UK cryptoasset regime 2027: the 25 October build list for exchanges and apps

Summary. The UK's cryptoasset regime starts on 25 October 2027, 346 days from 13 November 2026. That date is written into regulation 1(2) of the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102, made on 4 February 2026), although the FCA's regime page still describes it as expected. The SI adds nine cryptoasset activities to the Regulated Activities Order, so firms issuing UK qualifying stablecoin, running a trading platform, dealing, arranging, safeguarding or staking for UK customers need FSMA permission, and registration under the Money Laundering Regulations does not convert. The FCA published its final rules on 30 June 2026 in PS26/9 to PS26/13. Its application period runs from 30 September 2026 to 11:59pm on 28 February 2027, 107 days away. Firms that apply in the window and are still waiting at go-live can keep operating under a saving provision; late applicants can only run off existing contracts; both routes end two years after commencement. By 31 October 2026 the FCA had received 2 variation of permission applications and no new authorisation applications. A draft amending SI is still before Parliament, and the FCA's perimeter and DeFi guidance consultations close on 18 November 2026. Apply early and build in parallel.

About this article. For product, engineering and compliance leads at exchanges, custodial wallets, stablecoin issuers and fintech apps serving UK customers. We checked every date and rule on 13 November 2026 against the SI, the FCA's direction, regime pages, policy statements and consultations, HM Treasury and Parliament records and the Bank of England; where we rely on KPMG or Latham & Watkins summaries we say so. This is general information, not legal or regulatory advice, and the FCA itself tells applicants to consider independent advice. Researched with AI assistance and reviewed by our editorial team.

The dates that matter

The commencement date is fixed in the SI as the full commencement day, so moving it would take further legislation. The FCA's regime page still uses the word expected, while its preparation page and the CP26/36 page state the date plainly. The application period comes from a formal FCA direction dated 20 February 2026. The table draws on the SI, the FCA's gateway, perimeter and consultation pages, and the Parliament record.

Regulation 52 required the FCA to set a window at least 28 days long that closes at least 28 days before commencement, and lets the FCA extend it. The chosen window leaves 239 days, almost 8 months, between closing and go-live for the FCA to decide applications.

How you apply decides what happens on 25 October 2027:

• Applied in the window, decision pending. The saving provision lets you keep providing cryptoasset services until the application is finally determined, including any reference to the Upper Tribunal. The SI switches that provision off two years after commencement.

• Applied after 28 February 2027 but before go-live, not yet authorised. You enter the transitional provision by operation of law. You may perform pre-existing contracts only, and may not sign new contracts with existing or new UK customers. The FCA will not speed up late applications.

• Did not apply. You must run off UK business before the regime starts. Carrying on afterwards risks breaching the general prohibition in section 19 of FSMA, or section 20 if you are already authorised.

The market is still early. As at 31 October 2026 the FCA had received 92 pre-application meeting requests, held 54 meetings and rejected 18 requests, and had received 2 variation of permission applications and 0 new authorisation applications since the gateway opened.

Who needs permission: the nine new regulated activities

The FCA lists the activities the SI adds to the Regulated Activities Order:

1. Issuing qualifying stablecoin in the United Kingdom.

1. Safeguarding qualifying cryptoassets and relevant specified investment cryptoassets.

1. Arranging for another person to safeguard them.

1. Operating a qualifying cryptoasset trading platform.

1. Dealing in qualifying cryptoassets as principal.

1. Dealing in qualifying cryptoassets as agent.

1. Arranging (bringing about) deals in qualifying cryptoassets.

1. Making arrangements with a view to transactions in qualifying cryptoassets.

1. Qualifying cryptoasset staking.

Firms already authorised under FSMA apply for a variation of permission. Everyone else applies for FSMA authorisation, including firms registered under the Money Laundering Regulations and payment or e-money firms under the Payment Services Regulations 2017 or Electronic Money Regulations 2011. Once authorised, crypto firms no longer register separately under the MLRs.

The perimeter is still moving. PS26/18 is the final guidance on the original activities. HM Treasury then laid a second instrument, the draft Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026, in September 2026. According to the FCA, it adds exclusions for temporary settlement arrangements, temporary holdings of UK qualifying stablecoin for payments, stablecoin backing asset arrangements, some proprietary trading and market making, and technical services that only give access to a third party's service or a decentralised protocol. Lords and Commons committees debated it on 10 and 11 November 2026, and Parliament's record shows no approval yet. The FCA's guidance on these exclusions, CP26/36, closes on 18 November 2026. Where a firm can show that uncertainty over the technical services exclusion materially affected its application, the FCA will allow extra time on the arranging parts, provided the rest is complete and submitted in the window.

The FCA's reading list shows which rulebooks hit which business model, as set out in its overview of the policy statements.

What exchanges and trading platforms must build

Admissions and disclosures. PS26/9 covers admitting qualifying cryptoassets to UK platforms: admission criteria, due diligence, the qualifying cryptoasset disclosure document (QCDD), triggers for supplementary disclosures and withdrawal rights notices. The final rules add a digital token identifier standard used across admissions and market abuse, and drop an exception that let a token skip the QCDD if it was fungible with one already admitted on the same platform. Platforms need an admissions workflow that stores due diligence evidence, version-controls disclosure documents and tags every instrument with its identifier.

Market abuse surveillance (MARC). The SI prohibits insider dealing, unlawful disclosure of inside information and market manipulation, and requires systems and procedures to prevent, detect and disrupt market abuse (regulation 30) and insider lists (regulation 31). The FCA kept the threshold above which large UK platforms take on extra obligations and narrowed their on-chain monitoring duty. KPMG reports that cross-platform information sharing stays and that MARC gives platforms and intermediaries a bigger role than UK MAR gives traditional venues. In practice that means order and trade surveillance with alert triage, inside information disclosure workflows, insider list tooling and, for large platforms, on-chain analytics feeding the same case management.

Best execution and transparency. Principal dealers are out of the pre-trade transparency rules. Best execution needs effective overall arrangements backed by periodic monitoring and post-trade analysis, not checks on every transaction. KPMG reports that firms should compare prices against at least three reliable UK-authorised venues where possible. Build a price reference service and a post-trade analysis report before smart order routing.

Client money. CASS 7 applies to client money held in connection with safeguarding client cryptoassets, and KPMG adds execution, dealing and arranging, with the professional client opt-out switched off for this money. Exchanges holding fiat balances need segregated accounts, regular client money calculations and reconciliations an auditor can rerun.

What custodial wallets and custodians must build

PS26/11 applies a new chapter, CASS 17, to client cryptoassets, with stronger protection for ownership rights, record-keeping, reconciliation and private key management. The final rules added targeted exceptions to trust requirements, clarified when control-based safeguarding applies, raised the settlement float limit to 2% and took a technology-neutral line on private keys. Custody of relevant specified investment cryptoassets (tokenised traditional instruments) stays under CASS 6 for now.

For a wallet team, CASS 17 becomes four systems:

• A client asset ledger recording each client's entitlement by asset and network, separate from the firm's own holdings, that survives a firm failure.

• Reconciliation jobs comparing the internal ledger with on-chain balances and any third-party custodian statements, with break handling and escalation.

• Key management records covering key generation, storage, signing policy, access and recovery, whether you use hardware security modules or multi-party computation.

• A settlement float control that keeps operational float within the 2% limit and reports breaches.

Non-custodial wallet software is a perimeter question, not a CASS question. If your app never controls client keys, read PS26/18 and the technical services exclusion in the draft amending SI, and take advice on whether any feature amounts to arranging.

What UK stablecoin issuers must build

PS26/10 sets the rules for issuing UK qualifying stablecoins, and CASS 16 covers safeguarding the backing assets. The FCA kept its core framework with these changes: no redemption forecasts to set backing asset composition; backing assets held on statutory trust, with unallocated backing fund accounts removed; redemption timelines adjusted; limited intragroup custody allowed with safeguards; up to a 5% excess allowed in the backing pool; and holders given access to historical disclosures. UK-issued qualifying stablecoins must be fully backed and redeemable at par.

KPMG adds that KYC checks should be finished before the redemption period starts, and that the Consumer Duty guidance warns against complex redemption mechanisms such as multi-step redemptions. PS26/12 cut the stablecoin issuance K-factor, K-SII, from 2% to 1%. A stablecoin that HM Treasury recognises as systemic moves to joint regulation by the Bank of England and the FCA, under an approach both published on 30 June 2026.

Payments use cases may sit partly outside this perimeter. In April 2026 HM Treasury proposed taking activities involving UK-issued qualifying stablecoins out of dealing and arranging, pending a reformed payments regime, and the draft laid in September carries payment-related exclusions. Until it is made, the FCA tells firms to work to the legislation in force.

The systems follow from those rules: a backing asset register under trust, a daily backing versus issuance check that flags when the pool drifts below 100% or above the permitted excess, a redemption engine with KYC completed up front, and a disclosure archive that keeps every past version available to holders.

What fintech apps, brokers, staking and lending services must build

Apps that arrange or deal as agent. A UK app offering crypto buying through a partner may be arranging deals or dealing as agent. KPMG's summary of PS26/13 says the Consumer Duty applies in full apart from limited exemptions for admissions and disclosures and for trading between participants on a UK platform. Expect to evidence fair value, consumer understanding and support that works for vulnerable customers. KPMG also reports that COBS 10 appropriateness applies and that the FCA will consult on how stronger appropriateness rules apply to existing clients. Firms using a section 21 approver for promotions should read the FCA's page on how that changes.

Staking. Retail staking needs disclosures, contractual terms, client consent and record-keeping. Consent may cover ongoing staking of current and future holdings, subject to conditions and an annual notice, so auto-staking still works. KPMG reports that COBS 16 client reporting does not apply to staking.

Lending and borrowing. Retail protections stay: enhanced disclosures, consent, appropriateness tests, record-keeping, over-collateralisation and negative balance protection. Retail collateral may be staked under CASS 17.

DeFi and international firms. The rules apply to DeFi arrangements with an identifiable controlling entity. The FCA's DeFi guidance consultation, GC26/7, covers operational resilience and financial crime, closes on 18 November 2026 and is due in final form in January 2027. KPMG reports that solo-regulated international firms are expected to use a UK legal entity, not a branch.

Firm-wide requirements every applicant shares

The table combines the FCA's overview with KPMG's summary of PS26/13 and the FCA's newer consultations.

On SM&CR, KPMG reports that the FCA will defer checking certification during the gateway, and the FCA's CP26/37, open until 22 January 2027, proposes removing the Certification Regime altogether. On financial crime, CP26/38 updates the Financial Crime Guide for the October 2027 regime and closes on 24 December 2026.

Two areas deserve early engineering time. Operational resilience mapping is slow because it needs every dependency of each important business service, including node providers, custodians, banking partners and cloud regions. Regulatory reporting is still moving: the FCA will work with firms before commencement on supplementary questions that apply from day one, alongside lighter baseline returns, and will release reporting materials and a version of the reporting interface early. Build the data warehouse so new fields are configuration, not code, and keep your own dated copies of rule text, because the FCA Handbook API serves only current versions.

The prudential headline in PS26/12 is a simpler market risk framework. Cryptoassets that can be prudently valued and are admitted to a UK qualifying cryptoasset trading platform face a single 40% net position requirement (K-NCP) and a 40% volatility adjustment for counterparty default (K-CCD). Those that fail either test are deducted from regulatory capital and take a 100% volatility adjustment.

Worked example: a 45-person London crypto app

Take a London company with 45 staff, registered under the Money Laundering Regulations, that lets UK retail customers buy and sell bitcoin and ether, holds their coins in a custodial wallet and offers optional staking. It keeps a trading inventory to fill small orders.

Permissions. Depending on its execution model, it needs dealing as principal or agent (or arranging), safeguarding and staking permissions. Its MLR registration will not convert.

Timing. From 13 November 2026 it has 107 days to submit a complete application by 28 February 2027. Latham & Watkins reports that the FCA has said it will review applications in the order received, so a December submission is worth more than a February one. If it applies in the window and is still waiting on 25 October 2027, the saving provision keeps it trading for up to two years. If it misses the window and is not authorised by go-live, it can only run off existing contracts, again for at most two years.

Capital inputs, illustrated. Suppose it holds a £2.5 million net long position in bitcoin and ether, both admitted to a UK platform, plus £0.4 million of a token not admitted to any UK platform. Using the PS26/12 rule above, 40% × £2.5 million = £1.0 million of K-NCP, and the £0.4 million token is deducted from own funds. The deduction cuts capital straight away; the £1.0 million counts only if the K-factor requirement ends up higher than the fixed overheads requirement and the permanent minimum. These are illustrative inputs; model the full rules with your adviser.

Build sequence.

Decision table: what to do now

The table follows the FCA's gateway and CP26/36 pages and KPMG's summary.

What is still open

When it published the final rules, the FCA listed work still to come: DeFi, DLT, cryptoasset derivatives, more stablecoin policy, audit requirements, the saving and transitional provisions, and a consultation on firm failure, including distribution rules for failed stablecoin issuers and custodians and possibly the rules on suspending redemptions. Since then it has opened consultations on DeFi (GC26/7), the amended perimeter (CP26/36), the Financial Crime Guide (CP26/38) and SM&CR (CP26/37). Check the FCA's consultation list for the firm failure paper, and Parliament's record for the amending SI. Design the systems most likely to change, such as reporting, redemption suspension and DeFi integrations, so that rules live in configuration.

For US-facing teams the timing differs: the GENIUS Act applies from 18 January 2027, covered in our GENIUS Act guide. For EU exposure, our EU AMLR guide covers the due diligence rules for crypto-asset service providers that apply from 10 July 2027.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our application development team builds the software this regime calls for, such as client asset ledgers, on-chain reconciliations, staking consent flows, redemption engines and reporting pipelines, while your compliance and legal advisers own the application and the regulatory judgements. Talk to us at /contact-us/.

Last updated: 13 November 2026.

References

1. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, Part 1 (regulations 1 and 2) — legislation.gov.uk

1. A new regime for cryptoasset regulation, updated 10 November 2026 — Financial Conduct Authority

1. Cryptoasset regulated activities: FSMA and the FCA Handbook — Financial Conduct Authority

1. Cryptoassets: How the gateway will operate, updated 3 November 2026 — Financial Conduct Authority

1. Overview of our cryptoassets regime policy statements, 30 June 2026 — Financial Conduct Authority

1. Relevant application period direction under regulation 52, 20 February 2026 — Financial Conduct Authority

1. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, Part 7 (savings and transitional provision) — legislation.gov.uk

1. Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026, procedure record — UK Parliament

1. CP26/36: Cryptoasset perimeter guidance, 21 October 2026 — Financial Conduct Authority

1. What you need to do when preparing for the new cryptoasset regulatory regime — Financial Conduct Authority

1. PS26/18: Cryptoasset perimeter guidance, 16 September 2026 — Financial Conduct Authority

1. Cryptoassets: The transitional provision — Financial Conduct Authority

1. Policy note: Draft statutory instrument amending the Cryptoasset Regulations, updated 15 September 2026 — HM Treasury

1. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, table of contents — legislation.gov.uk

1. The UK's finalised regulatory regime for cryptoassets, July 2026 — KPMG

1. Bank of England and Financial Conduct Authority's approach to joint regulation of systemic stablecoin issuers, 30 June 2026 — Bank of England

1. GC26/7: Decentralised finance guidance (DeFi), 21 October 2026 — Financial Conduct Authority

1. CP26/37: Senior Managers and Certification Regime (SM&CR) Review: Phase 2, 22 October 2026 — Financial Conduct Authority

1. CP26/38: Financial Crime Guide updates, 23 October 2026 — Financial Conduct Authority

1. The Race Is On: FCA Publishes Final Rules for UK Cryptoasset Regime — Latham & Watkins