Crypto authorisation opens: the FCA sets a hard deadline for legitimacy

The FCA has opened the door to full regulation of UK crypto firms, setting an application deadline of 28 February 2027 and a regime start date of 25 October 2027 (FCA). For the first time, cryptoasset businesses operating in the UK will be held to formal standards on consumer protection, safeguarding, market integrity and financial resilience (FCA). The gateway closes a long period of ambiguity, and it does so on terms that favour firms already prepared to meet prudential expectations.

Key Executive Takeaways

• UK crypto firms must apply to the FCA by 28 February 2027 to continue operating, with the full regime taking effect on 25 October 2027.
• Authorisation is not automatic: firms that cannot demonstrate consumer protection, safeguarding, market integrity and financial resilience standards will be shut out of the UK market.
• Regulated financial institutions should treat the gateway as a counterparty filter, re-examining exposures, partnerships and product plans against the forthcoming authorised perimeter.

The signalling matters as much as the mechanics. Dominic Cashman, director of authorisation at the FCA, said the regime will give consumers greater protections and firms a clear framework to operate in (FCA). That framing, consumer protection paired with a clear operating standard, mirrors the FCA's wider positioning on wholesale innovation and sits alongside its final crypto rules and guidance published in June 2026 (FCA). Firms with weak controls will not simply face enforcement risk, they will face commercial exclusion.

For banks and asset managers, the practical consequence is a bifurcation of the counterparty universe. Existing firms that apply during the window can continue providing cryptoasset services, including taking on new business, while their application is assessed (FCA). That creates a transitional period in which some counterparties will be in the queue, some will withdraw, and a residual group will fail to meet the bar. Treasury, risk and onboarding functions should be mapping exposures now against the likely authorised list, because by late 2027 the regulated perimeter will be the only defensible one for institutional engagement.

The timing also lands against a tougher backdrop for financial stability. The Financial Policy Committee noted in its September record that the risk outlook has worsened, with interconnected vulnerabilities more likely to crystallise simultaneously, and flagged the rapid rise in AI-related debt issuance as broadening capital markets exposure (Bank of England). Crypto's integration into regulated finance will proceed under a Bank that is already alert to correlated risks. Senior leaders considering crypto custody, tokenised collateral or distribution partnerships should expect prudential supervisors to apply the same lens, treating crypto exposures as part of a broader map of interconnected risk rather than a standalone product line.

Board-level positioning is the final piece. The FCA's own board has just been reinforced with the appointments of Lea Paterson CBE and Matthew Tobin as non-executive directors, alongside Sarah Pritchard joining as an executive member, all taking up their roles on 1 October 2026 (FCA). Tobin's background advising HM Treasury on systemic interventions including the Asset Protection Scheme and the nationalisation of Bradford & Bingley (FCA) suggests a board more attuned to systemic consequences of regulatory choices, including in novel markets.

The gateway is open, the clock is set, and the authorised perimeter will become the only credible one. Firms that treat the next sixteen months as a compliance exercise will miss the strategic question: which crypto counterparties, products and partnerships survive the filter, and whose book is ready for the answer.