FCA Crypto Regime: Perimeter Guidance and the 30 September Gateway

On 16 September 2026 the Financial Conduct Authority published PS26/18, its perimeter guidance for the new UK crypto regime. The authorisation gateway opens on 30 September 2026. The regime itself comes into force on 25 October 2027. The guidance answers the question firms have been asking since the enabling law appeared: which of my activities actually need FCA authorisation, and which sit outside the perimeter.

The FCA crypto regime does not switch on all at once. Applications open more than a year before the rules bite, because the FCA wants time to assess firms and grant permissions before go-live. That gap is the operational point of PS26/18. A firm that reads the guidance now can map its activities to the regulated list, decide whether it needs to apply, and use the pre-application window while there is still room in it. David Geale, the FCA’s executive director of consumers, payments and competition, framed the guidance as the clarity firms had asked for so they can prepare with confidence.

Related reading: our guide to the FCA cryptoasset authorisation gateway.

The dates that now drive the FCA crypto regime

Deadline urgency is why this topic matters, so start with the calendar. These are the operative dates a UK cryptoasset firm should hold:

• 4 February 2026: the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, SI 2026/102, were made. Most provisions come into force on 25 October 2027; earlier commencement provisions enable FCA rulemaking, guidance, directions, preparatory steps and applications ahead of full commencement.
• June 2026: the FCA finalised its rules and guidance for the regime, published on 30 June 2026.
• 16 September 2026: PS26/18, the cryptoasset perimeter guidance, was published.
• 30 September 2026: the authorisation gateway opens and firms can apply.
• October 2026: the FCA will consult on targeted updates to the perimeter guidance following the Government’s draft amending regulations.
• 25 October 2027: the regime comes into force.

The FCA has formally directed that the relevant application period runs from 9:00am on 30 September 2026 to 11:59pm on 28 February 2027. Applications can be made outside that period, but firms applying outside it cannot rely on the savings provisions tied to the relevant application period. The FCA may amend or replace its direction to extend the period, so firms should monitor the live gateway page for any extension.

Where the FCA crypto regime comes from: FSMA 2023 and the 2026 Regulations

The perimeter guidance is the visible layer. Underneath it sits a chain of primary and secondary law, and reading claims correctly means keeping the layers apart.

Section 69 of the Financial Services and Markets Act 2023 amended sections 21 and 22 of FSMA 2000 so that HM Treasury’s existing powers over financial promotions and regulated activities could be used for cryptoassets, and inserted the FSMA definition of cryptoasset. HM Treasury subsequently used FSMA 2000 powers to make the 2026 Regulations.

It did so in February 2026 through SI 2026/102, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. Those Regulations set the substance of the regime: a public-offers and admissions-to-trading regime for qualifying cryptoassets, a market-abuse regime covering qualifying cryptoassets, disclosure-document requirements, and amendments to the Regulated Activities Order that make specified cryptoasset activities regulated activities. The FCA then finalised the Handbook rules and guidance that fill in the conduct standards, publishing them in June 2026.

PS26/18 is guidance about the edge of that framework. It explains how the law applies to a firm’s activities and which of them may require FCA authorisation. Guidance interprets the perimeter; it does not create it. If a later court or the FCA reads a Regulated Activities Order provision differently, the legislation governs. That distinction matters when a firm’s model sits close to a boundary the guidance describes in general terms.

There is one more moving part. On 15 September 2026 the Government laid the draft Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 before Parliament under the draft affirmative procedure. They are not yet in force; if approved and made, they would introduce targeted exclusions and clarifications and amend the Regulated Activities Order, the Financial Promotion Order and the 2026 Regulations. The FCA has said most crypto firms are unaffected by these changes and can rely on the current guidance to prepare, while it consults in October on the updates the amendments require.

The activities that will need FCA authorisation

PS26/18 covers eight regulated cryptoasset activities: issuing a qualifying stablecoin; safeguarding cryptoassets; arranging cryptoasset safeguarding; operating a qualifying cryptoasset trading platform; dealing in qualifying cryptoassets as principal; dealing in qualifying cryptoassets as agent; arranging deals in qualifying cryptoassets; and arranging qualifying cryptoasset staking. Whether authorisation is required depends on whether the activity is carried on by way of business in the UK and on any applicable exclusion, exemption or transitional provision.

Two of the eight are broader than they look. Dealing covers acting as principal and acting as agent, while arranging covers both bringing about deals and making arrangements with a view to transactions. A referral model may therefore be in scope depending on how it operates, but the FCA perimeter guidance notes that fact-specific exclusions cut back the regulated arranging activities; whether a specific referral or introduction model falls inside or outside the perimeter depends on the exact facts and the applicable exclusions set out in PERG 19.

The classification analysis is not limited to whether a token is a qualifying cryptoasset. The 2026 Regulations define qualifying cryptoassets and qualifying stablecoins, but PS26/18 also addresses specified investment cryptoassets. Existing regulated activities can apply to specified investment cryptoassets, while safeguarding and arranging cryptoasset safeguarding can apply to relevant specified investment cryptoassets. Firms should therefore classify the cryptoasset first and then test the relevant activity and any applicable exclusion.

Operating a trading platform brings more than an operating permission. The 2026 Regulations established a market-abuse regime for qualifying cryptoassets and disclosure-document requirements, so a platform operator should plan for market surveillance and disclosure obligations alongside the authorisation itself. UK-issued qualifying stablecoins are regulated by the FCA. A stablecoin issuer moves into joint Bank of England/FCA regulation only if HM Treasury recognises it as systemic. PRA expectations are relevant where the issuer is a PRA-regulated firm or part of a PRA-regulated group; for that bank-specific prudential context, see the PRA’s capital expectations for tokenised deposits and stablecoins.

Money Laundering Regulations registration is not FSMA authorisation

The two frameworks run in parallel through the transition, which makes them easy to conflate. Since 10 January 2020, businesses carrying on in-scope cryptoasset services in the UK have been subject to FCA AML/CTF supervision and registration requirements under the Money Laundering Regulations 2017; the MLR perimeter is defined by the specified cryptoasset services, including cryptoasset exchange provider and custodian wallet provider activities. That registration is an AML supervisory gateway, and it carries none of the permissions the new regime will require.

The FCA has been explicit that firms currently on the cryptoasset AML register still need to prepare for authorisation under the FSMA regime, and that the two frameworks run in parallel through the transition. An existing MLR registration does not convert automatically into a Part 4A permission. A firm that wants to rely on the savings provisions should submit its Part 4A application during the relevant application period from 30 September 2026 to 28 February 2027.

The AML obligations themselves stay in place. Registered firms remain subject to the Money Laundering Regulations 2017 and to financial-crime rules, and the wider virtual-asset AML expectations, including the FATF travel rule for virtual asset service providers, continue regardless of the conduct regime. The MLR and FSMA regimes remain distinct, but an authorised cryptoasset firm acting as a cryptoasset exchange provider or custodian wallet provider will not need separate MLR registration. It must still comply with the applicable MLR requirements and notification obligations; an existing MLR-registered firm that intends to continue those activities must notify the FCA within 30 days of the regime commencing.

What the perimeter guidance does not settle yet

PS26/18 is described as final guidance, but the FCA has already told the market that part of it will change. The Government’s draft amending regulations introduce exclusions and clarifications, and the FCA will consult in October 2026 on targeted updates to the perimeter guidance to reflect them.

The consultation scope is specific. It covers UK qualifying stablecoins, proprietary trading and market making, certain technology providers, decentralised protocols, safeguarding arrangements that involve central securities depositaries, and financial promotions. A firm sitting in one of those areas should monitor the October 2026 consultation and the FCA’s subsequent final guidance. The FCA says it aims to publish the updated guidance in early 2027. The FCA’s own framing is that most crypto firms are unaffected and can prepare now, so this is a reason to check whether you sit in the affected set before deciding to wait.

PS26/18 explains the authorisation perimeter set by legislation; opening the gateway on 30 September 2026 is the start of the application process, not an authorisation grant. The FCA Handbook rules finalised in June 2026 carry the conduct, prudential and reporting obligations an authorised firm will operate under.

Preparing for the gateway: pre-application support and the Handbook

The FCA has built a runway into the timetable. Pre-application support meetings are available, and the FCA is running webinars on the regime, on applying the Handbook, on getting authorised, and on the prudential framework. An introductory session on the new regulatory regime is available on demand. Firms that have never held a Part 4A permission can reduce the risk of a deficient application by using those channels before submitting.

Authorisation brings the standard FCA supervisory architecture with it. The Senior Managers and Certification Regime will apply to authorised cryptoasset firms, which means allocating prescribed responsibilities to named senior managers and certifying staff who could cause significant harm; the direction of travel there is set out in the 2026 SM&CR reforms. The Consumer Duty applies to relevant retail market business carried on by authorised cryptoasset firms, subject to the final crypto-specific exclusions. In particular, the Duty does not apply to trades entered into by users on a UK qualifying cryptoasset trading platform, and the Admissions and Disclosures regime is outside the Duty for qualifying cryptoassets other than UK-issued qualifying stablecoins; the Duty continues to apply to other relevant retail interactions. A prudential framework sets capital and other requirements. Financial promotions for qualifying cryptoassets are already regulated under section 21 FSMA and the Financial Promotion Order, but the 2026 Regulations amend that regime from 25 October 2027, including the treatment of the article 73ZA exemption. Firms should therefore assess the financial-promotion perimeter alongside Part 4A authorisation rather than assume the current routes remain unchanged.

PS26/18 does not set regulatory returns. Baseline and existing reporting requirements are set through the June 2026 policy statements and Handbook changes, but the reporting build is not fully closed: the FCA says it will develop supplementary questions with firms before commencement, those questions will apply from the outset, and it will make reporting materials and a version of the reporting interface available ahead of commencement. Firms should therefore build to the final Handbook requirements and track the FCA’s pre-commencement reporting materials and supplementary questions.

Reading the perimeter for overseas and borderline models

The hardest calls are at the edges, and the guidance is aimed squarely at them. Three model types repay close reading.

Overseas firms are subject to a two-stage territorial analysis. A firm must first consider whether the activity is carried on in the UK under the ordinary FSMA territorial principles; if not, the cryptoasset-specific deeming provisions in section 418 can still treat certain activities as carried on in the UK where they involve a UK consumer. For this purpose, a consumer is an individual in the UK acting outside a trade, business or profession. An overseas firm should therefore test the specific activity against PERG 19 rather than relying on its place of incorporation.

Decentralised models are the second. Decentralised protocols are named in the October consultation scope, which signals that the treatment of genuinely decentralised arrangements is one of the areas the FCA is still refining. A firm running what it describes as a decentralised protocol should not read the current guidance as the final word on where it sits.

Tokens that look like cryptoassets but fall outside the qualifying definition are the third. A collectible or utility token that is not a qualifying cryptoasset does not pull its issuer into these regulated activities merely because it lives on a distributed ledger. The classification question is separate from the technology, and it is the same discipline the EU applies when it asks whether a token is a financial instrument, which our note on how ESMA classifies crypto-assets as financial instruments works through. The UK perimeter is its own creature, set by the FSMA framework and PS26/18, but the analytical move is familiar: classify the instrument first, then read the activity.

Frequently Asked Questions

We are already on the FCA cryptoasset AML register. Do we still need to apply from 30 September 2026?

Yes, if your activity falls within the new regulated set. Registration under the Money Laundering Regulations 2017 is AML supervision, not conduct authorisation, and it does not convert into a Part 4A permission. The FCA has said registered firms should prepare for authorisation under the FSMA regime, which runs in parallel with the AML register through the transition.

We only arrange staking, we do not custody assets. Is that in scope?

Arranging cryptoasset staking is one of the activities the FCA has named as likely to require authorisation, so a staking-only model is not automatically outside the perimeter. The test is whether the specific activity is a regulated activity under the amended Regulated Activities Order, which is the question PS26/18 is designed to help firms answer.

We are incorporated outside the UK. Does the regime reach us?

It can. PERG 19 applies a two-stage territorial test: first determine whether the activity is ordinarily carried on in the UK, then consider whether a cryptoasset-specific section 418 deeming provision applies. For certain activities, dealings with a UK consumer can bring an overseas firm within scope even where it would otherwise be outside the UK territorial perimeter.

What if the guidance changes after we have applied?

The FCA will consult in October 2026 on targeted updates covering UK qualifying stablecoins, proprietary trading and market making, certain technology providers, decentralised protocols, safeguarding involving central securities depositaries, and financial promotions. If you sit in one of those areas, treat the current guidance as a working position and follow the consultation. The FCA has said most firms are unaffected by the underlying legal changes.

Does issuing a stablecoin only engage the FCA?

Issuing a UK qualifying stablecoin is regulated by the FCA. If HM Treasury recognises a stablecoin as systemic, its issuer moves into joint Bank of England/FCA regulation. PRA expectations are relevant to PRA-regulated firms and groups rather than to standalone stablecoin issuers generally.

Is our NFT collection caught?

Not on the basis of the technology alone. The classification of the token comes first. A token that is not a qualifying cryptoasset may nevertheless be a specified investment cryptoasset, in which case existing regulated activities can apply; safeguarding and arranging cryptoasset safeguarding can also apply to relevant specified investment cryptoassets.

Where do our reporting obligations come from once we are authorised?

PS26/18 does not set regulatory returns. The June 2026 policy statements and Handbook changes establish baseline and existing reporting requirements, but the FCA is also developing supplementary questions that will apply from commencement and plans to publish reporting materials and a version of the reporting interface before the regime starts. Scope the build from both the final Handbook requirements and those pre-commencement reporting materials.

Related Articles

• FCA UK Cryptoasset Regime: The Authorisation Gateway: how the FCA structured the authorisation gateway and the June 2026 rulebook for cryptoasset firms.
• PRA Cryptoasset Capital Expectations for Tokenised Deposits and Stablecoins: the prudential side of stablecoin issuance and how the PRA frames capital and backing.
• MiCAR Token Classification and Reporting Obligations: how the EU classifies ARTs, EMTs and utility tokens, a useful contrast to the UK perimeter.
• MAS Stablecoin Framework Under the Payment Services Act: Singapore’s approach to stablecoin regulation for firms comparing jurisdictions.
• CARF and DAC8 Crypto-Asset Reporting: the tax-transparency reporting layer that applies to crypto-asset service providers alongside conduct rules.
• SM&CR Reforms 2026 and Accountability: the senior-manager accountability framework that authorised crypto firms will operate under.

Key Takeaways

• The authorisation gateway opens on 30 September 2026; the FCA crypto regime comes into force on 25 October 2027. The relevant application period runs from 30 September 2026 to 28 February 2027; firms relying on the savings provisions must apply within that window.
• PS26/18, published 16 September 2026, is perimeter guidance: it tells firms which activities need authorisation, and it does not grant authorisation.
• The legal chain runs from section 69 of FSMA 2023, through SI 2026/102 (the Cryptoassets Regulations 2026), to the FCA Handbook rules finalised in June 2026.
• The regulated cryptoasset activities include issuing qualifying stablecoins, safeguarding cryptoassets, arranging cryptoasset safeguarding, operating a qualifying cryptoasset trading platform, dealing as principal, dealing as agent, arranging deals in qualifying cryptoassets, and arranging qualifying cryptoasset staking. Each activity is subject to its statutory scope and exclusions.
• Money Laundering Regulations 2017 registration is AML supervision, not FSMA authorisation, and does not convert into a Part 4A permission.
• The FCA consults in October 2026 on stablecoins, proprietary trading and market making, technology providers, decentralised protocols, CSD safeguarding, and financial promotions; check whether you are in that set.
• PS26/18 does not set regulatory returns. The June 2026 package establishes baseline and existing reporting requirements, while the FCA is still developing supplementary questions that will apply from commencement and further pre-commencement reporting materials.
• Confirm the application window closing date against the live FCA gateway pages before finalising a submission timeline.

Sources and References

• FCA, Crypto firms get guidance on how the new regime applies (press release, 16 September 2026): fca.org.uk
• FCA, PS26/18: Cryptoasset perimeter guidance: fca.org.uk/publications
• FCA, The new regime for cryptoasset regulation (firms hub): fca.org.uk/firms
• FCA, Cryptoassets information for firms: fca.org.uk/firms/cryptoassets-information
• Financial Services and Markets Act 2023, section 69 (cryptoassets): legislation.gov.uk
• The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, SI 2026/102: legislation.gov.uk/uksi/2026/102
• Draft: The Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026: legislation.gov.uk/ukdsi
• The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017: legislation.gov.uk/uksi/2017/692

What to do before 30 September 2026

The guidance turns a long-dated regime into a near-term task. Before the gateway opens, map each of your activities to the regulated list in PS26/18, decide which permissions you will need, and check whether you sit in one of the areas the October consultation will touch. If you hold a cryptoasset AML registration, log it as what it is and plan the FSMA application separately. Then book a pre-application meeting while the runway is still open. The relevant application period runs from 30 September 2026 to 28 February 2027; firms that want to rely on the savings provisions should file within that window.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.