By CRYPTOVERSE Legal Consultancy
A crypto company is ready for an FCA authorisation application when it can explain its regulated business, demonstrate credible resources and controls, and support its material statements with evidence. Having completed forms and a folder of policies does not, by itself, establish readiness.
The assessment must also distinguish readiness to submit from readiness to operate under the relevant permissions. Outstanding implementation may need to be addressed through a credible plan, but its treatment depends on the applicable requirements and circumstances.
The FCA expressly encourages crypto firms to assess their proposed permissions, conduct a gap analysis and develop a realistic implementation plan approved at board level. FCA
For management, a readiness review should produce a clear decision: proceed, proceed after specified remediation, or defer submission.
What Does FCA Application Readiness Mean?
The FCA’s general authorisation guidance describes applicants as needing to be ready, willing and organised. It expects final documents, appropriate sign-off and proactive engagement during assessment. FCA
In practical terms, management should be able to answer:
- What activities will the applicant perform?
- Why are the requested permissions appropriate?
- Who makes decisions and oversees risks?
- How is the business funded?
- Which controls already operate?
- What remains outstanding?
- How will the firm maintain compliance after approval?
A readiness assessment tests those answers against records, contracts, financial information and operational demonstrations.
The framework below is a practical assessment approach, rather than an FCA scoring system.
Start With the Correct Regulatory Route
Before reviewing controls, confirm the applicant, activities and application route.
An existing MLR-registered firm may require new FSMA authorisation. An existing Part 4A-authorised firm may need a variation of permission. Payment services or electronic money status must be assessed precisely.
The FCA confirms that MLR registration does not automatically convert into authorisation. www.fca.org.uk
Readiness against the wrong route wastes resources and can leave material requirements unaddressed.
First deliverable: A confirmed permissions matrix supported by a regulatory perimeter assessment.
1. Is the Business Model Settled and Understandable?
A review should establish whether the proposed business is sufficiently defined.
Examine the products, customers, tokens, transaction roles, asset control and entity responsibilities. Separate launch activities from future ambitions.
Warning signs include:
- Unclear customer contracting arrangements;
- Contradictory custody descriptions;
- Products included in forecasts but absent from the permission assessment;
- Unresolved token rights; and
- Group functions described differently across documents.
The FCA’s PS26/18 provides final guidance on when cryptoasset activities require authorisation. www.fca.org.uk
Evidence to review: Product terms, customer journeys, transaction diagrams, token assessments and management decisions.
2. Can Management Exercise Effective Control?
Governance readiness concerns real authority and oversight.
The FCA’s threshold conditions address effective supervision, suitability, appropriate resources and the business model. FCA
Assess whether:
- Responsibilities are clearly allocated;
- Key personnel have relevant experience and availability;
- Compliance can escalate concerns;
- The board receives useful information;
- Conflicts are identified and managed; and
- Overseas and outsourced functions remain subject to oversight.
A role may be documented without being effective. For example, a proposed compliance lead might lack access to transaction records or authority to suspend onboarding.
Evidence to review: Appointments, role descriptions, reporting arrangements, committee terms and examples of decisions.
3. Are Financial Resources Supported by Evidence?
Readiness requires credible resource planning.
Distinguish current funds from anticipated investment. Review conditions attached to commitments and the effects of delayed funding.
For relevant cryptoasset firms, the prudential framework includes COREPRU and CRYPTOPRU. www.fca.org.uk
A practical review should reconcile forecasts with:
- Staffing;
- Technology and suppliers;
- Compliance costs;
- Proposed transaction volumes;
- Downside scenarios; and
- Exit or wind-down arrangements where applicable.
Warning sign: A forecast shows rapid growth while omitting the resources needed to supervise that growth.
4. Do Financial Crime Controls Work in Practice?
Policies should describe procedures suited to the actual business. Implementation evidence should show how those procedures operate.
For MLR registration, the FCA emphasises a tailored framework and relevant competence. Those expectations should be assessed within that route, alongside the requirements applicable to an FSMA application. www.fca.org.uk
Review customer due diligence, sanctions screening, monitoring, investigations, suspicious activity reporting and Travel Rule arrangements.
Useful questions include:
- Who owns an alert?
- How is it investigated?
- What triggers escalation?
- Can the system settings be explained?
- How are exceptions recorded?
- What does management learn from the results?
Evidence to review: Configuration, testing, anonymised cases, training and reporting records.
5. Are Technology and Supplier Dependencies Controlled?
A readiness review should test whether the applicant understands and controls the infrastructure supporting its services.
Assess access rights, wallet controls, change management, incident response, recovery and material suppliers.
An illustrative weakness would be a recovery plan that depends on a provider whose agreement does not support the stated recovery arrangements.
For overseas groups, examine the applicant’s dependence on affiliates and its ability to obtain information and exercise oversight. The FCA’s FG26/7 addresses international cryptoasset firms. www.fca.org.uk
Evidence to review: Architecture diagrams, contracts, supplier assessments, testing and remediation records.
Specialist technical verification should be identified separately from legal document review.
6. Are Customer Terms and Controls Consistent?
Customer documents should accurately explain the operating model.
Review ownership, fees, withdrawals, redemption, execution and relevant risks. Compare those terms with operational procedures.
For activity-specific controls, use the requirements relevant to the business. The FCA’s policy package addresses trading, custody, stablecoin issuance, staking and other regulated functions. www.fca.org.uk
A custody review, for example, should consider the relevant asset categories and applicable safeguarding rules. The FCA distinguishes initial treatment under CASS 17 and CASS 6. www.fca.org.uk
Warning sign: Customer terms promise immediate withdrawals while procedures contain significant operational restrictions.
7. Is Marketing Lawful and Operationally Supported?
Financial promotions readiness requires more than reviewing wording.
Assess the communication route, audience, channels and linked customer journey. Verify applicable safeguards and distribution controls.
The existing cryptoasset promotions regime reaches overseas firms marketing to UK consumers. www.fca.org.uk
Evidence to review: Final materials, review records, relevant approval arrangements and journey testing.
Keep internal legal review distinct from statutory approval where required.
8. Is the Application Pack Coherent?
The FCA’s application information includes general firm components and cryptoasset-specific sections driven by the proposed model. www.fca.org.uk
Readiness review should confirm that the forms, business plan, forecasts, contracts and policies describe the same arrangements.
Check:
- Names and ownership figures;
- Permission scope;
- Personnel and responsibilities;
- Financial assumptions;
- Asset control;
- Supplier arrangements; and
- Implementation status.
Maintain an evidence index and remove superseded versions from the submission pack.
Use Status Labels That Distinguish Documentation From Implementation
The following labels can support a practical gap analysis:
| Status | Meaning |
| Not started | Required work has not begun |
| In development | Material elements remain incomplete |
| Documented | Written arrangements exist; approval or implementation remains outstanding |
| Implemented | Arrangements operate; sufficient verification remains outstanding |
| Verified | Evidence supports the assessed readiness criterion |
| Unverified | Information is insufficient to conclude |
| Not applicable | Exclusion is supported by recorded reasoning |
Avoid an overall percentage that conceals a critical issue.
A company could have most documents completed while lacking an essential funding commitment or a settled custody model.
Identify Submission Blockers Explicitly
A blocker is an issue preventing a credible or sufficiently complete application at the relevant stage.
Illustrative blockers include:
- Unresolved applicant identity or permission scope;
- Material inconsistencies about customer asset control;
- Unsupported financial resources;
- Missing required information;
- Inaccurate implementation claims; and
- Unresolved governance arrangements.
The FCA warns that poor-quality submissions may be rejected where minimum information is missing, and may also cause delay or refusal. FCA
Each blocker needs an owner, action and measurable closure requirement.
| Gap | Remediation | Closure evidence |
| Monitoring configuration unverified | Complete configuration review and testing | Approved results and resolved defects |
| Funding dependency unclear | Document terms and availability | Executed evidence and updated forecast |
| Conflicting custody descriptions | Resolve legal and technical model | Aligned contracts, procedures and diagrams |
What Should the Final Readiness Conclusion Say?
A useful report should select one of four conclusions:
- Ready for final submission review: No material unresolved gaps identified within scope.
- Conditionally ready: Specified items require completion and verification.
- Not ready: Material gaps prevent a credible submission.
- Unable to conclude: Essential evidence is unavailable.
Record the reasons, conditions and remaining limitations.
Management approval allocates resources and confirms decisions. It does not waive regulatory requirements or turn incomplete evidence into compliance.
Readiness Must Continue After Submission
Material changes can affect an application already under review.
Examples include new investors, revised products, personnel departures, supplier changes or altered wallet controls.
Use change control to identify affected forms and documents. Reassess launch and continuity plans where necessary.
The saving and transitional arrangements require separate eligibility analysis; submission alone does not create unrestricted permission to operate. www.fca.org.uk
How CRYPTOVERSE Can Help
CRYPTOVERSE provides specialist legal and regulatory support for UK FCA cryptoasset authorisation.
Our readiness assessments can identify regulatory gaps, review supporting evidence and produce a prioritised remediation plan. Support can extend to permissions mapping, business plans, agreed documentation and final submission review.
Request an FCA cryptoasset readiness assessment from CRYPTOVERSE before committing to your submission date.
FAQs
1. What does FCA cryptoasset authorisation readiness mean?
FCA cryptoasset authorisation readiness means a crypto company can clearly explain its regulated activities, demonstrate adequate financial and operational resources, and provide evidence supporting its governance, compliance and risk controls. A readiness assessment identifies gaps that should be addressed before submission.
2. How can a crypto company assess its readiness for FCA authorisation?
A crypto company can assess its readiness by reviewing its regulatory permissions, business model, governance, financial resources, financial crime controls, technology arrangements, customer terms and application documents. The review should identify outstanding gaps, assign remediation responsibilities and determine whether the evidence supports a credible application.
3. What documents are needed for an FCA cryptoasset authorisation application?
Depending on the business model and requested permissions, an application may require a business plan, ownership details, financial forecasts, governance arrangements, compliance policies, customer terms, technology and supplier information, and evidence of operational controls. The application pack should be consistent, complete and supported by appropriate evidence.
4. Can an MLR-registered crypto company operate under FCA authorisation without applying again?
No. Money Laundering Regulations (MLR) registration does not automatically convert into FSMA authorisation. A crypto company must assess its activities and applicable regulatory requirements to determine whether it needs a new authorisation or another regulatory route. The correct position depends on the firm’s circumstances and the activities it intends to conduct.
5. What happens if a crypto company is not ready for FCA authorisation?
If material gaps remain, the company should develop a prioritised remediation plan before proceeding with its application. Outstanding issues may include unclear permission requirements, insufficient financial evidence, ineffective controls, inconsistent customer documents or unresolved governance arrangements. CRYPTOVERSE can help identify these gaps and prepare a structured readiness assessment.