Ensuring FSMA Readiness: Key Priorities for Cryptoasset Firms
15 October 2026
Taken from the published LinkedIn Pulse article.
Introduction
On 30 September 2026, the UK’s Financial Conduct Authority (FCA) opened its authorisation gateway for cryptoasset firms, as part of its mandate to bring the sector fully within the UK’s financial services regulatory perimeter under the Financial Services and Markets Act 2000 (FSMA). From 25 October 2026, when the new regime comes into force, firms carrying on any of the following cryptoasset activities in the UK will need FCA authorisation and apply through the gateway:
Issuing a qualifying stablecoin
Safeguarding cryptoassets
Arranging cryptoasset safeguarding
Operating a qualifying cryptoasset trading platform
Dealing in qualifying cryptoassets as principal and/or agent
Arranging deals in qualifying cryptoassets
Arranging qualifying cryptoasset staking
The application window closes on 28 February 2027. Importantly, existing firms that apply by the deadline can continue operating if a decision is still pending when the regime starts, while firms that cannot demonstrate the required standards will not be authorised to operate in the UK market.
Given the nascent nature of digital asset regulation in the UK, this will be many firms' first encounter with regulatory supervision. Many cryptoasset businesses already hold registration under the Money Laundering Regulations (MLR), in place since 2020, but it does not confer FSMA authorisation. Firms on the existing register, and those not previously regulated at all, will need to meet standards on governance, prudential resilience, conduct and operations that go beyond what MLR registration requires.
This article walks through the key dates, what authorisation will require, what happens to firms that miss the window, and how firms can gauge their readiness in the time that remains.
Timeline
The diagram below shows the application window and the key dates leading up to the regime coming into force. The gateway opened on 30 September and closes on 28 February 2027. The FCA expects to determine applications submitted within this window before the regime commences on 25 October 2027. If a decision is still pending by then, firms that applied on time can continue providing cryptoasset services until their application is finally determined. Authorisation is not guaranteed, though, and the FCA has said it will not expedite assessments, so applying within the window is the only protection against an operating gap. Firms can still apply outside the window, but without these savings provisions, they would fall under a more restrictive transitional provision.
Some firms also face an extra layer of uncertainty. Following the Government’s draft amending regulations, the FCA will consult in October 2026 on targeted updates to its perimeter guidance covering UK qualifying stablecoins, proprietary trading and market making, certain technology providers, decentralised protocols, safeguarding involving central securities depositories, and financial promotions. The FCA expects most firms to be unaffected. For those who are, the final updated guidance is not expected until early 2027, close to or possibly after the window closes, so they will need to decide how to apply before the guidance is fully settled.
Authorisation Requirements
FSMA authorisation will require firms to demonstrate that their business model, resources and controls meet the standards applicable to their specific cryptoasset activities. The precise requirements will vary according to those activities and the firm’s customer base, and preparation must go beyond document policies to evidence of how arrangements work in practice.
It should be noted, however, that firms will approach this process from different starting points. Since January 2020, businesses carrying on cryptoasset exchange provider or custodian wallet provider activities in the UK have been subject to FCA registration and anti-money laundering supervision under the MLR. That gives these firms a foundation in AML controls and experience of FCA supervision on which to build. But registration does not convert into FSMA authorisation, nor does it guarantee it. The FCA has said that MLR-registered firms still need to prepare for FSMA authorisation while continuing to meet their existing MLR obligations ahead of the new regime’s commencement. The table below compares what firms may already have in place with what authorisation adds.
The right-hand column shows where the gap is. The FCA has said it will assess applicants against standards on consumer protection, safeguarding of customer assets, market integrity and financial resilience, and an MLR registration covers only part of that.
Some firms will start from further back. Those whose activities fall outside the MLR perimeter, such as firms that only arrange staking, may never have been registered and will be building their regulatory framework from scratch.
What Happens if a Firm Misses the Window
The savings provisions protect firms that apply in time. For everyone else, the outcome depends on whether they applied late or not at all, with the consequences varying substantially. The following table sets out the main situations and outcomes:
With such high-stakes riding on the window, the next question is how ready firms really are to use the time that remains.
Current State of Preparedness
Firms are approaching the application window from very different starting points. Through Appold’s engagements, we have observed three broad profiles:
Firms registered under MLR, with experience of FCA scrutiny.
Firms with financial institution backing and access to established governance and regulatory expertise.
Firms whose activities have previously sat outside regulatory supervision, with limited experience of engaging with regulators.
These backgrounds shape the scale of preparation required, but none guarantees readiness. Regulatory familiarity and institutional backing help only where they have produced governance and controls that the applicant can demonstrate in practice.
A less developed starting point does not rule out a credible application, but it makes an early, realistic assessment of the gaps essential. What matters most is the distance between a firm’s current operating arrangements and the standards it will need to demonstrate. A firm with sound underlying controls but little experience documenting them for regulatory scrutiny faces a different task from one that must still establish effective governance and embed controls in its day-to-day operations.
Whether the remaining time is enough depends on the scale of each firm’s readiness gaps and its capacity to address them. Closing those gaps will require sustained management attention, clear internal accountability, adequate funding and evidence of implementation. In our view, the immediate priority is a comprehensive readiness assessment, conducted at pace and supported by a realistic delivery plan. For some firms, decisive action now can still provide a credible path to submitting an application. Others may need to narrow the scope of their proposed activities or pursue authorisation in phases. Every week of delay shortens the time available to prepare and raises the risk of business disruption.
How Appold Can Help
The FCA will test whether a business can demonstrate it is governed, controlled and able to operate under supervision, and that takes time to build. For MLR-registered firms and first-time applicants in particular, the gap between today’s arrangements and what the FCA expects is often wider than it first appears. Appold’s experience engaging with regulators, global financial institutions, blockchain native firms, and legal experts equips us with the ability to turn requirements into working processes before the application window closes.
Appold is well prepared to support clients with:
Scoping whether, and how, the regime applies to their activities
Building governance, accountability and operating structures
Developing policies, systems and controls, and financial resilience arrangements
Preparing for FCA engagement, including pre-application meetings, the application itself and life under supervision
Accelerating implementation and delivery
For firms new to FSMA authorisation, we can also support you through the FCA’s pre-application support service (PASS): preparing your request, attending the meeting with you, and applying what you learn to your application.
With the window closing on 28 February 2027, the sooner the conversation starts, the better. To talk through where your firm stands, get in touch at info@appold.com.