Is Cryptoasset Trading Regulated in the UK? (2026 Guide)

Cryptoasset trading is regulated in the UK, but only partially until late 2027\. Today, crypto firms must register with the FCA under anti-money-laundering rules and follow strict financial promotions requirements. A full authorization regime under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 takes effect on October 25, 2027, with applications opening September 30, 2026\.

If you run a crypto exchange, brokerage, custodian, or stablecoin project touching UK customers, you are living through the most consequential 14 months in UK crypto history. The FCA published its final cryptoasset rulebook on June 30, 2026, and the authorization gateway opens on September 30, 2026\. Firms that misread the difference between today's registration regime and tomorrow's authorization regime risk being locked out of the UK market entirely.

This guide covers what is regulated right now, what changes in 2027, the full timeline, and the KYC/AML obligations UK cryptoasset firms must meet at every stage.

The short answer: regulated today, fully regulated from October 2027

UK crypto regulation currently operates on three layers:

1. AML/CTF registration. Since January 2020, cryptoasset exchange providers and custodian wallet providers must register with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs). This is an anti-financial-crime check, not full conduct regulation.
2. Financial promotions. Since October 8, 2023, any crypto promotion capable of reaching UK consumers must comply with the FCA's cryptoasset financial promotions regime: risk warnings, a 24-hour cooling-off period for first-time investors, and a ban on refer-a-friend incentives.
3. The incoming full regime. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made by Parliament on February 4, 2026, bring cryptoasset trading, dealing, custody, staking, and stablecoin issuance inside the FSMA regulatory perimeter. The new regime comes into force on October 25, 2027.

So when someone asks "is cryptoasset trading regulated in the UK," the accurate answer in 2026 is: yes for financial crime and marketing purposes, and yes in full from October 25, 2027, with the application window opening in weeks, not years.

The legal foundation is the Financial Services and Markets Act 2023 (FSMA 2023), which gave HM Treasury the power to bring cryptoassets into the regulatory perimeter, followed by the Treasury's October 2023 policy framework for a future cryptoasset regime.

UK crypto regulation timeline: 2020 to 2027

The FCA consulted extensively on the new regime, four discussion papers and ten consultation papers since 2023, according to its cryptoasset regime policy statement overview. Here is the full arc:

What crypto activities are regulated in the UK, and what is not

The 2026 Regulations create new regulated activities under FSMA. Per the FCA's overview of cryptoasset regulated activities, the regime centers on "qualifying cryptoassets" and "qualifying stablecoins."

Two points consumers and compliance teams often confuse. First, the cryptoassets themselves are not "approved" by anyone. It is the activity that gets regulated. Second, buying crypto remains high-risk even after 2027: holdings are generally not covered by the Financial Services Compensation Scheme, a point the FCA repeats in its consumer warnings.

Registration vs. authorization: the distinction that decides your 2027

This is the single most misunderstood part of UK crypto regulation, so let's be precise.

MLR registration (the current regime) is a financial-crime check. The FCA assesses whether your AML systems, controls, and key personnel are fit for purpose. It does not supervise your conduct, prudential soundness, or how you treat customers.

FSMA authorization (the incoming regime) is full financial-services licensing, the same statutory gateway that banks and investment firms pass through, with ongoing conduct rules, governance requirements under the Senior Managers regime, operational resilience, and prudential standards set out in the FCA's June 2026 final rules.

Critically, existing MLR registration does not roll over automatically. Firms already registered under the MLRs must still apply for authorization through the gateway that opens September 30, 2026 and closes February 28, 2027. The FCA has addressed transition questions for registered firms in its authorizations webinar Q\&A. \VERIFY: whether the FCA confirmed any streamlined/expedited assessment path for MLR-registered firms in the June 2026 policy statements\]

The practical takeaway: if you intend to serve UK customers in 2028, your authorization application, including a credible KYC/AML framework, needs to be substantially ready this autumn.

FCA crypto rules on financial promotions: already fully in force

Unlike the authorization regime, the promotions rules are not coming. They are here, and the FCA enforces them actively. Under the cryptoasset financial promotions regime, a crypto promotion to UK consumers is only lawful through one of four routes: communicated by an FCA-authorized person, approved by an authorized person, communicated by an MLR-registered crypto firm under a bespoke exemption, or covered by another exemption.

Compliant promotions must carry prescribed risk warnings, classify crypto as a "restricted mass market investment," give first-time investors a 24-hour cooling-off period, and drop incentives like referral bonuses. Overseas exchanges targeting UK users without a lawful route are committing a criminal offense. Geography is not a defense.

UK stablecoin regulation: issuance and custody get their own rulebook

Stablecoins are the piece of UK crypto regulation moving fastest. The FCA consulted on stablecoin issuance and cryptoasset custody in CP25/14 (May to July 2025), and the final rules landed in the June 30, 2026 policy statement package.

Under the 2026 Regulations, issuing a qualifying stablecoin becomes a regulated activity capturing firms that offer a stablecoin from a UK establishment, are responsible for its creation, and handle redemption and maintenance of its stable value. Safeguarding qualifying cryptoassets, including controlling the means of access, such as private keys, becomes regulated custody.

Systemic stablecoins get a second layer: HM Treasury can recognize a stablecoin as systemic, triggering joint regulation by the Bank of England and the FCA under their published joint approach, which also covers how firms transition between the two regimes.

If you operate across both the UK and EU, note that the UK model differs structurally from MiCA. The EU regulated stablecoins first and fully, while the UK phased them into a broader FSMA framework. Our guide to MiCA KYC requirements in 2026 covers the EU side.

KYC and AML obligations for UK cryptoasset firms

Whatever happens with authorization timing, the AML layer applies now and does not go away. UK cryptoasset firms, the businesses international frameworks call CASPs or VASPs, must:

1. Register with the FCA under the MLRs before carrying on cryptoasset exchange or custodian wallet activity.
2. Run a risk-based KYC program: identify and verify every customer, apply customer due diligence before the business relationship starts, and escalate to enhanced due diligence for high-risk customers such as PEPs.
3. Screen against sanctions and watchlists continuously, not just at onboarding. OFSI and UN/UK sanctions lists change weekly.
4. Comply with the Travel Rule: collect, verify, and share originator and beneficiary information on cryptoasset transfers, in force in the UK since September 2023.
5. Monitor transactions and report suspicion via SARs to the National Crime Agency.
6. Keep records that evidence all of the above for supervisory inspection, and expect the FCA to test them during authorization.

For a step-by-step operational breakdown, see our guides to crypto KYC compliance and compliant onboarding for crypto exchanges in 2026.

The strategic problem for UK crypto firms is that these obligations traditionally force you to hoard exactly the data that makes you a target. Passport scans, selfies, and proof-of-address documents sitting in a centralized vendor database are a breach waiting to happen, and from October 2027, operational resilience failures become an authorization-level concern, not just a GDPR one.

Meeting UK crypto KYC rules without building a PII honeypot

Zyphe is a privacy-first, decentralized identity verification and compliance platform (KYC, KYB, AML screening) that verifies users without storing their personal data in a central vendor database. Identity data is sharded across decentralized storage, encryption keys stay with the user, and compliance teams keep full audit trails. Zyphe reports this cuts data-breach risk by around 90% versus centralized vendors.

For UK cryptoasset firms heading into the authorization gateway, that architecture maps neatly onto what the FCA will scrutinize:

• Verification that satisfies the MLRs: government-ID verification covering 190+ countries, biometric face capture with liveness detection, and AI deepfake mitigation, with typical verification completing in under a minute. See KYC for crypto.
• No central honeypot: decentralized KYC preserves the audit trail regulators expect while removing the single database attackers want.
• Ongoing obligations, automated: perpetual KYC keeps sanctions, PEP, and watchlist screening continuous, which is how the FCA expects a risk-based program to run.
• Faster onboarding across venues: users who verify once carry a reusable KYC Passport for one-click onboarding on other platforms, useful in a market where every UK exchange is about to re-paper its compliance stack.

UK crypto firms have a hard deadline: an authorization application window that opens September 30, 2026, with a KYC/AML framework the FCA will inspect line by line. Book a demo to see how Zyphe gets your verification stack authorization-ready, without a central PII database on your risk register.