FCA Finalises UK Cryptoasset Rulebook Ahead of 2027 Authorisation Deadline

The Financial Conduct Authority (FCA) published a package of final rules on 30 June 2026 for much of the UK’s new cryptoasset regulatory regime. The rules cover cryptoasset trading venues, intermediaries, custodians, lending, borrowing and staking providers, fiat-backed stablecoin issuers, and other businesses carrying on regulated cryptoasset activities. The regime takes effect on 25 October 2027, when firms conducting regulated cryptoasset services will generally need FCA authorisation.

The framework is designed to bring specified cryptoasset activities into the FCA’s authorisation and supervisory system, with standards intended to support market integrity, consumer protection and firms’ financial resilience. It applies familiar financial-services concepts to crypto markets, including governance, disclosure, custody safeguards, operational resilience and conduct obligations.

For firms seeking to continue providing services as the new regime begins, the FCA authorisation gateway opens on 30 September 2026 and closes on 28 February 2027. Applying by that date is necessary to rely on the saving provision, which allows continued provision of cryptoasset services while the regime comes into force. The FCA has said it will consider applications in the order received, so firms have an operational incentive to prepare and submit early. Firms may request a Pre-Application Support Service (PASS) meeting; requests have been open since 11 May 2026 and meetings begin in July 2026.

PS26/9 introduces admission and disclosure standards for qualifying cryptoasset trading platforms and cryptoasset issuers, as well as the Market Abuse Regime for Cryptoassets (MARC). MARC is a dedicated framework intended to address market abuse involving qualifying cryptoassets. PS26/10 sets reserve and redemption requirements for issuers of fiat-backed stablecoins. PS26/11 defines the regulated cryptoasset perimeter and confirms conduct rules for relevant activities, including custody and safeguarding. PS26/12 establishes prudential standards on capital, liquidity and risk management; the FCA is separately consulting on related COREPRU and CRYPTOPRU guidance. PS26/13 explains how existing FCA Handbook requirements will apply, including the Consumer Duty, operational-resilience obligations and provisions relevant to international firms.

Under PS26/11, operators of UK qualifying cryptoasset trading platforms (QCATPs), including exchanges and trading venues, face broad requirements on authorisation, governance, market operations and customer protection. Cryptoasset intermediaries, including dealers and arrangers, are also within the conduct framework. Cryptoasset borrowing must be over-collateralised, and providers must offer negative balance protection so customers do not owe more than their account balance from relevant losses.

The FCA made several targeted changes from its earlier proposals. It dropped pre-trade transparency requirements for firms dealing as principal. Best-execution requirements for intermediaries are aligned with conventional standards: where comparable, firms must achieve outcomes at least as good as those available through UK-authorised venues. For safeguarding, the FCA adopted limited exceptions to trust requirements, clarified when a control-based approach may apply, and permits firms using settlement-float models to use up to 2% of their own funds. Its approach to private keys is technology-neutral. CASS 17 does not currently apply to custody of relevant specified investment cryptoassets (RSICs).

The staking rules allow auto-staking of a client’s continuing holdings where the client consents and specified conditions, including annual notifications, are met. They also permit staking of retail-client collateral under CASS 17. The FCA clarified that limits on top-ups apply to firms, rather than clients.

Some parts of the framework remain under consultation or will be developed further. CP26/13 proposes perimeter guidance for the Perimeter Guidance Manual (PERG). CP26/19 proposes extending the FCA’s Decision Procedure and Penalties Manual (DEPP) to MARC, with comments due by 10 August 2026. The FCA also expects to consult in late 2026 on decentralised-finance (DeFi) guidance and Financial Crime Guide updates. Until further guidance is issued, it will assess DeFi arrangements case by case where an identifiable person exercises control; it will take a similarly non-prescriptive approach to international firms.

Businesses should now assess whether their activities fall within the regulated perimeter, map the applicable conduct, custody, stablecoin, market-abuse and prudential requirements, and build an authorisation plan around the 28 February 2027 saving-provision deadline. The final rules establish the core framework, but firms will need to track the remaining consultations and FCA guidance as implementation approaches.