By CRYPTOVERSE Legal Consultancy
To apply for FCA cryptoasset authorisation, a company must establish its regulatory perimeter, identify the appropriate permissions, assess readiness and prepare a coherent application supported by evidence. The application must describe the business the firm will actually operate.
The process starts before completing a form. Decisions about customer contracts, asset control, personnel, funding and outsourcing determine what the applicant must explain and demonstrate.
The FCA’s cryptoasset authorisation application period opened on 30 September 2026 and closes on 28 February 2027, ahead of the expanded regime commencing on 25 October 2027. www.fca.org.uk
This guide sets out a practical sequence for UK companies and overseas groups preparing an application.
The FCA Crypto Application Process at a Glance
| Stage | Main task | Practical output |
| 1. Regulatory assessment | Analyse activities, assets and UK connections | Regulatory assessment report |
| 2. Permission mapping | Identify applicant and application route | Permissions matrix |
| 3. Readiness review | Assess documentation and operational gaps | Gap analysis and action plan |
| 4. Implementation | Resolve material gaps and gather evidence | Verified completion records |
| 5. Application preparation | Complete forms and supporting materials | Indexed submission pack |
| 6. Final review | Check consistency and obtain approvals | Approved final application |
| 7. Submission | Submit through Connect with applicable fee | Submission receipt and archive |
| 8. Regulatory assessment | Respond to questions and material changes | Controlled correspondence record |
These stages overlap, but their dependencies matter. A business plan cannot be finalised reliably while the underlying operating model remains unsettled.
Step 1: Establish Whether the Activities Require Authorisation
The first task is a regulatory perimeter assessment.
It should examine:
- The services performed by each entity;
- Token rights and classifications;
- Principal, agency and intermediary roles;
- Customer asset control;
- Customer types and locations;
- UK territorial connections; and
- Applicable exclusions or exemptions.
The FCA’s final perimeter guidance, PS26/18, explains when cryptoasset activities require authorisation. www.fca.org.uk
The assessment should use actual functions rather than labels such as “broker”, “wallet” or “technology provider”.
Why This Changes the Application
Consider an illustrative trading service. Customers deposit assets, request transactions and receive settlement through wallets controlled by the business.
Preparing an application solely around transaction execution could overlook safeguarding responsibilities. The asset-control assessment must therefore inform both the requested permissions and supporting documentation.
Recommended output: A written conclusion identifying the relevant activities, supporting provisions, material assumptions and unresolved questions.
Step 2: Confirm the Applicant and Application Route
Identify the legal entity that will perform the regulated activities and its current status.
| Existing status | Route to assess |
| No relevant Part 4A authorisation | New authorisation |
| Existing Part 4A-authorised firm | Variation of permission |
| MLR-registered cryptoasset business | Required FSMA authorisation |
| Payment or electronic money firm | Precise status and applicable FSMA route |
The FCA confirms that MLR registration does not automatically convert into authorisation. It also provides a cryptoasset form for firms varying existing permissions. FCA
For overseas groups, applicant selection must be considered alongside the proposed structure and supervisory arrangements. FG26/7 sets out the FCA’s approach to international cryptoasset firms. www.fca.org.uk
Recommended output: A permissions matrix linking each entity and function to the application route.
Step 3: Conduct an Application Readiness Assessment
Compare existing arrangements with the requirements relevant to the proposed business.
Review governance, personnel, financial resources, financial crime controls, technology, outsourcing, customer protection and activity-specific procedures.
The FCA encourages firms to conduct a gap analysis and develop a realistic, board-agreed implementation plan identifying accountability, changes, delivery and timing. FCA
Distinguish three kinds of gap:
- Information gaps: facts or evidence are missing.
- Documentation gaps: arrangements exist but are inadequately recorded.
- Implementation gaps: the required arrangement has not been put in place.
The response differs for each. Producing a policy cannot resolve an unconfigured monitoring system or an unfilled management role.
Recommended output: A prioritised action plan with owners, deadlines and closure evidence.
Step 4: Resolve the Operating Model and Material Dependencies
Application drafting should follow clear business decisions.
Management needs to settle:
- Which services launch first;
- Who contracts with customers;
- Where decisions are made;
- How transactions and assets move;
- Which suppliers are used;
- Who oversees each risk; and
- How the business is funded.
Record outstanding dependencies accurately. Determine what must be completed for submission and what may be addressed through a credible implementation plan under the applicable requirements.
Avoid presenting planned controls as already operational.
Step 5: Prepare the Regulatory Business Plan
The business plan should explain how the applicant will operate and meet its obligations.
A practical structure includes:
- Applicant identity and ownership;
- Products, customers and permission scope;
- Customer journeys and transaction flows;
- Revenue model and forecasts;
- Governance and personnel;
- Risk management and compliance;
- Technology and outsourcing;
- Activity-specific controls; and
- Implementation and contingency planning.
The purpose is to make the business understandable. Commercial ambitions should be connected to realistic staffing, systems and financial assumptions.
For MLR applications, the FCA specifically expects supporting information tailored to the cryptoasset business. The same preparation discipline is useful when assembling an FSMA submission, while keeping the legal requirements of each route distinct. www.fca.org.uk
Step 6: Assemble the Supporting Evidence
The application pack should substantiate its material statements.
| Statement in the application | Supporting evidence to consider |
| Ownership is transparent | Ownership chart, registers and control arrangements |
| Personnel are suitable and available | CVs, appointments, responsibilities and time commitments |
| Funding is available | Financial records and funding agreements |
| Monitoring operates | Configuration, testing and investigation records |
| Outsourcing is controlled | Due diligence, contracts and oversight records |
| Customer assets are protected | Legal arrangements, control descriptions and reconciliations |
| Recovery arrangements are credible | Continuity plans and testing evidence |
Financial planning should reflect the applicable framework. Relevant cryptoasset firms must assess COREPRU and CRYPTOPRU, rather than rely on a generic minimum capital assumption. www.fca.org.uk
Not every evidence item is necessarily an attachment. Map each document to the relevant question and identify material retained for later review.
Step 7: Consider Pre-Application Engagement
The FCA’s Pre-Application Support Service, or PASS, can help firms discuss their business model and understand the process.
A request should include meaningful information about products, customers and intended regulated activities. Pre-application engagement does not constitute legal advice or guarantee a successful application. FCA
Prepare a focused discussion pack:
- Business and entity overview;
- Proposed permission scope;
- Customer and transaction diagrams;
- Material regulatory questions;
- Readiness position; and
- Supporting analysis.
A useful meeting begins with a sufficiently developed model and specific questions.
Step 8: Complete the Applicable Forms
Use the current forms and instructions for the selected route.
The FCA publishes information covering general firm application components and cryptoasset-specific sections, together with a cryptoasset VoP form and financial data template. FCA
Maintain a question-to-evidence index. Each response should agree with the supporting documents.
Take particular care with:
- Entity names;
- Ownership percentages;
- Personnel responsibilities;
- Financial figures;
- Asset-control descriptions;
- Customer restrictions; and
- Statements about implementation.
Where a question is not applicable, explain why rather than leaving it unanswered.
Step 9: Review Consistency and Obtain Management Approval
The FCA expects final documents that have been thoroughly reviewed and appropriately signed off. Its general authorisation guidance also emphasises being ready, willing and organised. FCA
The final review should test whether every document describes the same business.
For example:
- Does the forecast fund the staffing plan?
- Do customer terms match the custody model?
- Do procedures describe the selected suppliers?
- Are proposed activities consistent with requested permissions?
- Are unresolved dependencies disclosed?
Management should approve the exact submission versions and confirm the accuracy of factual statements. Relevant individuals must make their own required declarations.
Step 10: Submit Through Connect and Retain the Record
Relevant applications are submitted through the FCA’s Connect system. FCA
Before submission, confirm authorised access, applicable fees, attachments and the submission instruction.
Retain:
- The exact application submitted;
- Every attachment and version;
- Management approvals;
- Payment confirmation;
- Submission receipt; and
- The correspondence reference.
Submission is a milestone in the process. It does not itself establish permission to commence regulated activities.
What Happens After Submission?
Prepare for questions about the business, personnel, finances and controls.
Allocate each request to an appropriate subject owner. Responses should answer the question directly, provide supporting evidence and identify any resulting amendments.
The FCA expects applicants to respond proactively and remain open and honest during assessment. A poor initial application should not be submitted on the assumption that the regulator will help complete it. FCA
Use a controlled tracker for deadlines, versions and approvals. Material changes to the model should be assessed promptly for their effect on the application.
Common Preparation Mistakes
Practical weaknesses to avoid include:
- Choosing permissions before understanding the business;
- Reusing another firm’s documents without adapting them;
- Leaving group responsibilities unclear;
- Forecasting growth unsupported by resources;
- Describing controls that have not been implemented;
- Allowing contradictory versions into the pack; and
- Treating the application deadline as the date to begin preparation.
A disciplined readiness review can identify these issues before submission.
How CRYPTOVERSE Supports the Application
CRYPTOVERSE provides specialist legal and regulatory support for UK FCA cryptoasset authorisation.
Our support can include perimeter assessments, permissions mapping, readiness reviews, business plans, agreed compliance documentation, evidence reviews and application coordination.
The engagement should allocate responsibilities clearly: advisers prepare and review agreed materials; the Client supplies accurate information, makes business decisions and implements its operating arrangements.
Preparing an FCA cryptoasset application? Request an application scoping consultation with CRYPTOVERSE.
FAQs
1. How do you apply for FCA cryptoasset authorisation in the UK?
To apply for FCA cryptoasset authorisation, a company must assess its regulated activities, identify the required permissions, review its operational readiness, and prepare an application supported by relevant evidence. The process includes developing a regulatory business plan, completing the applicable forms, obtaining management approval, and submitting the application through the FCA’s Connect system.
2. What documents are required for FCA cryptoasset authorisation?
Documents may include a regulatory business plan, ownership structure, management CVs, financial forecasts, governance documents, compliance policies, customer transaction flows, outsourcing arrangements, and evidence of operational controls. The exact documentation depends on the applicant’s business model, proposed permissions, and application route.
3. Can an MLR-registered crypto business apply for FCA cryptoasset authorisation?
Yes. An MLR-registered cryptoasset business must assess and follow the applicable FSMA authorisation requirements for its proposed activities. Existing MLR registration does not automatically convert into FCA authorisation, so the business should identify the appropriate application route and prepare the required supporting evidence.
4. What is the FCA cryptoasset authorisation application process for overseas companies?
Overseas companies should assess their UK regulatory obligations, proposed applicant entity, business activities, group structure, and supervisory arrangements. They should also review how their governance, financial resources, compliance controls, and operating model meet the applicable UK requirements before preparing their application.
5. What happens after submitting an FCA cryptoasset authorisation application?
After submission, the FCA assesses the application and may request additional information about the business model, management, finances, governance, or operational controls. Applicants should respond accurately and promptly, maintain consistent documentation, track deadlines, and assess material business changes that could affect the application.