UK cryptoasset authorisation: a 24-point readiness checklist
This is a readiness checklist for authorisation under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, SI 2026/102. Every item below carries the article, regulation or policy statement it comes from, so you can check it against the source rather than against us. Where a figure comes from an FCA publication rather than the instrument, that is marked.
Twenty-four items, six workstreams. It is not exhaustive, and it is deliberately weighted towards the things that are commonly got wrong.
Perimeter: what you actually do
- 1. Map each business line to the specified activity articles inserted into the Regulated Activities Order by reg. 40 of SI 2026/102: arts. 9M, 9N, 9S, 9T, 9W, 9Y and 9Z6.
- 2. Decide whether you count seven activities or nine, and be able to say why. Art. 9N(1) has two limbs and art. 9Y has two paragraphs, each expressed as a specified kind of activity. Published counts differ — some firms report seven, others nine — and both readings are defensible. Say which you used.
- 3. Do not assume a permission before checking the exclusions. Chapter 2B runs to 25 articles, of which 18 are exclusions, including art. 9Z10 (sale of goods or supply of services by a supplier to a customer), art. 9Z11 (incidental to a profession or business) and art. 9Z9 (staking technical services, including the operation of a validator node, where you do not hold out to the public).
- 4. If you safeguard tokenised securities, read art. 9N in full. Its statutory name is "Safeguarding of qualifying cryptoassets and relevant specified investment cryptoassets". Concluding that the regime does not reach you because your instruments are already specified investments is wrong on custody.
- 5. Test each token against s.88F(2): fungible, transferable, not solely a record of value or contractual rights, and not excluded by s.88F(4).
- 6. For stablecoins, test against s.88G(2) and note the carve-out in s.88G(3): a token referenced to an asset other than a fiat currency is not a qualifying stablecoin even where that asset is expressed in a fiat currency. Commodity-referenced tokens sit outside.
- 7. Check whether the heads stack. Arts. 9V(2), 9X(2) and 9Z5(2) carve arts. 9M, 9S and 9Z6 out of the dealing and arranging heads.
Timing
- 8. Diarise 9:00am on 30 September 2026 to 11:59pm on 28 February 2027. These dates are not in the SI; they come from an FCA direction under reg. 52 published on 20 February 2026.
- 9. Understand what that window is. Reg. 52(5) says a direction "does not prevent applications for a relevant cryptoasset permission being made outside the relevant application period". Nothing closes on 28 February 2027. What ends is eligibility for the reg. 53 saving, and the FCA has said it will not expedite a late application.
- 10. Note that applications have been capable of being made and determined since the partial commencement under reg. 1(3), roughly seven months before the window opens.
- 11. Full commencement day is 25 October 2027 (reg. 1(2)).
- 12. Diarise the longstop correctly. Regs. 53(3) and 55(9) run "2 years beginning with the full commencement day", which includes 25 October 2027 — so the savings cease at the end of 24 October 2029, not on the 25th. Several published notes give the 25th.
Capital
- 13. Identify your highest applicable permanent minimum requirement, not the sum of them. Per the June 2026 policy statements: GBP 75,000 for dealing as agent and arranging; 150,000 for a trading platform, staking and safeguarding; 350,000 for stablecoin issuance; 750,000 for dealing as principal.
- 14. Compute own funds as the higher of the PMR, the fixed overheads requirement and the K-factor requirement. K-SII is 1% of stablecoins issued and K-RCS 0.04% of assets safeguarded (PS26/12).
- 15. Assume no transitional relief on capital. It applies from authorisation.
People and governance
- 16. Assume you are an SM&CR Core firm. The Enhanced thresholds are GBP 100bn in safe custody assets and client cryptoassets combined, and GBP 20bn in backing assets calculated as a three-year rolling average; the FCA does not anticipate many, if any, firms meeting them.
- 17. Build the wind-down plan as an application document, not as a post-authorisation task.
- 18. Write the regulatory business plan first and let the rest of the pack follow it, rather than assembling it last from documents drafted independently.
Offers and disclosure
- 19. If you make an offer, check reg. 11(1)(b): the disclosure obligation is triggered at GBP 500,000 total consideration.
- 20. Check the Schedule 1 exceptions before relying on one — GBP 1,000,000 de minimis (para. 1), offers to fewer than 150 persons (para. 3), GBP 100,000 minimum per investor (para. 4) — and the 12-month aggregation of connected offers in reg. 11(3) and para. 8.
Money laundering registration and post-filing
- 21. Understand that reg. 48 takes authorised firms off the FCA cryptoasset register entirely by substituting MLR 2017 reg. 54(1A). Registration is not converted into authorisation and does not survive it.
- 22. Diarise the replacement notification duty in new MLR reg. 56B: notify before acting or within 28 days of doing so; firms already acting at commencement get 30 days; material changes or inaccuracies 30 days; ceasing 28 days. Breach is enforceable as a relevant requirement.
- 23. If you are refused inside the window, do not assume you drop to reg. 56. Under reg. 53(1)(b)(ii) a refusal that is still open to review keeps the reg. 53 saving, which is materially better.
- 24. If your plans involve distributing UK-issued qualifying stablecoins, check whether HM Treasury has made its draft amending SI, published 21 April 2026, before you scope permissions. As at 18 August 2026 it had not been made. It would insert an art. 9Z10A exclusion for transferring and exchanging relevant qualifying stablecoins — a perimeter the Treasury has already proposed to move.
Two things this checklist does not give you, because they do not exist yet in published form: the FCA application fee, which PS26/14 deferred and which had not been published as at 18 August 2026, and the final perimeter guidance consulted on in CP26/13, which closed on 3 June 2026 and is expected in autumn 2026. Do not budget against either.
The checklist behind this article
The UK gateway checklist is the long-form version of the list above: a readiness document for the FSMA cryptoasset regime with every item cited to an article, regulation or policy statement, every figure marked as instrument text or as FCA reporting of it, and the open questions — the application fee, the final perimeter guidance, the unmade amending SI — left marked as open rather than guessed at. USD 149, with the updated edition free as the position develops.
If your permissions map cleanly onto one or two of the activity heads, the checklist is enough and you do not need us. If it does not — a group structure, tokenised securities alongside qualifying cryptoassets, or a stablecoin distribution model that the draft amending SI would change — there is a 48-hour gap check.