At 9am on 30 September, the Financial Conduct Authority opened its authorisation gateway for crypto firms. It closes on 28 February 2027. Full regulation of crypto activities in the UK begins on 25 October 2027, according to LeapRate's summary of the FCA timetable. The window matters because of what it protects. Existing firms that apply within it can keep providing crypto services, including taking new business, while the FCA assesses their application. Firms that miss it lose that protection. For any exchange, broker or platform serving UK clients, the next five months are now the most important regulatory deadline of the year.
Why the window matters so much
Regulatory transitions are dangerous for firms that are not prepared. When a new regime starts, any firm without authorisation must usually stop regulated activity. The FCA's application window is designed to avoid a cliff edge: firms that apply on time can continue operating while the regulator decides, and the FCA has said it expects to determine applications submitted in the window before the regime takes effect.
That makes the deadline effectively the real start date. A firm that applies in March 2027 may still be authorised eventually, but it will not have the right to continue operating in the meantime if the regime starts before a decision. For businesses with UK revenue, that risk is too large to accept.
Authorisation is not automatic. The FCA will assess applicants on consumer protection, safeguarding of client assets, market integrity and financial resilience. Firms that do not meet those standards will not be authorised and cannot offer regulated crypto services in the UK. Applying is the minimum; passing is the goal.
The FCA has also warned that it expects a surge of applications late in the window. Firms that apply in the final weeks may face slower reviews and more questions, simply because of volume. Applying early gives more time to respond to queries and correct gaps before the regime begins.
What the FCA will look for
The four assessment areas map directly onto the failures that have hurt crypto users in recent years. Consumer protection covers how firms market products, disclose risks and treat customers. Safeguarding covers how client assets are held and separated from the firm's own money, the issue at the heart of several exchange collapses. Market integrity covers manipulation and abuse. Financial resilience covers whether a firm can survive stress without harming customers.
Recent events give each area urgency. Bitget lost about 388 million dollars to hackers in September, a reminder of operational risk. Several exchanges have closed this year as volumes fell and costs rose. The FCA will want evidence that applicants can protect clients through both kinds of shock.
The FCA has also been active on enforcement while building the regime. In September it acted against unlicensed peer-to-peer crypto operations in London alongside tax authorities and police, which we covered in our report on the London raids. The message is that the authorised market will be protected, and the unauthorised one will be pursued.
Safeguarding is likely to be the most demanding area. Firms must show clearly how client assets are held, who controls the keys or accounts, how assets are reconciled and what happens if the firm fails. Vague answers about custody arrangements, or reliance on third parties without proper oversight, are likely to cause problems.
- Gateway opens: 9am, 30 September 2026
- Gateway closes: 28 February 2027
- Full regime starts: 25 October 2027
- Assessment areas: consumer protection, safeguarding, market integrity, financial resilience
- Applicants in the window can continue operating pending a decision
Who needs to apply
The regime covers a broad range of crypto activities, from operating trading platforms and providing custody to dealing and arranging deals in cryptoassets. Firms can apply for new authorisation or, if they already hold FCA permissions for other activities, for a variation of their existing permission. That second route matters for traditional brokers that offer crypto alongside forex, CFDs or shares.
Overseas firms serving UK clients need to think carefully. The UK, like the EU, is tightening how it treats foreign firms that serve local customers without authorisation. The European debate over Binance's use of the reverse solicitation exemption shows how regulators view firms that try to serve clients from outside the perimeter. UK-facing firms should assume that operating without authorisation after October 2027 will carry significant risk.
For firms already registered with the FCA under existing anti-money laundering rules, the new regime is a step up. Registration focused mainly on financial crime controls. Authorisation covers the full range of conduct and prudential standards, which will require more capital, more governance and more documentation.
Firms should also consider marketing rules. The UK already restricts how cryptoassets can be promoted to consumers, with requirements on risk warnings and cooling-off periods for first-time investors. Authorised firms will be expected to meet those rules consistently, and past breaches could count against an application.
What it means for Asian firms with UK clients
Many crypto and brokerage firms headquartered in Asia serve UK clients, often through international entities. The UK regime forces them to choose: obtain authorisation, which may require a UK presence and significant investment, or stop serving UK clients by October 2027. For firms with meaningful UK revenue, the choice must be made in time to apply by February.
For Asian regulators, the UK timetable offers a useful reference point. Clear application windows, defined assessment standards and continuity protection for timely applicants reduce disruption. Regions designing their own regimes, from Vietnam's pilot to Thailand's tightening rules, can learn from how the UK manages the transition.
Some Asian firms may decide the UK is not worth the cost. Authorisation requires capital, governance, local expertise and ongoing compliance. Firms with small UK client bases may choose to exit rather than invest. Those decisions need to be made early, so that clients can be notified and assets returned in an orderly way well before October 2027.
Firms that stay should start client communications early, explaining what authorisation means for them and whether terms or products will change.
The application deadline is effectively the real start date.
How the UK compares with Europe
The UK regime arrives after the European Union's MiCA framework, which required unlicensed firms to begin winding down EU activity from 1 July 2026. The two systems share goals, including consumer protection and safeguarding, but they differ in detail. Firms operating in both markets will need separate authorisations and will face different documentation and capital requirements.
The UK's transitional approach is more forgiving than the EU's in one respect: firms that apply on time can keep operating during assessment. Under MiCA, the transition periods varied by country and some firms found themselves forced to wind down while waiting for decisions. The UK's single application window and continuity protection give firms more certainty.
Europe's experience with Binance also shows what happens when a major firm fails to secure a licence. Regulators are now questioning how it continues to serve EU customers under the reverse solicitation exemption. UK-facing firms should take the lesson seriously and apply properly rather than relying on exemptions.
How to prepare an application
Firms should start with a gap analysis against the four assessment areas, identifying where current practices fall short. Safeguarding arrangements, governance structures and risk management frameworks usually need the most work. Engaging advisers early and allowing time for internal approvals will avoid a rush in February, when the FCA is likely to receive a surge of applications.
Firms should also prepare for questions about their business models. The FCA will want to understand how firms make money, how they manage conflicts of interest and how they protect clients when markets move sharply. Clear, honest answers, backed by documentation, make the review faster and reduce the risk of rejection. For firms with UK revenue, the planning should begin this week rather than next quarter.
When does the FCA crypto authorisation gateway close?
The gateway opened at 9am on 30 September 2026 and closes on 28 February 2027.
When does full UK crypto regulation begin?
Full regulation of cryptoasset activities in the UK begins on 25 October 2027.
Can firms keep operating while the FCA assesses them?
Existing firms that apply within the window can continue providing cryptoasset services, including new business, while their application is assessed.
What will the FCA assess?
The FCA will assess applicants on consumer protection, safeguarding of client assets, market integrity and financial resilience.
The UK has spent years debating how to regulate crypto. The debate is over, and the timetable is fixed. For firms that want to serve UK clients after October 2027, the work starts now, and the deadline that matters is not the regime's start date but 28 February 2027. Those that apply early and well will gain a licence that becomes a competitive advantage. Those that wait may find the door closed.
Speak with the SpinDepth desk
