AMLBot Academy

Crypto Regulations in the UK 2025 — Post‑Brexit Framework for Digital Assets, AML & FCA Licensing

AMLBot Team

Dec 16, 2025 • 19 min read

Updated: Sep 30, 2026

Summary: A UK crypto business in late 2026 is subject to two regulatory timelines at once. Today, FCA registration under the Money Laundering Regulations remains the operative requirement for in-scope cryptoasset firms, alongside the Travel Rule (in force since 1 September 2023), the financial promotions regime (since 8 October 2023) and CARF data collection (since 1 January 2026). Separately, the FCA's authorization gateway for the new FSMA cryptoasset regime opens on 30 September 2026, the application period closes on 28 February 2027, and the regime itself starts on 25 October 2027. The single most important point for existing firms: MLR registration does not convert into FSMA authorization. A firm holding one may still need to apply for the other.

Note: None of this is legal, tax, or investment advice. UK crypto rules changed substantially during 2026 and some instruments are still being finalized. Verify current requirements before acting.

Note: None of this information should be considered as legal, tax, or investment advice. While we’ve done our best to ensure this information is accurate at the time of publication, laws and practices may change, so please double-check it.

A UK crypto firm can hold a valid FCA registration today and still be unable to operate legally in October 2027. That is not a loophole, an enforcement risk, or a drafting oversight. It is how the transition was designed.

The scale of what that means becomes clearer against the FCA's own registration record. Between January 2020 and 1 August 2026, the regulator received 412 applications for cryptoasset registration under the Money Laundering Regulations and determined 391 of them. Sixty-eight ended in registration — 17%. Two hundred and sixty-three were withdrawn, 46 were rejected before substantive assessment, and 14 were formally refused.

(Source: FCA, "Cryptoasset AML/CTF regime: feedback on good and poor quality applications" — https://www.fca.org.uk/firms/cryptoassets-aml-ctf-regime/feedback-good-poor-applications)

Those 68 firms did the hardest version of UK crypto compliance available at the time. And their registrations will not, by themselves, carry them past 25 October 2027.

That is the shift this article is about. The older framing of UK crypto regulation — a regime under development, consultations pending, rules expected at some point — describes a period that ended during 2026. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made in February. The FCA published its final rules in June, its final perimeter guidance in September, and opens its application gateway on 30 September 2026. Announcing the perimeter guidance, the FCA's executive director for consumers, payments and competition, David Geale, framed the objective plainly: "We are building a crypto regime that firms, consumers and international partners can trust."

In practical terms, that means a UK crypto business now has two distinct compliance questions rather than one. What do I have to comply with today? And what do I need to apply for, and by when, to still be operating after October 2027?

One terminology point before going further, because it causes genuine confusion. "UK crypto licence" is how people search, and it is a reasonable shorthand. But UK law in 2026 distinguishes two different things: registration under the MLRs, which is anti-money-laundering supervision, and authorization under FSMA, which is permission to carry on regulated cryptoasset activities. Calling the current MLR registration a licence blurs a distinction that determines whether a firm can trade in 2028.

UK Crypto Regulation in 2026: What Applies Now?

Before looking at what is coming, it helps to be precise about what is already enforceable. As of late September 2026:

FCA MLR Registration. Status: the current requirement for relevant in-scope UK cryptoasset businesses.

AML and KYC obligations under the MLRs. Status: applicable now, and amended with effect from 30 June 2026.

UK Travel Rule (Part 7A of the MLRs). Status: applicable since 1 September 2023.

Financial promotions regime for cryptoassets. Status: applicable since 8 October 2023, including to overseas firms marketing to UK consumers.

CARF data collection and due diligence. Status: applicable from 1 January 2026.

FSMA cryptoasset authorization applications. Status: gateway opens 30 September 2026; application period closes 28 February 2027.

New FSMA cryptoasset regime. Status: expected to start 25 October 2027.

The first five are live obligations. The last two are the transition. A firm that treats the whole list as future work is misreading the top half; a firm that treats the current regime as sufficient for 2028 is misreading the bottom half. It is also worth noting what the MLR regime is not. FCA registration under the MLRs is AML/CTF supervision. It does not carry the conduct, prudential, disclosure or consumer-protection obligations that the FSMA regime will introduce, which is precisely why the two cannot be treated as versions of the same thing.

Do You Need a Crypto Licence in the UK in 2026?

The answer depends on what your business does, where it does it, and which of the two regimes you are asking about. Both can apply, at different times, to the same company.

FCA Registration Under the Money Laundering Regulations

Since 10 January 2020, businesses carrying on in-scope cryptoasset activities in the UK have fallen under FCA supervision for AML and counter-terrorist-financing purposes. The MLR perimeter covers cryptoasset exchange providers and custodian wallet providers as defined in the regulations. Where a firm is in scope, registration is required before it begins the activity — operating without it is an offence, not a paperwork gap.

One widely repeated claim deserves correction, because the previous version of this guide carried it. It is not accurate that every VASP serving a UK customer must register. The FCA's position is that having UK clients does not by itself mean an overseas business is carrying on cryptoasset business in the UK for MLR registration purposes. The analysis turns on where the activity is actually carried on — establishment, personnel, and how the business operates — rather than on customer location alone.

That distinction matters commercially, and it comes with a trap attached: being outside the MLR registration perimeter does not put a firm outside the financial promotions regime, which is a separate question addressed below.

The MLR gateway also continues to operate through the transition. The FCA has confirmed that firms must keep complying with the MLR registration requirement until the new regime starts, and that new firms may still apply for MLR registration before the FSMA gateway opens if they want to begin trading sooner — while recognizing they will still need to decide whether to apply for FSMA authorisation once that gateway is open.

(Source: FCA, "Cryptoasset firms: registration under the MLRs ahead of the new FSMA regime" — https://www.fca.org.uk/firms/new-regime-cryptoasset-regulation/registration-under-mlrs-ahead-new-fsma-regime)

FCA Authorization Under the New FSMA Regime

From 25 October 2027, firms carrying on the new regulated cryptoasset activities in or to the UK will need FCA authorization — either a new Part 4A permission or a variation of an existing one.

The point that catches most existing firms: an MLR registration does not convert into a Part 4A permission. There is no grandfathering mechanism, no automatic transfer, and no reduced application route by virtue of already being on the cryptoasset register. The FCA has been explicit that firms already registered under the MLRs should prepare to apply for authorization if they intend to carry on the new regulated activities.

That is the real answer to the question people type into search engines. A UK crypto licence, in the sense of a permission to run a regulated crypto business under the broader financial-services framework, is something that does not yet exist for anyone — and the window to apply for it runs from 30 September 2026 to 28 February 2027.

(Source: FCA, "What you need to do when preparing for the new cryptoasset regulatory regime" — https://www.fca.org.uk/firms/new-regime-cryptoasset-regulation/what-you-need-to-do)

For a business weighing the UK against other markets, the structural contrast with the EU is worth stating without editorialising: the UK route is FCA authorisation under FSMA and the FCA Handbook, giving UK-only permission, with the new regime starting in October 2027; the EU route is CASP authorisation under MiCA, which is already applicable and carries passporting across member states. Those are different mechanisms with different geographic reach, and which suits a given business depends on where its customers are. The general mechanics of how crypto licensing works across jurisdictions sit outside the UK-specific picture; everything UK-specific stays here.

The New FCA Cryptoasset Regime: 2026–2027 Timeline

The transition has six dates that matter. Each one closed off a question that was still open a year earlier.

4 February 2026 — the statutory basis. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made, creating the statutory foundation for the new regulatory perimeter and the specified cryptoasset activities within it.

30 June 2026 — the final rules. The FCA published its final policy package covering the regulated cryptoasset activities, stablecoin issuance, custody, prudential requirements, admissions and disclosures, market abuse, and how the FCA Handbook applies to cryptoasset firms. These rules apply to firms granted permission under FSMA on or after 25 October 2027.

(Source: FCA, cryptoasset regime policy statements — https://www.fca.org.uk/publications/policy-statements/cryptoasset-regime)

16 September 2026 — the perimeter guidance. The FCA published PS26/18, its final cryptoasset perimeter guidance, setting out how it interprets which activities fall inside the new regime. The FCA has also indicated it will consult on targeted updates to this guidance following the Government's draft amending regulations.

30 September 2026 — the gateway opens. Firms can submit applications for authorisation, or variations of existing permissions, through the FCA's online system.

28 February 2027 — the application period closes. Applications submitted within this window are the ones the FCA expects to determine before the regime commences, and firms relying on the savings provisions need to file inside it. A firm can still apply after the window and before the regime starts, but the FCA has said it will not accelerate assessment to compensate for a late filing.

25 October 2027 — the regime starts. From this date, carrying on a regulated cryptoasset activity in or to the UK without the relevant authorisation is not permitted.

(Source: FCA, "A new regime for cryptoasset regulation" — https://www.fca.org.uk/firms/new-regime-cryptoasset-regulation)

The thirteen months between the gateway opening and the application deadline are not preparation time. They are the filing period. Preparation had to start before it.

Which Crypto Activities Will Require FCA Authorization?

The perimeter is defined by activity, not by business description. This is the point that most determines whether a given company needs to act. Based on the Cryptoassets Regulations 2026 and the FCA's final perimeter guidance, the relevant categories can include:

operating a qualifying cryptoasset trading platform;
dealing in qualifying cryptoassets as principal;
dealing in qualifying cryptoassets as agent;
arranging deals in qualifying cryptoassets;
safeguarding, or safeguarding and administering, qualifying cryptoassets — custody;
cryptoasset lending and borrowing;
qualifying cryptoasset staking;
issuing a qualifying stablecoin in the UK;
relevant admissions and offers activity where applicable.

Classification depends on what the business actually does, not on whether it describes itself as an exchange, a fintech, a Web3 company or a VASP. A company with one regulated activity buried inside an otherwise unregulated product is in scope for that activity. A company that calls itself an exchange but never touches the regulated function may not be.

Equally, this list should not be stretched by analogy. NFTs, DeFi protocols, gaming tokens and mining are not automatically inside the perimeter, and assuming they are produces the opposite error from ignoring the regime entirely. Where a specific activity does not fall within a defined regulated activity, it is not brought in by resemblance. Firms with unusual models should test their position against the perimeter guidance itself rather than against a summary.

(Source: FCA, PS26/18 Cryptoasset perimeter guidance — https://www.fca.org.uk/publications/policy-statements/ps26-18-cryptoasset-perimeter-guidance)

FCA Authorization Application: What Firms Need to Prepare

The FCA has published the information it expects applications to contain, covering both the standard components any FSMA applicant completes and the cryptoasset-specific sections driven by the applicant's business model. At a high level, a firm should expect to evidence:

the business model, described operationally rather than in marketing terms;
the specific regulated cryptoasset activities for which permission is sought;
governance arrangements and organisational structure;
controllers, senior management and the individuals holding relevant functions;
systems and controls, including financial crime controls;
financial information and projections;
prudential readiness against the requirements applying to the permissions sought;
safeguarding and custody arrangements, where relevant to the activities;
operational resilience;
the compliance framework that will operate once authorised.

What nobody can responsibly tell you is how long your application will take, what it will cost, what your chances are, or what minimum capital figure applies to your business. Those depend on the permissions sought, the complexity of the model, and the quality of what is submitted. Anyone quoting a universal timeline or a guaranteed figure is guessing. The FCA's own registration data is instructive here, though it describes the old regime rather than the new one. When two-thirds of determined applications end in withdrawal, the constraint is rarely the regulator's appetite. It is applications that arrive before the underlying business is ready to be described.

AML and KYC Requirements That Apply Today

AML obligations under the MLRs apply now and will continue to apply through and beyond the transition. For a firm already operating, this is the part of the framework that does not wait for October 2027.

The core requirements are familiar to anyone running a compliant operation: a business-wide risk assessment covering the firm's products, customers, delivery channels and jurisdictions; customer due diligence including KYC for individuals and KYB for corporate clients; enhanced due diligence for higher-risk relationships; ongoing monitoring of the business relationship; transaction monitoring calibrated to the firm's risk profile; sanctions screening at onboarding and on a continuing basis; suspicious activity reporting to the UKFIU without tipping off; recordkeeping; and a governance structure with a Money Laundering Reporting Officer who has the authority and resources to do the job.

These obligations are grounded in the same international baseline most major jurisdictions follow, so firms operating in more than one market will recognize the shape of them from the FATF standards for virtual assets and VASPs. Where they differ meaningfully is in detail and supervision rather than in principle, which is why comparing crypto AML regulations across major jurisdictions is more useful for multi-market firms than treating each regime as unrelated.

2026 Changes to the MLRs

Amendments to the MLRs took effect on 30 June 2026, and several bear directly on cryptoasset businesses. They include changes concerning unusually large and unusually complex transactions, the treatment of high-risk third countries, and — most specifically for this sector — cryptoasset correspondent relationships.

The new Regulation 34A applies to cryptoasset exchange providers and custodian wallet providers entering into a correspondent relationship with a third-country provider. Before establishing such a relationship, the UK firm is expected to gather enough information to understand the respondent's business, assess its reputation and the quality of its supervision, assess its AML and CTF controls, obtain senior-management approval, document the respective responsibilities of each party, and satisfy itself that relevant customer due diligence information can be supplied on request. Correspondent relationships with shell banks are prohibited.

(Source: The Money Laundering and Terrorist Financing (Amendment) Regulations 2026, SI 2026/621, regulation 20 — https://www.legislation.gov.uk/uksi/2026/621/regulation/20/made)

In practical terms, this formalises something many firms were already doing informally: assessing the counterparty before routing value through it. The difference is that the assessment now needs to be documented, approved at the right level, and capable of being produced on request.

UK Crypto Travel Rule

The UK Travel Rule has been in force since 1 September 2023, introduced into the MLRs as Part 7A. It requires cryptoasset businesses to collect, verify and, where applicable, transmit information about the originator and beneficiary of a cryptoasset transfer.

One correction is needed here, because the previous version of this guide stated it incorrectly and the error is common across the industry. It is not accurate to say the UK Travel Rule applies only to transfers above £1,000. The rule applies to relevant cryptoasset transfers more broadly. Monetary amounts affect which information must accompany certain transfers, and what verification is required in specified cases — they do not create a general exemption below which the rule stops applying.

The figures themselves also changed during 2026. The amendments effective 30 June 2026 replaced euro-denominated thresholds in the MLRs with sterling values, including £800 in the relevant provisions. A firm that configured its systems against €1,000 and never revisited it is working from a superseded figure.

The operational substance is unchanged in shape. Where information is missing or incomplete on an incoming transfer, the firm needs a documented process: obtain what is missing where possible, assess the risk, and make a risk-based decision about whether to make the assets available, hold, or reject. And responsibility stays with the UK firm even where a third-party Travel Rule provider handles the technical exchange — outsourcing the mechanism does not outsource the obligation.

Financial Promotions to UK Consumers

This is a current rule, not part of the future FSMA regime, and it catches firms that correctly conclude they are outside the MLR registration perimeter.

Since 8 October 2023, the financial promotions regime has applied to the marketing of qualifying cryptoassets to UK consumers. It applies to UK-facing promotions even where the promoting firm is based outside the UK. A promotion must be communicated through one of the lawful routes available, must be fair, clear and not misleading, and is subject to requirements including risk warnings, client categorization and appropriateness assessments, and restrictions on incentives such as referral bonuses.

The point to hold onto: UK market access and UK financial promotions are two different questions. An overseas firm may sit outside the current MLR registration perimeter in a given set of circumstances and still fall squarely within the financial promotions regime the moment it markets cryptoassets to UK consumers.

(Source: FCA, "Marketing cryptoassets to UK consumers" — https://www.fca.org.uk/firms/cryptoassets/marketing-uk-consumers)

Stablecoin Regulation Is No Longer Just a Proposal

UK stablecoin rules moved from consultation into final and near-final form during 2026, and describing them as prospective is now wrong. The framework splits along a line that determines which regulator a firm answers to.

Non-systemic qualifying stablecoins sit with the FCA. As part of its 30 June 2026 package, the FCA published PS26/10 on qualifying stablecoin issuance, alongside rules on custody and the wider regulated activities. Under the UK regime, the FCA regulates the issuance, custody and admission to trading of UK-issued qualifying stablecoins.

Systemic stablecoins are regulated jointly by the FCA and the Bank of England, once recognised as systemic by HM Treasury. On 22 June 2026, the Bank published its policy statement and draft Code of Practice for sterling-denominated systemic stablecoin issuers, covering backing assets and safeguarding, capital and reserves, issuance, legal claim and redemption, remuneration, and a temporary issuance guardrail.

(Source: Bank of England, policy statement and draft rules on regulating systemic stablecoins, 22 June 2026 — https://www.bankofengland.co.uk/news/2026/june/bank-of-england-launches-policy-statement-and-draft-rules-on-regulating-systemic-stablecoins)

Precision matters on status. The Bank's consultation on the draft Code closed on 22 September 2026, and the Code had not been finalised as of late September. So the systemic framework should be described as settled in policy direction but not yet final in rule form — not as applicable rules, and not as an open question. No stablecoin had been designated systemic by HM Treasury at that point either, which means the joint regime is a structure waiting for its first subject.

CARF Reporting Already Started in 2026

The UK's implementation of the OECD Crypto-Asset Reporting Framework is not a future obligation. It began on 1 January 2026. From that date, in-scope Reporting Cryptoasset Service Providers have been required to carry out due diligence on their users, collect the specified data, and keep records. The first reporting period runs from 1 January to 31 December 2026. The first submission window runs from 1 January to 31 May 2027.

(Source: HMRC, "Reporting cryptoasset user and transaction data" — https://www.gov.uk/guidance/reporting-cryptoasset-user-and-transaction-data)

In practical terms, a firm that has not been collecting this data since January 2026 has a gap it cannot retroactively fill by improving its process now — the reporting period is already most of the way through. The detail of what counts as in-scope, which users must be documented and what the data set contains is covered in the CARF requirements for crypto businesses.

What Crypto Firms Should Do Before October 2027

This is a transition exercise, and the sequencing matters more than the length of the list.

Confirm your current MLR registration status, and whether it remains required for your activities.
Map what the business actually does against the final FCA perimeter guidance, activity by activity.
Determine which FSMA permissions will be required, including whether a variation of an existing permission is the right route.
Prepare and submit the application within the 30 September 2026 to 28 February 2027 window.
Review governance and senior-management structure against what the new regime expects.
Test AML, KYC and transaction-monitoring controls against current MLR obligations, including the June 2026 amendments.
Assess prudential requirements attaching to the permissions sought.
Review custody and safeguarding arrangements where the business holds client assets.
Review conduct requirements, including Consumer Duty considerations, for the future regime.
Review operational resilience arrangements.
Confirm financial promotions compliance now, independently of the authorization project.
Confirm CARF data collection has been running since January 2026.

Two of those deserve emphasis. The perimeter mapping should come before any decision about what to apply for, because applying for the wrong permissions is a slower failure than applying late. And the financial promotions and CARF items are not part of the authorization project at all — they are live obligations that continue regardless of how the FSMA application goes.

For firms already operating, the practical reading of the FCA's registration history is that applications fail on readiness rather than on ambition. The businesses that struggled were not the ones with unusual models; they were the ones that could not evidence how their controls actually worked.

Two Timelines, One Compliance Plan

In September 2026, the UK crypto regime is not a hypothetical under consultation. It is in authorization transition, with the rules largely defined and the filing window opening.

That leaves a crypto business with two tasks running in parallel. Today: comply with the obligations already in force — MLR registration where required, AML and KYC controls, the Travel Rule, financial promotions, and CARF data collection. Next: determine whether the business will carry on regulated cryptoasset activities under the new regime, and if so, prepare and file an application in the window that closes on 28 February 2027, ahead of the regime starting on 25 October 2027.

Those are different projects with different deadlines, and the most common mistake available right now is assuming the first one covers the second.

If it would help to pressure-test where your current AML, KYC and transaction-monitoring controls stand against both the MLR obligations in force today and what the FSMA application will ask you to evidence, that gap analysis is considerably cheaper before the filing window closes than after it.

FAQ

Is Crypto Regulated in the UK in 2026?

Yes, across several separate frameworks. In-scope cryptoasset businesses require FCA registration under the Money Laundering Regulations and must meet AML and KYC obligations. The Travel Rule has applied since September 2023 and the financial promotions regime since October 2023. Separately, the new FSMA cryptoasset authorisation regime is in its application phase, with the regime itself starting in October 2027.

Do I Need a Crypto Licence in the UK?

"Crypto licence" is a common search term, but UK law distinguishes two things. Relevant firms operating in scope currently need FCA registration under the Money Laundering Regulations. Businesses carrying on regulated cryptoasset activities under the new regime will require FCA authorisation under FSMA from October 2027. Which applies to you depends on your activities and when.

What Is the Difference Between FCA Crypto Registration and Authorisation?

MLR registration is anti-money-laundering supervision: it confirms the FCA supervises the firm for AML and CTF purposes. FSMA authorisation is permission to carry on regulated cryptoasset activities under the broader financial-services regime, carrying conduct, prudential and consumer-protection obligations. MLR registration does not automatically become FSMA authorisation.

When Can Crypto Firms Apply for FCA Authorisation?

The application period runs from 30 September 2026 to 28 February 2027. Applications filed within that window are the ones the FCA expects to determine before the new regime commences, and firms wishing to rely on the savings provisions need to apply inside it. Later applications remain possible but without accelerated assessment.

When Does the New UK Crypto Regime Start?

The new FSMA cryptoasset regime is expected to come into force on 25 October 2027. From that date, carrying on a regulated cryptoasset activity in or to the UK requires the relevant FCA authorisation or an applicable exclusion.

Do Existing FCA-Registered Crypto Firms Need to Apply Again?

Yes, if they intend to carry on activities regulated under the new FSMA regime. Existing MLR registration alone is not sufficient and does not convert into a Part 4A permission. Firms already on the cryptoasset register should treat the application window as a fresh authorisation project rather than a renewal.

Does an Overseas Crypto Company Need FCA Registration Just Because It Has UK Customers?

Not necessarily. The FCA's position is that having UK customers alone does not automatically mean an overseas business is carrying on cryptoasset business in the UK for current MLR registration purposes. However, the financial promotions regime can still apply when marketing cryptoassets to UK consumers, which is a separate question with its own requirements.

Does the UK Crypto Travel Rule Apply Only Above £1,000?

No. The Travel Rule applies to relevant cryptoasset transfers more broadly. Monetary amounts affect what information must accompany certain transfers and what verification applies in specified cases, rather than creating a general exemption below a figure. Sterling values, including £800, replaced the previous euro-denominated thresholds with effect from 30 June 2026.

Are UK Stablecoin Rules Final?

Partly. The FCA published final rules for qualifying stablecoin issuance in June 2026 as part of its wider policy package. The Bank of England's framework for systemic stablecoins was still being finalised: its policy statement and draft Code of Practice were published on 22 June 2026, and the consultation on the draft Code closed on 22 September 2026.

Does CARF Apply in the UK in 2026?

Yes. Due diligence, data collection and recordkeeping obligations for in-scope Reporting Cryptoasset Service Providers started on 1 January 2026. The first reporting period covers 1 January to 31 December 2026, with first submissions due between 1 January and 31 May 2027.