Skip to main content
Polar Insight

Crypto authorisation opens: the FCA sets a hard deadline for legitimacy

The FCA has opened its authorisation gateway for crypto firms, with applications due by 28 February 2027 and the new regime live from 25 October 2027. For banks, asset managers and insurers, this changes counterparty due diligence, product strategy and the risk calculus of engaging with the sector.

The FCA has opened the door to full regulation of UK crypto firms, setting an application deadline of 28 February 2027 and a regime start date of 25 October 2027 (FCA). For the first time, cryptoasset businesses operating in the UK will be held to formal standards on consumer protection, safeguarding, market integrity and financial resilience (FCA). The gateway closes a long period of ambiguity, and it does so on terms that favour firms already prepared to meet prudential expectations.

Key Executive Takeaways

  • UK crypto firms must apply to the FCA by 28 February 2027 to continue operating, with the full regime taking effect on 25 October 2027.
  • Authorisation is not automatic: firms that cannot demonstrate consumer protection, safeguarding, market integrity and financial resilience standards will be shut out of the UK market.
  • Regulated financial institutions should treat the gateway as a counterparty filter, re-examining exposures, partnerships and product plans against the forthcoming authorised perimeter.

The signalling matters as much as the mechanics. Dominic Cashman, director of authorisation at the FCA, said the regime will give consumers greater protections and firms a clear framework to operate in (FCA). That framing, consumer protection paired with a clear operating standard, mirrors the FCA's wider positioning on wholesale innovation and sits alongside its final crypto rules and guidance published in June 2026 (FCA). Firms with weak controls will not simply face enforcement risk, they will face commercial exclusion.

For banks and asset managers, the practical consequence is a bifurcation of the counterparty universe. Existing firms that apply during the window can continue providing cryptoasset services, including taking on new business, while their application is assessed (FCA). That creates a transitional period in which some counterparties will be in the queue, some will withdraw, and a residual group will fail to meet the bar. Treasury, risk and onboarding functions should be mapping exposures now against the likely authorised list, because by late 2027 the regulated perimeter will be the only defensible one for institutional engagement.

The timing also lands against a tougher backdrop for financial stability. The Financial Policy Committee noted in its September record that the risk outlook has worsened, with interconnected vulnerabilities more likely to crystallise simultaneously, and flagged the rapid rise in AI-related debt issuance as broadening capital markets exposure (Bank of England). Crypto's integration into regulated finance will proceed under a Bank that is already alert to correlated risks. Senior leaders considering crypto custody, tokenised collateral or distribution partnerships should expect prudential supervisors to apply the same lens, treating crypto exposures as part of a broader map of interconnected risk rather than a standalone product line.

Board-level positioning is the final piece. The FCA's own board has just been reinforced with the appointments of Lea Paterson CBE and Matthew Tobin as non-executive directors, alongside Sarah Pritchard joining as an executive member, all taking up their roles on 1 October 2026 (FCA). Tobin's background advising HM Treasury on systemic interventions including the Asset Protection Scheme and the nationalisation of Bradford & Bingley (FCA) suggests a board more attuned to systemic consequences of regulatory choices, including in novel markets.

The gateway is open, the clock is set, and the authorised perimeter will become the only credible one. Firms that treat the next sixteen months as a compliance exercise will miss the strategic question: which crypto counterparties, products and partnerships survive the filter, and whose book is ready for the answer.

Sources

What this reveals

The FCA's hard deadline exposes a quiet problem for banks, insurers and asset managers: counterparty, product and partnership decisions involving crypto have often been made on assumptions about where the regulatory perimeter would eventually settle, rather than on tested evidence of which firms will clear it. Many leadership teams will assume their existing due diligence frameworks already capture this, when in reality their exposure maps, product roadmaps and partnership pipelines were built against a pre-authorisation universe. The underlying issue is not crypto specifically, it is the lag between a regulator setting a new perimeter and institutions re-testing whether their internal view of who is 'inside' still matches external reality. By late 2027, firms that have not actively re-tested those assumptions will find the gap has crystallised into counterparty, product and reputational exposure.

Questions accountable leaders should ask

  • 01Which of our current or planned crypto counterparties, partners or service providers have we actually confirmed will apply by 28 February 2027, as opposed to assumed?
  • 02If a material counterparty fails to secure authorisation, what is the operational, commercial and reputational cost to us, and who in the organisation owns that exposure today?
  • 03Where in our product roadmap, treasury strategy or distribution plans have we embedded assumptions about the crypto perimeter that have not been revisited since the gateway opened?
  • 04How confident are we that our onboarding, risk and compliance functions share the same view of which crypto exposures are defensible under the forthcoming regime, rather than the current one?
  • 05What is our plan for the transitional window, when some counterparties are authorised, some are in the queue, and some will quietly withdraw, and who decides when we stop engaging with each category?

What accountable leaders should do now

  1. 1Commission a counterparty and partnership mapping exercise now that tags every crypto-related exposure by likely authorisation status, not current regulatory treatment, and surfaces where internal assumptions have not been tested externally.
  2. 2Require risk, compliance and the first line to produce a joint view of the forthcoming authorised perimeter, with explicit disagreements documented rather than smoothed over, so the board sees where internal confidence may exceed external evidence.
  3. 3Set internal decision triggers tied to the 28 February 2027 and 25 October 2027 dates, specifying what action the firm will take as counterparties apply, withdraw, or fail, rather than waiting for the regime to go live.
  4. 4Pressure-test any product, treasury or distribution strategy that depends on crypto counterparties against the scenario in which a material partner does not secure authorisation, and document the fallback position before it is needed.
  5. 5Open a structured channel to gather external signal on how the FCA is actually assessing applications, so the firm's view of the perimeter is updated by evidence from the gateway itself rather than by inference from the published rules.

Explore the practical guide

This guide examines what goes wrong when firms design compliance initiatives around their own reading of new rules without validating how supervisors will actually interpret and enforce them. After reading, you will know how to test interpretive assumptions early, where the real exposure sits, and how to sequence supervisor engagement without inviting unwanted scrutiny.

Read the guide

Where internal confidence may exceed external evidence

Polar Insight helps leadership teams test critical assumptions against stakeholder, market, regulatory, and operational reality before risk compounds.

Explore Stakeholder Proximity

Related insights

Mini-bonds resurface: the FCA reopens a distribution risk banks thought was closed

The FCA has issued a fresh consumer warning on unregulated loan notes and mini-bonds after the failure of litigation funder Woodville Consultants, and has already issued more than 1,200 warnings this year. For banks, payment firms and professional advisers, the regulator is signalling that distribution-adjacent roles now carry active supervisory attention.

OFSI rewrites the sanctions rulebook for crypto remittances

OFSI has quietly amended a long-standing personal remittances general licence to define cryptoassets and impose a bespoke reporting requirement on anyone using them under the licence. For banks, payment firms and crypto venues, it signals that sanctions compliance is now explicitly a digital-asset problem, with reporting obligations that cut across previously separate compliance silos.

Agentic finance arrives: the FCA signals testing over consultation

Jessica Rusu's 19 October speech confirms the FCA will embed six of the seven Mills Review recommendations into live supervisory work rather than consult further, as 86% of surveyed firms now use AI. Senior leaders should expect direct engagement, assurance testing and surveillance on AI deployments, not another rulebook.

Stakeholder Signals

Consequential developments in financial services and other regulated markets, with one implication for accountable leaders.