FCA Crypto Gateway: What MLR-Registered Firms Must Do

On 30 September 2026 the FCA opened its authorisation gateway for the new UK cryptoasset regime. The application window closes on 28 February 2027. For crypto firms currently registered under the Money Laundering Regulations, this is the most important regulatory deadline they will face, and the financial crime framework sits at the centre of it.

What has changed

Firms carrying on the new cryptoasset regulated activities will need to be authorised under the Financial Services and Markets Act 2000 (FSMA). Registration under the Money Laundering Regulations is no longer enough.

MLR-registered cryptoasset firms do not convert automatically. The FCA is clear that they will need to secure authorisation under FSMA.
Payment and e-money firms registered or authorised under the Payment Services Regulations 2017 or the Electronic Money Regulations 2011 also need FSMA authorisation with the relevant permission if they carry on these activities.
Firms already authorised under FSMA must apply to vary their existing permissions.

Applications are made through the FCA's Connect system.

Why the window matters

The date you apply changes what happens to your business when the regime commences.

Apply within the window

The FCA expects to determine your application before the regime commences. If it has not been finally determined by then, a saving provision allows you to keep providing cryptoasset services until it is.

Apply after 28 February 2027

You can still apply before commencement, but the FCA will not expedite your assessment. If you are not authorised by commencement, you enter the transitional provision, where you can only perform pre-existing contracts and cannot enter into new contracts with existing UK customers or take on new ones.

Do not apply

You must run off your UK cryptoasset business before the regime commences. Continuing without authorisation risks breaching the general prohibition under section 19 of FSMA.

The FCA has not yet confirmed the commencement date on its gateway page. Firms should plan on the basis that the application window is the deadline that matters.

Where financial crime fits

FSMA authorisation is a much higher bar than MLR registration. The FCA will look at whether your business is capable of being effectively supervised, whether you have appropriate resources, and whether your systems and controls are adequate for the risks you run. For a cryptoasset business, financial crime risk is usually the largest of those risks.

Under the MLR registration regime, many crypto applications were withdrawn or refused, frequently because of weaknesses in anti-money laundering controls. There is little reason to expect a lighter touch under FSMA.

What a readiness review should test

In our view, these are the areas an application's financial crime framework needs to evidence, not merely describe:

A business-wide risk assessment written for your actual products, customers, channels and jurisdictions, not a generic template.
Customer due diligence and EDD that address crypto-specific risks, including source of funds and source of wealth for customers funding with cryptoassets.
Sanctions controls covering customers, counterparties and wallet addresses, with a documented approach to alert adjudication.
Travel Rule compliance, which has applied to UK cryptoasset businesses since 1 September 2023, including how you handle transfers to and from unhosted wallets and jurisdictions without the rule.
Blockchain analytics and monitoring appropriate to your volumes, with clear escalation and suspicious activity reporting.
Governance: a capable MLRO, board oversight, management information and evidence that the controls actually operate.
Outsourcing oversight where you rely on third-party providers for screening, analytics or onboarding.

A practical timeline

With the window closing on 28 February 2027, firms that have not started should treat the next four months as follows:

Now to November: an independent gap analysis of your financial crime framework against what the FCA will assess.
December to January: remediation, policy updates and evidence that the controls are operating.
February: final review and submission well before the deadline, not on it.

The FCA also offers optional pre-application meetings free of charge. It notes that it does not provide advice and that firms should consider seeking independent legal or compliance advice.

How we can help

KYCifi carries out gateway readiness reviews of the financial crime framework your application relies on, and helps you close the gaps before you submit. We are not a law firm, and we work alongside your legal advisers on the application itself.

Source: FCA, Cryptoassets: how the gateway will operate. This article is general information, not legal advice.

The FCA crypto gateway is open: what MLR-registered firms must do before 28 February 2027.