High stakes: UK cryptoasset regulation

The current UK cryptoasset regulation is somewhat piecemeal and limited. This will change in October 2027 when the new regulatory regime comes into force for cryptoassets.

The government has legislated for a new financial services regulatory framework for cryptoassets to support safe innovation and help improve consumer protection. As part of this, in February 2026, the government introduced The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (the Cryptoasset Regulations), which ushers in a new regulatory regime for cryptoassets.

In June 2026, the FCA published the majority of its finalised rules and guidance, and the application window is due to open on 30 September 2026 for a five-month period. If firms apply for authorisation during this period they will benefit from a transitional regime under which they will be able to engage in regulated activities while their application is assessed. As of 25 October 2027, firms will need to be FCA authorised to carry out certain activities related to cryptoassets including issuing a qualifying stablecoin, safeguarding, arranging deals in cryptoassets and staking.

The very short Property (Digital Assets etc) Act 2025 has also confirmed that digital assets – including cryptoassets – are capable of being the object of personal property rights, bringing clarity to this area.^[1]

In this article, we explain the UK's new cryptoasset regulatory regime, the activities that will become regulated, and what UK and overseas firms need to know ahead of October 2027.

What is a cryptoasset?

The Financial Services and Markets Act 2000 (FSMA 2000) (as amended by the Financial Services and Markets Act 2023 (FSMA 2023)) defines a cryptoasset as:

"any cryptographically secured digital representation of value or contractual rights that (a) can be transferred, stored or traded electronically, and (b) that uses technology supporting the recording or storage of data (which may include distributed ledger technology)."

This statutory definition is intentionally broad. FSMA 2023 also gives HMT the power to amend the statutory definition, thus providing an element of 'future-proofing' for this area of regulation.

What is the current UK regulatory framework for cryptoassets?

E-money and security tokens

Broadly speaking, some cryptoassets and cryptoasset activities, where they relate to e-money tokens and security tokens, are already regulated. E-money tokens are regulated as e-money under the Electronic Money Regulations 2011, and security tokens that provide rights such as ownership or the right to repayment of a specific sum of money, are regulated as specified investments under the Regulated Activities Order 2001 (RAO).

cETNs

As of October 2025, the sale of crypto exchange traded notes (cETNs) to retail investors has been permitted on FCA-approved, UK-based investment exchanges.

AML

Since 2021, all cryptoasset firms have needed to be registered with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and comply with anti-money laundering rules.

Financial Promotions

The financial promotion regime also applies to firms looking to promote certain cryptoassets in the UK.

What is being regulated?

The government has described its approach to regulating cryptoassets as following a "same risk, same regulatory outcome" principle. By bringing cryptoassets within the existing regulatory framework, it is seeking to achieve consistency in its regulation between cryptoasset activities and other regulated activities, notwithstanding the important differences between them. The government also intends that the new regime is proportionate, agile and flexible.

Key provisions of the Cryptoasset Regulations include:

Amending the RAO to bring new defined categories of cryptoasset into the regulatory perimeter

These categories are:

• Qualifying cryptoassets: fungible (ie interchangeable with another identical item of the same type and value) and transferable.
• Qualifying stablecoin: a subset of qualifying cryptoassets which reference a national currency and are backed by assets with a view to maintaining a stable value.
• Specified investment cryptoassets: defined as something that meets both the FSMA 2000 definition of a cryptoasset and the FSMA 2000 definition of a specified investment (such as a tokenised interest in an equity).
• Qualifying cryptoasset trading platform (QCATP): a system that allows for the exchange of qualifying cryptoassets for other cryptoassets, a fiat currency, or another asset, similar to a multilateral trading facility.

Creating new designated activities

The Cryptoasset Regulations also include new designated activities related to cryptoassets. Under the designated activities regime established under FSMA 2023, firms do not need to be authorised to undertake the following activities, but the FCA has certain supervisory and enforcement powers in relation to them:

Creating a new cryptoassets admissions and disclosures regime

Public offers of qualifying cryptoassets (eg offering and advertising (or otherwise disclosing information about) qualifying cryptoassets), and the admission of qualifying cryptoassets to trading on a qualifying cryptoasset trading platform will be designated activities.

Establishing a market abuse framework for relevant qualifying cryptoassets

The Cryptoasset Regulations also define and prohibit insider trading, unlawful disclosure of inside information, and market manipulation, under the designated activities regime.

The Cryptoasset Regulations also provide for various consequential amendments to other instruments relating to existing anti-money laundering and financial promotions requirements.

Who will need to be authorised by the FCA?

Firms carrying out any new regulated activities in relation to cryptoassets will need to be authorised by the FCA to do so. The Cryptoasset Regulations do not create a bespoke 'appointed representative' regime for cryptoasset firms equivalent to the existing regime for other regulated activities.

Firms carrying on, or wishing to undertake, by way of business regulated activities in the UK relating to cryptoassets will need to obtain full FCA authorisation or risk committing a criminal offence by breaching the general prohibition set out in FSMA 2000.

Firms with existing FCA authorisation for non-cryptoasset-related activities which intend to begin (or continue) carrying on the new regulated activities will need to apply for a variation to their permissions.

Will overseas cryptoasset firms need to be authorised by the FCA?

The Cryptoasset Regulations will apply to non-UK based cryptoasset firms carrying on certain regulated activities in the UK. This includes the new regulated activity of issuing a qualifying stablecoin: if the three components (offering, redeeming, and maintaining the value) are carried out in the UK, then the issuer will need authorisation.

If the firm is not carrying out these activities in the UK and only issuing qualifying cryptoassets to the UK, they will not require authorisation but will need to comply with the designated activities regime set out above.

The Cryptoasset Regulations also amend s.418 FSMA (carrying on regulated activities in the UK), to require that firms carrying out certain regulated activities which involve the sale or subscription of a qualifying cryptoasset to, or by, a UK consumer, must be authorised to do so, even if they are based overseas. These regulated activities include: operating a QCATP, dealing in qualifying cryptoassets as principal, dealing in qualifying cryptoassets as agent, and arranging deals in qualifying cryptoassets.  

What are the FCA's new cryptoasset rules?

On 30 June 2026 the FCA published its finalised rules and guidance relating to the new regime. The FCA has mostly taken the approach of applying its existing rules and guidance to cryptoasset firms, in line with the 'same risk, same outcome approach' taken by the Government, with some tweaks to take into account the nature of cryptoassets.

The FCA notes that some residual market abuse risk is likely to remain higher than in more established markets, and they will continue to monitor the market and potentially amend the rules as the market develops.

The new rules are contained in new sourcebooks: CRYPTO, COREPRU and CRYPTOPRU, and also in amendments to other parts of the FCA Handbook, including CASS.

The new rules and guidance relate to the following areas:

• The FCA's approach to firms conducting the new regulated cryptoasset activities (CRYPTO 5-10), including operating a QCATP, dealing, arranging, lending and borrowing, staking, safeguarding, and decentralised finance.
• The application of the FCA's rules and guidance to firms carrying out the new cryptoasset regulated activities, including those relating to conduct and firm standards, systems and controls, governance, and the custody of client assets (amendments to various sourcebooks including CASS 17).
• Admissions and disclosures (CRYPTO 3), and market abuse (CRYPTO 4).
• Stablecoin issuance (CRYPTO 2 and CASS 16), including rules relating to backing assets and safeguarding, redemption requirements, and disclosures to holders (for the position relating to the use of stablecoins as payments, see further below).
• The new prudential regime (COREPRU and CRYPTOPRU) – the FCA is separately consulting on guidance on non-handbook guidance on these new rules.
• Guidance on the application of the Consumer Duty, operational resilience, and the approach to international firms.

What further FCA rules and guidance are expected?

The FCA's finalised changes to the Perimeter Guidance Manual (PERG) are due to be published later this summer, further to the consultation published in April.

The FCA intends to consult on tailored guidance on decentralised finance later this year.

The FCA is planning further work on distributed ledger technology, cryptoasset derivatives, audit requirements, resolution of failing cryptoasset firms and financial crime.

How will stablecoins used for retail payments be regulated?

The government is keen to encourage the development of UK-denominated stablecoins, but recognises the risks they may pose. Within the stablecoin regime, the FCA will regulate all UK-issued qualifying stablecoins, including their use in retail payments, on which the government will be consulting later this year as part of its wider review of payments.

Under the regime set out in the Banking Act 2009 (as amended by FSMA 2023) for systemic stablecoins, the Treasury can designate stablecoins which are widely used in payments and therefore may pose risks to UK financial stability as systemic. Once designated, issuers of sterling-denominated systemic stablecoins will then be regulated by both the Bank of England and the FCA.

The Bank of England consulted in November 2025 on its proposed requirements for issuers of sterling-denominated systemic stablecoins, and in June 2026 published its policy statement and draft Code of Practice. These new rules are intended to create a forward-looking regime, putting in place safeguards whilst at the same time enabling innovation and market entry. The Bank of England has updated its policy position, further to its consultation, particularly with regards to backing asset composition and holding limits. The Bank intends to finalise the Code of Practice by the end of this year.

In June the Bank of England and FCA published a joint policy statement, setting out how the two parts of the UK's stablecoin regime will operate in an integrated way, with proportionate requirements for both issuers of systemic and non-systemic stablecoins.

Separately, and as noted above, the government legislated in April this year to carve out certain activities involving UK-issued qualifying stablecoins from the new cryptoasset regime, including arranging and dealing, while the payments reforms are still being completed. The government had received industry feedback that the forthcoming regulatory regime could cause difficulties for firms offering payments services utilising stablecoins. The intention is to include the use of qualifying stablecoins for payments in the regulatory perimeter as part of the general reforms to payment services.

To avoid consumer harm, firms undertaking custody of qualifying stablecoins will still need to be authorised to do so.

Which cryptoasset activities are outside the new regime?

Certain activities will not be included in the new regime:

• if an activity relates to a specified investment (already regulated);
• e-money tokens (regulated under the e-money regime);
• cryptoasset investment advice; and
• mining and validation services.

How should firms prepare for the new UK cryptoasset regime?

The expansion of the regulatory perimeter to bring the most widely used forms of cryptoasset into the FCA's regulatory remit is the most significant upheaval in UK financial services regulation in recent years. Many firms which have not previously had to navigate the FCA's authorisation processes will now find themselves within the regulatory perimeter, with all the obligations that that brings (including in relation to the FCA's Consumer Duty).

The FCA is aiming to support firms as much as possible with the new regime and firms still have time to prepare: the FCA's authorisations gateway for cryptoassets firms opens on 30 September 2026, and firms considering authorisation are already able to seek assistance from the FCA via its pre-application support service (PASS). The FCA has been running a helpful series of webinars to help firms to prepare for authorisations. The FCA has also published a Q&A relating to anti-money laundering for cryptoasset firms.

Firms which are already authorised and wish to undertake one of the new regulated activities will need to apply for a variation of their permission.

Firms which are registered under the MLRs will still need to apply for authorisation, but the FCA has indicated that they will aim not to duplicate requests for information they already have as part of a firm's MLR registration. Firms which are not already registered will not need to apply for MLR registration once the new regulated activities regime goes live.

Whilst the Cryptoasset Regulations do not come into force until October 2027, businesses should start planning now for their implementation. Firms that fail to prepare risk finding themselves on the wrong end of regulatory scrutiny and unable to capitalise on the continued momentum of cryptoasset adoption. If firms miss the authorisation gateway, they may need to halt their cryptoasset activities while they await authorisation.

[1] The Property (Digital Assets etc) Act 2025) also extends to Northern Ireland. An equivalent Scottish statute – the Digital Assets (Scotland) Act 2026 – became law in April 2026.

Many thanks to trainee Alan MacInnes for their help in writing this article.

This publication is a general summary of the law. It should not replace legal advice tailored to your specific circumstances.

© Farrer & Co LLP, July 2026