UK FCA Opens Crypto Authorisation Gateway: February 2027 Deadline

The Financial Conduct Authority has opened its authorisation gateway for cryptocurrency businesses, giving firms until the end of February 2027 to file applications. That five-month window is the first hard regulatory milestone under the UK's incoming full-spectrum digital asset regime, which is scheduled to take effect in October 2027. Miss it, and a firm risks operating without a licence once that regime is live. For accounting professionals, auditors, and CFOs supporting crypto-active businesses, the clock is already running.

Background: Why This Moment Has Been a Long Time Coming

The legislative groundwork for a comprehensive UK crypto regime dates to 2022, making this a multi-year journey by any measure. For several years the UK's progress looked slow relative to the European Union, where the Markets in Crypto-Assets Regulation (MiCA) entered into force in June 2023 and has since been rolling out across member states. The UK chose a phased approach rather than a single omnibus instrument, building the regime through a series of consultation papers, policy statements, and amendments to existing financial services legislation.

That approach has now reached a concrete inflection point. The FCA has confirmed that the full framework will take effect in October 2027 and has opened the gateway that allows businesses to seek the authorisation they will need to operate legally under it. The February 2027 deadline for applications is therefore not a soft target. It is the cutoff before which firms must have submitted a complete application if they want to be in a position to trade lawfully from day one of the new regime.

How the UK Differs from MiCA

Unlike MiCA, which created a single pan-EU licensing passport, the UK framework is jurisdiction-specific and supervised entirely by the FCA. There is no passporting mechanism into or out of the EU regime. A firm authorised under MiCA cannot rely on that status to operate in the UK, and vice versa. Firms with cross-border operations therefore face the prospect of parallel applications and parallel ongoing compliance obligations. Accounting teams managing group structures need to reflect that asymmetry in their regulatory-cost forecasts and in how they allocate compliance resources across entities.

The AML Registration Head Start

One of the most practically significant details in the FCA's announcement is the status of firms already registered under the existing anti-money-laundering regime. More than 60 businesses have secured AML registration with the FCA, a process that required demonstrating robust controls around customer due diligence, transaction monitoring, and sanctions screening. The FCA's position is that those firms may find a meaningful portion of the new authorisation groundwork already covered.

What AML-Registered Firms Still Need to Do

AML registration and full financial-services authorisation are not the same thing. The existing registration focuses on preventing financial crime. The new authorisation regime will layer on top of that a broader set of conduct requirements covering, at minimum, prudential standards, governance, consumer protection obligations, and custody rules. Firms that are already registered should audit their current controls against the full authorisation criteria rather than assuming the work is complete.

Edinburgh-based crypto infrastructure platform Zumo, which obtained FCA AML registration in 2021, has illustrated this challenge by building a public "UK Cryptoasset Regulation Tracker." The tracker maps every individual regulatory obligation to the specific regulated activity it attaches to and is updated as new FCA policy papers are published. Zumo's CEO Nick Jones has described the process of building it as requiring a line-by-line reading of the regime rules. That level of granularity is telling: the compliance surface area is large, and it is activity-specific rather than generic.

Accounting and Financial Reporting Implications

The authorisation application is not purely a legal exercise. The FCA will expect applicants to demonstrate financial soundness, and that means the quality of a firm's books, its chart of accounts for digital assets, and its internal controls over financial reporting all come under scrutiny.

Capital Adequacy and Prudential Evidence

Under a full authorisation framework, firms are typically required to hold minimum capital against the risks they run. The exact prudential thresholds for each class of crypto activity are still being finalised by the FCA, but firms should expect to produce audited or auditor-reviewed financial statements that segregate digital-asset holdings, reflect fair-value movements in line with applicable accounting standards, and demonstrate that custody assets are kept off the firm's own balance sheet where required. CFOs who have not yet implemented asset-class-specific ledger structures for cryptocurrencies will find this the most time-consuming element to fix before February.

Internal Controls and Audit Trail Requirements

The FCA's authorisation process typically involves a detailed review of a firm's systems and controls. For a crypto business, that means demonstrating that wallet management, private-key custody, transaction reconciliation, and ledger entries all tie together in a way an auditor can independently verify. Crypto bookkeeping software that produces exportable, timestamped audit trails becomes a prerequisite rather than a convenience at this point. Firms relying on manual spreadsheet reconciliations should treat the authorisation window as a forcing function to upgrade their digital asset accounting infrastructure before the application is submitted.

Financial Crime Controls: The Bridge from AML to Authorisation

The FCA's emphasis on the existing AML registrations as a potential head start signals that financial crime controls will remain central to the authorisation assessment. That includes transaction monitoring calibration, suspicious activity reporting workflows, sanctions list screening, and the documentation of risk appetite for different asset classes. Accounting teams have a direct role here: a firm's transaction records, reconciled on-chain data, and counterparty documentation all feed into the financial crime evidence file that the FCA will review. For a deeper look at how on-chain AML screening fits into a compliant crypto workflow, the engineering decisions that underpin reliable monitoring are worth understanding before the application is assembled.

What Accounting Firms and Auditors Must Do for Clients

The February 2027 deadline creates a defined engagement window for practitioners. Accounting firms advising crypto businesses should be initiating scoping conversations now rather than waiting for clients to ask. The practical work falls into three overlapping streams.

Regulatory Readiness Reviews

A gap analysis comparing the client's current controls against the FCA's published authorisation criteria is the logical starting point. The FCA has set out the regulated activities that will require authorisation, and each activity carries its own obligation set. Mapping those obligations to the client's actual business model, identifying gaps, and estimating the remediation timeline will determine whether February 2027 is achievable without a significant restructuring of the firm's operations.

Financial Statements and Disclosures

Where clients hold digital assets on behalf of customers, the accounting treatment of those assets, whether as financial instruments, intangibles, or under an emerging specific standard, needs to be consistent, documented, and auditable. The FCA will expect to see financial statements that accurately reflect the firm's exposure to crypto markets and that separate customer assets from proprietary assets without ambiguity. Any firm that has not yet aligned its financial reporting with current guidance should make that alignment a prerequisite of the application pack.

Governance Documentation

Authorisation applications require evidence of a functioning governance framework: board oversight, senior manager accountability, and documented decision-making processes for material risks. For crypto-specific risks, that means board-level policies on asset custody, concentration limits, and operational security. Practitioners can add real value by helping clients build the governance paper trail in a format the FCA expects to see, rather than leaving clients to discover gaps at the point of submission.

Timeline Overview

Wider Context: UK Positioning Post-MiCA

The UK's decision to operate its own standalone regime rather than align structurally with MiCA reflects a deliberate regulatory sovereignty choice made post-Brexit. The FCA has been clear that it intends to calibrate the framework to UK market conditions rather than transpose EU rules wholesale. That creates some genuine uncertainty for firms trying to compare the two regimes, but it also means that the UK framework may accommodate certain business models differently from MiCA, for instance in how it treats decentralised protocols or exchange-traded crypto products listed on UK venues.

For accounting and compliance professionals, the divergence from MiCA is not merely a legal curiosity. It affects how group-level compliance teams structure their reporting lines, how internal audit scopes are drawn for UK versus EU entities, and how digital asset accounting software is configured to capture jurisdiction-specific classification rules. The broader picture of the broader UK digital asset regulatory framework taking shape is worth reviewing alongside this gateway announcement to understand the full scope of what the October 2027 regime will cover.

Practical Next Steps for CFOs and Finance Teams

The five-month window is short when set against the typical lead time for a substantive regulatory application. Finance and compliance teams should treat the following as immediate priorities.

Prioritised Action List

• Confirm which of the firm's activities will be in scope for authorisation under the FCA's defined regulated activity categories.
• Review existing AML registration documentation and identify what additional evidence is needed for full authorisation.
• Assess whether current digital asset accounting software and ledger infrastructure can produce the financial statements and audit trails the application will require.
• Commission or update a prudential capital assessment calibrated to the FCA's expected thresholds for the relevant activity class.
• Instruct legal and compliance advisers to begin drafting governance policies and senior manager accountability maps.
• Set an internal application-ready date no later than mid-January 2027 to allow time for review and submission before the February cutoff.

Firms that are part of a group with EU entities regulated under MiCA should also assess whether any regulatory capital or governance documentation can be adapted rather than rebuilt from scratch, while remaining alert to the differences between the two regimes.

Frequently Asked Questions

What is the FCA authorisation gateway for crypto firms?

It is the formal application process through which cryptocurrency businesses must seek permission from the Financial Conduct Authority to carry out regulated crypto activities in the UK. The gateway opened in September 2026, with a submission deadline of end-February 2027, ahead of the full regime going live in October 2027.

Does existing FCA AML registration count towards the new authorisation?

It provides a partial head start. Firms already registered under the FCA's AML regime have demonstrated financial crime controls, which is one component of the authorisation assessment. However, full authorisation also requires meeting prudential, conduct, governance, and custody standards that go beyond AML registration. A gap analysis against the full authorisation criteria is still necessary.

What financial documentation will firms likely need for the application?

Expect to provide audited or auditor-reviewed financial statements, evidence of capital adequacy against the FCA's prudential thresholds for the relevant activity class, proof that customer assets are segregated from proprietary assets, and documented internal controls over financial reporting and transaction reconciliation. The exact requirements will depend on the regulated activities the firm is applying to conduct.

Can a firm authorised under MiCA rely on that authorisation to operate in the UK?

No. The UK regime is entirely separate from MiCA, and there is no passporting mechanism between them. A firm needs standalone FCA authorisation to conduct regulated crypto activities in the UK, regardless of its EU regulatory status.

What happens if a firm misses the February 2027 deadline?

A firm that has not submitted an application before the deadline and does not hold existing authorisation will need to cease in-scope regulated activities when the full framework goes live in October 2027, or risk operating without authorisation, which carries significant legal and regulatory consequences. The FCA has not indicated that late applications will be accepted.

Source: CoinDesk Policy