How to Get a Crypto License in the UK: FCA Authorisation, the Application File and the 28 February 2027 Window

The short version: From 25 Oct 2027, running a crypto trading platform, dealing, arranging deals, safeguarding or arranging staking in or to the UK needs a Part 4A permission from the FCA under the Financial Services and Markets Act 2000 (FSMA) (SI 2026/102, reg. 1). There is no separate crypto “licence”: a firm becomes an FCA-authorised firm with crypto permissions. Applications go through FCA Connect, and the application period that protects existing businesses runs from 30 Sep 2026 to 28 Feb 2027 (FCA direction). This guide walks through the procedure. For what changes and who is affected, see our overview of the regime. For the old registration's track record, see our MLR analysis.

A summary of FCA pages, FCA rules and UK legislation linked in each paragraph. Not legal advice. VASP Tracker is an independent project, not affiliated with the FCA or HM Treasury, and has no connection to the Bank of England.

Step 1: Map Your Activities to the New Permissions

SI 2026/102 adds nine activities to the Regulated Activities Order (RAO): issuing a qualifying stablecoin in the UK, safeguarding qualifying cryptoassets, arranging safeguarding, operating a qualifying cryptoasset trading platform (QCATP), dealing as principal, dealing as agent, arranging (bringing about) deals, making arrangements with a view to transactions, and qualifying cryptoasset staking (FCA; SI 2026/102). Each has exclusions, such as group activity and introducing, and the FCA's perimeter guidance explains where the lines fall (PS26/18).

The FCA's first ask is that firms work this out themselves: review which activities they carry on, run a gap analysis against the final rules, and put a board-approved implementation plan in place (FCA: what you need to do). Lending and borrowing are covered by conduct rules in PS26/11, and the application form has a separate lending and borrowing section (FCA form information), but they are not a tenth RAO activity. Firms should check which permission their model actually needs.

Step 2: Decide on the UK Entity and Presence

The FCA's baseline expectation is that regulated crypto activities are carried on from a UK legal entity. Generally, a UK branch alone will not meet the FCA's minimum standards (FG26/7). The exception is operating a QCATP. An overseas operator may apply through a UK branch where this gives UK clients access to global liquidity, but it must explain in its application why the structure fits its business model. Dual-regulated (PRA) firms are assessed case by case (FG26/7, sections 5 and 8).

The threshold conditions in Schedule 6 to FSMA apply from day one: location of offices, effective supervision, appropriate resources, suitability and a viable business model. A UK-incorporated firm needs its head office and registered office in the UK (FCA: our standards). The FCA also expects “mind and management” to sit in the UK, and the holders of SMF16 (compliance oversight) and SMF17 (money laundering reporting) to work from the firm's principal place of business in the UK (PS26/13, ch. 7).

Step 3: Name Your Senior Managers and Controllers

The FCA applies the Senior Managers and Certification Regime (SM&CR) in full to authorised crypto firms. That means the relevant senior management functions, certification functions, prescribed responsibilities and conduct rules (PS26/13). Because the Certification Regime is under government review, the FCA is using a “modification by consent” waiver for that part. Enhanced-tier requirements start at £65bn of backing assets per stablecoin for issuers and £100bn of client assets for custodians. The FCA does not expect many, if any, crypto-only firms to reach those thresholds when the regime starts.

Applications for senior manager approval are attached to the firm's application, along with the details of controllers and close links (FCA form information). Each individual controller must have a criminal record check dated no more than 6 months before the application. In England and Wales that is a standard DBS check, or a basic check for a sole director (FCA: apply for authorisation). The FSMA fit and proper test covers honesty, integrity and reputation, financial soundness and competence. The FCA notes it is “broader” than the test under the MLRs (FCA).

Step 4: Put Capital in Place

Prudential rules are final in PS26/12. A firm's own funds requirement is the highest of three amounts: its permanent minimum requirement (PMR), a fixed overheads requirement (a quarter of the previous year's relevant expenditure), and a K-factor requirement. The PMR depends on the permissions held, and the highest applicable figure applies (CRYPTOPRU 4.2.1R):

• Dealing in qualifying cryptoassets as principal: £750,000
• Issuing a qualifying stablecoin: £350,000
• Safeguarding cryptoassets, arranging qualifying cryptoasset staking, operating a QCATP: £150,000 each
• Dealing as agent, arranging deals: £75,000 each

The FCA's guidance for applicants says firms must show they meet their prudential requirements when the regime goes live, not on the day they submit (FCA webinar Q&A). Forecasts go into the FCA's financial data template, which is submitted with the application (template). The FCA's current proposals contain no requirement for specific types of insurance (same source).

Step 5: Talk to the FCA Before You File (Optional)

The FCA's pre-application support service (PASS) offers optional, free meetings (FCA gateway page; PASS). Requests must describe the business model, products, customer types and the regulated activities the firm intends to apply for. The FCA may ask for any legal advice behind that analysis, and it rejects requests without meaningful supporting information. There is no set limit on the number of meetings, but the FCA can decline repeat requests (FCA webinar Q&A).

Step 6: Build the Application File

The FCA has published the full set of questions in a 73-page information document dated 17 September 2026 (FCA form information). The non-crypto core covers:

• Firm and people: firm details, trading arrangements, SMF applications, controllers, close links and an organisation chart.
• Business model: permissions, a regulatory business plan, projected income (used to calculate first-year fees and levies), financial promotions, financial forecasts and an IT self-assessment.
• Governance: disclosure of significant events, the financial crime framework, a compliance monitoring plan and a complaints policy.

Crypto-specific sections apply only where relevant. They include record-keeping, a personal account dealing attestation, retail appropriateness assessments and, for branch applicants, an international firm risk assessment. There are separate sections for stablecoin issuance (redemption, backing assets), safeguarding (reconciliation, trust arrangements, third-party custodians, a CASS questionnaire), staking, lending and borrowing, intermediaries (order handling, conflicts, market abuse) and trading platforms (rulebook, admissions, market abuse framework, post-trade transparency). The FCA's sample business plan sets out what it expects a plan to cover.

The FCA says it will not review drafts. Documents must be final and signed off. Generic business models are a common reason for delay (FCA).

Step 7: Register on Connect, Pay and Submit

Applications are made only through Connect, which needs a user registration first (Connect registration). Firms already authorised under FSMA apply to vary their permission instead, using the crypto variation of permission form (VoP form; FCA).

Fees. The application fee depends on the FCA pricing category of the activity applied for (FEES 3 Annex 1; FEES 3 Annex 1A):

• Arranging deals, dealing as agent, arranging staking: Category 4, £2,820
• Dealing as principal, safeguarding or arranging safeguarding, issuing a qualifying stablecoin: Category 6, £11,260
• Operating a QCATP: Category 7, £28,150

The FCA's general fees page still lists only the MLR registration fee for crypto firms, also Category 6 (FCA fees). We did not find an FCA worked example of the fee for an application that combines several crypto activities, or of annual fees for crypto firms. The FCA refunds the fee if it rejects an application as incomplete, but not if the firm withdraws or the FCA refuses (FCA).

Step 8: The Assessment and the Clock

FSMA gives the FCA 6 months from receipt of a complete application to make a decision, and a maximum of 12 months for an incomplete one (FSMA s.55V). The FCA's general guidance says the same and adds that it usually has follow-up questions (FCA). A case officer is assigned, and the FCA aims to keep one case officer per crypto application (FCA webinar Q&A). Calls may be recorded.

The FCA will review applications in the order they arrive and expects to decide in-window applications before 25 Oct 2027. It will not speed up late ones (FCA). Firms already serving UK customers that apply in the window can keep operating under the saving provision if no decision has been made by commencement. That protection lasts until the application is determined, and for no longer than two years after commencement (SI 2026/102, reg. 53). The FCA has said firms must notify it when they use the saving provision, but has not yet published how; that will come in a later direction (FCA). Our overview covers the paths for late applicants and non-applicants.

If an application is poor, the firm may be asked to withdraw and reapply. A rejected submission counts as never made for the saving provision, and the date of any new submission decides the firm's position (FCA). Refusals follow a warning and decision notice procedure, with a right to refer the case to the Upper Tribunal (FCA refusal process).

Not public: how many crypto applications the FCA has received since 30 Sep 2026, and any average decision time for FSMA crypto applications. The only official timing data concerns MLR registration (our analysis of it).

If You Are Already MLR-Registered

There is no automatic conversion. MLR-registered firms, and firms registered or authorised under the Payment Services or E-Money Regulations, must obtain FSMA authorisation like everyone else (FCA). For these firms the FCA has highlighted market conduct, customer treatment and senior leadership as the main areas to strengthen (FCA). New MLR registrations are still possible until the regime starts, but after 30 September 2026 firms should contact the FCA first. The FCA may accept the FSMA form for both, with one fee (the higher of the two), and advises against applying for MLR registration after 31 July 2027 because of its 3-month decision deadline (FCA). Once the regime starts, crypto firms authorised under FSMA will not need a separate MLR registration (FCA). Our register check shows which major exchanges are on the current list.

Financial Promotions in Brief

Since 8 October 2023, crypto promotions to UK consumers have had to come from, or be approved by, an authorised or MLR-registered firm (PS23/6). Once authorised, a crypto firm communicates its own promotions and no longer needs an s.21 approver. It can also approve promotions for an unauthorised company in its own group. Firms relying on an approver can keep it while their in-window application is pending. Those that do not apply must run off their UK business before 25 Oct 2027 (FCA: s.21 approvers).

After Authorisation

• Register entry. The firm appears on the Financial Services Register with a Firm Reference Number. The FCA's letter sets out the permissions and any limitations or requirements (FCA).
• Handbook duties. The Consumer Duty, COBS, SM&CR, operational resilience and financial crime rules apply, along with the activity rules in PS26/9–PS26/11 (FCA policy statements).
• Ongoing standards. Threshold conditions and the 12 Principles must be met at all times, not only at the gateway (FCA).
• Systems and reporting. RegData registration, notifications and annual attestations (FCA).

The UK Route Next to MiCA and Singapore

The UK applies its existing FSMA framework to crypto rather than a dedicated crypto licence. It is a single national authorisation from one regulator, the FCA, with no passport into the EU. In the EU, firms are authorised as CASPs under MiCA; see our EU hub and who is authorised. Singapore licenses digital payment token providers through MAS and restricts offshore-only businesses; see our Singapore hub and the DTSP rules.

Practical Checklist Before You File

1. Map each product to one of the nine RAO activities and check the exclusions in PS26/18.
2. Confirm the legal entity: a UK company, or a branch only if you operate a QCATP and can justify it.
3. Name the SMF holders (SMF16 and SMF17 working from the UK) and get controllers' criminal record checks no more than 6 months old.
4. Calculate own funds: the highest of the PMR, fixed overheads and K-factor requirements, and show they will be met at commencement.
5. Complete the financial data template and a business plan specific to your model.
6. Prepare final, signed policies: financial crime, compliance monitoring, complaints, records, conflicts, safeguarding.
7. Optionally, request a PASS meeting with a real business description.
8. Register on Connect and budget for the application fee (£2,820 to £28,150 by category).
9. Submit by 28 Feb 2027 if you already serve UK customers.
10. Staff the application so FCA questions are answered quickly; that is part of being “ready, willing and organised”.

Checked against FCA pages, FCA Handbook pages and legislation.gov.uk on 28 Oct 2026. Where the FCA has not published something (decision statistics for crypto applications, the method for notifying use of the saving provision, a combined fee worked example), we say so rather than estimate.