Mark Beardsworth, Duncan Grieve, Tom Crawford and Sharon Takhar examine the recent cryptoasset regulations in Thomson Reuters Regulatory Intelligence

The UK's new regulatory regime for cryptoassets represents a significant expansion of the Financial Conduct Authority's (FCA) remit. The Financial Services and Markets Act (FSMA) 2000 (Cryptoassets) Regulations 2026 (the Regulations), which come fully into force on 25 October 2027, will bring a range of cryptoasset activities within the UK's regulated financial services framework. Firms carrying on those activities will generally need to obtain FCA authorisation and comply with a new set of conduct, prudential and market-abuse requirements.

On 30 June 2026, the FCA published its final rules and guidance, for cryptoasset firms authorised under FSMA from 25 October 2027. Deriving from the new comprehensive regulatory framework, they bring “qualifying” cryptoasset activities within the agency’s regulatory remit, which is described by the regulator as “a significant milestone for the FCA.”

Except for a limited number of purposes, the new regime will not come into force until next October. In the interim, transitional provisions under a statutory instrument passed by Parliament enables the FCA to facilitate a smooth transition. These include making designated activity rules, giving guidance and directions, and enabling applications for Part 4A permissions to carry out regulated activities.

The Regulations expand the FCA’s remit to cover the following regulated cryptoasset activities:

• Operating a qualifying cryptoasset trading platform
• Dealing in qualifying cryptoassets, either as principal or agent
• Arranging deals in, or making arrangements for, transactions in qualifying cryptoassets
• Safeguarding, or arranging for another person to safeguard, qualifying cryptoassets
• Arranging qualifying cryptoasset staking
• Issuing qualifying stablecoins in the UK.

The Regulations define a qualifying cryptoasset as a cryptoasset which is fungible and transferable, is not solely a record of value of contractual rights, and does not fall within specified exclusions. The definition is technology-neutral and captures a broad range of cryptoassets, subject to the specified exclusions.

Notably, a distinct difference exists between activities which are regulated and those which are designated. In essence, regulated cryptoasset activities require full FCA authorisation to operate, while designated activities do not.

For regulated activities, which are governed by the Regulated Activities Order (RAO), firms must first gain formal FCA approval before conducting cryptoasset activities commercially. Undertaking such operations without approval is a criminal offence under the FSMA. As outlined above, examples include: safeguarding or dealing in qualifying cryptoassets, issuing qualifying stablecoins, operating trading platforms, and staking.

Governed through the Designated Activities Regime (DAR), designated activities do not automatically require full FCA authorisation, although the FCA does retain the power to supervise, make rules, and penalise violations. Examples include public offers of qualifying cryptoassets, admissions to trading, insider dealing, and market manipulation.

A range of obligations apply under the new regulations.

Authorised firms must adhere to core FCA requirements as set out in the Handbook, with respect to their systems and controls (SYSC), conduct of business (COBS), and client money safeguarding (CASS). Holding cryptoassets also brings firms within the scope of updated prudential regulations relating to capital adequacy, liquidity, and risk management.

The new regulations also introduce a specific market abuse framework for qualifying cryptoassets which prohibits insider dealing and market manipulation. Before offering tokens to the public or admitting them to trading platforms, issuers may be required to publish detailed disclosure documentation covering technology, governance, and asset risks.

The new regime also places greater emphasis on firms' internal controls and whistleblowing arrangements. By integrating the cryptoasset sector into its existing Handbook framework, the FCA makes robust whistleblowing channels and specific safe harbour regimes a core compliance requirement. Authorised cryptoasset firms are also subject to the SYSC 18 (Whistleblowing) rules, which require them to implement clear, anonymous, and unhindered internal mechanisms for their employees to report regulatory infractions or market abuse.

The Market Abuse Regime for Cryptoassets (MARC), established under the new regulations and finalised via Policy Statement PS26/9, introduces a legal safe harbour designed to encourage transparency. Protections apply to authorised firms and individuals who make good-faith reports of suspicious activities to Cryptoasset Trading Platforms (CATPs). Notably, safe harbour is highly restricted, protecting only the initial disclosure and receipt of information. It does not therefore apply to data protection breaches or subsequent unlawful use of that data.

Under the new regulations, undertaking regulated cryptoasset activities (such as operating trading platforms, safeguarding assets, or issuing stablecoins) without FCA authorisation, or making unlawful public offers of qualifying cryptoassets, constitutes a criminal offence which is punishable by unlimited fines and imprisonment.

For senior management, the implications extend beyond the firm's regulatory status. The new framework creates potential criminal exposure for unauthorised activity and market abuse, meaning that firms will need to consider not only whether their business falls within the regulatory perimeter but also whether their governance, escalation and surveillance arrangements are capable of identifying and preventing misconduct by individuals.

Any business that carries out regulated cryptoasset activities must be authorised or fall within an applicable exemption. Otherwise, they risk prosecution. Likewise, launching a public offer for a qualifying cryptoasset within the UK without specific legal exemptions or promoting cryptoassets unlawfully to UK consumers are strictly prohibited, and potentially triggers criminal liability. Penalties for those involved include imprisonment for up to two years and/or unlimited fines.

FCA penalties and enforcement powers extend further to cover cryptoasset market abuse. Under FCA Consultation Paper CP26/19, the regulator proposes “extending our penalty framework to cover cryptoasset market abuse and reflect new powers”. When determining penalties, the FCA takes account of individuals’ wealth, income, and assets in order to scale fines while updating serious financial hardship thresholds based on inflation metrics.

As part of its expanded enforcement powers, the FCA can apply for injunctions to prevent anticipated or ongoing contraventions of the new cryptoasset regulations, market abuse rules, or unauthorised public offers. Similarly, the regulator holds powers to require restitution or seek court-ordered compensation where persons suffer loss due to contraventions of requirements imposed by the new regulations.

Beyond fines and custodial sentences, the FCA can issue public warning notices, demand that app stores and social media platforms remove offending apps, and declare unlawful contracts unenforceable. These penalties and enforcement procedures can have consequences for corporate and individual reputations.

The new regime should also be viewed against the backdrop of increasing enforcement activity in the cryptoasset sector. In 2026, the FCA, HMRC and the South West Regional Organised Crime Unit conducted an operation targeting suspected illegal peer-to-peer cryptoasset trading, with evidence obtained during the operation supporting ongoing criminal investigations. The FCA has also taken action against cryptoasset businesses for unlawful financial promotions, demonstrating that enforcement activity is already extending beyond the traditional perimeter of regulated financial institutions.

The Serious Fraud Office has also begun to use its criminal enforcement powers in this area. In November 2025, it announced an investigation into the collapse of the $28 million Basis Markets cryptocurrency scheme, its first major cryptocurrency investigation, with two individuals arrested on suspicion of fraud and money laundering

Firms should therefore be assessing now whether their existing business activities fall within the new regulatory perimeter, whether authorisation will be required and whether their governance, surveillance and reporting arrangements will meet the FCA's expectations. Firms seeking to benefit from the transitional arrangements will need to submit their applications by 28 February 2027. To help in-scope cryptoasset firms prepare for the new regime, the FCA has published information and provided links to relevant webinars.

For businesses operating across jurisdictions, the exercise is likely to require particular care. The new regime extends to activities connected with the UK market, while cryptoasset businesses and transactions frequently operate across multiple jurisdictions. Firms should therefore consider the regulatory perimeter alongside their existing financial crime, market-abuse and governance frameworks rather than treating authorisation as a standalone exercise.