UK Crypto Regulation in 2027: What Companies Must Prepare Before the New Regime Begins

By CRYPTOVERSE Legal Consultancy

The expanded UK cryptoasset regime begins on 25 October 2027. Companies intending to carry on in-scope activities must prepare for FCA authorisation or the appropriate variation of permission, alongside the governance, financial resources and operational controls their business requires.

The authorisation gateway is already open. The application period runs from 30 September 2026 to 28 February 2027. Existing registration under the Money Laundering Regulations does not automatically convert into authorisation. www.fca.org.uk

For management teams, preparation involves more than selecting an application date. It requires decisions about the operating entity, products, personnel, funding, technology and customer arrangements.

This article explains what crypto companies should prepare—and how to turn the regulatory requirements into a workable implementation programme.

What Changes Under UK Crypto Regulation in 2027?

The expanded framework brings a broader range of cryptoasset activities within the FCA’s regulatory perimeter.

It moves beyond the financial crime registration and financial promotions requirements that previously defined much of the FCA’s role in this market. The framework is underpinned by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. FCA

Affected business models include cryptoasset trading platforms, intermediaries, custodians, qualifying stablecoin issuers and firms arranging staking. Their precise obligations depend on their activities, assets and applicable exclusions. www.fca.org.uk

A company should therefore establish its permission scope before deciding which policies or application documents to prepare.

The Dates Management Must Understand

The FCA encourages firms to apply early within the application period and warns that poor-quality submissions or applications outside that period can affect assessment and business continuity. FCA

The closing date should not become the company’s preparation deadline. Management needs time to resolve gaps, obtain approvals and review the final evidence.

Existing Obligations Continue During Preparation

The future regime does not suspend requirements that apply today.

A business providing current in-scope cryptoasset services in the UK must address MLR registration before commencing those services. The FCA also provides specific guidance for firms considering registration ahead of the expanded FSMA framework. www.fca.org.uk

UK-facing financial promotions require a separate assessment. The existing cryptoasset promotions framework applies to firms marketing to UK consumers, including overseas firms. www.fca.org.uk

Every preparation programme should therefore distinguish:

• Current compliance: the legal basis for existing services and communications;
• Application readiness: information and evidence needed for regulatory assessment; and
• Commencement readiness: arrangements required when the expanded framework applies.

1. Confirm the Regulatory Perimeter and Application Route

The first deliverable should be a documented assessment of the business.

It should identify:

• Each legal entity and its responsibilities;
• Products, services and customer groups;
• Token classifications;
• Transaction execution and asset control;
• UK territorial connections;
• Relevant exclusions; and
• Required permissions.

The FCA’s PS26/18 sets out final guidance on when cryptoasset activities require authorisation. www.fca.org.uk

Once the perimeter is established, determine whether the entity needs new authorisation or a variation of existing Part 4A permissions.

Payment services, electronic money or MLR status should not be treated as automatically covering the new crypto activities. www.fca.org.uk

Practical output: A permissions matrix showing the entity, activity, legal basis, application route and outstanding questions.

2. Obtain Board Approval for a Realistic Implementation Plan

Preparation needs accountable owners and committed resources.

The FCA expressly encourages a board-agreed implementation plan setting out responsibilities, required changes, delivery arrangements and completion dates. It also expects firms to assess preparation and ongoing compliance costs. FCA

A useful plan should connect each regulatory gap to:

Without those decisions, application drafting can proceed faster than the underlying business becomes ready.

3. Strengthen Governance and Personnel

Management should review whether responsibilities match the proposed activities.

Important questions include:

• Who oversees financial crime and compliance?
• Who owns customer asset risks?
• Who controls technology changes and incidents?
• How are conflicts escalated?
• How does the applicant supervise overseas affiliates?
• Which decisions require board approval?

The FCA’s threshold condition framework addresses effective supervision, appropriate resources, suitability and the business model. It also explains that FSMA suitability requirements extend beyond the MLR assessment. www.fca.org.uk

Relevant appointments and responsibility arrangements should be assessed against the firm’s actual regulatory category.

A named officeholder without sufficient authority, time or resources will not resolve an operational weakness.

4. Rework Financial Planning Around the Applicable Requirements

The cost of authorisation is wider than the application fee.

A preparation budget should distinguish:

• Regulatory fees;
• Legal and compliance support;
• Required financial resources;
• Recruitment;
• Technology and monitoring;
• External assurance; and
• Ongoing compliance expenditure.

The new prudential framework includes COREPRU and CRYPTOPRU, with requirements relevant to firms conducting regulated cryptoasset activities. www.fca.org.uk

Management should determine the applicable calculations, resource composition and liquidity requirements for its particular model. Forecasts should also account for downside scenarios and operational dependencies.

Practical output: A documented financial resource assessment supported by forecasts, assumptions and funding evidence.

5. Demonstrate That Financial Crime Controls Operate

Existing AML documentation can provide a foundation. The review should establish whether it accurately describes the business and is supported by implementation evidence.

Examine customer due diligence, enhanced checks, sanctions screening, transaction monitoring, blockchain analytics, suspicious activity reporting and Travel Rule processes.

For MLR registration, the FCA emphasises tailoring the framework to the cryptoasset business and demonstrating relevant competence. www.fca.org.uk

Useful evidence can include:

• Documented system settings and threshold rationale;
• Testing results;
• Anonymised investigations;
• Escalation records;
• Training completion; and
• Management reporting.

Buying a monitoring tool does not establish that it has been configured appropriately or that staff can respond to its alerts.

6. Prepare Customer Asset and Activity-Specific Controls

The preparation work changes significantly by business model.

A custodian should assess ownership rights, asset control, records, reconciliations and return arrangements. A trading platform should examine admission, trading rules, surveillance and settlement. A stablecoin issuer must address the specific issuance, backing and redemption framework.

The FCA’s June 2026 package includes:

Firms should use the statements relevant to their actual activities. FCA

Custody Requires Careful Rule Mapping

The FCA distinguishes the application of CASS 17 to qualifying cryptoasset custody from the initial application of CASS 6 to relevant specified investment cryptoasset custody. Associated client money treatment also needs assessment. FCA

A single generic “crypto safeguarding policy” may therefore fail to address the assets the firm actually holds.

7. Review Technology and Outsourcing Dependencies

Preparation should establish how the applicant controls the systems supporting its services.

An implementation review should examine:

• Access and signing permissions;
• Software deployment and change control;
• Incident escalation;
• Recovery arrangements;
• Supplier responsibilities;
• Group service dependencies; and
• Exit or substitution options.

For each material supplier, the applicant should understand the service, contractual responsibilities and evidence available to support its application.

Where independent technical verification is needed, schedule it early enough to allow remediation.

8. Align Customer Terms Disclosures and Actual Operations

Customer documents should describe the same model as the application.

An illustrative inconsistency would arise where the business plan says customers retain control of their assets, but operational procedures allow the firm to transfer them without a customer signature.

Similar problems arise where:

• Fees differ between documents;
• Withdrawal terms omit operational restrictions;
• Customer contracts allocate responsibilities differently from supplier agreements; or
• Risk disclosures understate staking or counterparty exposure.

Treat consistency review as a substantive legal and operational task.

9. Assess Business Continuity and Transitional Eligibility

Management must understand what happens if authorisation has not been obtained by commencement.

The applicable saving and transitional arrangements have eligibility conditions. A pending application does not create an unrestricted entitlement to operate.

The FCA’s transitional guidance addresses existing businesses that have not secured the necessary permissions and the arrangements for orderly exit. FCA

A company-specific continuity assessment should cover existing services, new business, contractual obligations and the consequences of withdrawal or refusal.

Build the contingency plan before it becomes urgent.

10. Prepare One Coherent Application Evidence Pack

The final submission should bring together the business plan, governance, finance, policies, contracts and implementation evidence.

The FCA’s application information includes general firm sections and cryptoasset-specific components driven by the business model. www.fca.org.uk

Use an evidence index showing the applicable question, document version, owner and approval status.

Material changes during preparation should trigger updates across affected documents. A stronger application is one management can explain consistently and support with evidence.

A Practical Preparation Programme

The following sequence is a planning approach, not a regulatory timetable:

The programme should be adapted to the firm’s target dates and current readiness.

How CRYPTOVERSE Supports Preparation

CRYPTOVERSE provides specialist legal and regulatory support for UK FCA cryptoasset authorisation.

Our support can include perimeter assessments, permissions mapping, readiness reviews, gap remediation planning, business plans, agreed compliance documentation and application coordination.

For overseas groups, we can assess UK market-entry structures and the allocation of responsibilities between the applicant and its affiliates.

Prepare for the 2027 regime with a documented route and implementation plan. Request an FCA cryptoasset readiness assessment from CRYPTOVERSE..

FAQs