Crypto authorisation opens: the FCA sets a hard deadline for legitimacy
The FCA has opened its authorisation gateway for crypto firms, with applications due by 28 February 2027 and the new regime live from 25 October 2027. For banks, asset managers and insurers, this changes counterparty due diligence, product strategy and the risk calculus of engaging with the sector.
The FCA has opened the door to full regulation of UK crypto firms, setting an application deadline of 28 February 2027 and a regime start date of 25 October 2027 (FCA). For the first time, cryptoasset businesses operating in the UK will be held to formal standards on consumer protection, safeguarding, market integrity and financial resilience (FCA). The gateway closes a long period of ambiguity, and it does so on terms that favour firms already prepared to meet prudential expectations.
Sources
What this reveals
The FCA's hard deadline exposes a quiet problem for banks, insurers and asset managers: counterparty, product and partnership decisions involving crypto have often been made on assumptions about where the regulatory perimeter would eventually settle, rather than on tested evidence of which firms will clear it. Many leadership teams will assume their existing due diligence frameworks already capture this, when in reality their exposure maps, product roadmaps and partnership pipelines were built against a pre-authorisation universe. The underlying issue is not crypto specifically, it is the lag between a regulator setting a new perimeter and institutions re-testing whether their internal view of who is 'inside' still matches external reality. By late 2027, firms that have not actively re-tested those assumptions will find the gap has crystallised into counterparty, product and reputational exposure.
Questions accountable leaders should ask
- 01Which of our current or planned crypto counterparties, partners or service providers have we actually confirmed will apply by 28 February 2027, as opposed to assumed?
- 02If a material counterparty fails to secure authorisation, what is the operational, commercial and reputational cost to us, and who in the organisation owns that exposure today?
- 03Where in our product roadmap, treasury strategy or distribution plans have we embedded assumptions about the crypto perimeter that have not been revisited since the gateway opened?
- 04How confident are we that our onboarding, risk and compliance functions share the same view of which crypto exposures are defensible under the forthcoming regime, rather than the current one?
- 05What is our plan for the transitional window, when some counterparties are authorised, some are in the queue, and some will quietly withdraw, and who decides when we stop engaging with each category?
What accountable leaders should do now
- 1Commission a counterparty and partnership mapping exercise now that tags every crypto-related exposure by likely authorisation status, not current regulatory treatment, and surfaces where internal assumptions have not been tested externally.
- 2Require risk, compliance and the first line to produce a joint view of the forthcoming authorised perimeter, with explicit disagreements documented rather than smoothed over, so the board sees where internal confidence may exceed external evidence.
- 3Set internal decision triggers tied to the 28 February 2027 and 25 October 2027 dates, specifying what action the firm will take as counterparties apply, withdraw, or fail, rather than waiting for the regime to go live.
- 4Pressure-test any product, treasury or distribution strategy that depends on crypto counterparties against the scenario in which a material partner does not secure authorisation, and document the fallback position before it is needed.
- 5Open a structured channel to gather external signal on how the FCA is actually assessing applications, so the firm's view of the perimeter is updated by evidence from the gateway itself rather than by inference from the published rules.
Explore the practical guide
This guide examines what goes wrong when firms design compliance initiatives around their own reading of new rules without validating how supervisors will actually interpret and enforce them. After reading, you will know how to test interpretive assumptions early, where the real exposure sits, and how to sequence supervisor engagement without inviting unwanted scrutiny.
Read the guideWhere internal confidence may exceed external evidence
Polar Insight helps leadership teams test critical assumptions against stakeholder, market, regulatory, and operational reality before risk compounds.
Explore Stakeholder ProximityRelated insights
Mini-bonds resurface: the FCA reopens a distribution risk banks thought was closed
The FCA has issued a fresh consumer warning on unregulated loan notes and mini-bonds after the failure of litigation funder Woodville Consultants, and has already issued more than 1,200 warnings this year. For banks, payment firms and professional advisers, the regulator is signalling that distribution-adjacent roles now carry active supervisory attention.
OFSI rewrites the sanctions rulebook for crypto remittances
OFSI has quietly amended a long-standing personal remittances general licence to define cryptoassets and impose a bespoke reporting requirement on anyone using them under the licence. For banks, payment firms and crypto venues, it signals that sanctions compliance is now explicitly a digital-asset problem, with reporting obligations that cut across previously separate compliance silos.
Agentic finance arrives: the FCA signals testing over consultation
Jessica Rusu's 19 October speech confirms the FCA will embed six of the seven Mills Review recommendations into live supervisory work rather than consult further, as 86% of surveyed firms now use AI. Senior leaders should expect direct engagement, assurance testing and surveillance on AI deployments, not another rulebook.
Stakeholder Signals
Consequential developments in financial services and other regulated markets, with one implication for accountable leaders.