UK Opens Crypto Authorisation on September 30. The FCA Has Approved Roughly 50 Firms in Six Years.

September 30, 2026 is the day Britain stopped promising to regulate crypto and started accepting paperwork for it.

The Financial Conduct Authority opened its crypto authorisation gateway today. That means trading venues, custodians, stablecoin issuers, and lending desks that want British customers can now file for permission to operate. Not a consultation. Not a discussion paper. An application window, with a deadline attached and a fee schedule behind it.

The legal machinery came from the Financial Services and Markets Act 2023, which handed the Treasury power to pull cryptoassets into the same perimeter that already covers stocks, derivatives, and insurance. HM Treasury ran the statutory instrument. The FCA wrote the detailed rulebook earlier this year and finalised it. Firms applying now get assessed against that rulebook, and the regime goes fully live in 2027, when the temporary permissions fade and the operating licences become the only way to trade.

The Transitional Trap

Here's the part that's easy to miss. Firms already on the FCA's money laundering register don't get grandfathered in automatically. They get a runway, and the runway has an end date. Apply inside the window and they can keep serving customers while the regulator reviews the file. Miss the window and they're not in the regime at all.

So how big is the starting grid? Roughly 50 firms hold FCA registrations for cryptoasset activity under the money laundering rules. That's the pool. Six years of applications, somewhere in the region of 350 submitted since 2020, and the FCA has approved about 50 of them. Around 85 percent were withdrawn, refused, or abandoned by the applicants themselves.

Sit with that ratio for a second.

The marketing says decentralized. The paperwork says otherwise.

Who Actually Wins Here

Start with the obvious beneficiary. Large, well-capitalised firms with compliance departments that already exist. A full authorisation isn't a cheap exercise. Legal counsel, financial crime systems, capital requirements, custody arrangements, an audit trail that survives contact with a hostile examiner. That stack runs well into six figures before you've processed a single customer transaction, and it renews every year.

For a startup with twelve employees and a nine-month cash runway, that's not a hurdle. It's a wall.

Is that a failure of the regime? Honestly, no. It's the regime working as designed, and the design intent was always to make the UK a hard place to be a cowboy. Skepticism isn't pessimism. It's due diligence. The problem isn't that the bar is high. It's that the regulator's capacity to process anyone over that bar has never matched its ambition to set it.

Look at the actual bottleneck. An application filed in October 2026 has no guaranteed decision date. The FCA's own timeliness on the crypto register has been measured in years, not months. If a firm applies this autumn and waits eighteen months for an answer, that firm is either burning investor money on lawyers or quietly relocating to a friendlier jurisdiction. Some will do both.

And then there's the incentive question nobody at the FCA wants to answer directly. What happens when the deep-pocketed incumbents get authorised first, the smaller players get stuck in queue, and the market that was supposed to open up ends up concentrated among five or six names? You get a British crypto market that looks a lot like British banking. Safe, supervised, and tiny.

Maybe that's the trade. Maybe that's fine. But then say so out loud, because the industry spent a decade arguing that regulation would bring competition, and the first real test is whether the gate produces new entrants or just a nicer lobby for the ones already inside.

The stablecoin piece deserves its own paragraph. Sterling-denominated stablecoins sit at the centre of this regime, and whoever gets authorised to issue them at scale isn't running a crypto product. They're running a payments business with a government-blessed moat. That's the prize. Everything else is a licensing exercise.

The Burden Sits With the Applicants

Here's my read on what September 30 actually changes. It shifts the burden of proof from the regulator to the firm, permanently. For years, crypto companies got to operate in a grey zone and complain that nobody had told them the rules. That excuse is now dead. The rules exist, they're published, and the application form is live.

Any firm that can't produce clean reserve attestations, a real governance structure, and a named accountable executive shouldn't get a licence. Show me the audit. If the reserves aren't there, the audit will say so, and no amount of community enthusiasm substitutes for a balance sheet that reconciles.

So who loses? Firms that built their entire model on the assumption that the UK would never get its act together. Firms that treated compliance as a cost centre to be minimised. Firms whose custody arrangements are one spreadsheet and a promise. Those businesses don't fail because the FCA is mean. They fail because they were never solvent in the way a regulated entity has to be.

The burden of proof sits with the team, not the community. That's the standard, and it's been the standard since the day the FSMA 2023 powers were drafted.

What the industry gets on September 30, 2026 is a door with a real lock on it. Roughly 50 firms are close enough to reach the handle. The rest have a choice: build the compliance function, or find a jurisdiction that asks fewer questions and offers fewer customers.

Britain just made that choice explicit. The interesting part is how many firms are willing to make the same one back.