Crypto License in the UK: FCA Registration & the New FSMA Regime

Why Operators Consider the UK for Crypto Licensing

The United Kingdom is one of the world’s deepest financial centres and runs a bespoke cryptoasset regime outside the EU’s MiCA single market. An FCA permission carries premium global credibility, the legal system is English common law with a transparent regulator that publishes detailed guidance, and the regime is moving from a narrow anti-money-laundering registration to a full conduct and prudential framework from 25 October 2027. The UK suits operators with UK customer bases or institutional counterparties who value an FCA credential over a passport.

An FCA Permission Carries Premium Credibility

FCA authorisation is recognised by global institutional counterparties as a high-bar credential, in the same tier as the Monetary Authority of Singapore and the Hong Kong Securities and Futures Commission. The FCA’s gatekeeping is demonstrably selective: since it became the cryptoasset anti-money-laundering supervisor on 10 January 2020, it had received 403 registration applications by 1 June 2026, of which only 65 firms (about 17% of the 385 determined) secured registration.^[1] For operators selling to banks, asset managers, and listed institutions, that scarcity is the point: an FCA permission shortens institutional due diligence in a way a lighter registration cannot.

A Statutory FSMA Regime Replaces the Narrow AML Registration

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made by Parliament on 4 February 2026, following the final draft statutory instrument published on 15 December 2025, and the new regime commences on 25 October 2027.^[2] The Regulations amend the Regulated Activities Order to bring stablecoin issuance, custody, trading platforms, dealing, arranging, and staking inside the FCA authorisation perimeter as fully regulated activities, replacing the narrow Money Laundering Regulations registration with a conduct and prudential framework. For operators planning a multi-year build, the move to a full Part 4A permission provides a depth of legal certainty the registration regime never offered.

A Real GBP Market and Established Promotions Regime

The UK is among the largest crypto-owning populations in Europe, giving stablecoin issuers and exchanges a genuine domestic GBP market rather than a brass-plate base. The cryptoasset financial promotions regime has been in force since 8 October 2023, so the rules for marketing to UK consumers are settled and well-documented in the FCA’s PS23/6 and FG23/3.^[3] Operators that build to the UK promotions standard inherit a mature compliance baseline. In practice, this means a UK-authorised firm arrives into an ecosystem with a defined marketing perimeter, an FCA that engages through pre-application support, and a settled tax treatment: operational context that newer jurisdictions cannot yet match.

Settled Tax Treatment and Broad Treaty Network

The UK’s tax treatment of cryptoassets is settled: HMRC treats exchange tokens as property within Capital Gains Tax for individuals and Corporation Tax for companies, and the buying and selling of exchange tokens for fiat is exempt from VAT following the Court of Justice ruling in Skatteverket v Hedqvist.^[4] The UK has one of the world’s widest double-taxation treaty networks, covering more than 130 jurisdictions, which reduces withholding leakage on cross-border interest, royalty, and dividend flows. For a UK-domiciled crypto operator, the combination of a clear domestic charge and deep treaty coverage is a quantifiable structural advantage over jurisdictions where withholding can erode 5–15% of cross-border cash flows.

Regulatory Framework

The United Kingdom regulates crypto businesses through one regulator running two regimes in transition. The FCA supervises anti-money-laundering obligations under the Money Laundering Regulations 2017 today, and from 25 October 2027 it supervises a full conduct and prudential regime for regulated cryptoasset activities under the Financial Services and Markets Act 2000. HMRC administers tax, and the Prudential Regulation Authority takes the lead on any systemic stablecoin.

One Regulator, Two Regimes (and the Tax Authority)

The FCA is the Financial Conduct Authority, the UK’s conduct regulator for financial services and the anti-money-laundering supervisor for cryptoasset businesses since 10 January 2020.^[5] Under the MLRs 2017, cryptoasset exchange providers and custodian wallet providers must be registered before carrying on business; the FCA assesses the firm’s AML and counter-terrorist-financing systems and controls, beneficial ownership, and the fitness of key individuals. Its enforcement powers include refusal, cancellation, public censure, and referral. Operating without the required registration, or making an unlawful financial promotion, is a criminal offence.

The FSMA regime is the new conduct and prudential framework. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made on 4 February 2026, amend the Regulated Activities Order to specify the regulated cryptoasset activities; the FCA is building the detailed rulebook through consultation papers including CP25/14 (stablecoin issuance and custody), CP25/40 and CP25/42 (regulating cryptoasset activities and the prudential regime), and CP26/13 (perimeter guidance).^[6] Final policy statements are expected through 2026 ahead of the 25 October 2027 commencement. The Senior Managers and Certification Regime and the Consumer Duty will apply to authorised cryptoasset firms.

HM Treasury, the PRA, and HMRC complete the architecture. HM Treasury is the policy lead and laid the Cryptoassets Regulations; the final draft statutory instrument was published on 15 December 2025.^[2] The Prudential Regulation Authority leads on any systemic payment stablecoin under the Bank of England’s financial-stability remit. HMRC administers tax, treating exchange tokens as property under its Cryptoassets Manual rather than as currency, and from 1 January 2026 requires UK cryptoasset service providers to collect and report user data under the OECD Cryptoasset Reporting Framework.^[7]

Recent Regulatory Developments

• 4 February 2026: The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 are made by Parliament, bringing cryptoassets within the FCA’s regulatory remit with full commencement on 25 October 2027.^[2]
• 1 January 2026: The OECD Cryptoasset Reporting Framework takes effect in the UK; the first reporting period runs to 31 December 2026, with reports due to HMRC by 31 May 2027.^[7]
• 16 December 2025: The FCA publishes CP25/42, the second prudential consultation, alongside CP25/40 on regulating cryptoasset activities, proposing own funds requirements for trading platforms, staking, dealing, and arranging.^[6]
• 15 December 2025: HM Treasury publishes the final draft statutory instrument for the cryptoasset regulatory regime.^[2]
• June 2025: The FCA publishes CP25/14 (stablecoin issuance and cryptoasset custody) and CP25/15 (a prudential regime for cryptoasset firms), proposing permanent minimum capital of £350,000 for stablecoin issuers and £150,000 for custodians.^[8]
• April 2025: HM Treasury publishes its first draft statutory instrument setting out the new cryptoasset regulated activities and a near-final policy approach.^[2]
• 8 October 2023: The cryptoasset financial promotions regime takes effect: marketing qualifying cryptoassets to UK consumers is restricted under section 21 of FSMA, breach being a criminal offence.^[3]
• 10 January 2020: The FCA becomes the anti-money-laundering supervisor for UK cryptoasset businesses under the MLRs 2017.^[5]

How the Two Regimes Overlap

The MLR-to-FSMA Perimeter Question

The defining feature of the UK regime in 2026 is that it is mid-transition, and the two regimes do not connect automatically. An MLR registration confirms only that a firm’s AML controls meet the standard; it is not a prudential or conduct authorisation, and it will not convert into an FSMA permission. The FCA has been explicit that firms intending to operate after 25 October 2027 should focus on securing FSMA authorisation rather than MLR registration, while a new entrant wanting to trade before the gateway opens may still apply for MLR registration if confident it can be secured in time.^[9]

The harder analytical question is the regulatory perimeter: which activities, and which firms, fall inside the new regime. The FCA’s CP26/13 perimeter guidance addresses where the line sits, including the treatment of overseas firms serving UK persons. The editorial position: the new regime narrows the room for offshore operators to serve UK retail clients through the overseas-persons route, so firms targeting UK consumers should plan for a UK authorisation rather than relying on a cross-border carve-out. Operators with novel structures (DeFi front-ends, staking-as-a-service, wrapped tokens) should treat perimeter classification as a first-order legal question, not a downstream one.

Tokenised securities and RWA

A UK cryptoasset authorisation does not cover tokenised securities. A tokenised share, bond, or fund interest is a financial instrument regulated under the Financial Services and Markets Act, so it sits inside securities law rather than the cryptoasset regime, which was laid before Parliament in late 2025 as a separate framework. The live testing route is the Digital Securities Sandbox (DSS), operated jointly by the Bank of England and the FCA, which lets firms test the issuance, trading, and settlement of digital securities under a modified regulatory regime; it opened in late 2024 and runs for five years. HM Treasury is also piloting a digital-gilt instrument (DIGIT), and the FCA’s policy work on tokenised and authorised funds is expected in the first half of 2026. We scope the security-token route through securities and DSS rules, pairing it with our fund licensing work where the asset is a fund interest.

Regulatory Transition: MLR Registration to the FSMA Regime

The United Kingdom is moving from a narrow anti-money-laundering registration to a full conduct and prudential regime on a defined timetable. The Money Laundering Regulations registration remains live, but the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 introduce a new authorisation regime that commences on 25 October 2027, reached through a time-limited authorisation gateway set out below.

The Authorisation Gateway and How It Operates

The FCA has published a sequenced timetable for the transition. Firms can request a pre-application meeting through the FCA Pre-Application Support Service (PASS) from 11 May 2026, with meetings taking place from July 2026; the FCA will publish the application forms and open PASS more fully in July 2026.^[10] The application period itself runs from 30 September 2026 to 28 February 2027. Where a firm applies during this window, the FCA expects to determine the application before the regime commences; if it cannot, a saving provision allows the firm to continue providing cryptoasset services until the application is finally determined.

Two transitional positions sit outside the main window. A firm that applies after the window closes but before commencement, and is not authorised by 25 October 2027, enters a transitional status under which it may conduct the new regulated cryptoasset activities only to the extent necessary to perform a pre-existing contract. A firm that does not intend to apply at all must run off its UK cryptoasset business before the new regime begins.^[10]

The New Regulated Activities

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 amend the Regulated Activities Order 2001 to specify the following cryptoasset activities as regulated:

• Issuing a qualifying stablecoin: offering or arranging the offer of, and undertaking to redeem, a qualifying stablecoin.
• Safeguarding and arranging safeguarding: custody of qualifying cryptoassets on behalf of another, and arranging for another to do so.
• Operating a qualifying cryptoasset trading platform: running a system that brings together multiple third-party buying and selling interests in qualifying cryptoassets.
• Dealing as principal and dealing as agent: buying, selling, subscribing for, or underwriting qualifying cryptoassets on the firm’s own account or on behalf of another.
• Arranging deals: making arrangements for another person to buy, sell, subscribe for, or underwrite qualifying cryptoassets.
• Qualifying cryptoasset staking: making arrangements for another person’s qualifying cryptoassets to be used in staking.

A qualifying cryptoasset is, broadly, one that is fungible and transferable and is not solely a record of value or contractual rights; a qualifying stablecoin is a cryptoasset that seeks to maintain a stable value by referencing one or more fiat currencies.^[11] The regime is built to capture firms providing these activities to UK persons, narrowing the room to rely on the overseas-persons exclusion for retail-facing business.

Key Deadlines

Practical implications. Firms targeting UK customers after 25 October 2027 should (i) decide early whether their activity falls inside the new perimeter, particularly for custody, stablecoins, and staking; (ii) use the Pre-Application Support Service from 11 May 2026 to test novel structures with the FCA before lodging; (iii) lodge the authorisation application inside the gateway window to secure the saving provision; and (iv) build the prudential and Consumer Duty package in parallel with the application rather than after it. A firm that wants to trade before the gateway opens may still pursue MLR registration, but only if confident it can be secured in time.

License Types and Activities Covered

The United Kingdom has no single “crypto licence”. It has a layered authorisation perimeter that shifts on 25 October 2027. Today, FCA registration under the MLRs applies to cryptoasset exchange providers and custodian wallet providers. From the FSMA commencement date, separate authorisations apply by activity: issuing a qualifying stablecoin, safeguarding (custody), operating a trading platform, dealing, arranging, and staking.

Covered Activities

• FCA cryptoasset registration under the MLRs 2017. Required since 10 January 2020 for cryptoasset exchange providers (exchanging cryptoassets for money or for other cryptoassets, arranging such exchanges, or operating an automated machine) and custodian wallet providers (safeguarding or administering cryptoassets or private keys on behalf of customers). This is an AML registration, not a conduct or prudential authorisation.
• FSMA authorisation: issuing a qualifying stablecoin. From 25 October 2027, offering or arranging the offer of, and undertaking to redeem, a qualifying stablecoin is a regulated activity. Backing assets must be low-risk and liquid, held on statutory trust for holders, and managed by an unconnected third party.
• FSMA authorisation: safeguarding and arranging safeguarding. Custody of qualifying cryptoassets for another, and arranging for another to provide custody, become regulated activities with client-asset protections.
• FSMA authorisation: operating a qualifying cryptoasset trading platform. Running a system that brings together multiple third-party buying and selling interests in qualifying cryptoassets.
• FSMA authorisation: dealing as principal, dealing as agent, and arranging deals. Buying, selling, subscribing for, or underwriting qualifying cryptoassets, on own account or for another, and making arrangements for another to do so.
• FSMA authorisation: qualifying cryptoasset staking. Making arrangements for another person’s qualifying cryptoassets to be used in staking.

What Does NOT Require FCA Permission

• Holding or trading cryptoassets for one’s own account as a non-business activity. Personal investment is outside the perimeter, although disposals are within Capital Gains Tax.
• Pure software and infrastructure provision where the firm never takes custody, deals, or arranges deals in qualifying cryptoassets.
• Cryptoassets that are not “qualifying cryptoassets”. Assets that are solely a record of value or contractual rights, or are non-fungible or non-transferable, fall outside the qualifying-cryptoasset definition, though other regimes (for example securities or e-money rules) may still apply.
• Native validation by an asset holder may sit outside the staking activity where there is no arrangement made for another person; the FCA’s perimeter guidance is the controlling source.
• Activities already regulated under another regime, such as security tokens that are specified investments, which are caught by the existing FSMA framework rather than the new cryptoasset activities.

DeFi, Staking, and Tokenised RWA Treatment

The FCA’s approach to decentralised finance, staking, and tokenised real-world assets is being set out in its consultation papers and the CP26/13 perimeter guidance. Staking and arranging staking are expressly within the new perimeter where arrangements are made for another person. Tokenised securities that meet the specified-investment definition are regulated under the existing FSMA framework rather than the new cryptoasset activities, so the analysis turns on whether a token is a qualifying cryptoasset or an existing specified investment. For genuinely decentralised arrangements, the controlling question is whether an identifiable person carries on a regulated activity by way of business: front-ends, interface operators, and parties making arrangements for others are the most likely to fall inside the perimeter, and operators with novel structures should obtain a written perimeter analysis before launch.

Requirements

UK crypto requirements depend on the regime. MLR registration has no minimum capital but demands robust AML systems and controls, beneficial ownership disclosure, fitness testing of key individuals, and a Money Laundering Reporting Officer. The forthcoming FSMA regime adds an own funds requirement that scales by activity (proposed £350,000 for stablecoin issuance), the Senior Managers and Certification Regime, the Consumer Duty, and client-asset safeguarding rules.

Fit-and-Proper and Senior Management

Under the MLRs, the FCA assesses the fitness of beneficial owners, officers, and managers, including the Money Laundering Reporting Officer, as part of registration. Criminal-record and adverse-information checks apply, and the FCA expects the MLRO to have genuine knowledge of UK regulation and of cryptoassets, plus the authority and independence to manage compliance. Under the FSMA regime, the Senior Managers and Certification Regime applies: named senior managers hold statements of responsibility, the certification regime covers staff who can cause significant harm, and the FCA can refuse authorisation where it is not satisfied a firm meets the threshold conditions. The common mistake is treating fitness as a paperwork exercise: the FCA’s assessment weighs prior regulatory history, the substance of UK decision-making, and the quality of the firm’s own due diligence on its people.

Local Presence and Substance

A UK company (typically a private company limited by shares) must have at least one director and a registered office in the UK under the Companies Act 2006; there is no nationality or residence requirement for directors, but substance matters. The FCA expects a registered or authorised firm to have a genuine UK establishment, a UK-based MLRO, and decision-making located in the UK rather than offshore. For tax residence, a company incorporated in the UK is UK tax resident, and central management and control in the UK can make a non-UK company resident too. Experienced applicants treat the MLRO and senior-management appointments as critical-path items and begin sourcing well before lodgement, because thin UK substance is one of the most common reasons for FCA challenge.

AML, Travel Rule, and Sanctions

The AML framework must include a firm-wide risk assessment, customer due diligence and enhanced due diligence, ongoing monitoring, suspicious activity reporting to the National Crime Agency, record keeping, and staff training, all under the Money Laundering Regulations 2017. The UK cryptoasset travel rule has applied since 1 September 2023 under the Money Laundering and Terrorist Financing (Amendment) Regulations 2022: the originating cryptoasset business must collect and transmit originator and beneficiary information on transfers, and the beneficiary business must verify it. Sanctions compliance must cover the UK consolidated list maintained by the Office of Financial Sanctions Implementation under the Sanctions and Anti-Money Laundering Act 2018, and firms serving US-resident customers must additionally screen against US OFAC lists.

Capital and Financial Requirements (FSMA detail)

The FCA’s proposed prudential regime, set out in CP25/14, CP25/15, and CP25/42, sets an own funds requirement equal to the highest of a permanent minimum requirement (PMR), a fixed overhead requirement, and a K-factor requirement.^[8] The proposed permanent minimum requirements are £350,000 for a qualifying stablecoin issuer, £150,000 for a qualifying cryptoasset custodian, £150,000 for operating a trading platform and for staking, and £75,000 for dealing as agent and for arranging deals; where a firm carries out both stablecoin issuance and custody, the higher figure applies. On top of the PMR sit K-factor add-ons such as K-SII (2% of average stablecoin in issuance) and K-QCS (0.04% of average qualifying cryptoassets safeguarded).

For stablecoin issuers, the backing-asset pool must be composed of low-risk, secure, and sufficiently liquid assets, with a minimum proportion held as on-demand bank deposits, held on statutory trust for holders and managed by an unconnected third party. These figures are proposals as of June 2026, not final rules: the FCA expects to confirm them in policy statements ahead of the 25 October 2027 commencement, so operators should budget against the proposed PMR while monitoring the final policy.

Application Process

The UK application process depends on which regime the firm enters. MLR registration runs through the FCA Connect portal and, on observed timelines, takes 9–18 months because the FCA returns applications that do not meet the AML standard. FSMA authorisation runs through the authorisation gateway described under Regulatory Transition above.

Application language: English.

Pre-application engagement: the FCA offers pre-application meetings on the FSMA regime through its Pre-Application Support Service (PASS) from 11 May 2026, with meetings from July 2026, and engages on MLR applications through the registration team. Use the available channels: novel structures benefit most from early FCA contact.

The compliance documentation is the most time-intensive component of any UK application: 8 to 16 weeks of specialist work that cannot be shortcut with generic templates, because the FCA assesses whether the AML, prudential, and safeguarding frameworks reflect the firm’s actual business model rather than an adapted template.

Required Documents

Required documents for UK crypto licensing span four categories: corporate and constitutional documents for the UK entity, personal documents for directors, the MLRO, and beneficial owners, an extensive compliance documentation pack, and a regulatory business plan with financial projections. The FCA accepts lodgement digitally through FCA Connect (MLR) and the FSMA gateway, with all supporting evidence uploaded as part of the structured application.

Corporate Documents

Certificate of incorporation and Companies House registration, articles of association, statement of capital, register of members, register of persons with significant control, and registered-office details. CT registration with HMRC and, where the firm exceeds the threshold or chooses to register, VAT registration. For foreign-controlled entities, FCA controller-approval analysis where the relevant thresholds are met. A UK company must have at least one director and a UK registered office under the Companies Act 2006.

Personal Documents (Directors, MLRO, UBOs)

Certified copies of passports for all directors, the Money Laundering Reporting Officer, and beneficial owners. Disclosure and Barring Service or equivalent criminal-record checks. Adverse-information, bankruptcy, and disqualified-director checks. CVs and evidence of relevant experience for the MLRO and senior managers, including knowledge of cryptoassets and UK regulation. Where an individual has held a regulated-sector role, regulatory references covering conduct under the SM&CR reference requirements.

Compliance Documentation

The compliance documentation is the most heavily scrutinised component of any UK application. Each document must be bespoke and UK-specific, not a template adapted from another jurisdiction, and must reflect the applicant’s specific business model, risk profile, and operational structure. The FCA returns applications where the documentation is generic or does not match the firm’s actual activities.

Business Plan and Financial Projections

A regulatory business plan with financial projections covering revenue, expenses, capital expenditure, and cash flow. Own funds documentation showing compliance with the relevant proposed FSMA requirement (PMR plus K-factor add-ons by activity). Funding evidence (capital injection, parent-company support, or debt). An operating-model description including business lines, customer segments, jurisdictional reach, and growth assumptions.

Technology and Operational Documentation

IT infrastructure description (architecture, hosting, third-party providers). Operational resilience and cybersecurity framework aligned with ISO 27001 or equivalent. Business continuity and disaster-recovery plans. Custody procedures (hot and cold wallet segregation, key management, multi-signature controls) and, for stablecoins, backing-asset safeguarding. Outsourcing arrangements and material service-provider register. Data-protection and incident-response plans under UK GDPR.

Costs and Pricing

UK crypto costs concentrate in professional advisory work, compliance build, and (under the FSMA regime) own funds, rather than government fees. The FCA charges a one-off MLR cryptoasset registration application fee of £2,000 for firms with UK cryptoasset income up to £250,000 and £10,000 above that, non-refundable even if the application fails; FSMA authorisation application fees are set by the FCA fee tariff and depend on the permission applied for. The dominant first-year cost for a stablecoin or custody operator is the proposed own funds requirement of £150,000–350,000, held as regulatory capital rather than spent.

Government / Regulator Fees

Fee note: FCA application and periodic fees are set by the FCA fee tariff and are revised annually; the FSMA cryptoasset fee structure is being confirmed in the FCA’s fee policy statements ahead of the 25 October 2027 commencement.^[12]

Total Cost Summary

The own funds requirement is the largest committed cost under the FSMA regime. A stablecoin issuer holding £350,000 in regulatory capital, plus a K-factor add-on scaling with stablecoin in issuance, ties up capital that earns less than the operator’s cost of capital. For most operators this is a smaller drag than Australia’s AUD 10 million custodial lock-up, but it is real and permanent, and it should be planned into the funding round rather than treated as a working-capital line.

Timeline

Realistic UK timelines diverge by route. MLR registration has run 9–18 months on observed experience, because the FCA returns applications that do not meet the AML standard. FSMA authorisation runs to the published gateway: the application window opens on 30 September 2026 and closes on 28 February 2027, with the regime commencing on 25 October 2027 and a saving provision for in-window applications not yet determined.

The FCA does not publish a fixed service standard for cryptoasset applications equivalent to a statutory clock, and observed MLR timelines have routinely exceeded a year because the assessment is iterative and applications are frequently returned for AML deficiencies. The FSMA gateway changes the dynamic: applying within the window secures a saving provision, so the binding constraint becomes lodging a complete, high-quality application inside that window rather than waiting. In practice, the iteration cycle is driven by AML framework quality and, for FSMA, prudential and safeguarding evidence: each request for further information adds weeks, so the preparation effort, not the regulator’s queue, sets the realistic timeline.

Taxation

The United Kingdom is a standard-rate corporate jurisdiction with settled crypto tax treatment. HMRC treats exchange tokens as property rather than currency: companies pay Corporation Tax on profits and gains, individuals pay Capital Gains Tax on disposals, and the buying and selling of exchange tokens for fiat is exempt from VAT. The main Corporation Tax rate is 25%, with a 19% small profits rate and marginal relief in between.

Crypto Asset Taxation Specifics (HMRC Treatment)

HMRC’s Cryptoassets Manual treats exchange tokens as property, not as currency or money.^[13] For individuals, a disposal (selling for fiat, exchanging one token for another, spending, or gifting other than to a spouse or civil partner) is a Capital Gains Tax event, taxed above the £3,000 annual exempt amount; where activity amounts to a trade, profits are taxed as income with National Insurance. For companies, gains and profits fall within Corporation Tax. Staking and mining rewards are generally taxable as income at market value when received, with later disposals within the gains regime; airdrops attract specific HMRC guidance. The badges of trade determine whether activity is investing or trading.

VAT on Exchange Tokens

The buying and selling of exchange tokens for fiat is exempt from VAT under Item 1, Group 5, Schedule 9 of the Value Added Tax Act 1994, following the Court of Justice of the European Union ruling in Skatteverket v David Hedqvist.^[14] Charges made over and above the value of the tokens for arranging transactions are similarly exempt as financial intermediation. This avoids a double-VAT outcome on crypto trading. VAT continues to apply on the normal principles to goods and services paid for in crypto, and to fees for services that are not exempt financial intermediation.

CARF Reporting

From 1 January 2026, the OECD Cryptoasset Reporting Framework applies in the UK: reporting cryptoasset service providers must collect user information and report transaction data to HMRC.^[7] The first reporting period runs to 31 December 2026, with reports due by 31 May 2027, after which HMRC begins exchanging the data with partner tax authorities. Penalties of up to £300 per user apply for inaccurate, incomplete, or unverified reports, and HMRC has expanded its nudge-letter campaign and voluntary-disclosure facility for undeclared crypto gains.

Pillar Two (Global Minimum Tax)

The UK has implemented the OECD Pillar Two rules through the multinational top-up tax and domestic top-up tax in the Finance (No. 2) Act 2023. The 15% global minimum tax applies to in-scope multinational groups with consolidated revenue of at least EUR 750 million: a threshold unlikely to affect a standalone UK-domiciled cryptoasset firm but relevant to subsidiaries of larger crypto groups.

Ongoing Compliance & Post-Registration

UK registration and authorisation create a permanent compliance infrastructure obligation. MLR-registered firms must maintain their AML systems and controls, file annual reports and the financial-crime data return, operate the travel rule, and report suspicious activity to the National Crime Agency. FSMA-authorised firms additionally face the FCA’s Principles for Businesses, the Consumer Duty, the Senior Managers and Certification Regime, client-asset rules, and regulatory reporting through RegData.

Annual Reporting Obligations

MLR-registered firms submit the annual financial-crime data return and respond to FCA information requests. FSMA-authorised firms submit periodic regulatory returns through RegData (financial, prudential, and client-asset returns), an annual audit, and Consumer Duty board reports. All firms file annual accounts at Companies House and a Corporation Tax return with HMRC, plus, from 1 January 2026, the annual CARF report due by 31 May 2027. VAT-registered firms file periodic VAT returns.

Periodic and Supervision Fees

The FCA charges annual periodic fees set by its fee tariff: a minimum fee plus a variable component scaling with the firm’s activities and income, and FSMA-authorised firms additionally contribute to the Financial Ombudsman Service and, where applicable, the Financial Services Compensation Scheme. Recurring costs typically include the MLRO and compliance salaries (£70,000 to 180,000), annual audit and assurance (£15,000 to 50,000), professional indemnity insurance (£10,000 to 40,000), and technology and monitoring tooling.

Regulatory Supervision

The FCA conducts thematic reviews and targeted supervision, with a documented focus on cryptoasset AML controls, the financial promotions regime, and consumer-facing risk. It uses its information-gathering and skilled-persons powers (section 165 and section 166 of FSMA) and can impose requirements, vary permissions, and pursue enforcement. Firms should maintain audit-ready documentation across all registered and authorised activities, and treat the annual financial-crime return and any skilled-persons review as high-stakes supervisory touchpoints.

Enforcement

FCA enforcement powers include public censure, financial penalties, restitution orders, cancellation of registration or permission, and criminal prosecution. Carrying on a regulated activity without authorisation breaches the general prohibition in section 19 of FSMA, and making an unlawful financial promotion breaches section 21: both are criminal offences, the promotions offence carrying up to two years’ imprisonment, an unlimited fine, or both.^[3] The FCA has publicly warned and taken action against unregistered cryptoasset firms and non-compliant promotions, and it maintains a public warning list of firms operating without the required status.

Operational Resilience and Cyber

FSMA-authorised firms are subject to the FCA’s operational resilience rules: they must identify important business services, set impact tolerances, and be able to remain within those tolerances during severe-but-plausible disruption. Material cyber incidents must be reported to the FCA under Principle 11, and a personal-data breach must be notified to the Information Commissioner’s Office under UK GDPR. Operational resilience and cyber posture should be assessed on launch and reviewed at least annually.

Financial Promotions Rules

The cryptoasset financial promotions regime applies to any invitation or inducement to engage in cryptoasset investment activity capable of having effect in the UK, even from offshore. A promotion is lawful only through one of four routes: an FCA-authorised person, a section 21 approver with FCA permission, an MLR-registered firm complying with the FCA’s rules, or a Financial Promotion Order exemption.^[3] The PS23/6 rules require clear risk warnings, a ban on incentives to invest, a 24-hour cooling-off period for first-time investors, personalised risk warnings, and an appropriateness assessment. Influencer and affiliate marketing has been an active FCA enforcement area: each promotion needs documented compliance against the chosen section 21 route.

Banking

Banking access is the practical bottleneck for UK crypto operators, despite the United Kingdom having one of the deepest banking systems in the world. High-street banks restricted access to crypto businesses through 2023–2025, with several imposing payment limits or declining transactions to crypto exchanges. No statute prevents banking; the constraint is internal bank risk appetite.

The debanking of legitimate businesses became a UK political issue in 2023–2024, and HM Treasury has consulted on requiring banks to give notice and reasons before closing accounts. As of June 2026, however, no rule compels a bank to onboard a particular cryptoasset customer, and access remains a real and ongoing operational risk. Several major UK banks publicly limited card and faster-payment transactions to crypto platforms, citing fraud and AML risk, and some declined cryptoasset business customers outright.

The more reliable counterparties for serious operators are crypto-aware challenger banks and electronic money institutions, fintech-friendly business-banking providers, and specialist banking platforms in adjacent jurisdictions. For an FSMA-authorised custodian or stablecoin issuer, safeguarding and client-money arrangements must meet the FCA’s client-asset rules, which raises the bar on the choice of banking partner and on the legal structure of the accounts.

In practice, the operators that secure UK banking are those that arrive with a complete compliance package, a named UK-based MLRO, and a documented sanctions and CDD framework in production, not those that arrive with a registration certificate and expect onboarding to follow. The 2–6 month banking timeline runs in parallel with the application process for a reason: it is rarely faster. Banking access for UK-licensed crypto entities typically requires demonstrating the same standard of controls a bank would expect of any regulated financial firm.

For an overview of how banking placement works for crypto and high-risk businesses, see the Banking service page.

FATF Status & International Standing

The United Kingdom is a founding member of the Financial Action Task Force and maintains clear standing in the FATF mutual evaluation process. The UK’s most recent mutual evaluation rated it among the strongest AML/CTF frameworks globally, and the FCA’s cryptoasset AML supervision and the cryptoasset travel rule keep the UK aligned with FATF’s virtual-asset standards.

EU Market Access

A UK FCA registration or authorisation confers no MiCA passporting rights, and MiCA contains no third-country equivalence regime that would let the European Commission recognise a non-EU permission as equivalent. MiCA Article 61 permits third-country firms to serve EU clients only when the client initiates contact entirely on their own initiative. ESMA’s Guidelines on reverse solicitation under MiCA (ESMA35-1872330276-2030, published 26 February 2025 and applicable from approximately 27 April 2025) interpret the exemption restrictively.^[15] Any EU-targeted marketing, EU-language website content, geo-targeted advertising, app-store availability, or use of EU-based influencers constitutes solicitation that voids the exemption. The exemption is built for isolated contacts, not systematic EU market access.

For a detailed analysis of what constitutes solicitation and the documentation requirements, see Reverse Solicitation Under MiCA →.

Advantages and Limitations

The United Kingdom offers premium regulatory credibility, a settled tax treatment, a genuine domestic GBP market, and an English common law system; it pays for that in a long and uncertain MLR registration record, a regime mid-transition, and the absence of any EU passport. The trade-offs are clear: choose the UK for the standing of an FCA permission and a UK customer base, not for pan-EU access or speed.

• ✓ An FCA permission carries premium global credibility. Recognised across the Anglophone and institutional market; the FCA’s selective registration (about 17% of determined applications) makes the credential scarce and valuable.
• ✓ A statutory FSMA regime is arriving. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 move the UK from a narrow AML registration to a full conduct and prudential framework from 25 October 2027, with legal certainty across the activity set.
• ✓ Settled tax treatment and VAT exemption. HMRC treats exchange tokens as property, exchange-token sales for fiat are VAT-exempt, and the UK has one of the world’s widest treaty networks.
• ✓ A real domestic GBP market. The UK has one of Europe’s largest crypto-owning populations, giving stablecoin issuers and exchanges genuine demand rather than a brass-plate base.
• ✓ An established financial promotions regime. The marketing rules have been settled since 8 October 2023, so the compliance baseline for reaching UK consumers is well-documented.
• × The MLR registration record is long and selective. Observed timelines run 9–18 months and most applications are withdrawn or rejected. Mitigation: prepare a complete, UK-specific AML package before lodging, and use the FSMA gateway from 30 September 2026 if the objective is to operate after 2027.
• × No EU passporting. A UK registration or authorisation provides no MiCA equivalence or passporting rights to the EU/EEA. Mitigation: operators targeting EU clients should obtain a separate CASP authorisation in an EU member state (full market access via passporting) or, for isolated genuinely unsolicited contacts only, may fall within the narrow reverse solicitation exemption under MiCA Article 61.
• × The regime is mid-transition with no automatic conversion. An MLR registration does not roll into FSMA authorisation, and final FSMA rules are still being confirmed. Mitigation: decide the route early, use the FCA Pre-Application Support Service from 11 May 2026, and budget against the proposed prudential rules while monitoring the final policy.
• × Debanking risk remains material. UK banks have variable risk appetite and have limited or declined crypto business accounts. Mitigation: engage crypto-aware challenger banks and EMIs in parallel, and build banking conversations on a complete compliance package, not a registration certificate alone.

How the UK Compares

The United Kingdom’s natural comparators are the other premium European venues that operators weigh against it: Switzerland (the other major non-MiCA European centre), Malta, and Cyprus (established EU crypto centres under MiCA), with Estonia as the EU cost-leader cross-reference. Each operates under a substantial regulator; the decisive divide is whether the firm needs an EU passport. Malta, Cyprus, and Estonia grant a MiCA CASP authorisation that passports across all 30 EEA states; the UK and Switzerland do not.

Compare every crypto jurisdiction side by side →

Across this peer group, the UK and Switzerland share the premium non-MiCA profile: strong credibility and a genuine market. For operators whose objective is the single market, Malta and Cyprus carry the CASP authorisation at a lower capital and cost base and a shorter timeline than the UK’s registration record, with Estonia the EU cost-leader for the same passporting outcome.

Jagelski & Partners, through its partner network, delivers UK crypto licensing end-to-end: UK company formation, the FCA registration and FSMA authorisation, banking, and post-authorisation compliance, all coordinated in a single engagement. Where the objective is a single-market passport instead, we deliver the MiCA CASP route in Malta, Cyprus, or Estonia just as completely. See the full Malta crypto licensing guide →

When the UK Is the Right Choice

Choose the UK if:

• The standing of an FCA permission is the priority, and the firm is selling to UK banks, asset managers, or institutional counterparties who value the credential.
• The customer base is genuinely UK-resident, so a domestic permission and GBP settlement matter more than an EU passport.
• The firm is issuing a GBP-referenced stablecoin and wants to build to the FCA’s stablecoin and safeguarding rules.
• The operator wants a premium non-MiCA venue deliberately separate from the EU regulatory perimeter.

Consider alternatives if:

• Pan-EU market access is the objective: a MiCA CASP authorisation in Malta or Cyprus passports across all 30 EEA states, which no UK permission can.
• Cost and speed matter: Estonia offers the same MiCA passport at the EU cost-leader end and a shorter, more predictable timeline than the UK registration record.
• The firm wants a premium non-EU venue but with a settled licensing regime today: Switzerland’s FINMA framework is operational now, whereas the UK FSMA regime commences only on 25 October 2027.
• The business is primarily an EU-facing exchange or stablecoin issuer: an EU member-state CASP authorisation is the better natural fit than relying on UK status and reverse solicitation.

Not sure which column is you? Ask Emma. She compares these jurisdictions in seconds, in your language.

Common Mistakes in UK Applications

The FCA’s published guidance and its registration record point consistently to a small set of recurring application errors. The high withdrawal and rejection rate under the MLRs, and the FCA’s perimeter and prudential consultations, flag the same misconceptions. Across the MLR and FSMA tracks, the highest-frequency mistakes cluster around AML quality, perimeter classification, capital, and UK substance.

• Treating MLR registration as a light-touch tick-box. The FCA returns or rejects the majority of applications. The assessment is substantive: it weighs whether the firm-wide risk assessment, CDD, and monitoring genuinely reflect the business, and applications with generic AML frameworks are routinely withdrawn or refused.
• Assuming MLR registration carries over to FSMA. There is no automatic conversion. A firm intending to operate after 25 October 2027 must secure FSMA authorisation through the gateway, and time spent only on MLR registration does not advance the FSMA application.
• Misclassifying the activity against the new perimeter. Operators assume an activity sits outside the FSMA regime when it is in fact custody, dealing, arranging, or staking for UK persons. The FCA’s CP26/13 perimeter guidance is the controlling source, and novel structures (DeFi front-ends, staking-as-a-service, wrapped tokens) need a written perimeter analysis.^[6]
• Underestimating the prudential and safeguarding build. The proposed own funds requirement (up to £350,000 for stablecoins) is the headline, but the surrounding evidence (own funds calculation, K-factor analysis, backing-asset and client-asset safeguarding) is weeks of specialist work that generic templates do not satisfy.
• Generic AML policies adapted from another jurisdiction. The FCA’s assessment is whether the policies reflect the firm’s actual customer base, jurisdictional exposure, and product mix. Policies adapted from a MiCA, MAS, or BVI template attract requests for information and rejection; UK-specific risk-assessment language is required.
• Thin UK substance and an underqualified MLRO. The FCA scrutinises whether the MLRO and senior management are genuinely UK-based and engaged, and whether decision-making sits in the UK. Nominee or pass-through structures attract substance questions during assessment.

Frequently Asked Questions

References