The UK's Financial Conduct Authority has opened a five-month application window for cryptocurrency firms seeking authorization under the country's new Financial Services and Markets Act regime. Firms have until 28 February 2027 to file, with the new rules taking effect on 25 October 2027.

The FCA published application guidance on 30 September, outlining what cryptoasset businesses must demonstrate before operating under the broader regulatory framework that replaces anti-money-laundering registration. The rules, which the regulator finalized in June, cover stablecoin issuance, crypto trading platforms and market abuse.

What authorization now covers

The new requirements apply to activities the FCA classifies as cryptoasset services. Firms performing those activities will need authorization — either through a fresh application or by amending existing permissions.

Registration under the Money Laundering Regulations does not transfer automatically. The same applies to firms registered or authorized under the Payment Services Regulations 2017 and the Electronic Money Regulations 2011, which must obtain fresh authorization under the FSMA framework.

The shift matters for established firms. Money laundering registration is not a back door into the new regime. Current AML controls can serve as evidence of compliance, but the FCA expects applicants to assess broader changes covering market conduct, customer treatment and senior leadership accountability.

Applications must be submitted through the FCA's Connect system. Firms can also request a free, optional meeting through the agency's Pre-Application Support Service. According to the FCA, the meeting allows applicants to explain their business model and clarify expectations, but it does not constitute advisory input and carries no guarantee of approval.

What the FCA is asking applicants to do

• Compare existing arrangements against the expected FSMA requirements
• Strengthen any controls that fall short of the new standard
• Build an implementation plan with board-level oversight
• Assess the resources and costs needed to meet the new obligations

The five-month window is the formal submission period, but the regulator's guidance points to preparation work that must occur beforehand — gap analysis, remediation planning and board sign-off — rather than routine paperwork.

What happens when approval is delayed

The regime includes a saving provision for firms that apply within the window but have not received a final decision by 25 October 2027. Those firms may continue providing cryptoasset services until the application is finally determined, including during an appeal to the Upper Tribunal.

The protection is conditional. A firm using the saving provision must notify the FCA as soon as reasonably practicable once the regime is fully in effect. It must also inform the regulator when it stops relying on the provision.

Late applicants face a narrower path. The FCA has stated that it will not accelerate an assessment to compensate for a late submission. A firm that has not been authorized before commencement falls into a statutory transitional provision under which it may complete existing contracts but cannot enter new agreements with existing or new UK customers.

Non-applicants face the cleanest break. They must run off their UK cryptoasset business before the regime starts, receiving neither saving nor transitional protection. Continuing without the required permission could breach the FSMA general prohibition.

Why the practical deadline sits earlier than 28 February

Five months is the formal window. The practical preparation period is longer. The FCA's guidance points to gap analysis, board-level ownership of remediation work and testing of customer and market controls that must occur before a submission is complete.

A late or incomplete application can be rejected or delayed, leaving an existing firm unable to operate when the regime starts. Crypto companies with compliance work or systems to redesign face the shortest runway.

The UK is moving from registration that focused on anti-money laundering toward direct authorization of defined cryptoasset activities. The practical question for each firm is binary: can it demonstrate that its business is ready, or merely that it is registered?