Mark Beardsworth, Duncan Grieve, Tom Crawford and Sharon Takhar discuss the new UK regulatory regime for cryptoassets in New Law Journal

More than a decade after the first crypto exchanges began to operate internationally, UK legislation recently established its first comprehensive regulatory regime for cryptoassets. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (The Regulations) will come into full force on 25 October 2027, creating new regulated cryptoasset activities.

The new regime will require firms carrying on specified cryptoasset activities in or to the UK to obtain authorisation from the Financial Conduct Authority (FCA) and comply with a new framework of conduct, prudential and market-abuse requirements.

FCA Rules and Policy Statements

On 30 June 2026, the FCA published its final rules and policy statements for cryptoasset firms authorised under the FSMA, which will apply next October. In the interim, transitional provisions under a statutory instrument passed by Parliament enable the FCA to facilitate a smooth transition.

The Regulations bring a range of activities involving “qualifying cryptoassets" within the agency’s regulatory perimeter. Described by the regulator as “a significant milestone for the FCA,” it represents a significant expansion of the FCA's current remit.

In doing so, the Regulations will enable the FCA to cover the following regulated cryptoasset activities:

• Operating a qualifying cryptoasset trading platform
• Dealing in qualifying cryptoassets, either as principal or agent
• Arranging deals in, or making arrangements for, transactions in qualifying cryptoassets
• Safeguarding, or arranging for another person to safeguard, qualifying cryptoassets
• Arranging qualifying cryptoasset staking
• Issuing qualifying stablecoins in the UK.

The decision to usher in a new UK regulatory regime for cryptoassets comes in the wake of significant incidents such as the collapse and subsequent bankruptcy of FTX, a Bahamas-based global cryptocurrency exchange, in November 2022. This affected an estimated 80,000 UK creditors and customers of FTX. Meanwhile, UK reports  revealed a 55% jump in crypto-related scam losses last year. Law-enforcement agencies and the FCA have already begun to take action, and a strict new compliance and enforcement framework is on the horizon.

Taken together, the Regulations and the FCA's Cryptoasset Market Abuse Regime policy (MARC) will work in tandem: the Regulations define the scope of regulated activities involving "qualifying cryptoassets" and create a range of prohibitions and criminal offences, while MARC provides guidance on how businesses must comply in practice.

This article outlines the scope of the new crypto regime, the compliance obligations which it imposes, the consequences of non-compliance, and the steps that affected businesses should take now in order to be compliant. The FCA’s authorisation gateway is scheduled to close on 28 February 2027: with no grace period allowed beyond that date, preparation is therefore time-sensitive.

Scope of the new FCA rules

What is a "qualifying cryptoasset" according to the FCA’s new rules?

The Regulations define a qualifying cryptoasset as a digital token which shares the following characteristics:

(a) fungible (i.e. individual units can be replaced interchangeably with another of the same type);

(b) transferable (i.e. can be moved, assigned, or transferred from one person or entity to another);

(c) not solely a record of value or contractual rights; and

(d) not one of several specific exclusions (for example, electronic money or something that can only be used by the holder to acquire goods or services from the issuer).

In practice, this captures a broad range of widely used cryptoassets, which excluding assets sch as electronic money and certain loyalty or reward schemes.

Which activities are subject to the new FCA rules?

Before they carry out a wide range of regulated activities which involve qualifying cryptoassets, the Regulations require businesses to obtain prior authorisation from the FCA. Common activities include: issuing qualifying stablecoin (in essence, a cryptoasset which is pegged against a particular fiat currency), safeguarding, dealing in and arranging deals (either as agent or principal) involving qualifying cryptoassets, and operating a qualifying cryptoasset trading platform.

However, there is a range of exceptions which businesses can rely on in specific circumstances. These include assorted group activity and temporary settlement exclusions, as well as exclusions that enable parties to communicate about a transaction and activity which is incidental to professional services.

Although they do not require prior FCA authorisation, a spectrum of designated activities are also subject to FCA rules, prohibitions and enforcement. Prominent examples include offering a qualifying cryptoasset to the public in the UK, admitting a cryptoasset to trading on a trading platform, and communicating or disclosing information relating to those activities.

As a result, a wide range of businesses are affected by the rules - from those that one would typically expect to be regulated, such as crypto exchanges and trading platforms, to those that are perhaps less immediately obvious, such as brokers, dealers, arrangers and other intermediaries, and traditional financial institutions.

The regime is also not limited to businesses established in the UK: firms based overseas may also require authorisation where they carry on relevant activities in or to the UK.

Enforcement action has already moved beyond traditional crypto exchanges.

In February 2026, the FCA demonstrated its willingness to take enforcement action, when it commenced legal proceedings against cryptoasset exchange HTX (formerly Huobi) in relation to alleged unlawful financial promotions to UK consumers, despite having previously warned the firm about its conduct.

In April 2026, working with HM Revenue & Customs (HMRC) and the South West Regional Organised Crime Unit (SWROCU), the FCA conducted an operation across multiple London locations targeting suspected illegal peer-to-peer crypto trading at eight premises. Evidence that was obtained during the on-site inspections is supporting a number of ongoing criminal investigations.

What new obligations are businesses facing?

For any business that plans to engage in regulated activities, the Regulations require various procedures and systems to be implemented beforehand. In practice, the FCA will expect to see many of them in place before granting authorisation. These include: implementing appropriate systems and procedures in order to prevent, detect and disrupt insider dealing and market manipulation, drawing up insider lists which must be maintained and provided to the FCA on request, and establishing internal whistleblowing procedures which operate through an independent channel.

MARC introduces a legal safe harbour designed to encourage transparency. Specifically, there are safe harbour provisions for authorised firms and employees who report suspected market abuse to a nominated officer, which overrides contractual confidentiality obligations, provided that certain conditions are met.

Businesses will need to pay close attention to ongoing obligations imposed by the Regulations. These include obligations relating to the identification, handling and disclosure of inside information and the reporting of suspected market abuse.

Notably, safe harbour is highly restricted, protecting only the initial disclosure and receipt of information. It does not therefore apply to data protection breaches or subsequent unlawful use of that data.

What potential consequences arise from non-compliance?

Breach of the Regulations can lead to serious potential consequences: the risk of criminal prosecution, which may result in imprisonment, substantial fines, or both. The Regulations operate in parallel with other legislation, such as the Crime and Policing Act 2026, to extend the scope of corporate criminal liability.

Such risks are not purely confined to the period after the Regulations come into full force in October 2027. As discussed above, the FCA and law enforcement agencies are already taking enforcement action under the existing regulatory and criminal framework in order to prosecute cryptoasset businesses and individuals. The Regulations also operate alongside the Crime and Policing Act 2026 (CPA), which has broadened the circumstances in which a corporate body can be held criminally liable for offences committed by its senior managers. Under Section 250 CPA, a business can itself be guilty of an offence where a senior manager commits that offence while acting within their actual or apparent scope of authority.

For firms and their senior managers, the significance of the new regime therefore goes beyond obtaining regulatory permission. The combination of new criminal offences, market-abuse obligations and corporate criminal liability means that firms will need to consider whether their existing governance, surveillance and escalation arrangements are capable of identifying and addressing misconduct before it develops into an enforcement issue.

A crypto business that carries on a regulated activity without FCA authorisation may be subject to a fine and the individuals who are responsible for the offending conduct can also be imprisoned for up to two years. Market abuse offences, including insider dealing, can also attract significant criminal penalties, including imprisonment of up to ten years.

The Regulations also have an extraterritorial dimension: for certain market-abuse offences, the location in which the conduct occurs is not necessarily determinative of whether the UK regime applies.

Recent enforcement activity by UK regulators serves to illustrate the increasing focus on cryptoasset-related crime. In November 2025, the Serious Fraud Office (SFO) launched an investigation into the collapse of Basis Markets, a US$28 million cryptocurrency scheme - its first major cruptocurrency investigation. Following raids in London and West Yorkshire, two individuals were arrested on suspicion of fraud and money laundering.

But imprisonment and fines are not the only consequences of breaching the Regulations. It can also have a major reputational impact for a business, individuals who are responsible, or both. As an alternative to fines, or as an additional sanction, the FCA can impose formal public censures and individuals can be banned from carrying on regulated activities.

Other non-monetary remedies, such as injunctions to freeze assets, can also have an adverse impact on day-to-day business. Designed to deprive a firm or individual of any direct financial benefit or profit gained from a regulatory breach in addition to fines, the FCA can impose restitution orders for disgorgement of any profits to compensate victims.

Steps that every affected business should take now

The new Regulations are complex: making mistakes or ignoring any of the compliance obligations can have serious consequences. Businesses should therefore carefully consider taking legal advice on whether they are carrying on any current activities that will soon be subject to the Regulations, and whether they need to obtain FCA authorisation for regulated activities. In anticipation of the new regime commencing next October, the FCA's authorisation gateway is set to open on 30 September 2026 and will close on 28 February 2027.

Firms that wish to benefit from the transitional arrangements will need to apply within the gateway window. Those that do not apply by the deadline will not be able to rely on those transitional arrangements and, unless another exemption applies, will need to stop carrying on the relevant regulated activities until authorised.

Any business which is thinking of making an application to the FCA should also consider taking legal advice on setting up the various safeguards and processes required under the Regulations. These include assistance with building surveillance and whistleblowing systems, designating nominated officers, and creating insider lists.

Firms that delay the application process risk criminal liability once the new regime takes effect on 25 October 2027. As the FCA authorisation gateway closes on February 28, 2027, firms face a limited timeframe in which to apply - with no grace period available for those who miss it. Early preparation is therefore imperative.