FCA Opens Crypto Authorisation: 5 Months to File, 8 Months to Prove It

The UK crypto authorisation window is open. The FCA turned on its gateway on September 30, and the calendar from here's short and unforgiving.

Firms that want to keep serving UK customers under the full regime need their applications in by February 28, 2027. The rulebook itself takes effect on October 25, 2027. Do the math. That's roughly five months of filing runway and about eight months of review sitting between the two dates.

The Timeline

September 30 is the starting gun, not the finish line. From that day, the FCA began accepting applications from firms that plan to operate under the broader permissions regime.

Then comes February 28, 2027. That's the date the regulator wants applications in hand from anyone intending to stay in the UK market. Miss it and you're not banned, technically. You're just filing into a queue that's already been reading other people's paperwork for five months. Ask anyone who's been through a licensing cycle how much that costs.

October 25, 2027 is the switchover. That's when the regime goes live and the old arrangement stops being enough.

The applications themselves aren't a formality. Firms have to show they can handle safeguarding, market integrity, consumer protection and financial resilience. Four categories, and each one is a build project with its own audit trail. Safeguarding means client asset segregation and reconciliation that survives scrutiny on a bad day. Market integrity means surveillance and reporting you can actually demonstrate. Consumer protection has been live since October 2023 on the promotions side, so there's no excuse for showing up with a half-finished marketing funnel.

Here's the part that trips people up. Registration under the money laundering regulations isn't a substitute for authorisation under the incoming framework. It never was. The FCA said so plainly. A firm sitting on an MLR registration and assuming it's grandfathered in is a firm heading for a bad spring.

The Impact

The commercial damage lands before October 2027. Budget cycles are already running. Platforms have to plan capital, headcount, systems and the application itself while still servicing customers and shipping product.

That's the squeeze nobody talks about. You can't pause a live venue for eight months to write a permissions memo.

Here's the relevant code. Every firm doing this properly ends up with a permissions map, and a regulator will read it line by line:

{ "entity": "uk-ltd", "mlr_registration": true, "part_4a_authorised": false, "permissions": ["custody", "staking", "order_execution"], "safeguarding_ready": false }

Look at that last field. That's the one that kills applications. Custody without a working safeguarding model is a rejection with extra steps.

International groups have a separate decision to make. Which UK-facing activities fall inside the permissions regime? A MiCA licence in the EU doesn't answer that question. An approval in Singapore doesn't either. The FCA has been clear that clearance elsewhere carries no weight in London, which is normal for a national regulator and still seems to surprise people.

So who wins? Compliance vendors, custodians already running segregated structures, and mid-sized firms that treated operations like a product two years ago instead of a cost centre. Who loses? Small teams with real users and no path to carry the fixed cost of an authorisation file.

And here's my honest read. A lot of those smaller firms won't apply. They'll geo-fence UK traffic, block UK IPs, and quietly drop the market. That's not consumer protection. That's consumer protection by exclusion, and UK users end up with fewer venues and worse prices. The FCA will count applications and call it a success. Users will count options.

Which raises the question worth asking out loud: is the goal a licensed market, or a small one? Because those aren't the same policy.

Second take, and I'll say it flatly. February 28, 2027 is the only date in this whole sequence that matters. October 25 is theatre. The queue position is the market.

And one more. Filing an application isn't an approval. Plenty of coverage will blur that line over the next year. Watch the FCA register, not the press release. Clone the repo. Run the test. Then form an opinion.

The Outlook

Three things to track from here, all of them observable.

First, who files before February 28, 2027. Big venues will announce. Small ones will go quiet. Both are data.

Second, what permissions they ask for. A custody-only application is a very different business model from one that includes order execution and staking. The permission sets tell you where each firm thinks its revenue is going.

Third, how many applications get withdrawn before October 25, 2027. Withdrawals are the honest number. They're the firms that started the build, saw the gap between their systems and the safeguarding standard, and pulled out. If that count is high, the fixed cost of compliance is worse than anyone modelled.

The FCA's guidance runs to hundreds of pages. Read the sections on safeguarding twice. That's where applicants die, and it's where the winners are already ahead. Ship it to testnet first. Always.

The window is open. It just isn't wide.