UK Crypto Regulation October 2027: What Must Be Ready
Quick answer. Apply by February 28, 2027 so the savings provision lets you keep operating while the FCA decides. On October 25, 2027 the FCA's crypto rules apply, including SYSC 15A resilience, CASS 17 custody, admissions and market abuse.
Video transcript
UK crypto regulation starts on October 25, 2027. But the date that decides whether your business keeps operating is February 28.
There are five dates. Draft guidance comments close November 18, 2026. The application window closes February 28. Incident reporting starts March 18. Final DeFi and perimeter guidance follows by spring. Day one is October 25.
Apply inside the window and the savings provision lets you keep operating while the FCA decides. Apply later and you only get a narrow exemption to perform existing contracts.
The FCA is blunt about late applicants. And existing Money Laundering Regulations registrations do not convert automatically.
From March 18, 2027, incident reporting applies to every firm with a Part 4A permission. Crypto firms join that group once authorized, so runbooks need onchain triggers.
On October 25, these controls must be running, not planned. Operational resilience. CASS 17 custody, including private key management. Documented token admission due diligence. And market abuse surveillance, with onchain wallet monitoring for large platforms.
Your application describes these systems, and the FCA will assess you against them. Write those sections from the system as built and tested.
Guardian maps each date to the controls you need and writes the security, custody and continuity sections from the system as built. Read the full article, or talk to Guardian.
UK crypto regulation arrives in October 2027, but most of the work is due earlier.
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring cryptoasset activities into the FCA's perimeter on October 25, 2027.
The FCA's final rules have been public since June 30, 2026. For an existing business, the date that decides whether it can keep operating is February 28, 2027.
Related posts cover the FCA's draft decentralization guidance, GC26/7 DeFi mapping and token admission due diligence.
This article explains the technical and security side of SI 2026/102 and the FCA's cryptoasset regulation. It is not legal advice; confirm how it applies to you with counsel.
Five dates to plan around
| Date | What happens |
|---|---|
| November 18, 2026 | Comments close on draft perimeter (CP26/36) and DeFi (GC26/7) guidance |
| February 28, 2027 | The FCA application window, open since September 30, 2026, closes |
| March 18, 2027 | Incident reporting (PS26/2) applies to all firms with a Part 4A permission |
| Q1 to spring 2027 | Final DeFi guidance planned for Q1 2027, perimeter guidance for spring 2027 |
| October 25, 2027 | The new cryptoasset activities and the FCA's crypto rules apply |
Final guidance dates differ by source. The GC26/7 document says Q1 2027 and the CP26/36 paper says spring 2027; both web pages say January 2027.
CP26/32 also proposed a 6-month deferral of admission due diligence and disclosure for tokens trading on a platform before its authorization.
FG26/6 and GC26/7 both refer to a forthcoming FCA guidance consultation on distributed ledger technology. Review your perimeter analysis and dependency maps when the final texts arrive.
The legal basis
HM Treasury made SI 2026/102 on February 4, 2026, after each House of Parliament approved a draft. Under regulation 1(2), it comes fully into force on October 25, 2027, the “full commencement day”.
On June 30, 2026 the FCA published its final rules and guidance.
| Document | Covers |
|---|---|
| PS26/9 | Admissions and disclosures (CRYPTO 3) and market abuse (CRYPTO 4) |
| PS26/10 | Stablecoin issuance, including CASS 16 for backing assets |
| PS26/11 | Regulated cryptoasset activities, including CASS 17 safeguarding for custodians |
| PS26/12 | Prudential regime (COREPRU and CRYPTOPRU) |
| PS26/13 | Application of the existing FCA Handbook to cryptoasset firms |
| FG26/5, FG26/6, FG26/7 | Guidance on the Consumer Duty, operational resilience and international firms |
A second instrument, the FSMA 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026, was laid before Parliament in draft in September 2026.
It would add exclusions, including for certain technical services giving access to decentralized protocols. It needs approval by each House and is still listed as a draft.
Existing registrations do not convert. Firms registered under the Money Laundering Regulations need FSMA authorization for regulated activities, after which they no longer register separately under the MLRs.
February 28: the window closes
Regulation 52 required the FCA to set a “relevant application period”. It set the window as September 30, 2026 to February 28, 2027.
Applying inside it matters for two reasons.
- Savings provision (regulation 53). A window applicant can carry on the activity while its application is undetermined, or refused but still open to review.
- Timing. The FCA expects to determine window applications before the regulation begins, and advises applying as early as possible.
The savings chapter ends two years after October 25, 2027.
The second instrument arrived late, so the FCA will give some firms extra time on the arranging-permission parts of an application.
They must show uncertainty over the technical services exclusion materially affected their application, and submit an otherwise complete application in the window.
An application describes systems that must exist on day one: custody, key management, resilience and surveillance.
Write those sections from the system as built and tested. The FCA will assess the firm against them, and supervision will check them after authorization.
If you miss the window
Applying after February 28, 2027 is still possible (regulation 52(5)). But the savings provision covers only applications made during the window.
A firm that applies after the window but before October 25, 2027 falls under regulations 55 and 56 instead.
They give a temporary exemption limited to what is necessary to perform contracts entered into before the relevant day. Firms must notify the FCA and counterparties (regulations 57 and 58).
The FCA is blunt: firms that apply late “will not be able to rely on these provisions and may need to cease carrying on relevant activities until they are authorised”.
A business that does not apply at all is subject to the general prohibition from October 25, 2027.
March 18: incident reporting
PS26/2, published March 18, 2026, creates single FCA, PRA and Bank of England regulations for operational incident and third party reporting from March 18, 2027.
Incident reporting applies to all firms with a Part 4A permission and to payment service providers, among others.
Third party reporting applies to a narrower list, including enhanced scope SM&CR firms, banks, CASS large firms and authorized e-money and payment institutions.
An FSMA-authorized firm adding crypto permissions is in scope from March 18, 2027. A crypto business seeking authorization becomes a Part 4A firm once authorized.
Either way, the incident runbook needs onchain triggers.
October 25: day one
The FCA's made rules come into force on October 25, 2027. These controls must be operating, not planned.
- Operational resilience. SYSC 15A applies to all cryptoasset firms: important business services, impact tolerances, mapping and scenario testing.
- Third parties. FG26/6 says firms should tell the FCA before relying on third parties for critical or important functions, such as MPC or HSM custody infrastructure.
- Custody. CASS 17 applies to client cryptoassets, covering ownership rights, record-keeping, reconciliation and private key management. The FCA's approach to key management is technology-agnostic.
- Admissions. Retail platforms may admit a token only after documented due diligence on its smart contracts and protocol risk (CRYPTO 3.2.5R), with a published disclosure document.
- Market abuse. Platforms and intermediaries need systems and controls against insider dealing, unlawful disclosure and market manipulation.
- Wallet monitoring. Large CATP operators, with average annual revenue of at least £10m over the previous three years, must monitor onchain activity of relevant wallets (CRYPTO 4.7.20R to 4.7.23G).
- DeFi use. Firms using DeFi should have the dependency and admin key mapping GC26/7 describes.
A dated readiness plan
| By | Action |
|---|---|
| November 18, 2026 | Respond to CP26/36 and GC26/7 if relevant; settle your perimeter position with counsel |
| As early as possible before February 28, 2027 | Submit a complete application, with the control inventory, key records and dependency maps it describes |
| March 18, 2027 | If already FSMA-authorized: onchain incident triggers, a reporting runbook and, if in scope, the third-party register |
| Q1 to spring 2027 | Re-run perimeter analysis and DeFi mapping against the final guidance |
| Mid 2027 | Scenario tests: key compromise, custodian or node outages, oracle manipulation, compounded disruption |
| October 25, 2027 | Admission files (or deferral notices, if the FCA confirms the deferral), surveillance live, CASS 17 reconciliations tested, resilience mapping signed off |
What Guardian does
Guardian's regulatory readiness assessment works out which provisions reach your business, including the UK's SI 2026/102, and tests where you stand on each.
It closes the gaps in the order an application or examination will read them, with a gap register by provision.
Guardian writes the ICT, security, custody and continuity sections of an authorization file from the system as built. The legal reading stays with your counsel.
Frequently Asked Questions
What is the FCA application window for crypto firms?
It opened on September 30, 2026 and closes on February 28, 2027. Firms that apply within it can continue the relevant activities under the savings provision in regulation 53 while their application is decided.
What happens if a firm applies after February 28, 2027?
It cannot rely on the savings provision. Applying before October 25, 2027 gives only a temporary exemption to perform contracts entered into before the relevant day. The FCA says late applicants may need to stop until authorized.
Can firms still comment on the FCA's DeFi and perimeter guidance?
Yes, until November 18, 2026. CP26/36 takes comments through the FCA's online response form or by email to cp26-36@fca.org.uk, and GC26/7 through its own online form or by email to gc26-7@fca.org.uk.
Sources
- legislation.gov.uk: The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, SI 2026/102 (made February 4, 2026)
- FCA: Overview of our cryptoassets regime policy statements (June 30, 2026)
- legislation.gov.uk: The Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 (draft statutory instrument)
- FCA: CP26/36 Cryptoasset perimeter guidance (October 21, 2026)
- FCA: GC26/7 Decentralised finance guidance (DeFi) (October 21, 2026)
- FCA: PS26/2 Operational incident and third party reporting (March 18, 2026)
- FCA: PS26/9 Admissions and Disclosures and Market Abuse Regime for Cryptoassets (PDF, June 2026)
- FCA: FG26/6 Guidance on Cryptoasset Operational Resilience (PDF, June 30, 2026)
- FCA: CP26/32 Quarterly consultation paper No. 53 (September 4, 2026)
Be ready for October 25, 2027
Guardian maps the UK provisions that reach your business, tests your controls against each one and writes the technical sections of your application from the system as built.