UK crypto authorisations: less than 30 Days until applications open. Is your firm ready?

The countdown has started.

In less than 30 days, the FCA's application window for the new UK cryptoasset authorisation regime is expected to open, marking the beginning of one of the most significant regulatory changes the UK crypto sector has seen. The FCA has stated that the application period is due to begin on 30 September 2026 and close on 28 February 2027.¹

At first glance, five months may sound like plenty of time.

In reality, it isn't.

The window is shorter than you think

Authorisation applications are not simply forms to complete and submit. They require firms to demonstrate that they have appropriate governance, controls, financial resources, operational resilience, compliance frameworks and senior management oversight in place.

For many firms, preparing a high-quality application can take months of planning, remediation and documentation before submission is even possible.

The closer we move towards February, the greater the risk that firms find themselves rushing to complete critical documentation, governance enhancements and compliance projects.
 

What happens if you miss the deadline?

The FCA has not stated that firms will automatically be excluded from applying after the application window closes. However, firms that delay submission may face a significant practical challenge.

Put simply, if you are not authorised by the time the new regime comes into force, you may not be able to carry on regulated cryptoasset activities in the UK and may need to wind down your existing UK business.

A late application could mean:

• Extended regulatory uncertainty
• Delays to business plans and growth initiatives
• Restrictions on servicing UK customers
• Additional costs associated with remediation and resubmission
• Competitive disadvantage against firms that secure authorisation earlier

For most firms, waiting until the last minute is a high-risk strategy.
 

How difficult will it be to obtain authorisation?

The honest answer is that FCA authorisation processes are rarely straightforward.

The proposed crypto regime extends well beyond anti-money laundering registration requirements. Firms will be assessed across a broad range of areas, including:

• Governance and board effectiveness
• Senior management accountability
• Prudential resources and financial resilience
• Consumer protection requirements
• Operational resilience
• Financial crime controls
• Market abuse
• Safeguarding, client money and custody arrangements
• Prudential
• Market abuse monitoring
• Outsourcing oversight
• Technology and cybersecurity controls

This is a significant step up from the requirements many firms currently operate under.
 

The odds may not be in your favour

Across other FCA authorisation regimes, application failure rates and withdrawals have historically been significant.

Many firms underestimate:

• The level of regulatory scrutiny
• The quality of documentation required
• The volume of supporting evidence expected
• The importance of demonstrating effective governance and risk management

A common reason for delays or unsuccessful outcomes is not necessarily a poor business model. It is often a lack of preparation.

The FCA is likely to challenge firms on areas such as safeguarding, operational resilience, financial crime controls, governance arrangements and senior management accountability. Firms that cannot clearly evidence these requirements may face extensive questions, delays or the need for material remediation before authorisation can be granted.
 

Preparation is critical

The firms most likely to succeed are those that start preparing now.

A structured readiness assessment can help identify:

• Governance gaps
• Missing policies and procedures
• Prudential weaknesses
• Operational resilience shortcomings
• AML and financial crime control deficiencies
• Documentation that needs strengthening before submission

Addressing these issues early can significantly improve the quality of an application and reduce the likelihood of regulatory challenges later in the process.
 

A practical tool to help

We've developed a comprehensive UK Crypto Authorisation Readiness Questionnaire designed to help firms assess their preparedness for the new regime.

The questionnaire covers:

• Corporate structure and regulatory perimeter
• Business model and strategy
• Governance and accountability
• Financial resources
• Financial crime controls
• Custody and safeguarding
• Operational resilience
• Technology and cybersecurity
• Consumer Duty and conduct requirements

It has been designed to support gap analysis, governance workshops and authorisation planning exercises.
 

Final thought

September is now here and February will arrive far sooner than many firms expect.

Authorisation is likely to be complex, resource-intensive and highly scrutinised. Firms that start early will put themselves in the strongest position to navigate the process successfully.

If you're considering a UK crypto authorisation application and would like to discuss your readiness, or would like a copy of our authorisation questionnaire, please drop us a message. We’d be happy to talk through the requirements and help you assess where you stand ahead of the application window opening.

About the author

Ian Morton is a managing consultant at Ocorian’s Regulatory and Compliance team. He provides specialist advice on prudential regulation, including capital, liquidity, credit, operational and market risk, regulatory reporting and operational resilience. With over 30 years’ experience in financial services, Ian has held senior roles across capital markets firms, Tier 1 banks and challenger banks, giving him significant experience in helping firms navigate complex prudential and regulatory requirements.

¹Financial Conduct Authority, “Cryptoassets”,  https://www.fca.org.uk/firms/cryptoassets-information