FCA Crypto Authorization Requirements for Exchanges: UK Rules Explained

Running a cryptocurrency exchange in the United Kingdom is no longer just about building a secure platform and marketing to users. The regulatory landscape has shifted dramatically, moving from basic anti-money laundering checks to a full-blown financial services authorization regime. If you are planning to launch or operate a crypto business targeting UK clients, understanding the difference between simple registration and full FCA crypto authorization is critical. Get it wrong, and you risk heavy fines, forced shutdowns, or legal action.

The Financial Conduct Authority (FCA) has been tightening its grip on the industry since 2020. What started as a mandatory registration under Money Laundering Regulations (MLRs) is evolving into a comprehensive framework under the Financial Services and Markets Act 2000 (FSMA). This means that by late 2026 and beyond, most crypto activities will require formal authorization, similar to how banks or investment firms are regulated today. For exchanges, this isn't just paperwork; it's a fundamental change in how you structure your compliance, custody, and client relationships.

Current Status: MLR Registration vs. Future FSMA Authorization

To navigate the current rules, you first need to understand where things stand right now versus where they are heading. As of mid-2026, the baseline requirement for any firm providing cryptoasset exchange services or custodian wallet services in the UK is registration with the FCA under the Money Laundering Regulations. This system has been active since January 2020. It serves as the entry ticket for operating legally. Without this registration, you cannot offer these services to UK residents.

However, MLR registration is not the same as full financial services authorization. It primarily focuses on preventing money laundering and terrorist financing. The FCA evaluates your application based on four possible outcomes: approval, rejection, withdrawal, or refusal. To get approved, you must demonstrate robust compliance measures, often referencing guidance from the Joint Money Laundering Steering Group (JMLSG). Specifically, Part II, Chapter 22 of the JMLSG guidance outlines what the FCA expects from cryptoasset exchange providers.

But this is only half the picture. The UK government is implementing new provisions under the FSMA to bring crypto assets under the same regulatory umbrella as traditional financial products. This shift introduces "authorization" rather than just "registration." Under FSMA, specific activities become "regulated activities," requiring a much higher level of scrutiny, capital requirements, and ongoing supervision. For exchanges, this means the days of light-touch regulation are over.

Five Core Regulated Activities Under FSMA

The draft legislation under FSMA identifies five core activities that will require FCA authorization. If your exchange performs any of these, you must apply for permission. These are:

• Operating a qualifying cryptoasset trading platform: This covers the infrastructure that allows users to trade crypto assets against each other.
• Dealing in qualifying cryptoassets as principal: When your exchange buys or sells crypto using its own funds.
• Dealing in qualifying cryptoassets as agent: When your exchange executes trades on behalf of clients.
• Arranging deals in qualifying cryptoassets: Facilitating transactions between buyers and sellers without necessarily taking ownership.
• Safeguarding qualifying cryptoassets: Holding or protecting client funds and digital assets.

In addition to these five, qualifying cryptoasset staking and issuing qualifying stablecoins are treated as separate regulated activities with their own distinct authorization paths. This granular approach ensures that every part of the value chain-from holding keys to facilitating trades-is covered by regulatory oversight. For an exchange, this usually means applying for multiple permissions simultaneously, which increases the complexity and cost of compliance.

Territorial Scope: Do Overseas Exchanges Need UK Authorization?

A common question among international platforms is whether they need to comply with FCA rules if they are based outside the UK. The answer depends heavily on who your customers are. The new FSMA framework extends FCA authority to overseas entities that serve UK consumers directly or indirectly. A "consumer" is defined strictly as an individual acting for purposes outside their trade, business, or profession. In plain English, this means retail investors.

If your overseas exchange operates a trading platform, deals as principal or agent, or arranges deals for UK retail consumers, you generally need UK authorization. However, there is a crucial exception designed to prevent regulatory overlap. If an overseas firm deals with UK consumers through a UK-authorized intermediary that already has the necessary permissions, the overseas firm does not need separate authorization. This prevents an "ever-growing chain" of firms from all needing licenses. Instead, the responsibility falls on the local partner who holds the license.

For institutional clients, the rules are more lenient. Overseas firms serving only UK institutional customers do not need UK authorization for trading platforms, dealing, or arranging services, provided those institutions are not acting as intermediaries for retail consumers. This distinction recognizes that professional investors have different protection needs compared to everyday individuals. However, for safeguarding and staking services, overseas firms must still obtain authorization if they provide these services directly or indirectly for UK consumers, with limited exceptions for actions taken at the direction of an authorized person.

Stablecoin Issuance: A Different Rule Set

If your exchange also plans to issue stablecoins, be aware that the rules are different. Stablecoin issuance is a distinct regulatory category. Unlike trading or dealing, which focus on who the customer is, stablecoin issuance focuses on where the activity happens. Firms issuing qualifying stablecoins require UK authorization only if they carry out the activity from an establishment within the United Kingdom. This is known as a "physical presence test."

This approach reflects the unique risks associated with stablecoins, particularly their potential impact on payment systems and financial stability. The FCA wants to ensure that any stablecoin issuer with a significant UK footprint is subject to proper oversight. However, it avoids extraterritorial overreach by not forcing foreign issuers with no UK presence to comply solely because a UK user might hold the token. For exchanges, this means you can list foreign stablecoins without needing authorization for the issuance itself, but you may still need authorization for dealing in or safeguarding them.

High-Level Standards: Principles for Businesses

Once authorized, crypto firms must adhere to high-level regulatory standards that mirror those applied to traditional financial services. This includes meeting Threshold Conditions (COND) and General Provisions (GEN), ensuring you have adequate resources, governance, and operational resilience. The Principles for Businesses (PRIN) also apply, but with some important modifications tailored to the nature of crypto markets.

For example, Principles 1 (Integrity), 2 (Skill, Care and Diligence), 6 (Customers' Interests), and 9 (Customers: Relationships of Trust) are disapplied for transactions entered into on qualifying cryptoasset trading platforms by members. Why? Because the platform operator acts as a supervisor of the trading rules, ensuring fair play among participants. Similarly, for professional clients, Principles 6 and 9 are disapplied when providing trading platform services, recognizing that sophisticated investors can manage their own interests better than retail clients. This nuanced approach balances consumer protection with market efficiency.

Supervision and Compliance Costs

The FCA’s Supervision (SUP) provisions create a comprehensive oversight framework. Authorized firms face information-gathering powers, meaning the regulator can request detailed data at short notice. There are also CASS (Client Asset Sourcebook) audit requirements, particularly for stablecoin issuers and custodians. These audits ensure that client assets are properly segregated and protected, a critical concern given the history of exchange failures in the industry.

Compliance costs are significant. Market impact assessments suggest that the new territorial scope and authorization requirements will force many exchanges to restructure their business models. Overseas platforms serving UK retail customers must decide whether to obtain authorization, partner with a licensed UK firm, or exit the market entirely. Institutional-focused platforms have more flexibility, but they still need to carefully analyze their authorization obligations. The key takeaway is that compliance is no longer optional; it is a core business function that requires dedicated resources, legal expertise, and technological investment.

Recent Developments: Retail Access to cETNs

In a notable shift, the FCA lifted the ban on retail access to crypto exchange-traded notes (cETNs) in October 2025. Previously banned since January 2021, these derivatives allow retail investors to gain exposure to crypto prices without holding the underlying assets. This change followed consultations and the recognition that regulated products could offer safer alternatives to direct crypto trading. However, these cETNs must trade on FCA-approved, UK-based Recognised Investment Exchanges, ensuring that the market infrastructure meets strict investor protection standards. For exchanges, this opens up new opportunities to offer regulated products to retail clients, provided they meet the listing requirements.