Buying crypto in the UK has so far meant dealing with firms that were not under full Financial Conduct Authority regulation. That is about to change, and the first formal step has already been taken.
In this article we will explore what the FCA has opened, the dates that firms and holders need to know, how the authorisation test works, and the practical checks that help keep your money and your records in order.
The Gateway Is Open and the Dates Are Fixed
The Financial Conduct Authority opened its application gateway for UK crypto firms on 30 September 2026. The gateway is the formal route by which a business asks the regulator for permission to keep serving UK customers once the new rules apply. Firms that intend to keep operating in the UK must apply by 28 February 2027, and the regime itself comes into force on 25 October 2027. The FCA published its final crypto rules and guidance in June 2026, so applicants are not guessing at the standards they will be judged against.
For ordinary holders, the headline is easy to state. The FCA says that, for the first time, crypto firms operating in the UK will come under full FCA regulation, and that this gives consumers protections they have not had before. Dominic Cashman, the FCA’s Director of Authorisation, said: “The UK’s new crypto regime will give consumers greater protections and firms a clear framework to operate in.” Nothing in that statement means your holdings change overnight, and nothing in the announcement tells you which individual firms will succeed.
Application Window
Between the opening of the gateway and the February 2027 deadline there are roughly five months (simple arithmetic from the two dates). Firms that want to talk to the regulator before they submit can request a pre-application support meeting. That is a sensible step for any business whose structure is unusual, because a badly prepared application costs time that a firm in this position may not have.
The deadline is aimed at businesses, not customers. You do not have to apply for anything, sign anything or move any coins because of it. What the deadline gives you is a point in the calendar at which a firm should be able to tell you whether it has applied, which is a fair question to put to any provider you use.
Run-Up to October 2027
From the end of the application period to the start of the regime on 25 October 2027 there are about eight months (again simple arithmetic). The FCA says it expects to decide applications before the regime comes into force, so that period is the assessment phase. Regulators rarely work through a large batch of complex files at speed, and readers should not be surprised if some outcomes arrive close to the start date.
| Date | What happens | Who it matters to |
| June 2026 | FCA publishes final crypto rules and guidance | Firms preparing applications |
| 30 September 2026 | Application gateway opens | Firms |
| 28 February 2027 | Deadline to apply for firms intending to keep operating in the UK | Firms, and their customers indirectly |
| 25 October 2027 | New regime comes into force | Firms and every UK holder |
Four Tests Decide Whether a Firm Is Authorised
Authorisation is not guaranteed. The FCA has been explicit that firms must show they meet its requirements, and that those which cannot will not be authorised to operate in the UK market. According to the regulator, applicants are assessed on four broad themes: consumer protection, safeguarding of customer assets, market integrity and financial resilience. Each of those is worth translating into plain language, because they describe the things that tend to go wrong when a crypto business fails.
Consumer Protection
Consumer protection covers how a firm treats the people who use it. In general terms that means clear information about costs and risks, fair handling of complaints and honest descriptions of what a product does. A business that hides charges in small print or makes a risky product sound like a savings account would be failing this kind of test. The detailed rules are in the FCA’s published material, and readers who want to see how a particular provider is expected to behave can read them there.
Safeguarding of Customer Assets
Safeguarding is the idea that the coins and cash you entrust to a firm must be kept safe and kept distinct from the firm’s own money. In general terms, a well-run provider keeps accurate records of who owns what, separates customer holdings from company funds, and has controls over who can move assets and how. The reason this matters is simple: if a firm gets into trouble, customers need their property to be identifiable and returnable rather than tangled up in the firm’s own debts.
Please do not read more into this than the regulator has said. The announcement does not describe any compensation arrangement, and this article does not promise one. Whether a particular loss would be covered by any scheme is something to check with the firm and the official bodies, not to assume.
Market Integrity
Market integrity is about whether trading is fair and orderly. Rules in this area aim to discourage manipulation and the misuse of inside information, and to make sure that venues have sensible systems for monitoring what happens on them. For a holder, the benefit is indirect but real: prices on a well-supervised venue are less likely to be distorted by tricks that ordinary customers cannot see.
Financial Resilience
Financial resilience asks whether a firm has the money and the planning to survive a bad period and, if necessary, to close down in an orderly way. A business that depends on a single funding source, or that has no plan for a run of withdrawals, is a risk to its customers however friendly its app looks. This is the test that most clearly separates a serious exchange from a start-up with a marketing budget.
Existing Firms Can Keep Trading While the FCA Decides
One feature of the regime is easy to miss and matters a great deal in practice. According to the FCA, existing firms that apply during the application period can continue offering cryptoasset services while their application is assessed, including taking on new business, if no decision has been made before the new regime starts. The point is to stop a backlog of applications from forcing perfectly capable firms to switch off on the first day.
That arrangement should be read carefully. Applying is not the same as being authorised, and nothing the regulator has published says that a firm in the queue has passed any test. It means only that the firm is allowed to carry on while the FCA works through its file. A provider that markets itself as “authorised” when it has merely applied would be giving customers the wrong impression, and you are entitled to ask which of the two applies.
The other side of the arrangement is the fate of firms that miss the deadline. The announcement says firms that intend to keep operating in the UK must apply by 28 February 2027, and nothing in it suggests that late applicants will receive the same breathing space. If a platform you use has gone quiet about its plans, treat that silence as information. A business that is confident of its position usually says so.
For exchanges, the practical message is to plan early. A platform with a large customer base also has to think about communication: customers will want plain answers about timing, about what happens if the outcome is a refusal, and about how withdrawals would work in that case. The firms that publish those answers before they are asked usually earn more trust than those that wait for a rumour to circulate.
On the planning itself, compliance staff, legal advice, governance documents and financial projections all take time to build, and the deadline leaves less room than it first appears once the pre-application stage is included. For holders, the message is to keep an eye on what your provider says in the coming months and to compare it with what the public register shows.
Regulated and Unregulated Crypto Firms Offer Different Footing
The difference between a regulated and an unregulated business is not that one is safe and the other dangerous. It is that a regulated firm has agreed to meet written standards, accepts supervision, and can be questioned and, if necessary, disciplined by a public authority. An unregulated firm has made no such promise, so everything depends on its own honesty and competence, and you have fewer places to turn if something goes wrong.
Even so, regulation does not remove investment risk. The FCA’s regime is about how firms operate, not about what crypto assets are worth, and prices can fall as fast as they rise whatever the status of the platform you used to buy them. A fully authorised exchange can still list a token that collapses. Authorisation tells you something about the firm; it tells you nothing about whether a purchase will make or lose money. Anyone who treats a regulator’s stamp as a reason to put in more than they can afford to lose has misread what it is for.
It is also wise to be careful about what you assume regarding compensation and complaints. The facts published with the announcement do not set out what redress rights a customer would have, and this article does not claim any. If a provider tells you that you are “fully protected”, ask in writing what exactly is protected, against what, and under which scheme, and keep the reply.
During the transition, expect a mixed picture, and expect your provider to say more about its plans as the dates draw nearer. Some firms will be able to say they have applied and are waiting, some will say nothing, and a few will announce that they are leaving the UK market. None of those is automatically a warning sign, but each deserves a few minutes of checking before you add more money.
Checking a Firm on the FCA Register Before You Deposit
The most useful single habit for a UK crypto user is to look a firm up on the Financial Services Register, which is the FCA’s public database of firms and individuals. Do it before you deposit, not afterwards, and repeat the check from time to time because status can change.
Look the Firm up by Its Legal Name
Start with the full legal name of the company, which is usually in the footer of its website or in its terms and conditions, rather than the brand name on the app. Search the register for that name and compare the address, the permissions listed and the reference number with what the firm tells you. If you cannot find a legal entity name at all, that is a poor sign in itself.
Read the Entry Itself
Registers record different things for different firms, and the wording matters. A firm may be on the register for one activity and not for another, so look at the listed permissions instead of stopping at the word “authorised”. During the build-up to the new regime, check how the register describes the firm’s status and read any notes, since the register is the place to learn the difference between a firm that has applied and one that has been given permission.
Contact the Firm Through Details From the Register
If a firm gets in touch with you, do not reply using the phone number or link in its message. Find the contact details on the register or on the firm’s established website and call from there. Clone businesses copy real firm names and numbers, and the register is the way to catch them out. If something looks wrong, the FCA publishes warnings about unauthorised firms, and it is worth reporting what you saw.
Firms themselves should expect scrutiny of how they describe their status. A business that implies it is authorised before it is, or that suggests the regulator endorses its products, is making a claim customers will rely on. Customers who spot such wording can raise it with the firm first and, if the answer is unsatisfactory, with the FCA. Keeping a screenshot of the original wording and the date helps if you later need to show what you were told.
Scams Will Try to Borrow the Regulator’s Credibility
Every large change in financial regulation brings a wave of fraud that uses the change as bait. Expect messages along the lines of “register now before the deadline”, “your wallet must be verified under the new law” or “claim your protected status”. None of those reflects a step an ordinary holder has to take. The deadline in February 2027 applies to firms, not to you.
The oldest warning sign still works: guaranteed returns. No lawful provider can promise a fixed profit from a volatile asset, and anyone who does is either mistaken or lying. Treat promises of daily percentages, “risk-free” trading bots and unusually generous referral rewards the same way. If a stranger on a messaging app, a dating site or a social network is steering you towards a crypto platform, stop and tell someone you trust before you send anything.
Clone firms deserve a separate warning. A scammer may copy the name, logo and even the registration details of a real authorised business, then direct victims to a lookalike website. Defences are mundane but effective: type the address yourself rather than following a link, confirm the contact details on the register, and never allow a caller to guide you through installing software on your phone or computer.
Social media adds its own twist. Paid adverts, cloned profiles of well-known figures and fake testimonials can make a poor platform look established, and a large follower count proves nothing. Before you trust a promotion, look the firm up on the register, search for its legal name alongside the word “scam”, and notice whether it pressures you to act quickly. Established businesses can wait while you check; fraudsters cannot.
There is also the recovery scam, aimed at people who have already lost money. A stranger offers to retrieve your funds for an upfront fee, often claiming to work with the regulator. Regulators do not cold-call victims to demand payment, and a request for money before help is delivered is the giveaway. Never share recovery phrases, passwords or one-time codes with anyone, whoever they say they are.
Custody Choices: Leaving Coins on an Exchange or Holding Them Yourself
The new regime makes it a good time to think about where your coins are held. Broadly there are two models, and each has a different failure mode. The table below summarises the trade-offs in general terms.
| Approach | What you rely on | Main risk | Worth checking |
| Holding on an exchange | The firm’s systems, controls and honesty | The firm fails, is hacked or loses its permission | Its status on the register, how it describes safeguarding |
| Holding in your own wallet | Your own care with keys and backups | Lost keys, theft, mistakes sending to wrong addresses | Backups stored safely and separately |
| A mixture | Both, in different proportions | Complexity, and mistakes in moving between the two | Small test transfers before large ones |
Keeping Assets With an Exchange
Leaving assets with a platform is convenient, and for someone who trades often it is the only practical option. The cost is that you are trusting the firm with custody. Safeguarding rules exist to make that trust less blind, but they do not remove it. Reasonable precautions include turning on every available security feature, using a unique password that you do not use elsewhere, and not keeping more on a platform than you would be comfortable having delayed if it ran into trouble.
Holding Coins Yourself
Self-custody puts you in sole charge, which is both its strength and its weakness. Nobody can freeze your coins, but nobody can reset your password either. If you lose the recovery phrase for a wallet, there is normally no helpline that can restore access. Anyone moving to self-custody should practise with a small amount first, write down recovery details offline, and store copies in more than one safe place.
Keeping Records for Tax
Whichever route you choose, keep records, and keep them in a form you can read years from now. A simple spreadsheet with one row per transaction does the job, and it is worth saving screenshots or exported files from each platform alongside it. For each purchase, sale, swap, transfer and fee, note the date, the asset, the amount and the sterling value at the time. Exchanges can close or change their reporting tools, so downloading your transaction history regularly, while the platform still operates, is better than hoping to retrieve it later. HMRC sets the tax rules separately from the FCA, and a tax adviser or HMRC’s own guidance should be your source on how any gain or loss is treated.
Final Thoughts
Nobody needs to act in a panic. The dates are far enough away that a measured sequence works well, and the steps below are general ideas rather than advice on your own money, which a regulated professional can discuss with you.
First, list where your crypto sits today: which exchanges, which wallets, roughly how much in each. Many people find they have forgotten an old account, and old accounts are where weak passwords and neglected email addresses cause trouble. Second, look each provider up on the register and note what it says. Third, read what each firm has told customers about its plans for the new regime, and note which have said nothing.
Fourth, download your transaction history and store it securely. Fifth, decide on a custody mix that matches how you use crypto and how comfortable you are with the risks of each model. Sixth, think about concentration: holding everything with a single provider, or in a single token, puts all your eggs in one basket, and the sensible response is to avoid relying on any one firm or asset for more than you could afford to lose. Crypto remains a high-risk area, and none of this is a recommendation to buy or sell.
If a provider you use does not get authorised, the FCA’s statement that such firms will not be able to operate in the UK market is the signal to act. Withdraw in good time, using the provider’s normal process, and avoid leaving it to the last day, when queues and technical problems are likeliest. Do not trust any message telling you to hurry or to move funds to a “safe” address supplied by a stranger.
| Stage | Sensible check | Notes |
| Now to February 2027 | Inventory accounts, check the register, download records | No action is required of customers by the application deadline |
| March to October 2027 | Watch what your provider says; recheck the register | Applications are being assessed; status may change |
| Around 25 October 2027 | Confirm your provider’s status again | Firms that cannot be authorised will not be able to operate in the UK market |
| If a firm exits | Withdraw in good time through the official process | Beware of scam messages offering to help |
Frequently Asked Questions
How Do I Check if a Crypto Exchange Is Authorised by the FCA?
Search the Financial Services Register for the firm’s full legal name and compare the reference number, address and listed permissions with what the firm shows you. Contact the firm only through details you have found yourself. Check again from time to time, since status can change.
When Does the New UK Crypto Regime Come Into Force?
The FCA says the regime comes into force on 25 October 2027. Firms that intend to keep operating in the UK must apply by 28 February 2027, and the gateway opened on 30 September 2026.
Can Crypto Firms Keep Operating While the FCA Reviews Their Application?
According to the FCA, existing firms that apply during the application period can continue offering cryptoasset services, including taking on new business, while the application is assessed, if no decision has been made before the regime starts. Applying is not the same as being authorised.
Does FCA Authorisation Protect Me From Losing Money if Prices Fall?
No. Authorisation concerns how a firm is run, such as how it protects customer assets and handles risk, not what a crypto asset is worth. The announcement does not describe any compensation arrangement, so do not assume one exists.
Should I Move My Crypto off an Exchange Before the 2027 Deadline?
There is no general rule, and nobody has to move anything because of the deadline. It makes sense to check your provider’s status, keep records and avoid leaving more with any one firm than you could cope with losing. If a firm is clearly not going to be authorised, withdraw in good time.
Who Has to Apply to the FCA for Crypto Authorisation?
Firms that intend to keep operating in the UK crypto market must apply by 28 February 2027. Individual customers do not apply for anything.
