Running a cryptocurrency exchange in the United Kingdom is no longer just about building a secure platform and finding users. It is about navigating one of the strictest regulatory environments in the world. If you are planning to launch or expand a crypto business in the UK, you need to understand that the Financial Conduct Authority (FCA) does not take 'move fast and break things' seriously. They want you to move carefully and comply fully.
The landscape has shifted dramatically since the early days of crypto deregulation. Today, the rules are split into two distinct phases: the current mandatory registration under anti-money laundering laws and the upcoming, much stricter authorization regime under the Financial Services and Markets Act (FSMA). Getting this wrong means your application gets rejected, or worse, your business gets shut down. Let’s look at exactly what the FCA requires from exchanges right now and what is coming next.
Current Status: The Money Laundering Registration
Right now, if you operate a cryptoasset exchange provider or a custodian wallet provider in the UK, you must be registered with the FCA. This isn’t optional. It started in January 2020 as part of the Money Laundering, Terrorist Financing and Transfer of Funds Regulations. Think of this as the baseline ticket to play. Without it, you are operating illegally.
This registration process is not a simple form fill. The FCA looks closely at your systems to prevent money laundering and terrorist financing. You have to prove you can identify who your customers are (KYC), monitor their transactions for suspicious activity, and report anything weird to the authorities. The Joint Money Laundering Steering Group (JMLSG) provides specific guidance for crypto firms, and the FCA expects you to follow it closely.
There are four possible outcomes when you apply:
- Approval: You are registered and can operate legally.
- Rejection: Your application was incomplete or didn’t meet standards, but you can fix it and reapply.
- Refusal: The FCA decided you don’t meet the requirements. This is harder to overturn.
- Withdrawal: You pulled your application before they made a decision.
Many startups stumble here because they underestimate the documentation needed. You need clear policies on how you handle Politically Exposed Persons (PEPs) and how you assess risk based on FATF guidelines. The FCA wants to see that you have thought through every angle of financial crime prevention before you accept a single pound sterling.
The Big Shift: FSMA Authorization Coming Soon
Registration is just the beginning. The real change is coming with the expansion of the Financial Services and Markets Act 2000 (FSMA). The government is bringing more crypto activities under full financial services regulation. This means moving from simple registration to full FCA crypto authorization. This is a higher bar. It treats crypto firms more like traditional banks or investment platforms.
Under the new framework, several activities will require specific authorization. These include:
- Operating a qualifying cryptoasset trading platform.
- Dealing in qualifying cryptoassets as principal (trading with your own funds).
- Dealing in qualifying cryptoassets as agent (trading on behalf of clients).
- Arranging deals in qualifying cryptoassets.
- Safeguarding qualifying cryptoassets (holding them for clients).
Additionally, issuing stablecoins and providing staking services are treated as separate regulated activities. This creates a comprehensive net. If you do any of these things, you need permission. The goal is to bring consumer protection and market integrity standards to crypto that already exist in traditional finance.
Territorial Scope: Do Overseas Firms Need Permission?
A common question is whether an exchange based outside the UK needs FCA authorization. The answer depends on who you are serving. The new rules extend FCA authority to overseas entities if they serve UK consumers directly or indirectly.
If you are an overseas firm dealing with UK retail consumers (individuals acting outside their trade or profession), you generally need UK authorization for trading platforms, dealing, and arranging deals. However, there is a crucial exception. If you serve UK consumers through a UK-authorized intermediary, you might not need separate authorization. This prevents a chain reaction where every link in the supply chain needs its own license.
Institutional clients get different treatment. Overseas firms serving only UK institutional customers usually do not need authorization for trading or dealing activities, provided those institutions aren’t acting as intermediaries for retail consumers. But if you are safeguarding assets or offering staking services to UK consumers, even overseas firms likely need authorization. The definition of "consumer" is key here. If you are targeting everyday people in the UK, the FCA sees you as a domestic player regardless of where your servers are located.
Stablecoins and Physical Presence
Stablecoin issuers face a unique rule. Unlike other crypto activities that focus on where the customer is, stablecoin issuance focuses on where the business operates. To issue a qualifying stablecoin, you generally need to carry on the activity from an establishment in the United Kingdom. This is a physical presence test.
This means a foreign company cannot just issue a stablecoin and sell it to UK users without having a base here. The FCA wants direct oversight of the entity managing the peg and the reserves. This reflects the systemic risk stablecoins pose compared to volatile cryptocurrencies like Bitcoin. If a stablecoin de-pegs, it can cause wider market instability, so the regulator wants to ensure the issuer is within their jurisdiction and subject to UK law.
High-Level Standards: Principles for Businesses
Once authorized, you must follow high-level standards similar to traditional financial firms. The FCA applies Threshold Conditions and General Provisions to crypto firms just like banks. You also must adhere to the Principles for Businesses (PRIN), though with some tweaks for the crypto context.
For example, Principle 6 (Customers’ Interests) and Principle 9 (Relationships of Trust) are disapplied for transactions entered into on qualifying cryptoasset trading platforms by members. Why? Because the platform operator supervises the trading rules, so the individual broker doesn’t need to bear that specific burden again. Similarly, for professional clients, these principles are relaxed because professionals are assumed to know what they are doing. But for retail clients, the protection remains strong. You still need to act with integrity and skill.
Supervision and Client Asset Safety
The FCA isn’t just granting licenses and walking away. The Supervision (SUP) provisions give them broad powers. They can gather information, appoint skilled persons to audit your books, and vary or cancel your permissions if you misbehave. One critical area is client asset safety.
Custody and safeguarding standards are tightening. The Client Assets Sourcebook (CASS) audit requirements will apply to stablecoin issuers and custodians. This means you must keep client crypto separate from your own corporate funds. If your exchange goes bankrupt, client assets should not be available to your creditors. This segregation is non-negotiable. The FCA wants to ensure that if a firm fails, customers can still get their Bitcoin or Ethereum back. This addresses one of the biggest fears in the industry after high-profile exchange collapses.
Retail Access to Crypto ETNs
While restrictions tighten on direct spot trading for some risky products, access to certain crypto instruments has opened up. In October 2025, the FCA allowed retail access to crypto exchange-traded notes (cETNs). This reversed a ban that had been in place since 2021.
However, this isn’t a free-for-all. These cETNs must trade on FCA-approved, UK-based investment exchanges that are Recognised Investment Exchanges. This ensures the market infrastructure is robust and investor protections are in place. For exchanges, this creates a new product category to offer, but only if they can list on these approved venues. It’s a way for retail investors to gain exposure to crypto prices without holding the underlying asset directly, shifting the custody risk to the note issuer rather than the user.
| Feature | Current MLR Registration | Future FSMA Authorization |
|---|---|---|
| Legal Basis | d>Money Laundering RegulationsFinancial Services and Markets Act 2000 | |
| Scope | AML/CFT compliance only | Full conduct of business & prudential rules |
| Consumer Protection | Limited | High (similar to traditional finance) |
| Client Assets | Basic segregation expected | Strict CASS audit requirements |
| Overseas Firms | Must register if targeting UK | Complex territorial scope rules |
Practical Steps for Compliance
So, how do you actually prepare? First, map your activities. Are you just exchanging? Or are you also safeguarding, dealing as principal, or offering staking? Each activity triggers different requirements. Second, review your AML/KYC procedures against JMLSG and FATF guidance. Don’t use generic templates; tailor them to your specific risk profile.
Third, engage with the FCA early. Pre-application meetings are available. Use them. Ask questions about how they interpret the rules for your specific business model. Finally, budget for compliance. This isn’t a side project. You need dedicated staff, legal counsel, and potentially external auditors. The cost of non-compliance is far higher than the cost of getting it right.
What is the difference between FCA registration and authorization?
Registration is currently required under Money Laundering Regulations and focuses primarily on preventing financial crime. Authorization, which will come under the FSMA framework, is a broader requirement that includes consumer protection, market conduct, and prudential standards similar to those applied to traditional financial institutions.
Do I need FCA authorization if my exchange is based outside the UK?
If you target UK retail consumers directly or indirectly, you likely need authorization for trading and dealing activities. There are exceptions if you work through a UK-authorized intermediary. Institutional-only services may be exempt from some requirements, but safeguarding and staking for UK consumers usually require authorization regardless of location.
When will the new FSMA crypto rules come into effect?
The implementation timeline is still being developed by the FCA and HM Treasury. While the draft legislation is established, specific dates for enforcement depend on further consultations and rule-making processes. Firms should prepare now by aligning with current registration standards and anticipating the stricter future requirements.
Can retail investors buy crypto ETFs or ETNs in the UK?
Yes, as of October 2025, retail investors can access crypto exchange-traded notes (cETNs). However, these must trade on FCA-approved, UK-based Recognised Investment Exchanges. Direct sale of derivatives referencing unregulated cryptoassets to retail clients remains restricted unless structured as approved ETNs.
What happens if I fail to register or get authorized?
Operating without required registration or authorization is illegal. The FCA can issue warnings, impose fines, and seek court orders to stop your business activities. Repeated or severe breaches can lead to criminal prosecution and permanent bans on individuals involved in running the firm.