The UK's New Cryptoasset Regulatory Regime: What Firms Should Be Doing Now

Digital Assets Perspectives is a series of strategic commentaries examining developments in digital assets, payments and financial regulation. Rather than simply summarising legal and regulatory developments, each paper considers their wider commercial implications for internationally active businesses. The following advisory outlines the UK’s new cryptoasset regulatory and tax framework and the urgent steps firms should take to assess their activities, secure the necessary Financial Conduct Authority (FCA) permissions and prepare their governance, systems and operating models before the regime takes effect in October 2027.

Key Takeaways

Launch the implementation programme now. Map activities against the perimeter, confirm the permissions needed, identify gaps, run a gap analysis, establish board accountability and prepare a fallback plan. Submit the FCA application by 28 February 2027 and be ready to comply by 25 October 2027.
Settle the UK operating model early. Determine which legal entity will apply, where regulated activities and decision-making will sit, and whether the proposed UK presence will meet the FCA’s expectations.
Build the authorisation application alongside remediation. Align the business plan, permissions, governance, financial forecasts, outsourcing arrangements and supporting policies so they present a coherent operating model.
Address prudential readiness now. Model capital and liquidity needs, stress-test financial resources and develop a credible wind-down plan for the proposed business.
Test controls in practice. Gather evidence that governance, operational resilience, outsourcing oversight, customer protection and other key controls work effectively. rather than relying on policies alone.
Review custody and stablecoin operations. Map asset ownership, wallet and key controls; reserve assets, reconciliations, redemption processes and third-party dependencies.
Integrate regulatory, tax and data planning. Assess the tax effects of structural changes and ensure systems can support overlapping onboarding, regulatory reporting and Cryptoasset Reporting Framework reporting requirements.
Plan for business continuity. Work backward from 25 October 2027 and prepare an orderly run-off or exit strategy in case permissions are delayed, narrowed or refused.

From policy to implementation

The UK’s new regulatory framework for cryptoassets has moved decisively from policy development to implementation. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 establish a new regulatory perimeter for cryptoasset activities, bringing a range of activities within the UK financial services regulatory framework under the Financial Services and Markets Act 2000 (FSMA). The new regime is due to take effect on 25 October 2027.

The FCA has now published the principal rules and guidance that will apply to firms conducting regulated cryptoasset activities. These include requirements covering, among other things, governance and systems and controls, prudential standards, conduct, custody, stablecoin issuance, admissions and disclosures and market abuse. The FCA published its final Perimeter Guidance manual chapter on regulated cryptoasset activities (PERG 18) in September 2026, although it intends to consult on targeted updates following recent amendments to the Cryptoasset Regulations, with final amended guidance expected in early 2027.

For firms that intend to carry on regulated cryptoasset activities in the UK, the immediate milestone is the FCA’s authorisation application period on 30 September 2026. The application window is scheduled to close on 28 February 2027, well ahead of commencement of the regime. The FCA has encouraged firms intending to rely on the transitional arrangements to apply as early as possible. The practical consequence is that the question for cryptoasset businesses is no longer whether comprehensive UK regulation is coming, but whether their activities will fall within the new regime and, if so, what they need to do now to be ready.

Who and what will be caught

The new regime significantly expands the UK regulatory perimeter for cryptoassets. It introduces several new regulated activities, covering businesses involved in stablecoin issuance, custody, trading platforms, dealing and arranging. Broadly, the new regulated activities are

issuing qualifying stablecoins in the UK;
safeguarding qualifying cryptoassets and relevant specified investment cryptoassets;
arranging for another person to safeguard those assets;
operating a qualifying cryptoasset trading platform;
dealing in qualifying cryptoassets as principal;
dealing in qualifying cryptoassets as agent;
arranging (bringing about) deals in qualifying cryptoassets; and
arranging qualifying cryptoasset staking.

The regime therefore extends considerably beyond the categories of cryptoasset business currently subject to FCA registration under the Money Laundering Regulations (MLRs). Businesses that have previously operated outside the FSMA authorisation regime may, for the first time, need to consider whether their activities amount to regulated financial services activities requiring FCA permission. Importantly, however, the regime does not make every activity involving a cryptoasset a regulated activity. The analysis will depend not simply on whether a business describes itself as a crypto exchange, custodian, broker or stablecoin issuer, but on what it actually does and how its activities are structured. Particular care will be required where a business performs several functions within the same group or platform, or where activities such as staking, lending or borrowing form part of a wider service. In some cases, more than one regulated activity may be engaged.

The scope of the relevant cryptoassets is also important. The legislation introduces concepts including “qualifying cryptoassets” and “qualifying stablecoins”, and the precise classification of an asset may determine both whether an activity is regulated and which regulatory requirements apply. For existing FCA-authorised firms, the new regime does not mean that existing permissions automatically extend to cryptoasset activities: firms wishing to undertake one or more of the new regulated activities will need to obtain the relevant additional permissions. Equally, firms currently registered with the FCA under the MLRs will not be automatically converted into FSMA-authorised firms and will need to apply for authorisation if they wish to continue carrying on regulated cryptoasset activities after the new regime takes effect. For many businesses, therefore, the first step should be a perimeter-mapping exercise: identifying the activities undertaken, the entities through which they are carried on, the cryptoassets involved and the jurisdictions in which relevant parts of the service are performed.

The territorial question: overseas firms and UK customers

The territorial scope of the new regime will be particularly important for international cryptoasset businesses. An overseas firm should not assume that it falls outside the UK regulatory perimeter simply because it is incorporated, headquartered or operates its principal trading or technological infrastructure outside the UK. Whether UK authorisation is required will depend on the particular regulated activity being carried on, where that activity is regarded as taking place and the nature of the firm’s connection with the UK. Firms providing cryptoasset products or services into the UK will therefore need to analyse the territorial provisions by reference to their actual operating model, rather than relying solely on the location of the contracting entity, servers or trading infrastructure. That analysis can become considerably more complex for businesses operating on a cross-border or group-wide basis. Cryptoasset businesses frequently divide functions between entities, personnel and infrastructure in several jurisdictions. A platform might contract with customers through one entity, hold assets through another, employ developers or traders elsewhere and make key operational or risk decisions in a further jurisdiction. Similarly, global firms may operate “follow-the-sun” models under which activities pass between teams in different financial centres over the course of the trading day.

In those circumstances, firms will need to look beyond formal corporate structure and identify where the substance of each potentially regulated activity sits. Relevant considerations may include where customer relationships are established and serviced; which entity enters into transactions; where orders are received, transmitted or executed; where custody or safeguarding functions are performed; where trading parameters or other material decisions are set or altered; and what functions are performed by UK-based personnel. No single factor will necessarily determine the outcome, and the analysis will remain highly fact-specific.

This is particularly significant where technology enables an activity formally attributed to an overseas entity to be materially influenced or supported from the UK. The fact that a trade ultimately executes on infrastructure outside the UK, for example, will not necessarily resolve the regulatory analysis if UK personnel perform functions that are integral to the activity. Businesses using centralised global systems will therefore need to map not only the relevant legal entities, but also the operational and decision-making chain through which their cryptoasset activities are conducted. The FCA has separately published perimeter guidance intended to assist firms in determining how the new regulated activities and relevant exclusions apply in practice. Firms should also consider whether any applicable statutory exclusion or exemption affects the analysis. The availability of an exclusion should, however, be considered by reference to the particular facts and activity rather than assumed simply because the firm is established outside the UK. In particular, the Overseas Persons Exclusion does not apply to new cryptoasset regulated activities, and services provided to UK consumers from overseas may be treated as carried on in the UK. Firms should also be mindful that exclusions designed for traditional financial services may not be available for cryptoassets or may apply in novel ways.

The position of international firms does not end with the perimeter analysis. Where an international cryptoasset firm requires FCA authorisation, the FCA’s baseline expectation is that regulated cryptoasset activities will be carried on from a UK legal entity. The FCA will consider the proposed structure as part of its assessment of the threshold conditions, including whether the firm can be effectively supervised and whether it has appropriate governance, resources and substance in the UK. A UK branch may be acceptable in some circumstances, including for cryptoasset trading platforms, but the FCA will assess the proposed structure on a case-by-case basis. Firms should therefore avoid assuming that authorisation can simply be obtained by attaching a lightly staffed UK branch to an otherwise wholly offshore business.

This can have wider implications for group structuring. Establishing a UK entity or greater UK substance may affect governance arrangements, staffing, outsourcing, intra-group agreements and the allocation of capital and operational responsibilities. It will also have tax consequences, which is one reason why regulatory and tax structuring should be considered together at an early stage rather than sequentially.

International firms should also distinguish the question of whether authorisation is required from the separate question of which UK conduct and other regulatory requirements apply once a firm is authorised. The FCA’s rules recognise that an internationally operating firm may service both UK and non-UK users, and particular Handbook requirements may apply differently depending upon the nature and location of those users. The territorial analysis therefore does not necessarily end once the authorisation question has been answered.

There is also a separate issue which overseas businesses should not overlook: UK financial promotions. The UK cryptoasset financial promotions regime already applies to overseas firms seeking to market cryptoassets to UK consumers, and overseas firms that are neither FCA-authorised nor appropriately registered may need an authorised firm to approve their promotions in order to communicate them lawfully in the UK. An overseas firm may therefore need to address UK financial promotion requirements even where its analysis of the regulated-activities perimeter produces a different conclusion.

Accordingly, any international business with a material UK nexus should undertake its territorial analysis at an early stage. That exercise should identify not only UK customers, but the entities, people, systems and decision-making processes involved in providing the relevant services. A conclusion that an activity is carried on “offshore” should be the result of a detailed analysis of the business model, not an assumption based on the location of the contracting entity.

Authorisation: the clock is now running

For firms that will carry on one or more of the new regulated cryptoasset activities, identifying the perimeter is only the first step. They will also need to determine how they will obtain the necessary FCA permission and whether their business, governance and control framework are capable of meeting the standards expected of an authorised firm.

The FCA’s application period runs from 30 September 2026 to 28 February 2027. Firms already authorised under FSMA will generally need to apply for a variation of permission to add the relevant cryptoasset activities, while firms that are not currently authorised will need to make a new application. Existing registration under the MLRs does not remove that requirement. The FCA has been explicit that firms should not have waited until the gateway opened before beginning their preparations. It expects prospective applicants to determine the permissions they will require, test those permissions against their business model and risk profile, carry out a gap analysis against the new FSMA requirements and develop a credible implementation plan agreed at board level, with clear accountability for what needs to change and by when. Authorisation will not be a simple registration exercise. A firm will need to demonstrate that it satisfies, and will continue to satisfy, the FSMA Threshold Conditions. The FCA will therefore look beyond the application form to the substance of the business: its ownership and group structure, governance, senior management, financial resources, systems and controls, risk management, outsourcing arrangements, operational resilience and the suitability of the individuals responsible for running it.

For many cryptoasset businesses, this will represent a substantial increase in regulatory intensity. Firms that have historically been subject primarily to the MLR registration regime will transition to full FSMA supervision. Depending on the nature of their business, they will need to grapple with the FCA’s Principles for Businesses, Consumer Duty requirements where applicable, prudential standards, detailed conduct requirements and a much more developed framework of individual accountability. The FCA has also proposed applying the existing elements of the Senior Managers and Certification Regime to cryptoasset firms.

The application itself will reflect that greater level of scrutiny. The FCA has published information describing both the general FSMA components of the application and the cryptoasset-specific sections that applicants will need to complete according to their particular business model. It has also published a financial data template which applicants will be required to complete. Firms should therefore expect their regulatory business plan, financial information, governance arrangements, systems and controls and activity-specific documentation to tell a coherent and internally consistent story about how the regulated business will operate.

The detailed requirements will depend on the activities undertaken. The FCA’s final framework combines core requirements applicable across the sector with activity-specific rules for businesses such as qualifying stablecoin issuers, cryptoasset custodians, trading platforms and intermediaries. It also introduces dedicated prudential rules under the Core Prudential sourcebook (COREPRU) and the Prudential sourcebook for CRYPTOPRU Firms (CRYPTOPRU), custody requirements, operational resilience standards and, where relevant, rules relating to admissions, disclosures and cryptoasset market abuse. Financial resources and prudential readiness should therefore be addressed early rather than left until the application is being assembled. Firms will need to understand not only any applicable minimum own-funds requirement, but also the broader requirements concerning liquidity, risk assessment, concentration and other exposures, and wind-down planning. Capital planning will need to reflect the regulated business that the firm actually proposes to conduct, rather than being treated as a final numerical calculation at the end of the authorisation exercise.

Governance is equally important. Firms should identify who will be responsible for the regulated business, whether existing management arrangements are suitable for an FCA-authorised entity, how responsibilities will be allocated, and which material functions will be outsourced or provided by other group entities. International businesses, in particular, will need to ensure that their governance arrangements are consistent with the FCA’s expectations concerning UK presence, effective supervision and regulatory substance discussed above.

The FCA is offering prospective applicants access to its Pre-Application Support Service (PASS). Firms can request a pre-application meeting to discuss their plans and raise questions before submitting an application. For businesses with novel structures, complex international arrangements or uncertainty about the scope of required permissions, there may be considerable value in identifying difficult issues before the formal application process begins, rather than attempting to resolve them after submission.

The timing of an application has consequences beyond administrative convenience. Where a firm applies during the prescribed application period but its application has not been finally determined by 25 October 2027, the statutory saving provision can permit it to continue providing cryptoasset services while the application remains outstanding. A firm that applies only after 28 February 2027 is in a materially less favourable position. The FCA has said that it will not expedite a late application simply because the firm has missed the application period. If the firm has not obtained the necessary permission when the new regime commences, it will enter the transitional regime and will generally be able to conduct regulated cryptoasset activities only to the extent necessary to perform contracts entered into before commencement. It will not be able to enter into new contracts with existing UK customers or take on new UK customers while relying on that transitional provision.

Firms that do not intend to seek authorisation face a different deadline altogether: they will need to run off their UK regulated cryptoasset business before commencement of the new regime. A firm that continues regulated business without the required authorisation or permission risks breaching the FSMA general prohibition or, for an existing authorised firm, carrying on activities outside the scope of its permission.

The authorisation process should therefore be approached as a regulatory transformation project rather than a form-filling exercise. Firms should already be addressing four questions: What permissions do we need? Where are the gaps between our current arrangements and the FCA’s requirements? What changes must be made before we apply? And who has responsibility for delivering them?

Stablecoins and custody

Stablecoins and cryptoasset custody sit at the heart of the new UK regime. Both involve a regulatory objective familiar from traditional financial services — ensuring that assets that support or belong to customers remain identifiable, protected and available when required — but the FCA has had to translate that objective into rules designed for blockchain-based business models.

Stablecoin issuance

The new regime creates a regulated activity of issuing qualifying stablecoins in the UK. A qualifying stablecoin is, broadly, a qualifying cryptoasset designed to maintain a stable value by reference to one or more fiat currencies. The FCA’s regime is intended to ensure that a UK-issued qualifying stablecoin can credibly maintain its value and be redeemed in accordance with the issuer’s obligations.

The starting point is 1:1 backing. UK stablecoin issuers will be required to maintain backing assets corresponding to the value of stablecoins in issuance. Those assets will be governed by chapter 16 of the Client Assets sourcebook (CASS 16) and held in a statutory trust for stablecoin holders, separating the backing pool from the issuer’s proprietary assets and strengthening protection in the event of insolvency. The FCA has also removed the concept of an unallocated backing-fund account and will permit an issuer to maintain an excess of up to 5 percent in the backing asset pool.

The composition of that backing pool is itself regulated. The FCA distinguishes between core and expanded backing assets, with additional liquidity requirements where expanded backing assets are used. The final rules simplify the originally proposed Backing Asset Composition Requirement: rather than forecasting future redemptions, an issuer using expanded backing assets must maintain a minimum proportion of core backing assets based on the higher of 5 percent of the backing pool or its highest daily redemption percentage over the relevant historic period, in addition to the separate on-demand deposit requirement. The calculation must be performed on each redemption day.

The currency of the reserve matters too. The FCA has decided that a UK-issued qualifying stablecoin should be backed only by assets denominated in the same currency as the stablecoin. The purpose is to avoid foreign-exchange risk that would weaken the issuer’s ability to maintain the peg or satisfy redemption requests during stressed market conditions. Redemption is therefore not merely a contractual feature of the product; it is a regulatory requirement that must be built into the issuer’s liquidity arrangements. The FCA’s baseline regime requires issuers to meet redemptions within the prescribed timeframe — generally T+1 — and the final rules clarify that the necessary know-your-customer (KYC) checks are completed before the redemption period begins. Issuers will need sufficient liquidity, operational capacity and banking arrangements to make that promise meaningful in practice, including during periods of unusually heavy redemption activity.

The rules also recognise that stablecoins circulate in secondary markets rather than remaining in the hands of the original purchaser. The FCA has therefore clarified the application of redemption requirements to secondary-market holders and strengthened disclosure requirements so that both existing and prospective holders can understand matters such as redemption rights, backing arrangements and relevant risks. Historical disclosures will also need to remain accessible. For issuers, this means that the regulatory exercise extends well beyond drafting terms and conditions. They will need an integrated treasury, liquidity, custody, reconciliation and redemption operating model. Decisions about reserve composition, banking partners, third-party custodians, intra-group arrangements and liquidity management will all become matters of regulatory importance.

Payments and systemic stablecoins

The position becomes more complex where stablecoins are intended to function as money for payments rather than principally as crypto-market settlement assets. The FCA describes its present rules as a baseline issuance regime and is continuing to develop the treatment of stablecoins used in payments through the Government’s wider Modernising Payments Regulation programme. The eventual payments framework will therefore need to be considered alongside the cryptoasset regime. There is also a separate regime for stablecoins that become systemic. HM Treasury may recognise a stablecoin issuer where disruption could threaten UK financial stability or have serious consequences for businesses or other interests across the UK. Once recognised, the issuer will be jointly regulated by the Bank of England and the FCA rather than by the FCA alone.

The Bank’s June 2026 framework illustrates how materially the requirements may change at that point. For sterling-denominated systemic stablecoins, the Bank’s policy provides for backing assets comprising up to 70 percent short-term UK government debt and up to 30 percent central-bank deposits, with T+0 redemption. It has also replaced its earlier proposed individual holding limits with a temporary £40 billion issuance guardrail for each systemic stablecoin.

Systemic issuers will also be expected to maintain robust liquidity contingency funding plans and undertake regular liquidity stress testing, including testing their ability to withstand elevated redemption demands and disruption in the markets for backing assets. This creates an important strategic issue for issuers with ambitions to scale. A business may begin within the FCA-only regime but later cross into joint Bank/FCA supervision. The regulatory architecture should therefore be considered not merely by reference to the issuer’s launch model, but also to its anticipated scale and use cases. An issuer hoping to become significant in UK retail or wholesale payments should assess early whether its structure, backing model and operational infrastructure are capable of evolving into the systemic regime.

The Bank and FCA have expressly designed the regime to facilitate a managed transition from sole FCA supervision to joint regulation where a stablecoin becomes systemic, making scalability itself a regulatory design consideration for ambitious issuers.

Cryptoasset custody

The new regime also brings the safeguarding of qualifying cryptoassets within the FSMA perimeter. The statutory concept is deliberately broader than traditional notions of possession. Safeguarding may arise where a person has control of a cryptoasset by means that enable it to bring about a transfer of the benefit of that asset. The regulatory analysis therefore depends upon control, rather than simply on whether the firm describes itself commercially as a custodian.

That distinction is important in crypto markets. Control may depend on private-key arrangements, signing authority, multi-signature or multi-party computation (MPC) structures, wallet architecture and the allocation of powers between the firm, its client, group companies and technology providers. A firm which regards itself merely as providing infrastructure may therefore need to analyse carefully whether, in substance, it exercises sufficient control to fall within the safeguarding perimeter.

For qualifying cryptoassets, the FCA is introducing a dedicated CASS 17 regime. The core requirements address ownership rights, books and records, reconciliations, safeguarding arrangements and private-key management. The FCA has deliberately adopted a technology-neutral approach rather than prescribing a particular wallet or key-management architecture: the focus is on whether the arrangements produce the required safeguarding outcome.

That outcome-based approach does not mean that operational design is left untouched. Custodians will need to be able to establish at any time which assets belong to which clients, where those assets are held, who is capable of transferring them and whether internal records reconcile with the relevant on-chain and third-party records. Governance around creation, storage, access, backup, recovery and compromise of private keys will consequently become a core regulatory control rather than simply an IT-security matter.

Particular attention will also be required where custody is outsourced or provided intra-group. Using a third party does not eliminate the regulatory risk associated with safeguarding client assets. Firms will need appropriate due diligence, contractual arrangements, oversight and contingency planning and should understand how assets could be recovered if either the custodian or a critical service provider fails.

The FCA has introduced targeted flexibility where necessary to accommodate how crypto markets operate. This includes limited exceptions to the trust requirements and a settlement-float model of up to 2 percent, allowing a restricted proportion of client cryptoassets to be available where necessary to facilitate settlement. The exception is tightly bounded and should not be treated as undermining the wider principle that client assets are to remain protected.

Client money is a separate layer of the analysis. CASS 7 will apply to client money arising from, or connected with, the safeguarding of client cryptoassets, subject to targeted adjustments intended to avoid duplication. Stablecoin issuers carrying on the regulated issuance activity are treated differently and will not be subject to CASS 7 in respect of that issuance activity.

The position of relevant specified investment cryptoassets is different again. Although a firm safeguarding them will require the relevant cryptoasset custody permission, the FCA has decided not to apply CASS 17 to such assets when the regime begins. Instead, CASS 6 will continue to govern their safeguarding for the time being.

Custody arrangements should therefore be reviewed at an architectural level, not merely against a checklist of policies. Firms should map legal ownership, beneficial entitlement, technical control, wallet and key arrangements, third-party dependencies, reconciliation processes and the steps required to return client assets in a stressed or insolvency scenario.

Failure planning is likely to become increasingly important. The FCA has confirmed that further work remains on the resolution of both stablecoin issuers and cryptoasset custodians, including rules governing distributions following a firm failure and, potentially, the circumstances under which stablecoin redemption can be suspended. Firms building their compliance frameworks now should therefore leave room for that regime to develop.

For both stablecoin issuers and custodians, the central message is the same: the new regime regulates the infrastructure behind the product as much as the product itself. Firms will need to demonstrate not only that customers have legal rights, but that the assets underpinning those rights can, in practice, be identified, controlled, protected, reconciled and (when required) redeemed or returned.

Financial regulation is only part of the picture — do not forget tax

Regulatory analysis and structuring should not be undertaken in isolation from tax considerations. The structure through which a cryptoasset business operates, the location of relevant activities and personnel, the treatment of stablecoins and the way in which cryptoassets are held, lent or deployed all have tax implications which should be considered alongside financial regulatory structuring rather than after it.

Cryptoasset reporting framework

The UK implemented the Organisation for Economic Co-operation and Development (OECD) Cryptoasset Reporting Framework (CARF) with effect from 1 January 2026 through the Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025 (CASP Regulations). The OECD developed CARF as a dedicated global tax transparency framework for the standardised automatic exchange of tax information on cryptoasset transactions to complement the requirements of the Common Reporting Standard (CRS). The CRS provides for automatic exchange of information between tax authorities on financial accounts held by financial institutions and others. CARF, however, unlike the CRS, requires reporting of transactions, as opposed to year-end account balances, transacted by UK cryptoasset users, not just overseas users, and introduces a significant increase in tax transparency for the cryptoasset sector. The CASP Regulations reference the rules and commentary set out in CARF.

Reporting Cryptoasset Service Providers within the scope of the CASP Regulations are required to carry out due diligence, collect specified information on users and transactions and maintain appropriate records. Cryptoasset businesses should therefore determine whether they fall within the definition of a Reporting Cryptoasset Service Provider, what information must be collected from UK and non-UK users, and whether their systems can produce the required reporting data. In addition to His Majesty’s Revenue and Customs (HMRC) commentary in its International Exchange of Information Manual, the OECD CARF FAQs provide additional guidance for cryptoasset businesses on their CARF obligations. The first reports, covering the 2026 calendar year, must be submitted to HMRC by 31 May 2027 and for subsequent calendar years on or before the following 31 May

The operational overlap between CARF requirements and regulatory onboarding, KYC and customer data processes should also be considered. Further, the CASP Regulations impose penalties on both Reporting Cryptoasset Service Providers and users who fail to comply with their respective obligations.

Stablecoins

Another development is in the tax treatment of stablecoins. Following a call for evidence, HMRC published draft legislation in July 2026 under which eligible stablecoins will be treated more like money for tax purposes. For individuals and trustees, disposals of eligible stablecoins will be exempt from capital gains tax, and certain interest-like returns will be taxed as savings income. For companies, eligible stablecoins will be treated as a money debt; where they are lent, they will be treated as a transaction for the lending of money under the loan relationship rules and will be taxed by reference to amounts recognised in the company’s profit & loss accounts, consistent with the existing treatment of traditional loans under the loan relationship rules. The measures are expected to take effect from 6 April 2027 for individuals and trustees and from 1 April 2027 for companies.

For businesses issuing, holding or using stablecoins, the tax analysis should therefore form part of the broader product and operating-model assessment. Particular attention should be given to whether the relevant token falls within the statutory definition of an eligible stablecoin and how the proposed tax treatment interacts with the regulatory classification and use case.

Cryptoasset loans and liquidity pools

HMRC also published draft legislation in July 2026, following a consultation in 2023, for cryptoasset lending, borrowing and automated market-making arrangements entered into by individuals and trustees. The purpose of the new legislation is broadly to prevent a capital gains tax charge from arising merely because cryptoassets are temporarily transferred under certain qualifying arrangements, with taxation instead deferred until there is an economic disposal. This is fairer for taxpayers and reduces the administrative burden that currently arises under the capital gains tax legislation in respect of such arrangements.

With effect from 6 April 2027, the acquisition or disposal by an individual or trustee of an interest in a single cryptoasset lending arrangement for the disposal or acquisition of cryptoassets of the same type as the invested cryptoassets under the lending arrangement will be treated for capital gains tax purposes as a ‘no gain, no loss’ transaction.

For single cryptoasset borrowing arrangements where an individual or trustee borrows qualifying cryptoassets, the borrowed cryptoassets will be treated as acquired for market value consideration at the time of borrowing. When cryptoassets of the same type are then transferred back under the arrangement, the individual or trustee will be treated as disposing of the cryptoassets for an amount equal to that value, so no gain or loss will arise for capital gains tax purposes.

Under automated market making arrangements where an individual or trustee acquires an interest in the arrangement in exchange for the disposal of cryptoassets of the same type as the invested cryptoassets to which the interest relates, the disposal will be a no-gain, no-loss disposal. Similarly, when an individual or trustee disposes of an interest in an automated market making arrangement and acquires cryptoassets of the same type as the invested cryptoassets to which the interest relates, the disposal is treated as a no gain, no loss disposal to the extent that the individual or trustee receives the same quantity of cryptoassets as those originally invested. To the extent that more or fewer cryptoassets are acquired, a capital gain or loss will arise by reference to the difference.

Regulatory structure and tax substance

Finally, firms should consider the tax consequences of the regulatory structures adopted to comply with the new regime. As discussed above, an international firm requiring FCA authorisation may need to establish greater UK legal presence and operational substance. For example, where no separate UK legal entity is used, this may give rise to a UK permanent establishment of the overseas firm with the consequence that profits arising from the activities of that permanent establishment may be within the charge to UK tax. Decisions about the location of entities, senior management, personnel, treasury functions, intellectual property and intra-group arrangements may therefore have tax consequences across several jurisdictions.

This is another example of why regulatory and tax advice should be coordinated from the outset. A structure designed solely to satisfy the FCA may produce unintended tax consequences; equally, a tax-efficient arrangement may not provide the governance, substance or supervisory access required by the FCA.

The practical message is therefore straightforward: perimeter, authorisation and tax structuring should form part of a single implementation exercise.

What should firms do now

For firms intending to remain active in the UK cryptoasset market, the implementation period has already begun. The new regime is not a single compliance exercise culminating in an FCA application. For many businesses, it will require a coordinated transformation programme spanning perimeter analysis, legal entity structure, authorisation, governance, prudential requirements, systems and controls, customer treatment, custody or stablecoin arrangements where relevant, tax and operational implementation.

The FCA has made clear that firms should already be preparing. It expects prospective applicants to identify the permissions they require, assess those permissions against their business model and risk profile, conduct a gap analysis and develop a clear and credible implementation plan agreed at board level, with individual accountability for delivery. Firms should also assess the financial and other resources required both to obtain authorisation and to operate successfully within the new regime.

For most firms, that programme should proceed through the following workstreams.

Map the business – not merely the legal entities

The starting point should be a detailed mapping of the business against the new regulatory perimeter.

That exercise should establish what activities are being carried on, by whom, for whom, involving which assets and from where. Firms should identify each potentially regulated activity and follow it through the actual operational chain rather than relying on job titles, corporate descriptions or contractual labels. For an international group, for example, the relevant entity may contract with the customer in one jurisdiction while trading, custody, technology, customer support or risk-management functions are performed elsewhere. UK personnel may make or influence decisions that are formally attributed to an overseas entity. Outsourced and intra-group functions should also be included.

The exercise should therefore produce an activity-by-activity analysis covering the relevant cryptoassets, entities, customers, personnel, systems, service providers and jurisdictions, together with any exclusions or exemptions on which the firm proposes to rely. The output should be a documented perimeter position that supports the permissions sought in the FCA application. A bare conclusion that a particular activity is “offshore” or “unregulated” will not be enough.

Translate the perimeter analysis into permissions

Firms should then identify the precise FCA permissions required by their proposed business model. This requires more than identifying the firm’s principal commercial activity. A business describing itself as a trading platform, for example, may also undertake dealing, arranging or safeguarding activities. A vertically integrated group may require several permissions across different entities.

Existing FSMA-authorised firms will need to identify the appropriate variations of permission. Firms currently outside FSMA will need to determine the scope of their new authorisation application. Existing MLR registration, payment-services or e-money permissions do not automatically confer the new cryptoasset permissions.

The permissions analysis should then be stress-tested against the firm’s actual and planned business model. Firms should consider not only what they do today but what they expect to do during the period immediately after authorisation. Applying for an artificially narrow permission may create a further regulatory obstacle as soon as the business expands; applying unnecessarily widely may invite questions about whether the firm is genuinely ready to undertake all the activities for which it seeks permission.

Settle the UK legal and operating model

International firms should determine early whether their existing structure is capable of satisfying the FCA’s expectations concerning UK presence, governance and effective supervision. This may require decisions on the establishment or use of a UK entity, the allocation of activities between group companies, the location of staff and senior decision-makers, outsourcing and intra-group service arrangements, the ownership of technology and intellectual property, and the location of treasury and other support functions. These decisions should not be postponed until the authorisation application is being drafted. A business cannot sensibly describe its proposed governance, financial resources, outsourcing or systems architecture to the FCA while the structure through which it intends to operate remains unsettled.

Regulatory restructuring should also be coordinated with tax advice from the outset. Moving personnel, functions, contracts or assets into the UK can affect corporate residence, permanent-establishment risk, transfer pricing, employment and other tax issues. Conversely, a structure designed primarily for tax purposes may fail to provide the substance or supervisory access the FCA expects.

Perform a genuine regulatory gap analysis

Once the intended structure and permissions are clear, the firm should compare its existing arrangements with the standards that will apply once it becomes authorised. This is particularly important for businesses currently operating principally under the MLR registration regime. The FCA itself recognises that for many cryptoasset businesses this will be their first experience of regulation under FSMA. The assessment should cover the Threshold Conditions and, according to the firm’s activities, governance and individual accountability, the Principles for Businesses, Consumer Duty, financial crime systems and controls, conflicts, conduct requirements, prudential regulation, operational resilience, outsourcing, record keeping, regulatory reporting, complaints, financial promotions, custody and client assets, stablecoin requirements, admissions and disclosures and market abuse.

The critical distinction is between a policy gap and an operating-model gap. A missing policy can generally be drafted. A governance structure that does not work, insufficient staffing, inadequate financial resources, an uncontrolled outsourcing dependency or a custody architecture incapable of meeting CASS requirements may require substantially more time and expense to remediate. Firms should therefore grade gaps according to their significance and the time required to close them, identify dependencies between them, and establish evidence that remediation has actually been completed.

Put board ownership and individual accountability in place

The transition to FSMA regulation should have clear senior ownership. The board should approve the implementation programme, receive regular reporting on progress and significant risks, and understand the consequences if the firm is unable to obtain the permissions it seeks. Individual workstreams should have named, accountable owners rather than be collectively assigned to “Compliance”.

Governance arrangements themselves should also be tested. Firms should ask whether the board has appropriate skills and experience; whether senior management responsibilities are clear; whether UK management has sufficient authority; whether appropriate committees and reporting lines exist; and whether outsourced or overseas functions can be supervised effectively by the authorised firm.

The FCA will authorise a firm only where it is satisfied that the firm meets its minimum standards and is capable of continuing to do so. Authorisation should therefore be approached as an assessment of the business and the people running it, not simply of its documentation.

Build the prudential model early

Prudential requirements should not be left until the application is nearly complete. Firms should determine how COREPRU and CRYPTOPRU apply to their activities and model their expected own-funds and liquidity position. They should consider applicable capital requirements, liquidity needs, concentration and counterparty exposures, operational risks, stress scenarios and wind-down requirements. The exercise should look forward as well as backward. A firm’s resources may be adequate for its current scale but insufficient for the business plan submitted to the FCA. Conversely, projected growth may increase capital, staffing, technology and operational requirements more quickly than management expects. A credible prudential assessment should therefore connect financial forecasts, regulatory capital, liquidity, risk appetite and the firm’s business plan. Wind-down planning should likewise be realistic: it should address how the business could cease regulated activity without leaving customers or client assets stranded.

Test systems, controls and operational resilience in practice

Cryptoasset businesses are frequently technology-intensive and dependent on global infrastructure and third parties. Firms should test whether those arrangements will withstand the requirements of an FCA-authorised business. Particular attention should be given to cybersecurity, access controls, private-key governance where relevant, customer onboarding, transaction monitoring, incident management, data quality, business continuity, outsourcing, cloud services and other critical third-party dependencies. The question should not simply be whether a control exists on paper. Firms should be capable of demonstrating that it operates. That may require management information, testing results, incident records, reconciliations, escalation logs, outsourcing oversight and other evidence showing how the firm identifies and manages risk in practice. Firms should also identify plausible failure scenarios. What happens if a critical custodian, exchange, banking partner, cloud provider or intra-group service becomes unavailable? Which services stop? Which customers are affected? Who makes the decision to invoke contingency arrangements, and can those arrangements actually be implemented?

Undertake specialist workstreams for custody and stablecoins

Where custody is provided, firms should map the entire asset-control architecture: legal ownership and beneficial entitlement, wallet structure, private keys, signing rights, reconciliation processes, settlement arrangements, third-party and intra-group custody, and the mechanisms by which assets could be returned in the event of failure. Stablecoin issuers will need a separate implementation workstream covering backing assets, statutory trust arrangements, reserve custody, liquidity, reconciliation, redemption, disclosures and treasury operations. These workstreams are likely to require input extending beyond Legal and Compliance to Treasury, Finance, Operations, Technology and Risk. For stablecoin businesses with significant payment ambitions, scalability should also be considered. The architecture adopted for initial FCA authorisation should not unnecessarily obstruct a later transition into the systemic Bank of England/FCA framework.

Review the whole customer journey

The regulatory transition will affect the firm’s interaction with customers from initial marketing through onboarding, service provision, complaints and eventual termination. Firms should review financial promotions, onboarding and appropriateness processes where relevant, disclosures and risk warnings, contractual terms, customer support, complaints, redemption or withdrawal processes and treatment of vulnerable customers. Where the Consumer Duty applies, the exercise should go beyond checking documentation. Firms should consider whether the actual customer journey produces appropriate outcomes, whether foreseeable harm has been identified, and whether the firm has evidence to monitor those outcomes.

Current financial promotion requirements must also be observed during the transition. Firms currently relying on a section 21 approver should also plan carefully for the transition. Those applying for authorisation during the application period may continue to use an approver while their application is being determined, including during any applicable saving period. Firms that do not apply within the window will not have the same flexibility once the new regime commences.

Integrate regulatory, tax and data workstreams

Tax should be incorporated into the implementation programme rather than considered after regulatory structuring decisions have been taken. The regulatory and tax teams should work from the same proposed operating model. CARF implementation also means that customer data architecture deserves particular attention: firms may be gathering information for anti-money laundering (AML), regulatory, conduct and tax reporting purposes through overlapping but not identical processes. That creates both an opportunity and a risk. Properly designed systems can reduce duplication; poorly coordinated workstreams can result in inconsistent classifications, duplicated onboarding requests or data that is collected but cannot readily be extracted in the form required for regulatory or tax reporting.

Develop the application while remediation is underway

Application preparation and regulatory remediation should proceed in parallel, rather than sequentially. The FCA has published information on the anticipated general FSMA and cryptoasset-specific components of the application, as well as an updated financial data template. The crypto-specific information required will depend on the firm’s particular business model.

Firms should therefore begin assembling the regulatory business plan, ownership and group information, permissions analysis, governance structure, financial forecasts, prudential material, systems and controls, outsourcing arrangements, risk assessments, wind-down planning and activity-specific documents while implementation work continues. The application should tell a single coherent story. The proposed permissions must correspond with the business plan; financial projections must support the proposed activities; staffing must be credible in light of those projections; outsourcing arrangements must correspond with the governance model; and policies should describe the business the firm will actually operate. Firms should also build sufficient time for internal governance and quality assurance before submission. Application materials should be current, final and mutually consistent, rather than a collection of work-in-progress documents assembled to meet the gateway deadline. Inconsistencies between different parts of the application are likely to undermine confidence in the firm’s readiness.

Use pre-application engagement selectively

The FCA’s Pre-Application Support Service (PASS) is available to prospective cryptoasset applicants, and pre-application meetings are free of charge. They are an opportunity for firms to discuss their plans and raise issues before submitting a formal application. PASS should, however, be approached as a substantive engagement rather than an exploratory conversation. The FCA has expressly said that requests for meetings must be accompanied by meaningful supporting information and that a promise to provide information later is insufficient. Firms with novel business models, difficult perimeter questions, unusual international structures or complex permission requirements may therefore benefit from PASS — but only once they have developed their analysis sufficiently to have a productive regulatory discussion.

Treat the application window as a business-continuity issue

The application period is formally set to run from 30 September 2026 to 28 February 2027. Firms intending to rely on the saving provisions should therefore treat that window as a hard business-continuity deadline and should not assume that a late application can be accommodated without operational consequences. Firms applying within the prescribed window may, subject to the statutory conditions, benefit from the saving provisions while their applications are determined. Missing that window has potentially serious commercial consequences. Firms applying outside it cannot assume that they will be able to continue operating normally until authorisation is obtained. The FCA has made clear that firms unable to rely on the saving provisions may need to cease relevant activities until authorised.

Develop a credible plan B

Boards should also consider what happens if the preferred regulatory outcome is not achieved. That analysis should cover delay, requests for significant remediation, withdrawal of part of an application, refusal of particular permissions or refusal of the application altogether. An eligible firm entering the transitional regime may carry on regulated cryptoasset activity only so far as necessary to perform pre-existing contracts. It cannot enter into new contracts with existing UK customers or take on new UK customers. The purpose of the transitional provision is to facilitate an orderly run-off, not continued growth. Firms should therefore understand in advance how UK business could be separated or wound down, how customers would be treated, what would happen to customer assets and open positions, which contracts would need to be terminated or transferred, and what communications would be required. A credible implementation programme needs both an authorisation plan and an exit plan.

Work backward from 25 October 2027

The final deadline is operational, not documentary. The purpose of the exercise is not simply to submit an application or even to receive an FCA decision. It is to have a business capable of complying with the new regime when it commences on 25 October 2027. Firms should therefore work backward from commencement and identify when each governance, capital, staffing, systems, customer, custody, contractual and technology change must be designed, approved, implemented and tested. Policies should be embedded. Staff should be trained. Reporting should work. Reconciliations should have been tested. Governance bodies should already be functioning. Outsourcing arrangements should be documented and overseen. Required capital and liquidity should be available. “Ready” should mean capable of operating compliantly on day one - not capable of producing a collection of policies describing how the firm hopes eventually to operate. For boards and senior management, the immediate questions are therefore:

What regulated activities will we carry on?
What permissions will we require?
What must change in our business to meet the FCA’s standards?
What evidence will demonstrate that those changes have been implemented?
Who is accountable for delivering them?
Can we submit a complete, credible application within the gateway period?
And what is our plan if we cannot?

For many cryptoasset businesses, the period to October 2027 should therefore be treated not as an authorisation exercise, but as a full regulatory implementation programme.

Conclusion

The UK cryptoasset regulatory regime has moved from policy development into implementation. The perimeter is broader, the FCA’s expectations are clearer and the timetable is now fixed. For firms intending to operate in the UK market, the key question is no longer whether regulation is coming, but whether their business model, structure and systems will be ready when it arrives.

For many firms, the challenge will be significant. Businesses that have operated under the MLRs or outside the UK authorisation perimeter may now need to adapt to full FSMA supervision, including new requirements around governance, prudential resources, conduct, operational resilience, custody, stablecoin issuance and customer protection. International firms will also need to address the regime's territorial scope, UK legal presence and substance, and the interaction between regulatory and tax structures. The most effective response is therefore to treat the period to 25 October 2027 as a coordinated implementation programme. Firms should already be mapping their activities, determining the permissions they will require, testing their operating model against the FCA’s standards, identifying gaps, allocating responsibility for remediation and preparing their authorisation and implementation strategy.

The application window from 30 September 2026 to 28 February 2027 makes timing particularly important. For firms that intend to remain active in the UK market, delay may have consequences not only for authorisation but for business continuity.

The direction of travel is now clear. The UK is moving to a comprehensive regulatory framework for cryptoassets, bringing the sector much more firmly into the mainstream of financial services regulation. For firms that prepare early, the new regime should provide greater regulatory certainty and a clearer basis for building UK business. For those that do not, the transition may be considerably more difficult.

The implementation phase has begun.