The FCA's final cryptoasset rules: Preparing for the authorization gateway

On June 30, 2026, the Financial Conduct Authority (FCA) published its final rules and guidance for cryptoasset firms, completing its crypto roadmap and confirming the framework that will govern trading platforms, intermediaries, custodians, stablecoin issuers, and firms arranging staking in the United Kingdom (UK).

For an industry that has worked through years of consultations, the significance lies less in a change in direction and more in certainty. Firms now have a defined perimeter, a published rulebook, and a fixed timeline. The authorization gateway opens on September 30, 2026, and closes on February 28, 2027, ahead of the regime taking full effect on October 25, 2027.

That timeline is tighter than it looks. Authorization is a demonstration that a firm can meet the FCA’s standards from the commencement date, and should not be treated as a form to complete in the final weeks before a deadline. For compliance teams, mapping existing anti-money laundering (AML) frameworks against the new perimeter should start now.

What the final rules introduce

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made by Parliament in February 2026, brought cryptoassets within the FCA’s remit. The final package published in June builds the operational detail on top of that foundation.

Firms carrying out regulated cryptoasset activities will need FCA authorization under the Financial Services and Markets Act 2000 (FSMA). The framework introduces requirements across several connected areas:

• Prudential standards: Firms will need to hold regulatory capital and meet financial resilience requirements calibrated to their activities.
• Market integrity: New rules address insider dealing and market manipulation through a dedicated market abuse regime for cryptoassets.
• Conduct and consumer protection: The Consumer Duty applies, alongside conduct standards drawn from established financial services practice.
• Stablecoin standards: Issuers face tailored rules on asset backing and disclosures, developed jointly with the Bank of England for issuers recognized as systemically important.

The FCA has framed the regime around the government’s guiding principle of ‘same risk, same regulatory outcome’: where a crypto product behaves like a traditional financial product, it faces comparable oversight. Following consultation, the regulator simplified several requirements, including capital rules for stablecoin firms, to better reflect how crypto markets operate.

Why AML registration is not authorization

This is the point most likely to catch firms off guard. Registration under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) will not convert automatically into FSMA authorization. Firms currently registered under the MLRs will need to secure authorization through the gateway, and firms already authorized for other activities will need to vary their existing permissions.

The FCA’s track record here sets expectations. Under the MLR regime, only a minority of applicant firms were approved in the early years, with many either withdrawing or being refused for inadequate submissions. The regulator has been clear that it will not grant authorization unless it is satisfied that a firm can comply from the day the regime applies. A comparable pattern played out in the European Union (EU), where the Markets in Crypto-Assets (MiCA) regulation prompted some firms to exit markets rather than meet the authorization bar.

For AML and financial crime teams, that raises an immediate priority: map your current framework against the new perimeter. Questions may arise, such as: ‘Which activities fall in scope?’ and ‘Where do existing controls meet the FCA’s standards, and where are the gaps?’ Perimeter assumptions that held under the MLR regime may not hold under FSMA, and the cost of external legal advice is now likely lower than the cost of discovering a scoping issue partway through an application.

What compliance teams can do now

Pre-application support meetings became available from July 6, 2026, and the FCA has encouraged firms to engage before the gateway opens. The firms that treat readiness as a structured program, rather than a last-minute application, will be best positioned. Practical steps include:

• Revisit the perimeter assessment: Confirm which of your activities are regulated under the new framework, and challenge historic assumptions about scope.
• Refresh the risk assessment: A comprehensive, current risk assessment remains the foundation of a risk-based approach and underpins much of what the FCA will review.
• Test core AML controls: Review customer due diligence (CDD) and enhanced due diligence (EDD), ongoing monitoring, transaction monitoring, sanctions, politically exposed person (PEP), and adverse media screening against the standards expected of authorized firms.
• Strengthen governance: The Senior Managers and Certification Regime requires a clear allocation of responsibilities and the presence of fit-and-proper individuals in key roles.
• Plan for interconnection: Conduct, prudential, safeguarding, operational resilience, financial crime, and reporting requirements are designed to work as a single operating framework, not a set of standalone projects.
• Track what is still to come: The FCA plans a further policy statement on the regulatory perimeter in September 2026, with later consultations on decentralized finance (DeFi), distributed ledger technology, and updates to its Financial Crime Guide.

Treating authorization as a business transformation rather than a paperwork exercise is the framing that the FCA and its advisers have consistently encouraged.

Build the AML program that authorization depends on.

Strong controls start with a well-designed program. Our guide to anti-money laundering for crypto firms covers how to build and scale one, from risk assessments and core controls to navigating regulatory change, so you can approach the gateway from a position of readiness.

Download the guide

Turning readiness into a competitive advantage

There is a commercial dimension to this. The UK has set out to position itself as a hub for responsible cryptoasset activity, and authorization will increasingly shape which firms can operate, partner with banks, and attract investment. Advisers have framed the regime as a strategic question about where firms base activity and deploy capital, not only a compliance obligation. FCA research found that 8% of UK adults own cryptoassets, and that 26% of non-users would be more likely to invest if the market were regulated. Authorization, in other words, is also a signal of trust to customers and counterparties.

Technology is central to meeting the standard efficiently. Legacy, manual processes make it difficult to evidence consistent monitoring at scale, which is exactly what the FCA will scrutinize. Our AML platform, ComplyAdvantage Mesh, helps crypto firms screen customers and transactions in real time against sanctions, watchlists, PEPs, and adverse media data. Our models analyze risk patterns to prioritize genuine risk and reduce false positives by up to 70%, so analysts spend their time on complex cases rather than clearing noise.

Increasingly, this also means the use of agentic AI. Our agentic workflows are designed to resolve up to 85% of routine alerts autonomously while maintaining regulatory defensibility, giving fast-growing firms a way to scale compliance without scaling headcount at the same rate.

Preparing for the gateway

The direction of travel is now settled, and the timeline is fixed. Between the gateway opening on September 30, 2026, and the regime taking effect on October 25, 2027, firms have a defined window to demonstrate they can meet the FCA’s standards. The teams that begin mapping their AML frameworks against the new perimeter now will have the clearest path through it.