FCA Finalises The UK Crypto Regime

<table style="border: 1px solid; width: 100%;" border="1"cellspacing="1" cellpadding="5">
Five policy statements create the UK’s new cryptoasset framework. All rules come into force on 25 October 2027. The authorisation gateway application window closes on 28 February 2027.

Why should I read this?

The new Crypto Regime introduces a comprehensive authorisation and supervision regime for cryptoasset firms in place of the previous framework that covered money laundering and financial promotions.

On 30 June 2026, the FCA published five policy statements setting out final rules for the UK’s cryptoasset regulatory framework (Crypto Regime):

• PS26/9 “Admissions & Disclosures and Market Abuse Regime for Cryptoassets”

• PS26/10 “Stablecoin issuance”

• PS26/11 “Regulated Cryptoasset Activities”

• PS26/12 “A Prudential Regime for Cryptoasset Firms”

• PS26/13 “Application of FCA Handbook for Regulated Cryptoasset Activities”

HM Treasury laid the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102) on 4 February 2026 providing the statutory foundation.

The FCA has created a new Cryptoassets sourcebook (CRYPTO). It will apply existing Handbook requirements to cryptoasset firms. The regime covers admissions and disclosures, market abuse, stablecoin issuance, trading platforms, intermediaries, lending, borrowing, staking, safeguarding, prudential requirements, and cross-cutting rules.

A package of 11 FCA Handbook instruments come into force on 25 October 2027. The authorisation gateway application period closes on 28 February 2027. 

Firms with current or planned cryptoasset activities linked to the UK should begin a readiness assessment now. Early planning is critical to identifying authorisation requirements, addressing implementation gaps and preserving business continuity before the October 2027 commencement date.

Firms should first determine whether their current or planned UK-facing activities fall within the new perimeter and, if so, whether they can meet the FCA’s authorisation expectations by the gateway deadline.

What should I do?

Firms should start a structured readiness programme covering perimeter analysis, authorisation strategy, operating model design and implementation planning:

• Map the UK nexus of your activities

Assess whether services are being provided in or to the UK. Identify any targeting of UK clients. Assess whether overseas group entities need a UK legal entity, branch or revised cross-border operating model.

• Assess whether you need authorisation

The new regime brings cryptoasset trading platforms, intermediaries, stablecoin issuers, lending and borrowing platforms, staking providers, and custodians within the FCA’s regulatory perimeter. Review your activities against the statutory instrument.

• Apply for authorisation before 28 February 2027

The gateway application period closes on that date. Preparing an application is likely to require substantial lead time, including perimeter analysis, business plan development, governance documentation, financial projections, wind-down planning, systems and controls evidence, and senior management mapping. The FCA will not accept late applications from firms that were aware of the requirement.

• Review your governance and systems

The Senior Managers and Certification Regime (SM&CR), operational resilience requirements (SYSC 15A), and Consumer Duty apply in full. Map your senior management functions, certifiable roles, and conduct rules responsibilities now.

• Prepare for prudential requirements

The new COREPRU and CRYPTOPRU sourcebooks impose capital requirements based on a K-factor framework. Model your own funds requirements under the new regime.

• Review your admissions and disclosure processes

Firms operating or intending to operate a qualifying cryptoasset trading platform (UK QCATP must prepare qualifying cryptoasset disclosure documents (QCDDs) and upload those documents to the FCA’s centralised repository.

• Assess your market abuse compliance

The market abuse regime for cryptoassets (MARC) prohibits insider dealing, unlawful disclosure of inside information, and market manipulation. Build surveillance systems and compliance procedures.

• Review stablecoin backing arrangements

Firms intending to issue qualifying stablecoins should review their planned backing asset composition, redemption processes, and safeguarding arrangements. They should compare these arrangements with the finalised requirements.

• Map your financial crime obligations

SYSC 6, the Financial Crime Guide (FCG), and Financial Crime Thematic Reviews (FCTR) apply. The Money Laundering Regulations and FSMA financial crime regimes operate in parallel.

• Engage with industry consultations

The FCA intends to consult in September 2026 on proposed 6-month deferral arrangements for the admissions and disclosures regime for cryptoassets already in circulation.

Key risks for firms

Firms should pay particular attention to the following risk areas:

• Perimeter

Misclassifying activities or assuming that overseas structures avoid UK authorisation requirements.

• Timing

Underestimating the time needed to prepare a credible gateway application and implement required systems and controls.

• Governance

Failing to allocate clear senior management responsibility for cryptoasset activities, prudential compliance, safeguarding, financial crime and operational resilience.

• Client assets

Not building CASS 17 and trust arrangements into product and custody models early enough.

• Disclosure and market abuse

Treating QCDDs and MARC compliance as disclosure-only exercises rather than integrated governance, surveillance and escalation processes.

• Prudential

Failing to model capital and liquidity requirements across business lines, including stablecoin issuance, safeguarding, staking and trading activity.

What do I need to know about the Crypto Regime?

PS26/9: Admissions and disclosures and market abuse

PS26/9 sets out the FCA’s final rules on admissions and disclosures (A&D) and MARC. These rules are central to the new regime how cryptoassets can be admitted to trading in the UK and how market integrity obligations will apply to cryptoasset markets.

Admissions and disclosures

UK QCATPs act as gatekeepers for admissions to trading. A retail UK QCATP must conduct due diligence before admitting a qualifying cryptoasset. It must ensure publication and upload of a QCDD to the FCA’s centralised repository.

QCDDs must include a summary of key information (limited to two pages of A4), governance mechanisms, technology, and risks. The FCA requires the Digital Token Identifier (DTI) standard.

Issuers must publish a supplementary disclosure document (SDD) before admission if a significant new factor, material mistake, or material inaccuracy triggers this requirement. A protected forward-looking statements (PFLS) regime applies to QCDDs. The regime is modelled on the prospectus rules. Investors have withdrawal rights.

The FCA has disapplied the Consumer Duty for QCDDs and SDDs. It applies to all other activities.

Third parties can seek admission of UK-issued qualifying stablecoins to UK QCATPs. Multi-currency stablecoins are out of scope.

The FCA intends to consult in September 2026 on proposed 6-month deferral arrangements for cryptoassets already in circulation. This may extend the QCDD admission requirement to April 2028.

Market abuse regime for cryptoassets (MARC)

MARC prohibits insider dealing, unlawful disclosure of inside information, and market manipulation. The FCA has adopted an industry-led framework with additional obligations for large UK QCATPs (those with average revenue of £10 million or more per year over three years).

Large UK QCATPs must conduct on-chain monitoring and share information with other platforms. All UK QCATPs must disclose inside information on their website, disseminate it via social media and other channels, and upload it to the FCA’s centralised repository. Delayed disclosure is permitted in certain circumstances (for example, security vulnerability).

The FCA provides non-exhaustive examples of inside information. These include admissions, cancellations, stablecoin value or redemption issues, code vulnerabilities, blockchain forks, airdrops, burning of tokens, and market maker changes.

The FCA specifies legitimate cryptoasset market practices.

PS26/10: Stablecoin issuance

PS26/10 sets out final rules for non-systemic UK-issued qualifying stablecoins. The rules cover issuance, backing assets, redemption, safeguarding, and disclosures. For stablecoin issuers, these rules drive product design, treasury management, redemption operations, safeguarding arrangements and disclosure controls.

Backing assets

Core backing assets are limited to on-demand deposits and short-term government debt instruments. Issuers can use expanded backing assets with notification and conditions. These conditions include risk management and backing asset composition ratio (BACR) compliance.

The on-demand deposit requirement (ODDR) is 5%. Backing assets are held on statutory trust. A 5% excess is permitted in the backing asset pool.

Issuers are prohibited from passing interest or income from the backing asset pool to tokenholders. Third-party rewards from the issuer’s own account are permitted.

Redemption

Tokenholders can redeem at par value. The timeline is T+1. KYC checks must be completed before the redemption period begins.

Disclosure

Issuers must publish stablecoin-specific QCDDs. Website disclosures must include total stablecoins in circulation, backing asset composition, and redemption information. Backing asset information must be updated quarterly. An annual independent review must confirm the 1:1 ratio between the stablecoin pool and the backing asset pool.

Systemic stablecoin issuers

The Bank of England and FCA will jointly regulate systemic stablecoin issuers. The Bank of England requirements include: a maximum of 70% UK sovereign debt (under 6 months’ maturity); a minimum of 30% central bank deposits; a £40 billion per-coin temporary issuance guardrail; and T+0 redemption.

PS26/11: Regulated cryptoasset activities

PS26/11 sets out final rules for trading platforms, intermediaries, lending and borrowing, staking, safeguarding, and decentralised finance (DeFi). These rules matter to firms operating trading venues, custody models, order routing arrangements, lending products, staking services or business models involving DeFi.

Trading platforms

UK QCATPs must have a UK presence. The FCA prefers a UK legal entity. Branch authorisation is possible for overseas QCATPs in certain circumstances. UK retail investors can access qualifying cryptoassets only if they are admitted to trading on a UK QCATP with a QCDD.

The FCA requires market-maker and algorithmic trading rules, and kill switch capabilities for UK users. Principal dealers are removed from pre-trade transparency requirements. Settlement must be initiated within 24 hours of trade execution.

Best execution

Firms should check prices from at least three reliable UK authorised execution venues where possible.

Intermediaries

Firms must maintain functional separation between proprietary trading and client order execution. Payment for order flow (PFOF) is unlikely to meet requirements for retail or professional clients.

Lending and borrowing

The FCA prohibits the use of proprietary tokens for retail lending and borrowing services. Retail clients have negative balance protection. Collateral supplementation is limited to 50% of original collateral value for retail clients. Title Transfer Collateral Arrangements (TTCAs) are prohibited for retail clients.

Staking

Firms must give retail clients 12 months’ notification of material changes to staking arrangements.

Safeguarding (CASS 17)

Client cryptoassets must be held on trust. The FCA permits a settlement float of up to 2% of each client’s cryptoassets (per client, per cryptoasset class) outside the trust. Private key management is technology-agnostic and outcomes-based. Clients must have online access to up-to-date statements of holdings.

DeFi

The existence of an identifiable controlling entity brings DeFi activities within the rules. The FCA will issue separate guidance.

PS26/12: Prudential requirements

PS26/12 introduces two new sourcebooks: COREPRU (core prudential sourcebook) and CRYPTOPRU (cryptoasset-specific prudential sourcebook). Firms should assess prudential impact early. Own funds, liquidity and reporting requirements may affect group capital allocation, balance sheet structure and commercial viability.

Own funds

The capital structure follows CET1, AT1, and T2. Deductions from CET1 include: intangible cryptoassets; cryptoassets not traded on a UK QCATP; cryptoassets that cannot be prudently valued; and cryptoassets issued by the firm or a connected party (except UK-issued qualifying stablecoins).

K-factor framework

The framework is aligned with MIFIDPRU. The K-factors include:

• K-SII (stablecoin issuance): reduced from 2% to 1%

• K-NCP (net cryptoasset position): a single 40% net risk position requirement

• K-CCD (counterparty credit default): 40% volatility adjustment

• K-CCO (client cryptoasset orders)

• K-CTF (cryptoasset trading flow)

• K-RCS (cryptoassets safeguarded)

• K-CCS (client cryptoassets staked)

Non-UK-issued qualifying stablecoins are subject to a 40% position risk requirement. UK-issued qualifying stablecoins are excluded from K-NCP.

Liquidity

A basic liquid assets requirement (BLAR) applies to all CRYPTOPRU firms. An issuer liquid asset requirement (ILAR) applies to UK stablecoin issuers. There is no specific FX risk capital requirement for UK stablecoin issuers.

Disclosure and reporting

A public disclosure framework applies annually. Smaller firms benefit from a proportional minimum requirement (PMR) exemption. The FCA has removed the requirement to disclose own funds to total risk and liquid assets to total risk ratios. It has removed the intraday recalculation requirement.

The overall risk assessment operates as a continuous process.

PS26/13: Application of FCA Handbook

PS26/13 sets out how existing Handbook requirements apply to cryptoasset firms. Cryptoasset firms must meet many of the same governance, conduct, financial crime and operational resilience standards as other FCA-authorised firms.

Consumer Duty

The Consumer Duty applies in full, with limited exemptions for A&D activities. The FCA has published Finalised Guidance FG26/5 “Application of the Consumer Duty to Cryptoasset Firms”.

Financial promotions

UK-issued qualifying stablecoins are excluded from the restricted mass market investment (RMMI) classification. Other qualifying cryptoassets remain classified as RMMIs. Non-UK-issued qualifying stablecoins require additional risk warnings in financial promotions.

SM&CR

SM&CR applies in full. A modification by consent waiver for the Certification Regime is pending the Phase 2 review. Enhanced SM&CR thresholds are: £65 billion in backing assets (per stablecoin product) for stablecoin issuers; and £100 billion (safe custody plus client cryptoassets) for safeguarding firms. The FCA has removed the proprietary trader certification for stablecoin issuance.

Operational resilience and systems

SYSC applies, including operational resilience (SYSC 15A). Distributed ledger technology (DLT)-specific operational resilience guidance will follow.

Financial crime

SYSC 6, the FCG, and FCTR apply. The Money Laundering Regulations and FSMA regimes operate in parallel.

Conduct of business

COBS applies broadly. It is disapplied for non-UK users of overseas QCATPs authorised via a UK branch. A mandatory appropriateness assessment applies under COBS 10 (COBS 10 Annex 4R).

Investor protection

There is no FSCS coverage for cryptoasset activities. The Financial Ombudsman Service has compulsory jurisdiction for retail clients.

ESG

ESG rules apply. No sustainability labels are permitted for cryptoasset products.

International firms

The FCA expects solo-regulated firms to have a UK legal entity. Dual-regulated firms may operate via a branch. The FCA has published Finalised Guidance FG26/7 on the approach to international cryptoasset firms.

Regulatory reporting

Firms must submit baseline regulatory returns at commencement. The FCA will introduce supplementary data collections. The designated investment business (DIB) definition expands to include cryptoasset activities.

Next steps

How Eversheds Sutherland can help

We can support firms throughout the transition to the Crypto Regime, from initial perimeter analysis and authorisation strategy through to implementation, governance, documentation and assurance, including helping you to:

• assess whether your firm’s activities fall within the new regulated cryptoasset activities and whether you need FCA authorisation;

• prepare and submit gateway authorisation applications;

• review and develop your governance framework, including SM&CR mapping and operational resilience arrangements;

• advise on prudential requirements, including capital modelling under the K-factor framework;

• draft and review QCDDs;

• build market abuse surveillance frameworks and compliance procedures;

• advise on stablecoin backing asset arrangements, redemption processes, and safeguarding structures;

• review compliance with the Consumer Duty and financial promotions rules;

• advise on client asset protection and CASS 17 trust arrangements; and

• conduct gap analyses against the new regulatory requirements.