Quick overview
By Scorechain
Monday, November 9, 2026
The UK Crypto-Asset Framework: What Already Applies and What Changes in 2027
Global News.png){kind=logo}
The United Kingdom already has rules applicable to crypto-asset firms, but its expanded authorisation and supervision regime enters fully into application on 25 October 2027. The founding text, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, was adopted on 4 February 2026, and the Financial Conduct Authority (FCA) published most of its final rules on 30 June 2026. For firms, preparation is now concrete: the authorisation gateway has been open since 30 September 2026 and will close on 28 February 2027.
For providers, three issues shape this transition: access conditions to the UK market, client protection, and compliance controls. Preparing means distinguishing obligations already in force, the changes adopted for 2027, and the measures still being developed. Firms authorised in the European Union under MiCA must also examine the UK requirements separately, as their European authorisation does not automatically give them access to the UK market. The new framework centres on FCA authorisation, granted as a permission under Part 4A of the Financial Services and Markets Act 2000.
The UK framework is being built in stages, with different consequences for firms depending on the status of the measures. The obligations already applicable must be complied with now. The texts adopted for the expanded regime allow firms to prepare for the future conditions of authorisation and operation, according to their respective application dates. The proposals still under consultation or in preparation need careful monitoring, as their content and timetable may change. Separating these three levels lets firms prioritise compliance actions without confusing current requirements, changes to anticipate and developments still to be confirmed.
The United Kingdom is integrating the new activities into the architecture of the Financial Services and Markets Act 2000 (FSMA) by adding regulated activities to the Regulated Activities Order 2001. The FCA remains the central authority for providers; the Bank of England steps in for stablecoins recognised as systemic by HM Treasury. This organisation requires each asset and each service to be qualified: a tokenised financial instrument may already fall under existing financial law, and the new regime is not an identical starting point for all digital assets.
Firms carrying on, by way of business in the United Kingdom, crypto-asset exchange or wallet custody services must be registered with the FCA under the Money Laundering Regulations 2017 (MLRs). The perimeter covers exchanges between money and crypto-assets, exchanges between crypto-assets, certain intermediation activities and the safekeeping of private keys for clients. An existing financial authorisation does not remove the need for this registration. The territorial connection must be analysed precisely: registration targets firms carrying on their business from the United Kingdom, meaning those with an effective establishment there, and the FCA requires the designation of an officer responsible for receiving internal reports on money laundering. Having UK clients does not, on its own, trigger this obligation, unlike the financial promotions regime and the perimeter that will apply in 2027.
Since 1 September 2023, the UK Travel Rule has required the firms concerned to collect and transmit the required information on the originator and beneficiary of crypto-asset transfers and to carry out the prescribed checks according to the circumstances of the transfer. In its statement of 17 August 2023, the FCA made clear that using a technical provider does not transfer the firm’s responsibility. It also stated that where a transfer comes from a jurisdiction that has not yet implemented the Travel Rule and has missing information, the firm must take a risk-based decision on whether to make the assets available.
UK financial sanctions apply to crypto-assets as to other economic resources. Firms must freeze the assets of designated persons, refrain from making funds available to them and report the prescribed cases to the Office of Financial Sanctions Implementation (OFSI). Since 30 August 2022, crypto-asset exchange providers and custodian wallet providers have been among the categories of “relevant firms” covered by the reporting obligations laid down by the relevant UK sanctions regimes. These obligations must not be presented as depending solely on their actual registration with the FCA. The firms concerned must report to OFSI, under the conditions laid down by the applicable regime, information relating to designated persons and suspected offences.
Since 8 October 2023, financial promotions relating to crypto-assets within the scope of the UK regime must comply with the applicable restrictions where they are capable of having an effect in the United Kingdom. Firms established abroad are also concerned: a promotion does not need to target UK consumers expressly to be capable of having an effect in the United Kingdom.
The FCA identifies four routes for lawfully communicating a promotion concerned: its communication by a person authorised under FSMA; its approval by an authorised person with the necessary permissions; its communication by a crypto firm registered with the FCA under the MLRs, or on its behalf, within the limits of the exemption provided for by article 73ZA of the Financial Promotion Order; or its issue in accordance with the conditions of another applicable exemption.
The rules defined by the FCA in PS23/6 require that the promotions concerned be clear, fair and not misleading, that they carry the required risk warnings and that they do not inappropriately incentivise investment, for example through certain refer-a-friend bonuses. For direct offer promotions addressed to retail clients, additional protections apply under the conditions laid down by the rules: a personalised risk warning, client categorisation, an appropriateness assessment and, for the new clients concerned, a cooling-off period of at least 24 hours before the direct offer is communicated.
A firm’s registration under the MLRs must not be presented as FCA approval of the crypto-assets or investments it offers.
Since 1 January 2026, the reporting providers concerned have had to collect the required information on their users and the relevant transactions. Reports to HMRC concern users who are tax resident in the United Kingdom or in another jurisdiction participating in the CARF. The first report, covering 2026, must be submitted between 1 January and 31 May 2027. This tax obligation does not replace anti-money-laundering controls.
Another development already in effect is that certain crypto ETNs have been accessible to retail investors since 8 October 2025, provided they are admitted to trading on a UK-recognised investment exchange. The ban on the sale, marketing and distribution to retail investors of derivatives referencing unregulated transferable crypto-assets remains, and the FCA has made clear that these products do not benefit from the protection of the Financial Services Compensation Scheme.
The Cryptoassets Regulations 2026 add nine regulated activities to the Regulated Activities Order: issuing a qualifying stablecoin in the United Kingdom; safeguarding qualifying cryptoassets and relevant specified investment cryptoassets; arranging their safeguarding by a third party; operating a qualifying cryptoasset trading platform; dealing on own account; dealing as agent; bringing about deals; making arrangements with a view to transactions; and making arrangements, on behalf of another person, for qualifying cryptoasset staking, subject to the applicable exclusions. The lending and borrowing of crypto-assets do not appear, under those names alone, among the nine new activities listed above. The models concerned must nevertheless be analysed according to their structure and the regulated activities they involve; the FCA has also laid down specific conduct rules.
A firm registered under the MLRs will have to apply for the corresponding authorisation. The FCA states that there will be no automatic conversion of the registration. A firm already authorised under FSMA will have to have its permissions varied (variation of permission), attaching the crypto form to its application. A European authorisation under MiCA does not remove the need to examine the UK obligations separately.
The FCA guidance published on 16 September 2026 in PS26/18 and incorporated into chapter PERG 18 of its Handbook clarifies the territorial scope of the future regime. The general exclusion applicable to certain overseas persons (the overseas persons exclusion) has not been extended to the new regulated crypto-asset activities: a foreign firm carrying on an activity within the UK perimeter therefore cannot rely on that exclusion alone.
Certain activities provided from abroad may be deemed to be carried on in the United Kingdom where they concern a consumer located in the United Kingdom. In this context, the term “consumer” means a natural person acting for purposes outside their trade or profession.
A person established abroad who deals in qualifying cryptoassets on own account and is involved in their sale to a consumer located in the United Kingdom may fall within the UK perimeter. The safeguarding, or arranging of the safeguarding, of crypto-assets, as well as making arrangements for qualifying cryptoasset staking for such a consumer, may also be deemed to be carried on in the United Kingdom, even where the provider is established abroad. Specific provisions apply where the foreign provider acts on the instructions of a firm authorised to carry on the activity concerned; their application depends on the actual structure of the relationships between the parties.
For the issuance of a qualifying stablecoin, the FCA examines whether the constituent elements of the issuance, such as the offer, redemption and maintenance of value, are carried on, or arranged to be carried on, from an establishment located in the United Kingdom. The fact that a client took the initiative of contacting a firm does not, on its own, amount to an exemption or an exclusion from the regime. The commercial labels “offshore” or “DeFi” are therefore not enough to determine whether an activity falls outside the UK perimeter: each model must be examined according to the services provided, the client base, the operating arrangements and the applicable exclusions.
The September guidance does not yet take account of the changes envisaged by the draft regulations laid before Parliament on 15 September 2026. On 21 October 2026, the FCA published consultation CP26/36 to clarify the application of the envisaged exclusions, for certain technical services, own-account dealing operations and custody arrangements. The consultation is open until 18 November 2026, and the FCA plans to publish its final guidance in January 2027. The draft regulations and the guidance under consultation must not be presented as definitively adopted.
The wind-down arrangement may also cover, under the conditions laid down by the text, certain firms whose application has been refused or withdrawn. It allows the performance of pre-existing contracts for a maximum period of two years; it does not allow new contracts to be concluded with UK clients. The firms concerned must notify their situation to the FCA and inform the parties to the pre-existing contracts.
The date of 28 February 2027 is not an absolute bar on applying later, but it is decisive for the treatment of the transition. A distinction must be drawn between continuing business while an application submitted within the window is under review and the orderly wind-down arrangement, which is limited to existing contracts.
Policy statement PS26/11 defines the rules applicable to several crypto-asset activities, in particular those of trading platforms and intermediaries, custody, lending and borrowing, and staking.
For the safeguarding of qualifying cryptoassets, the new chapter CASS 17 governs the protection of clients’ rights, record-keeping, reconciliations and the management of the means of access to the assets. It provides, in principle and subject to the applicable exceptions, that the firm act as trustee under a trust designed to protect clients’ assets, in particular in the event of the firm’s failure.
The relevant specified investment cryptoassets, which include certain tokenised assets falling within existing investment categories, are excluded from the scope of CASS 17. Their custody remains subject to the rules applicable to them, in particular CASS 6, according to the nature of the asset and the activity carried on.
Policy statement PS26/13 clarifies the application to firms carrying on regulated crypto-asset activities of various existing rules of the FCA Handbook, such as those relating to the Consumer Duty, senior management accountability under the Senior Managers and Certification Regime, operational resilience and the fight against financial crime. These requirements apply according to the perimeter and conditions specific to each rule.
The FCA accompanied this policy statement with three guides on the application of the Consumer Duty to crypto firms, operational resilience and its approach to international firms. For providers, the challenge is to demonstrate that their arrangements work beyond transaction monitoring alone: client information, governance, asset protection and the ability to manage incidents.
Policy statement PS26/12 sets the prudential framework through two new sourcebooks, COREPRU and CRYPTOPRU, and opens a consultation on guidance for the overall risk assessment. Firms must prepare their analysis of own funds, liquidity and risks according to their activities. The FCA has reduced from 2% to 1% the coefficient of the K-SII prudential factor, which targets certain operational risks linked to stablecoin issuance. This factor is one component of the prudential calculation and does not, on its own, sum up all the applicable own-funds requirements.
Policy statement PS26/9 defines the admission and disclosure rules (CRYPTO 3) for offers to the public and admission to trading on UK platforms, as well as the Market Abuse Regime for Cryptoassets (MARC, CRYPTO 4). Platforms serving retail investors play a central role in vetting the assets admitted and publishing the required disclosure documents. The regime covers qualifying cryptoassets admitted to trading on a relevant UK platform or subject to an application for admission, in accordance with the conditions laid down by the texts.
Policy statement PS26/10 governs the UK issuance of qualifying stablecoins (CRYPTO 2), with a CASS 16 chapter devoted to the protection of backing assets, and deals with redemption and holder information. The regulation of issuance must be distinguished from the ongoing work on the use of stablecoins in payments.
In its policy statement of 22 June 2026 on sterling-denominated systemic stablecoins, the Bank of England provides that backing assets may include up to 70% short-term UK government securities, with the balance held as deposits with the central bank. It also provides for a temporary issuance cap initially set at 40 billion pounds per systemic stablecoin concerned. The Code of Practice was still in draft at the date of this article. The consultation on the code closed on 22 September 2026 and the Bank plans to finalise it before the end of 2026; it must not be presented as already applicable. Issuers falling under the FCA regime and not subject to systemic recognition remain subject to the applicable FCA framework. Where an arrangement is recognised as systemic, the Bank of England also intervenes under the conditions laid down by the UK framework.
In CP26/32, the FCA proposes targeted deferrals of certain admission and disclosure obligations for crypto-assets already offered before authorisation. For the platforms concerned, the draft provides for a period of up to six months from the operator’s authorisation, which may end earlier for an asset if the corresponding disclosure document is published. The consultation also provides for accommodations for certain intermediaries.
Laid before Parliament on 15 September 2026, this draft provides for defining the notion of “UK qualifying stablecoin” and for introducing or clarifying several exclusions, subject to its adoption. These concern certain temporary holdings in the context of payment transactions, certain own-account operations and certain technical services. It also provides for adjustments relating to financial promotions. Its publication does not amount to adoption.
The UK obligations already applicable on anti-money laundering, the Travel Rule and sanctions draw on certain controls also used in the European Union. Their scope and arrangements must nevertheless be examined in the light of the rules specific to each jurisdiction. From 2027, the expanded regime also provides for the application to the firms concerned of certain FCA Handbook requirements on operational resilience and the fight against financial crime.
Wallet Screening from Scorechain makes it possible to analyse an address at a given moment, from the data available on the blockchain. The tool provides an explainable risk score and indicators for identifying direct or indirect exposures to addresses associated with sanctioned entities, illicit activities or high risks. This information can help teams review counterparties and document their compliance decisions.
This analysis fits into the firm’s know-your-customer procedures, sanctions controls and alert handling, and the firm remains responsible for its regulatory obligations. It replaces neither FCA authorisation where required, nor all the controls needed for compliance. The firm must also assess its dependence on this provider in the light of the third-party management and operational resilience requirements applicable to it.
In 2026, firms must comply with the current UK obligations and prepare their authorisation for 2027, with the application window closing on 28 February 2027. The quality of the application will depend on the qualification of the activities, the consistency of the territorial perimeter and verifiable controls. Blockchain data strengthens these controls when it is linked to client information and compliance decisions.
To see how Scorechain supports wallet screening and sanctions checks in your UK compliance workflow before the FCA application window closes, book a demo with the Scorechain team.
It depends on the services provided, the client base and their connection with the United Kingdom. MiCA authorisation does not automatically open access to the UK market and does not replace FCA authorisation. Until the new regime enters into application, the registration obligations under the MLRs and the rules on financial promotions must be examined separately. From 25 October 2027, firms carrying on an activity within the UK perimeter will have to hold the necessary authorisations, unless an exclusion, exemption or statutory continuity arrangement applies.
No. The FCA states that there will be no automatic conversion: registered firms must submit an application for authorisation, preferably within the window open until 28 February 2027.
A firm that submitted its application within the window may continue its services while the application is under review and, where applicable, for as long as a refusal remains open to reconsideration, subject to the legal conditions and the FCA’s powers. A firm that applied after the window falls into the transitional arrangement, limited to the performance of pre-existing contracts.
.webp)
