Introduction

Following major incidents such as the collapse of FTX in 2022 (affecting c. 80,000 UK consumers) and UK reports showing a 55% jump in crypto related scam losses in 2025, the UK is ushering in a new regime to regulate cryptoassets. Law-enforcement agencies and the FCA are already taking action, and a strict new compliance and enforcement framework is on the horizon.

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (the Regulations) and the FCA's Cryptoasset Market Abuse Regime policy (MARC) come into full force on 25 October 2027. The two work hand-in-hand: the Regulations define the scope of the regulated activities involving "qualifying cryptoassets" and create various prohibitions and criminal offences, whilst MARC provides guidance on how businesses must comply in practice.

This article explains the scope of the new regime, the compliance obligations it imposes, the consequences of non-compliance, and the steps affected businesses should take now. With the FCA’s authorisation gateway closing on 28 February 2027 and no grace period thereafter, preparation is time-sensitive.

Scope of the new rules

What is a "qualifying cryptoasset" for the purpose of the new rules?

The Regulations define a "qualifying cryptoasset" as a cryptoasset that is (a) fungible, (b) transferable, (c) not solely a record of value or contractual rights, and (d) not one of several specific exclusions (for example, electronic money or something that can only be used by the holder to acquire goods or services from the issuer). So, popular cryptoassets such as Bitcoin, Ethereum and Solana are caught by the Regulations, but gift vouchers and reward credits such as Tesco club points are not.

What activities are caught?

The Regulations require businesses to obtain prior authorisation from the FCA before carrying out a wide range of regulated activities involving qualifying cryptoassets. This includes issuing qualifying stablecoin (in essence, a cryptoasset pegged against a particular fiat currency), safeguarding, dealing in and arranging deals (as agent or principal) involving qualifying cryptoassets, and operating a qualifying cryptoasset trading platform. There are, however, a number of exceptions that businesses can rely on in specific circumstances, including various group activity and temporary settlement exclusions, as well as exclusions to enable parties to communicate about a transaction and activity incidental to professional services.

In addition, although they do not require prior FCA authorisation, a range of designated activities are subject to FCA rules, prohibitions and enforcement. This includes offering a qualifying cryptoasset to the public in the UK and admitting a cryptoasset to trading on a trading platform, as well as communicating and disclosing information relating to those activities.

Accordingly, a wide range of businesses are affected, from those that one might expect to be regulated, such as crypto exchanges and trading platforms, to those that are perhaps less obvious, such as brokers, dealers, arrangers and other intermediaries, and traditional financial institutions.

Enforcement action is already moving beyond traditional crypto exchanges. In 2026, the FCA, HMRC and the South West Regional Organised Crime Unit conducted an operation targeting suspected illegal peer-to-peer crypto trading at eight premises. The evidence obtained during the operation is supporting a number of ongoing criminal investigations.

The FCA continued demonstrating its willingness to take enforcement action in this area in February 2026, when it commenced legal proceedings against cryptoasset exchange HTX (formerly Huobi) in relation to alleged unlawful financial promotions to UK consumers, despite having previously warned the firm about its conduct.

What new obligations do businesses face?

For businesses engaging in regulated activities, the Regulations require various procedures and systems to be in place, many of which the FCA will expect to see before granting authorisation. This includes implementing appropriate systems and procedures to prevent, detect and disrupt insider dealing and market manipulation, drawing up insider lists which must be maintained and provided to the FCA on request, and setting up internal whistleblowing procedures through an independent channel. Notably, the Regulations provide safe harbour for employees reporting suspected market abuse to a nominated officer, which overrides contractual confidentiality obligations, provided certain conditions are met.

Businesses will also need to keep a watchful eye on the ongoing obligations imposed by the Regulations, such as requiring businesses to share certain information, such as inside information, with other authorised persons and the public in order to detect, prevent and disrupt market abuse.

What are the potential consequences of non-compliance?

Breach of the Regulations carries the risk of criminal prosecution, which may result in imprisonment or substantial fines. The Regulations work alongside other legislation such as the Crime and Policing Act 2026 to extend corporate criminal liability. These risks are not purely prospective. As discussed above, the FCA and law enforcement agencies are already taking enforcement action against cryptoasset businesses and individuals under the existing regulatory and criminal framework. If a senior manager acting within the scope of their authority commits an offence under the Regulations, then the business also commits that offence.

A business that carries on a regulated activity without authorisation may be subject to a fine and individuals responsible for the offending conduct can also be imprisoned for up to two years. Market abuse offences, such as insider dealing, also carry heavy penalties, including fines and up to ten years' imprisonment.

Significantly, similar to the Bribery Act 2010, for purpose of the Regulations, it is immaterial where the market manipulation is carried out, giving the Regulations some extraterritorial effect, reflecting the often international nature of crypto transactions.

Recent enforcement activity illustrates the increasing focus on cryptoasset-related crime. In November 2025, the Serious Fraud Office launched an investigation into the collapse of the US$28 million Basis Markets cryptocurrency scheme, its first major cryptocurrency investigation. Two individuals were arrested on suspicion of fraud and money laundering following searches in London and West Yorkshire.

But, imprisonment and fines are not the only consequence of breaching the Regulations. Breaching the Regulations can also have a major reputational impact for a business and individuals. The FCA can impose formal public censures and individuals can be banned from carrying on regulated activities. Other non-monetary remedies, such as injunctions to freeze assets, can have a significant impact on day-to-day business. In addition to fines, the FCA can impose restitution orders for disgorgement of any profits to compensate victims.

Steps that affected businesses should take now

The Regulations are complex. Getting it wrong can have serious consequences. Businesses should consider obtaining legal advice on whether they are carrying on any activities that will soon be subject to the Regulations, and consider whether they need to obtain authorisation for regulated activities. Ahead of the new regime commencing on 25 October 2027, the FCA's authorisation gateway will open on 30 September 2026 and close on 28 February 2027.

Businesses that have not applied by the gateway deadline cannot rely on transitional provisions designed to enable businesses to carry out regulated activities while the FCA considers their application. Importantly, there is no grace period. Businesses that have not applied for authorisation by the deadline will face criminal liability from day one if they carry out regulated activities (even if they were carrying out those activities prior to the new Regulations coming into force). Those businesses will have to wait for their application to be determined by the FCA before resuming regulated activities.

Businesses thinking of making an application to the FCA should also consider legal advice on setting up the various safeguards and processes required under the Regulations, including assistance with building surveillance and whistleblowing systems, designating nominated officers, and creating insider lists.

The message is clear: businesses that delay risk criminal liability from the moment the new regime takes effect on 25 October 2027. With the FCA's authorisation gateway closing on 28 February 2027, there is a narrow window in which to apply, and no grace period for those who miss it. Early preparation is not just advisable; it is essential.