The Financial Conduct Authority opens its authorisation window for cryptoasset firms on 30 September 2026, the first hard deadline in the UK's new statutory regime for crypto.
Applications close on 28 February 2027, and the regime itself goes live on 25 October 2027. That leaves a five-month window to get an application in, followed by roughly eight months before the rules bite.
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made on 4 February 2026. They amend the Regulated Activities Order so that a set of crypto activities become regulated activities under FSMA, meaning firms carrying them on need FCA authorisation.
The activities brought into scope include:
The inclusion of staking and of safeguarding is the part worth reading twice. Both describe things that plenty of DeFi-adjacent businesses already do without thinking of themselves as regulated firms.
The FCA has been explicit that the window is not only for firms coming to it fresh. It also covers firms already authorised under FSMA that need to vary their permissions, payments and e-money firms, firms reaching the market through section 21 approvers, and firms currently registered with the FCA only for money laundering purposes.
That last group matters. Registration under the money laundering regime is not the same thing as authorisation, and a firm holding one does not automatically get the other.
The regulations set the perimeter. They do not, on their own, tell you how the FCA will interpret decentralised protocols, front ends, or governance participation — the questions that matter most to DeFi specifically. Those turn on guidance and supervisory practice that is still forming.
Nothing here is legal advice. If you run something that might fall inside the perimeter, the useful next step is reading the FCA's own regime page and taking proper advice, well before September.