If you're running or planning to launch a crypto exchange in the UK, the rules have changed-dramatically. As of January 2026, the Financial Conduct Authority (FCA) no longer just wants you to register. You need authorization. This isn’t a form you fill out and forget. It’s a full-scale compliance overhaul that impacts everything from how you handle customer funds to whether you can even serve UK retail investors.
What’s Changed Since 2020?
Back in 2020, the FCA introduced a basic registration system under the Money Laundering Regulations (MLRs). If you ran a crypto exchange or custodial wallet service, you had to register. That was it. No deep review. No ongoing supervision. Just a checkbox to tick before you could operate. That system is gone. The MLR registration still exists as a baseline, but it’s now just the first step. The real gatekeeper is the Financial Services and Markets Act 2000 (FSMA), which came into full force in 2025. Now, if you operate a crypto trading platform, deal in cryptoassets, or safeguard client funds, you need formal FCA authorization. No more gray areas. No more loopholes.The Five Core Activities That Require Authorization
The FCA has clearly defined five crypto activities that trigger mandatory authorization under FSMA:- Operating a qualifying cryptoasset trading platform
- Dealing in qualifying cryptoassets as principal
- Dealing in qualifying cryptoassets as agent
- Arranging deals in qualifying cryptoassets
- Safeguarding qualifying cryptoassets and relevant specified investment cryptoassets
Stablecoins Are a Separate Rulebook
Issuing stablecoins? That’s a whole different ballgame. Under the new rules, you only need FCA authorization if you’re issuing them from a physical office in the UK. If your stablecoin project is based in Singapore or Switzerland but marketed to UK users, you don’t need authorization-unless you’re also doing one of the five core activities above. This is a deliberate move. The FCA wants to control the infrastructure behind stablecoins, not every foreign issuer. But if you’re issuing a GBP-pegged stablecoin from London, you’re now under the same scrutiny as a bank. Expect audits, capital requirements, and strict redemption rules.Who Can You Serve? Retail vs. Institutional
The FCA draws a hard line between retail and institutional clients-and it affects whether you need authorization at all. If you’re an overseas crypto exchange and you only serve UK institutions (hedge funds, asset managers, corporations), you don’t need FCA authorization for trading platforms or dealing activities. But if you’re targeting UK retail investors-people buying crypto for personal use-you’re in the crosshairs. Even if your website is hosted in Estonia, if a UK resident signs up and trades, you need authorization. There’s one exception: if you work through a UK-authorized intermediary, you’re off the hook. For example, if a UK-based broker with FCA permission connects your platform to their clients, you don’t need your own license. This prevents a chain of foreign firms all trying to get UK approval just to reach one customer.
What About Crypto ETNs? Retail Access Is Back
In 2021, the FCA banned retail investors from buying crypto-backed exchange-traded notes (cETNs). That ban lifted in October 2025. Now, UK retail investors can buy cETNs-but only if they’re listed on an FCA-approved UK investment exchange. This isn’t a free-for-all. The cETNs must be issued by regulated entities, trade on recognized exchanges like the London Stock Exchange, and come with strict disclosure rules. The FCA isn’t endorsing crypto. It’s just letting retail investors access it through a controlled, transparent channel.Compliance Isn’t Optional-It’s Built In
The FCA doesn’t treat crypto firms like startups. They’re held to the same standards as banks. That means you must comply with:- Threshold Conditions: Your firm must be financially sound, properly managed, and have adequate systems to prevent financial crime.
- Principles for Businesses: Most apply, but some are modified. For example, you don’t need to act in the best interests of clients on a trading platform if those clients are professional traders.
- CASS Rules: If you hold client crypto or cash, you must segregate it. No commingling. No using it for liquidity. Audits are mandatory.
What Happens If You Don’t Comply?
The FCA doesn’t play around. In 2024, they shut down over 200 unregistered crypto firms. They’ve also issued public warnings against 30+ platforms still operating without authorization. If you’re caught operating without proper authorization:- Your website can be blocked by UK ISPs
- Your bank accounts can be frozen
- Senior managers can be personally fined or banned
- Criminal prosecution is possible for serious breaches
How to Prepare for Authorization
If you’re serious about operating in the UK, here’s your roadmap:- Review the FSMA regulated activities list. Map what your business does against the five core activities.
- Conduct a gap analysis. Compare your current AML, KYC, and custody systems to FCA requirements.
- Apply for MLR registration if you haven’t already. It’s still required, even if you’re preparing for FSMA.
- Book a pre-application meeting with the FCA. They offer these to help firms understand expectations.
- Start building your application package: business plan, compliance manual, organizational chart, financial projections, and evidence of staff training.
- Engage a compliance consultant with FCA experience. Don’t try to wing it. The application failure rate is high.
What’s Next?
The FCA is still refining the rules. They’re consulting on technical standards for cryptoasset custody, staking, and stablecoin redemption. Expect more guidance in 2026. But the core framework is locked in. The message is clear: the UK is no longer a wild west for crypto. If you want to serve UK customers, you need to play by the rules of a mature financial system. That means more cost, more complexity, and more accountability. But it also means legitimacy. The firms that get authorized now will be the ones trusted by institutions, banks, and retail investors in 2027 and beyond.Do I need FCA authorization if I’m based outside the UK?
Yes-if you’re serving UK retail customers. If your platform allows UK individuals to trade, deposit, or withdraw crypto, you need FCA authorization under FSMA, even if your office is in Canada or Dubai. The only exception is if you operate through a UK-authorized intermediary. If you only serve UK institutions (like hedge funds), you don’t need authorization for trading or dealing activities.
What’s the difference between MLR registration and FSMA authorization?
MLR registration is a basic anti-money laundering check. It’s like a business license. FSMA authorization is a full financial services license. It requires proof of financial strength, governance, client asset protection, and ongoing supervision. MLR registration is still required, but FSMA authorization is now the mandatory standard for core crypto activities.
Can I still offer crypto to UK retail investors?
Yes, but only through FCA-approved channels. You can’t sell crypto directly to retail users unless you’re FCA-authorized. However, retail investors can now buy crypto exchange-traded notes (cETNs) listed on UK-based investment exchanges like the LSE. These are regulated financial products, not direct crypto trades.
How long does FCA authorization take?
On average, it takes 6 to 9 months from submission to approval. The FCA reviews applications in detail and often requests additional documentation. Many applications are rejected or withdrawn because firms underestimate the depth of compliance required. Starting early and using experienced advisors significantly improves your chances.
What happens if my application is rejected?
If your application is rejected, you can appeal or resubmit after fixing the issues. But the FCA will publicly list you as an unapproved firm. Your bank may freeze your accounts, and UK payment processors may cut you off. You’ll also be added to the FCA’s warning list, which harms your reputation globally. Don’t submit a weak application. Get help.
Do I need to audit my crypto custody systems?
Yes. Under the CASS rules, any firm safeguarding client cryptoassets must undergo an annual audit by an FCA-approved auditor. The audit checks that client assets are properly segregated, stored securely, and not used for any other purpose. Failure to pass can lead to license suspension or revocation.
This is a game-changer for crypto firms operating in the UK. The shift from MLR registration to full FSMA authorization means you’re no longer just ticking boxes-you’re building a financial institution. The CASS rules alone require serious infrastructure. If you’re not auditing custody systems annually, you’re already non-compliant. Don’t wait until the last minute. Start now.