceptions |
| Admission framework | Support token review and decisions |
| Market integrity procedures | Explain surveillance and escalation |
| Execution documents | Support applicable execution arrangements |
| Custody documentation | Explain safeguarding and withdrawal control |
| Governance records | Allocate authority and oversight |
| Financial model | Support resources and funding assumptions |
| Testing and remediation | Demonstrate implementation status |
Check that terminology, entities and responsibilities agree across the pack.
A platform diagram describing one entity as the operator should not conflict with customer terms or application answers identifying another.
How CRYPTOVERSE Can Support Your Exchange Application
CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.
We can help assess permissions, review the operating model, identify readiness gaps and prepare business plans, governance documents, policies and supporting application evidence.
Our approach connects the legal analysis with the exchange’s transaction flows, customer relationships and operational controls.
Contact CRYPTOVERSE to discuss FCA authorisation support for your crypto exchange or trading platform.
FAQs
1. What is FCA crypto exchange authorisation?
FCA crypto exchange authorisation is regulatory approval required for firms carrying out specified regulated cryptoasset activities in the UK. The permissions needed depend on the exchange’s business model, transaction flow and services.
2. What permissions does a crypto exchange need from the FCA?
The required permissions depend on the activities performed, which may include operating a qualifying cryptoasset trading platform, dealing as principal, executing transactions and providing safeguarding services. Each activity must be assessed separately.
3. Is FCA MLR registration enough to operate a crypto exchange in the UK?
No. Existing registration under the Money Laundering Regulations does not automatically provide authorisation under the expanded FSMA cryptoasset regime. Firms must assess the applicable authorisation requirements and transitional arrangements.
4. What documents are required for an FCA crypto exchange application?
Supporting documents may include a regulatory business plan, permission analysis, transaction flow diagrams, platform rules, governance policies, safeguarding procedures, financial forecasts and evidence of operational testing. The exact requirements depend on the applicant’s activities.
5. How can a crypto exchange prepare for FCA authorisation?
A crypto exchange can prepare by mapping its business activities, identifying the required permissions, reviewing customer contracts, documenting operational controls, assessing financial resources and addressing compliance gaps before submitting its application through the FCA’s Connect system.