The UK’s new cryptoasset regulatory regime will come into force on 25 October 2027, and the window for submitting applications for authorisation opens in just a few months. For firms that are currently operating in the UK cryptoasset space, whether registered with the FCA as Virtual Asset Service Providers (“VASP”) or operating as existing FSMA authorised businesses, understanding how the application process and associated timelines will work will be critical to enabling the continued operation of your UK cryptoasset business. New entrants to the UK cryptoasset market have a little more leeway on timelines, given that there is no existing cryptoasset business to preserve. This flexibility on timelines will enable new entrants to pay attention to the issues identified by existing participants, feedback from firms and the FCA and build those findings into their own business arrangements and applications.
This article sets out the key elements of the FCA’s authorisation gateway for Crypto Asset Service Providers, the timelines and specific deadlines and the consequences of missing them.
Cryptoasset activities will require FSMA authorisation
From 25 October 2027, any firm wishing to carry on the new regulated cryptoasset activities in the UK will need to be authorised under the Financial Services and Markets Act 2000 (“FSMA”) as a Crypto Asset Service Provider (“CASP”), with the specific permissions corresponding to the activities that they intend to carry on. This requirement applies regardless of how a firm is currently regulated and, for UK firms currently registered under the Money Laundering Regulations (“MLR”) as VASPs, there is no conversion from the MLR registration to FSMA authorisation. The authorisation requirements represent a significant step-change in regulatory obligations and will require VASPs to allocate significant resources to meet FSMA authorisation requirements (both in terms of application preparation and development of business arrangements).
For firms that are already FSMA authorised in another capacity, for example as an investment firm, the route to obtaining the required cryptoasset permissions will be through a variation of the existing FSMA permissions rather than having to submit an entirely new application for authorisation. Whilst this may be a somewhat more straightforward process given that the firm should already be meeting threshold conditions, governance requirements, maintaining financial resources etc, a variation of permissions exercise is not trivial. Existing arrangements will all need to be reviewed, and updated where necessary, to ensure they meet the new cryptoasset activities.
Firms that are not currently providing cryptoasset services but are considering doing so are not bound by the application window timelines described below. In fact, applying after the initial rush (i.e. outside the application window) may have some practical advantages in terms of being able to incorporate market and regulatory feedback into the application and business arrangements to improve overall quality and the likelihood of success.
The FCA’s authorisation threshold requires applicants to demonstrate that they are “ready, willing and organised”. If you are intending to submit during the application window you should be well advanced in your work to build a business with demonstrable arrangements that can meet this operational threshold.
Pre-application support
From 11 May 2026, prospective CASP applicants have been able to request a Pre-Application Support Service (“PASS”) meeting with the FCA, with meetings being scheduled to take place from July 2026 onwards. Whilst the PASS process is optional, it does provide a valuable opportunity to introduce the firm’s business model and proposed arrangements to the FCA and to seek their clarification on specific questions in relation to your application prior to finalising for submission. It therefore follows that PASS meetings are most productive, for both firms and the FCA, when the firm is relatively advanced in its preparations (of the application materials and the underlying arrangements for being “ready, willing and organised”).
The FCA will expect applicant firms attending PASS meetings to be able to engage meaningfully on the substance of their proposed arrangements rather than seeking to ask general questions about the authorisation process or regulatory requirements. Firms should also note that attending a PASS meeting does not commit a firm to any particular timeline or approach, and does not constitute any form of pre-approval from the FCA. Be aware that the FCA would expect that any clarifications that are made during the PASS process are appropriately reflected in the application materials that are submitted.
It is advisable for applicant firms to seek independent legal and compliance advice as part of their preparatory work. As a minimum, a legal opinion on the permissions required for your services is certainly advisable. A ‘shotgun’ approach to permissions is never a good idea. Well-prepared, professionally supported applications tend to move through the authorisation gateway more efficiently with good quality applications being determined by the FCA in a more timely manner.
The CASP application window
Firms that are currently providing cryptoasset services in the UK should be aiming to submit their application for authorisation during the ‘application window’ in order to benefit from important legal protection. The application window opens on 30 September 2026 and closes on 28 February 2027. Where the FCA has not been able to determine an application that was submitted during the application window the firm is protected by the ‘saving provision’ when the regime commences on 25 October 2027. If the firm fails to become authorised, having submitted its application during the application window, it must run-off its regulated cryptoasset activities and will be able to do so under the protection of the ‘transitional provision’.
The saving provision and the transitional provision
The saving provision allows a firm with a pending application, that was submitted within the application window, to continue operating normally following the commencement of the cryptoasset regime on 25 October 2027, including onboarding new customers, whilst the FCA completes their assessment of the application. This is a significant commercial protection for firms that are currently operating in the UK cryptoasset market, essentially enabling continued business operations under the new regime and until the firm is either authorised as a CASP or the application fails:
- If the FCA authorise the firm, it will seamlessly transition into the new FSMA cryptoasset framework as an authorised CASP.
- If the FCA assessment of the application is not successful, the firm will enter the transitional provision, under which it may only carry on regulated cryptoasset activities to the extent necessary to perform pre-existing contracts, with no capacity to take on new business, while it runs off its UK cryptoasset operations.
UK VASPs that intend to continue providing cryptoasset services after the regime commences on 25 October 2027 should therefore treat submission within the application window as a deadline in order to qualify for these valuable provisions (which cannot be accessed retrospectively).
What happens if you miss the application window?
The FCA will continue to accept applications after the application window ends on 28 February 2027, however, submitting after the close of the application window carries material consequences for firms that wish to continue providing cryptoasset services in the UK after 25 October 2027.
A firm providing cryptoasset services in the UK that applies after the window closes will not have access to the saving provision (described above). Whilst the FCA will continue to assess the application for authorisation, it will not expedite the process to compensate for the late submission. This means that a firm whose application has not been determined by 25 October 2027 will face a genuinely difficult position: it has no saving provision protection, and without authorisation, continuing to carry on regulated cryptoasset activities will put the firm in a legally exposed situation. The firm cannot take on new customers or enter new contracts while awaiting the determination of the FCA’s assessment of their application (which it would be able to do if the saving provision could be applied).
If the FCA ultimately refuses to authorise the firm before the commencement of the new regime on 25 October 2027 the transitional provision will be available during the firm’s run-off.
Missing the application window does not prevent you from applying, but it removes the protections afforded by the saving provision, thereby creating a period of legal uncertainty at regime commencement – an important point to raise to your Board.
What if you do not apply at all?
Firms that do not submit an application for authorisation will need to wind down their UK cryptoasset business before the regime commences on 25 October 2027. Any firm that continues to carry on regulated cryptoasset activities in the UK after that date, and without authorisation, will be in breach of the general prohibition under section 19 FSMA – a criminal offence.
Is rushing an application to make the deadline a sensible approach?
Firms considering submitting an application quickly to secure their position within the application window should proceed with caution since the FCA has confirmed that it will reject applications that do not meet the minimum information requirements without assessing them on their merits. A firm whose application is rejected on this basis will be treated as having not applied at all and will not have access to the saving provision or the transitional provision. The consequences of a rejected “incomplete” application are therefore the same as those of not applying at all. The quality of your application, and underlying business arrangements, is paramount. Do not underestimate the work involved in meeting the FCA’s requirements, not just in terms of the application documents but also the implementation of demonstrable operational arrangements that meet regulatory requirements. A rushed poor quality application that is rejected will defeat its own purpose.
Contact
Dr Thaer Sabri
Managing director
