FCA Gateway Opens Sept 30: The UK Crypto Licence Countdown

The application window is fixed, it lasts five months, and it does not reopen. Miss it and you can service existing contracts and nothing else. Here is exactly what is in scope, who is caught, and what happens to firms that assume their AML registration carries them through.

THE THREE DATES THAT MATTER

30 September 2026 — the FSMA authorisation gateway opens. The application form goes live in the FCA’s online system.

28 February 2027 — the application period closes. Five months, fixed.

25 October 2027 — the new regime commences. From this date, carrying on in-scope activities without the right permission breaches the FSMA general prohibition.

In 26 days the United Kingdom opens the most consequential crypto licensing window in its history, and a striking number of firms serving UK customers have not started preparing.

The FCA published the bulk of its final rules on 30 June 2026 across a package of policy statements covering trading platforms, custody, stablecoin issuance, lending, borrowing, staking, prudential requirements and market abuse. On 8 July it published a preview of the application form. The pre-application support service has been running meetings since July.

Everything is now in place except the applications. And the practical warning from advisers is consistent: preparing a complete application can easily take three months or longer.

The assumption that will catch firms out

If you take one thing from this piece, take this: registration under the Money Laundering Regulations does not convert into FSMA authorisation. There is no automatic transfer and no expedited path.

The FCA has been unambiguous. Firms currently registered under the MLRs will need to obtain authorisation under FSMA. Firms already authorised under FSMA for other activities will need to apply for a variation of permission. Firms authorised or registered under the Payment Services Regulations 2017 or the Electronic Money Regulations 2011 face the same requirement.

AML registration shows you passed one set of checks. It gives very limited comfort at the new permission gate.

This is a genuine break in the perimeter. Being inside today’s AML regime and being permitted to conduct regulated cryptoasset activities from October 2027 are two different legal positions, and one does not lead to the other.

A related detail that is easy to miss: the provisions allowing MLR-registered cryptoasset firms to approve their own financial promotions are being removed. They were always intended to be temporary.

What is actually in scope

The legislation creates a defined set of new regulated activities. If your business does any of these by way of business with UK customers, you are in scope.

Three perimeter traps worth knowing

• Staking: the line is intermediation, not technology. Managing the end-to-end staking lifecycle, pooling customer assets to meet validator thresholds and distributing rewards are in scope. Operating a validator node or offering solo staking tools without further involvement is unlikely, on its own, to amount to arranging staking.

• Liquid staking: providing a liquid staking token in exchange for a staked cryptoasset is more likely to be treated as dealing than as arranging staking. If the same firm also arranges the underlying staking, it needs both permissions.

• No technical services exclusion for arranging. There is a technical services carve-out for the staking activity. There is no equivalent exclusion for arranging deals. Firms that assume “we only provide software” will want to test that assumption against the substance of what they do.

The overseas question: you probably need a UK entity

This is the section that matters most to non-UK platforms, and it is stricter than many expect.

The overseas persons exclusion, which allows firms outside the UK to conduct certain regulated activities without authorisation, is not available for any cryptoasset regulated activity. Section 418 of FSMA also contains deeming provisions that will treat certain overseas activity as carried on in the UK — including overseas persons safeguarding for UK consumers.

The FCA set out its Approach to International Cryptoasset Firms in FG26/7. The baseline expectation is that firms requiring authorisation will have a presence in the UK and will carry out their regulated cryptoasset activities from a UK legal entity. There is a narrow exception where an overseas firm may serve UK customers through a UK branch as a QCATP operator — and even then the FCA expects the home regulator to have comparable levels of regulatory protection and requirements, as determined by the FCA.

There is also a structural trap for stablecoin issuers. Where all elements of the issuing activity are carried out in the UK on behalf of an overseas person, that overseas person is treated as carrying on the activity in the UK and requires FCA authorisation. That has real implications for cross-border group structures.

What happens if you miss the window

This is the part firms consistently underestimate. The consequences are not “apply later”.

Read the middle row again. A firm that misses the window does not get a quiet wind-down period during which it keeps serving its book. It gets a run-off. No new contracts with anyone, including customers it already has. For a business built on repeat transactions, that is functionally a UK exit.

What the FCA is actually assessing

The gateway is not a form-filling exercise. It is a full authorisation process, and the application form combines the standard information required from most FSMA applicants with activity-specific modules — stablecoin issuance, safeguarding, staking, lending and borrowing, intermediation and operating a trading platform — built around the activities and customer types each applicant selects.

Expect to evidence:

• Threshold Conditions. A gap analysis against them is the standard starting point advisers recommend.

• Governance, accountability and Senior Managers and Certification Regime arrangements.

• Prudential resources. The FCA introduced a Core Prudential sourcebook and a Cryptoassets Prudential sourcebook; notably it reduced the stablecoin issuance operational-risk K-factor from 2% to 1% after consultation.

• Custody and safeguarding controls, including segregation and control of the means of access.

• Market abuse surveillance where relevant, under the dedicated cryptoasset market abuse regime.

• Operational resilience, systems and controls, complaints and redress, and a credible wind-down plan.

One useful signal on the FCA’s posture: it softened several proposals after consultation. Alongside the prudential change, UK-issued qualifying stablecoins were removed from the restricted mass market investment category, though the Consumer Duty still applies, and the staking rules were amended to avoid unintended restrictions on auto-staking arrangements by allowing consent to cover ongoing staking of current and future holdings subject to conditions. This is a regulator that has been willing to move on workability while holding the architecture firm.

Non-UK stablecoins can circulate in the UK if they meet FCA standards, and the FCA has confirmed plans to consult further on DeFi and on financial crime guidance for cryptoasset firms. Separately, the Bank of England and FCA published a joint approach paper on regulating systemic stablecoin issuers, setting out how responsibilities split and when dual supervision would apply.

A 26-day starting checklist

1. Decide whether the UK is strategic. This is a genuine commercial filter. Authorisation means documentation, governance work, capital and ongoing supervisory exposure. Some firms will rationally conclude the UK is not worth it — but that decision should be made deliberately, not by missing a date.

2. Map your activities against the six regulated activities, using substance rather than how you describe your product. Pay particular attention to staking, liquid staking and anything that might constitute arranging.

3. Resolve your legal entity structure. If you are overseas and expect to serve UK customers, assume a UK legal entity is required unless you fit the narrow QCATP branch exception.

4. Sort MLR registration where applicable. The FCA has advised getting this in order ahead of the FSMA application.

5. Book a pre-application meeting through PASS. Those engagements are most effective where firms arrive with well-developed proposals, identified implementation challenges and specific questions — not a blank sheet.

6. Run the Threshold Conditions gap analysis and start remediation now. Three months of preparation from a standing start puts you at the back of the queue, not outside the window.

The bigger picture

Step back and the timing is striking. MiCA became fully enforceable across the EU on 1 July 2026. The UAE has built out a defined federal licensing framework alongside VARA. And the UK gateway opens on 30 September.

Meanwhile the United States still has no statutory registration regime for spot digital commodity markets, with market structure legislation facing a difficult Senate vote in mid-September.

Three of the four major Western jurisdictions are now handing out licences you can actually apply for. That is a meaningful shift in where serious crypto businesses will choose to domicile over the next two years — and the UK window is the one with a hard closing date.

Important

This article is general information about a developing regulatory regime. It is not legal, regulatory or compliance advice, and it is not a substitute for reading the FCA’s policy statements, finalised guidance and the underlying legislation. Rules and dates may change. Firms should take qualified professional advice on their own circumstances before making authorisation decisions.

Sources

FCA policy statements and guidance published from June 2026, FCA gateway operating guidance and FG26/7, the FSMA (Cryptoassets) Regulations and accompanying explanatory memorandum, plus analysis from BCLP, Fox Williams, Travers Smith, Freshfields, Farrer & Co, Hogan Lovells, Complyport, CryptoUK and CryptoSlate.

Bitnxt tracks licensed exchanges, custodians, stablecoin issuers and crypto service providers across the UK, EU, UAE and US. Explore the directory at bitnxt.io.