By CRYPTOVERSE Legal Consultancy
Existing FCA authorisation does not automatically cover new regulated cryptoasset services. A firm must assess whether its current permission covers the proposed activities and, where necessary, apply for a variation of permission—VoP.
For investment firms, brokers and other authorised businesses, this requires more than adding crypto terminology to an existing business plan. The application should explain the new service, its risks and how the firm will remain adequately resourced and controlled across its expanded business.
This article explains how to approach that assessment and prepare a coherent application.
1. Confirm that variation of permission is the correct route
A firm already authorised under Part 4A of the Financial Services and Markets Act 2000—FSMA should assess whether it needs a VoP to undertake new regulated cryptoasset activities.
MLR registration or authorisation under payment or electronic money legislation does not, by itself, establish Part 4A status.
Begin with the applicant’s legal identity and regulatory record by using Crypto License.
Review:
- Its existing permissions.
- Relevant investment and client types.
- Limitations and requirements.
- Its actual regulated activities.
- The legal entity intended to provide the new service.
An authorised parent company’s status should not be attributed automatically to a subsidiary.
2. Understand the crypto application timetable
The expanded cryptoasset regime is scheduled to commence on 25 October 2027. The FCA gateway opened on 30 September 2026, with the relevant application period ending on 28 February 2027.
The gateway accommodates authorisation applications and VoP applications from firms already authorised under FSMA.
Keep three dates separate:
- Application submission.
- Permission approval and its effective date.
- Operational launch.
A pending application should not be treated as permission to commence a new regulated activity. Any reliance on transitional arrangements requires a separate eligibility assessment for explanation of FCA Authorisation.
3. Define the service before selecting permissions
Prepare a factual description of the proposed business.
Useful questions include:
- Which assets and instruments will the firm support?
- Who contracts with the customer?
- Who executes transactions?
- Who controls customer assets?
- Which entities provide technology, custody or liquidity?
- Which customers and jurisdictions are involved?
PERG 18.1.11 identifies activity, territorial scope, business status and exclusions or exemptions as connected parts of the authorisation assessment.
A commercial description such as “crypto brokerage” is insufficient on its own as per Crypto proprietary trading FCA Authorisation.
For example, distinguish a firm that transmits an order from one that executes it as agent or sells assets as principal. Prepare transaction diagrams showing the proposed roles.
4. Build a permission comparison
A useful crypto staking FCA authorisation preparation tool compares the existing permission with the proposed model.
| Assessment area | What to document |
| Regulated activities | Existing scope and requested additions |
| Instruments | Assets currently supported and proposed crypto products |
| Customers | Existing and proposed customer categories |
| Service delivery | Changes to contracts, execution and asset control |
| Limitations | Whether current restrictions affect the proposal |
| Territorial scope | UK operations and cross-border arrangements |
| Dependencies | Group entities and external providers |
Identify the precise variation requested and explain its relationship to the business plan.
The FCA’s VoP guidance recognises that a new business line, activity, product or client type may require a permission review.
Avoid requesting a broad scope merely to preserve hypothetical future options. The application should support the activities the firm genuinely intends to undertake.
5. Assess the effect on the whole firm
A VoP assessment considers whether the firm satisfies—and will continue to satisfy—the relevant threshold conditions across its permissions after variation. Readiness, willingness and organisation remain relevant.
The assessment should therefore extend beyond the new crypto team.
Consider whether expansion will affect:
- Management capacity.
- Compliance and financial crime resources.
- Existing customer services.
- Capital and liquidity.
- Technology resilience.
- Conflicts of interest.
- Complaints handling.
- Wind-down arrangements.
Illustrative example: A broker proposes to use its existing operations team for crypto settlement. The application should explain the additional workload, training and controls, including how existing services will remain adequately supported.
6. Prepare a coherent application evidence pack
The FCA publishes information about its cryptoasset authorisation application form to help firms prepare. Applicants should use the applicable live process and requirements when submitting.
A suggested preparation pack includes:
- Updated regulatory business plan.
- Permission and perimeter assessment.
- Transaction and asset-flow diagrams.
- Governance and responsibility maps.
- Financial forecasts and funding evidence.
- Relevant financial crime procedures.
- Technology and operational arrangements.
- Outsourcing documentation.
- Customer terms and disclosure materials.
- Implementation and launch plan.
This is a working checklist, rather than a statement that every item applies identically to every applicant.
Where existing documents remain relevant, explain how they support the expanded business. Update them where responsibilities, systems or risks change.
7. Recalculate prudential requirements
Adding crypto activities can affect the firm’s capital, liquidity and prudential framework. The final crypto prudential rules address own funds, financial resource requirements and interactions with other regimes.
Prepare an analysis of the framework applicable to the expanded firm, rather than assuming the existing calculation remains sufficient.
Forecast:
- Additional staffing and compliance costs.
- Technology and custody expenses.
- Trading or counterparty exposures.
- Launch losses.
- Stress scenarios.
- Wind-down costs.
Document funding instruments and availability.
A board’s willingness to fund expansion should be translated into evidence of resources the applicant can actually access.
8. Update governance and senior management responsibilities
The crypto regime applies relevant FCA Handbook requirements, including governance and Senior Managers and Certification Regime provisions. Their application requires assessment against the firm’s circumstances.
Review:
- Senior management responsibility allocation.
- Compliance and MLRO capacity.
- Committee terms of reference.
- Risk reporting.
- Product approval.
- Incident escalation.
- Staff competence and training.
Identify any associated individual approval, notification or documentation changes requiring separate action.
Existing senior managers should be able to explain the proposed crypto service, its risks and the controls within their responsibilities.
9. Demonstrate how systems and outsourcing will work
A useful application connects policies to operating evidence.
For each important system or provider, record:
| Dependency | Suggested evidence |
| Trading infrastructure | Execution workflows, controls and testing |
| Custody provider | Contractual roles and asset-control analysis |
| Monitoring systems | Coverage, escalation and quality checks |
| Group service team | Responsibilities, capacity and reporting |
| Cloud or technology provider | Access, resilience and exit arrangements |
| Customer support | Training, complaints and escalation procedures |
Test relevant workflows before presenting them as operationally ready.
Where a provider performs a substantial role, explain what the applicant retains control over and how it obtains the information needed for oversight.
10. Submit through the appropriate process and manage questions
The FCA directs firms to apply for a VoP through Connect. Application fees depend on the scope of the change; annual fees, financial categories and reporting requirements may also change.
Before submission, reconcile the form against the supporting documents.
Check that the permission request, business plan, forecasts and policies describe the same model.
During assessment, maintain a response register recording:
- Each FCA question.
- The responsible owner.
- Supporting evidence.
- The response submitted.
- Any resulting document changes.
If the model changes, update the affected materials consistently. A response to one question should not create contradictions elsewhere in the application.
11. Treat approval and launch as separate controls
The FCA states that firms must not start requested activities before approval. Confirm the effective permission, limitations and requirements in the decision before launch.
A suggested launch review should verify:
- The service matches the approved scope.
- Required personnel and resources are available.
- Customer documentation is final.
- Systems and controls have been tested.
- Providers are operational.
- Outstanding conditions have been addressed.
- Reporting responsibilities are assigned.
Marketing and financial promotion requirements should also receive their own assessment.
Permission approval is a significant milestone. The firm should still establish that the approved model is implemented before customers use it.
How CRYPTOVERSE can support your application?
CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.
CRYPTOVERSE can support permission assessments, application planning, business plan updates, documentation preparation and responses to FCA information requests.
Planning to add crypto services to an authorised firm? Contact CRYPTOVERSE to assess the required variation and prepare the supporting evidence.
FAQs
1. Does our existing investment permission cover spot crypto services?
Assess the assets and activities specifically. Do not infer coverage from a broadly similar existing service.
2. Is an MLR-registered firm eligible for the VoP route?
MLR registration alone is insufficient. Establish whether the applicant already holds Part 4A authorisation.
3. Must we submit an entirely new policy pack?
Not necessarily. Review existing documents, retain relevant material and update what the expanded business requires.
4. Can we launch while the VoP application is pending?
A pending application does not itself permit commencement. Check the applicable legal basis and any relevant transitional provisions.
5. Will a VoP be quicker because we are already authorised?
Do not assume a particular timeline. Complexity, readiness and the information required will affect assessment.