UK's FCA Opens Authorization Applications for Bitcoin (BTC) Firms Before October 2027 Regime

Applications Open for the New Regime

The UK's Financial Conduct Authority (FCA) began accepting authorization applications from cryptoasset service providers on September 30, 2026, the first step toward a full licensing regime that takes effect on October 25, 2027. The announcement lands as the Bitcoin (BTC) price holds its ground through a quiet session, but the regulatory clock, not the tape, is what UK operators now watch. Under the incoming framework, UK cryptoasset businesses will fall under FCA authorization and ongoing supervision for the first time, replacing the lighter-touch registration they currently hold under anti-money-laundering rules.

The new regime sets standards across four areas: consumer protection, safekeeping of client assets, market integrity and financial soundness. Firms already operating in the UK that intend to use transitional provisions, which allow continued trading while their application is under review, must file by February 28, 2027. The FCA plans to decide on applications submitted during the window before the October 25, 2027 commencement date. Authorization is not automatic: the regulator states plainly that applicants must demonstrate they meet the requirements, and firms that fall short will lose the ability to offer regulated cryptoasset services in the UK market. Dominic Cashman, who heads the FCA's authorization division, framed the regime as delivering stronger consumer protection alongside a clearer operating environment for businesses, and urged firms to prepare their applications now. The regulator says the framework reflects a joint policy with the UK government that the crypto sector should be defined by integrity and trust as much as growth, with the stated ambition of making the UK one of the world's most trusted jurisdictions for building and investing in cryptoassets.

Custody and Lending Get Different Treatment

The rules the FCA finalized on June 30, 2026 draw a sharp line between collateral and lent-out crypto. Custody operations fall under the CASS 17 chapter of the client asset protection rules, which generally requires customer crypto to be held on trust. Collateral posted by retail customers against borrowed crypto, often used to fund leveraged positions, must likewise remain safeguarded. A firm can only take full ownership of that collateral when the customer has explicitly agreed in advance for debt repayment and the right is exercised under a written contract.

Lending services work differently. Crypto lent out to earn yield can be excluded from the trust safeguarding obligation during the lending period, which means that if the operator fails, customer claims rest on contractual repayment rights and the insolvency process rather than on trust protection. Two further caveats apply. Newly regulated crypto activities remain outside the Financial Services Compensation Scheme even after authorization, and even trust-held assets are not guaranteed to be returned in full if there is a shortfall or deductible costs, with losses shared pro rata among customers. The FCA plans to consult on how failing firms should be handled in late 2026, a process that will help decide how effective these protections are in practice.

From AML Registry to Full FSMA Oversight

Read together, the two developments describe a structural shift rather than a single filing: the UK is moving from an anti-money-laundering registration to comprehensive authorization under the Financial Services and Markets Act. The final rules and guidance published on June 30, 2026 are a completed rulebook, not a proposal, and they bind every cryptoasset service provider operating in or seeking entry to the UK market once the regime commences on October 25, 2027. The February 28, 2027 transitional deadline is the binding constraint for incumbents: miss it and there is no automatic right to keep serving customers while under review. Our view at COINOTAG is that the custody-versus-lending split will force the largest operational rewrites, since yield lending now carries disclosed failure risk that firms must communicate to customers.