The FCA’s application period for the new UK cryptoasset regime opened on 30 September 2026 and closes on 28 February 2027. The regime itself starts on 25 October 2027. Firms that want to carry out the new regulated activities, such as operating a cryptoasset trading platform or safeguarding cryptoassets, need FCA authorisation under the Financial Services and Markets Act 2000 (FSMA). This guide turns the FCA’s published expectations into platform and engineering questions. It is a technology guide, not legal advice, and software alone does not make a firm authorised.
Key dates at a glance
Date | What happens |
|---|---|
30 June 2026 | The FCA publishes its final rules and guidance for the cryptoasset regime |
30 September 2026 | The application period opens; firms can apply for authorisation or vary existing permissions |
28 February 2027 | The application period closes |
25 October 2027 | The new regime starts and the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 take effect |
Facts checked against FCA pages on 29 October 2026. See the sources at the end of this page.
Which cryptoasset activities will need FCA authorisation?
The new regulated activities that the FCA lists are:
- Issuing qualifying stablecoin in the United Kingdom
- Safeguarding qualifying cryptoassets and relevant specified investment cryptoassets
- Arranging for another person to safeguard those assets
- Operating a qualifying cryptoassets trading platform
- Dealing in qualifying cryptoassets as principal
- Dealing in qualifying cryptoassets as agent
- Arranging (bringing about) deals in qualifying cryptoassets
- Making arrangements with a view to transactions in qualifying cryptoassets
- Qualifying cryptoasset staking
Whether your activity falls inside the perimeter depends on your facts. The FCA has published perimeter guidance (PS26/18) to help firms assess this, and it encourages firms to consider independent legal or compliance advice.
What does the FCA expect firms to be doing now?
The FCA asks firms that intend to apply to prepare a credible plan. In practice that means:
- Reviewing the new regulated activities and working out which authorisation is needed
- Making sure the requested permissions match the business model and risk profile
- Carrying out a gap analysis against the expected FSMA requirements
- Agreeing a board-level implementation plan covering who is accountable, what must change, how and by when
- Assessing the resources and costs of preparing, being authorised and staying compliant
- Taking legal, compliance or regulatory advice where appropriate
The FCA also encourages firms to apply as early as possible within the application period. It warns that late or poor-quality applications can be rejected, delayed or refused.
What happens depending on when a firm applies?
Situation | What the FCA says | Practical effect |
|---|---|---|
Applies during the application period and is not yet determined when the regime starts | A saving provision allows the firm to continue cryptoasset services until its application is finally determined | Continuity of service while the application is assessed |
Applies after the period closes but before the regime starts, and is not authorised by 25 October 2027 | The firm enters the transitional provision; the FCA will not expedite late applications | Limited to performing pre-existing contracts; no new contracts with new or existing UK customers |
Does not apply | The firm must run off its UK cryptoasset business before the regime starts and has no access to the saving or transitional provisions | Risk of unauthorised business if run-off is not completed |
Registered under the Money Laundering Regulations 2017 | There is no automatic conversion to the new regime | FSMA authorisation with permission for the new activities is still required |
Which platform workstreams should be reviewed?
The table lists engineering questions that tend to surface when a firm maps its platform against the FCA’s expectations. It is not a list of requirements. The rules that apply to your permissions come from the FCA’s final rules and Handbook and need to be confirmed by your compliance adviser.
Platform area | Engineering questions | Typical deliverables |
|---|---|---|
Customer onboarding and due diligence | Can the platform capture, verify, risk-rate and periodically review customers with a full evidence trail? Can rules differ by customer type and product? | KYC/KYB integration, risk scoring, review queues, evidence store |
Financial crime controls | Are sanctions screening, transaction monitoring and Travel Rule data flows integrated and auditable? Who can see and action alerts? | Screening and analytics integrations, alert and case management, decision logs |
Custody and safeguarding | How are keys generated, stored, backed up and used? Can client assets be separated from firm assets in records and on-chain, and reconciled on demand? | Key-management design, wallet segregation, reconciliation jobs, withdrawal controls |
Trading platform operation | Are order handling, matching, execution and trade records consistent and reconstructable? Which market-integrity controls exist? | Order and trade audit trail, limits and controls, monitoring hooks |
Customer information and complaints | Can the platform present the information your rules analysis requires, record acknowledgements and support complaint handling? | Disclosure flows, consent records, complaint-tracking exports |
Records and reporting | Can required records be retained, searched and exported? Can reporting data be produced without manual reconstruction? | Immutable logs, retention policies, reporting data model, export tooling |
Access, change and resilience | Who can change code, configuration and permissions? How are outages, incidents and third-party failures handled? | Role-based access, approval workflows, change log, incident runbooks, third-party register |
Management information | Can senior managers see risk, incident and complaint data when they need it? | Dashboards and management-information feeds |
UK platform readiness checklist
- Confirm with your legal adviser which regulated activities your model involves, using the FCA perimeter guidance (PS26/18).
- Decide whether you will apply as a new firm or vary existing permissions.
- Decide whether to request the optional, free FCA pre-application meeting, and prepare the business-model, product and customer-type information it requires.
- Build a system and data-flow inventory covering platforms, wallets, third-party services and data stores.
- Map each control your advisers identify to a platform feature, an owner and an evidence source.
- Close engineering gaps in onboarding, financial-crime monitoring, custody, trading records and reporting data.
- Test incident response, access reviews and change management in practice, not only in documents.
- Prepare a board-agreed implementation plan with owners, milestones and dates.
- Plan the application timing against the 28 February 2027 close, leaving time to respond to FCA data requests.
- Review FCA publications monthly until the regime starts on 25 October 2027.
What can software do, and what can it not do?
Software can implement controls, produce evidence and reduce manual reconstruction. It cannot determine your regulatory perimeter, replace governance and accountability, or guarantee approval. The FCA does not provide advice to applicants, and its pre-application meetings do not guarantee a successful application. Treat engineering readiness as one input to an application that your legal and compliance advisers lead.
How Alpharive helps
Alpharive is a technology partner. We run a technical readiness workshop for firms that need to assess or change their platforms ahead of the FCA application. The workshop produces:
- A system and data-flow inventory
- A mapping of the controls your advisers identify to platform features and gaps
- An architecture gap analysis covering onboarding, custody, trading records and reporting
- An integration plan for identity, screening, monitoring and reporting providers
- A prioritised engineering backlog with effort bands
If you need to build or re-platform an exchange, wallet or trading platform, our crypto exchange platform development service covers architecture, delivery and testing.
Book a technical readiness workshop
Tell us which activities you plan to apply for and how your platform is built today. We will outline how the workshop would run and what your advisers will need from engineering.
Book a readiness workshopRelated UK Based Queries
1. When does the FCA application window for crypto firms close?
The FCA’s application period opened on 30 September 2026 and closes on 28 February 2027. The new cryptoasset regime starts on 25 October 2027. Firms that apply within the period but are not yet determined when the regime starts can rely on a saving provision to keep operating until their application is finally determined.
2. Which cryptoasset activities will need FCA authorisation?
The new regulated activities include issuing qualifying stablecoin in the UK, safeguarding qualifying cryptoassets, arranging safeguarding, operating a qualifying cryptoassets trading platform, dealing in qualifying cryptoassets as principal or as agent, arranging deals, making arrangements with a view to transactions, and qualifying cryptoasset staking. Whether your activity falls within scope depends on your facts, so check the FCA’s perimeter guidance and take advice.
3. Is registration under the Money Laundering Regulations enough?
No. The FCA says there will be no automatic conversion for firms registered under the Money Laundering Regulations 2017. They need FCA authorisation under FSMA with permission for the new activities.
4. What happens if a firm applies after the application period closes?
Firms can still apply, but the FCA says it will not expedite assessment to make up for a late submission. A firm that applies before the regime starts but is not authorised by 25 October 2027 enters the transitional provision, which limits it to performing contracts it entered before that point and bars new contracts with new or existing UK customers.
5. Does buying or building compliant software make a firm authorised?
No. Authorisation is granted by the FCA to a firm after assessing its application, governance, controls and business model. Software can support controls and evidence, but it cannot determine your regulatory perimeter, replace governance or guarantee approval.
6. Which platform controls should a crypto firm review first?
Start with customer onboarding and due diligence, financial crime screening and monitoring, custody and key management, order handling and trade records, audit logging, access and change management, incident response and regulatory reporting data. Map each area to the requirements your compliance adviser identifies from the FCA’s final rules for your permissions.
7. Can overseas firms serving UK customers be affected?
The FCA’s guidance refers to firms providing, or planning to provide, cryptoasset services in or to the UK. Whether a specific overseas activity falls within the perimeter depends on the facts, so review the FCA’s perimeter guidance (PS26/18) and take legal advice.
8. Does Alpharive prepare FCA applications?
No. Alpharive is a technology partner. The FCA states that it does not provide advice and encourages firms to consider independent legal or compliance advice. Alpharive’s readiness workshop covers system inventory, control mapping, architecture gaps and an engineering backlog that your advisers can align with the application.
