The opinions expressed here are those of the authors. They do not necessarily reflect the views or positions of UK Finance or its members.

Following the FCA’s final policy statement package in June 2026, the focus is shifting from interpreting the regulatory framework to putting it into practice.

With the authorisation gateway opening on 30 September 2026, firms intending to undertake regulated cryptoasset activities in the UK now need to prepare for what comes next. 

Authorisation will require more than completing an application. Firms will need to demonstrate that the business model, governance, financial resources, technology and controls behind it are ready for the new regime.

The application follows the business model

Every applicant will need to provide standard FSMA information, including its regulatory business plan, governance arrangements, financial forecasts, IT arrangements and financial crime framework.

Additional information required will depend on the activities the firm intends to undertake. Stablecoin issuance, safeguarding, staking, lending and borrowing, intermediary activities and operating a cryptoasset trading platform each bring their own considerations which need to be well-demonstrated. 

This makes the sequencing important. Firms first need to decide what they want to do, which legal entity will do it, and which permissions are required before building the evidence needed for authorisation.

Demonstrating readiness

The new framework goes beyond licensing. Firms will need to consider requirements across:

• Prudential: adequate financial resources, governance and risk management. 
• Governance: clear Board oversight and senior management responsibilities. 
• Conduct: appropriate customer protection, disclosures and market integrity controls. 
• Operational resilience: effective outsourcing, third-party risk management and business continuity. 
• International operations: sufficient UK presence, local decision-making and clear interaction with overseas head offices. 

These requirements need to work together as part of a coherent operating model rather than being addressed separately for the purpose of the application.

The gateway is approaching

The FCA estimates that around 325 firms could be in scope, with 250–400 ultimately expected to be authorised. Around half are expected to apply through a Variation of Permission rather than a new authorisation. 

The application period is expected to run from 30 September 2026 to 28 February 2027. There are three potential routes:

• Apply during the window: firms may benefit from a saving provision if their application is still being determined when the regime commences. 
• Apply late: applications will still be accepted, but firms may be limited to servicing existing contracts during the transition. 
• Do not apply: firms without a valid application will need to run off their UK cryptoasset business before commencement. 

For firms intending to remain active in the UK, this makes preparation ahead of the gateway particularly important. 

The FCA’s Pre-Application Support Service (PASS), open since 11 May 2026, provides an opportunity to engage before submission. PASS does not provide advice or guarantee authorisation, but firms can use the pre-application stage to support their preparation. 

Effective engagement starts with transparency. Firms should be able to explain the applicant's role within its wider group, present a cohesive business plan supported by realistic financial projections, demonstrate appropriate financial crime controls and show that sufficient people and resources are available to support the business. 

Five actions for firms now

As the gateway approaches, firms should:

1. Define the perimeter – confirm activities, products, clients, legal entities and permissions. 
2. Confirm the application route – determine whether new authorisation or a Variation of Permission is required. 
3. Pressure-test the operating model – assess governance, people, outsourcing, custody, technology, financial crime and resilience. 
4. Build the evidence base – prepare the business plan, forecasts, policies, controls and activity-specific evidence. 
5. Engage and remediate early – identify and address material gaps before submission. 

From interpretation to implementation

The framework has been set and the gateway is approaching. Firms now need to move from understanding the requirements to demonstrating that they are ready to operate within them.

The application should ultimately be the output of a clearly defined business and operating model — not the point at which those decisions begin.