The FCA's crypto rulebook: authorisation windows close before firms are ready

The FCA has closed the loop on UK crypto regulation. Firms supporting people to buy, trade and hold crypto will need to meet financial resilience requirements including capital and stress testing, alongside new market integrity rules covering insider trading and market manipulation (FCA). Legislation in February 2026 brought cryptoassets into the FCA's remit, and the regulator has now set the operational clock: pre-application meetings begin in July, the authorisation window runs from 30 September 2026 to 28 February 2027, and mandatory rules bite on 25 October 2027 (FCA).

A five-month window to file, sixteen months to be ready

The design choices matter more than the headlines. The FCA has simplified capital requirements for stablecoin firms and tailored trading rules to reflect how crypto markets actually operate, drawing on international best practice and applying established financial services standards, including the Consumer Duty, where risks are comparable (FCA). That is a deliberate signal to incumbents: the regime borrows the grammar of existing prudential and conduct rules rather than inventing a parallel system. Banks and asset managers considering custody, staking arrangement or intermediation can map the requirements onto controls they already run. The corollary is that supervisors will expect them to.

Stablecoins: two regulators, one perimeter

The joint approach published alongside the rulebook sets out how UK stablecoin issuers may move from FCA supervision to joint FCA and Bank of England regulation once recognised as systemic by HM Treasury (FCA). For issuers with ambitions to scale, that is a two-stage regulatory journey with a threshold determined by the Treasury, not the firm. Boards contemplating a sterling stablecoin product need to model the transition costs of moving between regimes, not just the entry cost of authorisation. The Bank's separate policy statement on regulating systemic stablecoins, published on 22 June, sits alongside this framework (Bank of England).

The stakeholder calculus

David Geale, executive director of payments and digital finance at the FCA, framed the trade-off directly: 'This is a significant moment for crypto regulation in the UK. We've created a framework that doesn't force firms to choose between regulatory certainty and room to innovate, this regime means they can have both in a stable, competitive home to build and grow. For consumers, it means firms will be held to similar standards to other financial providers, though we can't regulate away risk' (FCA). The subtext for regulated incumbents is competitive. Crypto-native firms and traditional finance will be authorised under the same perimeter, and the FCA is explicitly positioning the UK against other jurisdictions courting the same business. Boards that treat this as a compliance exercise will cede ground to those treating it as market entry.

What senior leaders should do now

The practical demands are unglamorous but urgent. Legal and risk functions need to determine whether current or planned activities, including trading platforms, intermediation, custody, stablecoin issuance and staking arrangement, fall inside the perimeter (FCA). Capital planning teams need to price the resilience and stress testing requirements into 2027 budgets. Boards need a documented view before September on whether to apply, partner or exit. The FCA's 17 July webinar is the first calibration point.

The window is short, and the regulator has said the quiet part out loud: firms that miss it will be trading unauthorised under a mandatory regime from October 2027.