FCA Crypto Authorization Requirements for UK Exchanges
May, 23 2025
UK Crypto Exchange Regulatory Compliance Checker
Your Regulatory Obligations
Based on your inputs, you must complete the following:
These requirements apply under the current Money Laundering Regulations (MLR).
Starting in 2026, you will also need:
These requirements will apply under the new Financial Services and Markets Act (FSMA).
You'll need to prepare:
Checklist for Compliance
Quick Takeaways
- All crypto‑exchange providers serving UK consumers must register under the Money Laundering Regulations (MLR) today.
- From 2026 onward, the Financial Services and Markets Act 2000 (FSMA) will add a full FCA authorization layer for five core crypto activities.
- Overseas platforms that target UK retail users need a UK‑based licence unless they work through an authorised UK intermediary.
- Key documents include JMLSG crypto guidance, FATF VASP standards, and a CASS audit for custodial services.
- Prepare a compliance checklist now - the FSMA regime will hit the market soon and the FCA expects firms to be ready.
Running a crypto exchange in the United Kingdom means answering two regulatory questions: Am I registered for AML under the current rules? and Will I need a full FCA authorisation when the FSMA regime goes live? This guide walks you through every step, from the baseline MLR registration to the upcoming FSMA authorisation, and shows how to map your business model to the FCA’s requirements.
What the FCA Regulates Today
Since January2020 the Financial Conduct Authority has required crypto‑asset exchange providers and custodian‑wallet services to register under the United Kingdom’s Money Laundering Regulations. The registration is a gate‑keeping step that ensures firms have robust anti‑money‑laundering (AML) and counter‑terrorist‑financing (CTF) controls.
- Who must register? Any firm that offers crypto‑asset exchange services or holds customer wallets for the public.
- Outcome options: approval, rejection, withdrawal, or refusal.
- Key evidence: risk‑based AML policies, client‑due‑diligence procedures, and a senior‑person AML statement.
The Joint Money Laundering Steering Group (JMLSG) publishes sector‑specific guidance (PartII, Chapter22) that the FCA expects applicants to follow.
Future Landscape: FSMA Authorisation
The draft amendment to the Financial Services and Markets Act 2000 expands FCA authority over crypto‑related activities. Five core regulated activities will require a full licence:
- Operating a qualifying crypto‑asset trading platform.
- Dealing in qualifying crypto‑assets as a principal.
- Dealing in qualifying crypto‑assets as an agent.
- Arranging deals in qualifying crypto‑assets.
- Safeguarding qualifying crypto‑assets and specified investment crypto‑assets.
Two additional activities - issuing qualifying stablecoins and offering qualifying staking - will have their own authorisation routes.
Territorial Scope - When Overseas Firms Need a UK Licence
The FCA does not limit its reach to UK‑incorporated entities. If an overseas exchange serves UK retail consumers, it must obtain a UK licence for the activities listed above. The only carve‑out is when the foreign firm works through a UK‑authorised intermediary - the FCA deliberately avoids an “ever‑growing chain of licences”.
Institutional clients are treated differently. A foreign platform that serves only UK‑based institutional customers (e.g., hedge funds, asset managers) can operate without a UK licence, provided those institutions are not acting as intermediaries for retail users.
Stablecoin issuers face a stricter physical‑presence test: they need a UK licence only if the issuance activity is carried out from a UK establishment.
Key Compliance Documents You’ll Need
Whether you are filing today for MLR registration or preparing for FSMA authorisation, the FCA expects a solid paper trail.
- JMLSG crypto‑asset guidance (PartII, Chapter22).
- FATF VASP Guidance. Shows how you assess customer risk.
- FCA Financial Crime Guide. Covers AML, CTF, and politically exposed persons (PEPs).
- CASS audit report. Required for custodial and stable‑coin providers.
- Board‑level AML statement. Signed by a senior manager with responsibility for compliance.
Pre‑application meetings are free and highly recommended. The FCA’s recent webinars (2024‑2025) provide templates for the documentation.
Checklist - From Registration to Full Authorisation
| Milestone | When it applies | Core requirement | Key evidence |
|---|---|---|---|
| MLR Registration | Now - all crypto‑exchange & custodian providers | Fit‑and‑proper AML/CTF controls | Risk‑based policies, senior‑manager statement, JMLSG compliance |
| FSMA Authorisation (Phase1) | Projected 2026 rollout | Threshold Conditions (COND) & General Provisions (GEN) | Business plan, capital adequacy, governance framework |
| FSMA Authorisation - Safeguarding & CASS | When you hold customer crypto‑assets | Separate segregation & audit of assets | CASS audit report, segregation ledger, insurance proof |
| Stablecoin Issuance Licence | If you issue a qualifying stablecoin from the UK | Physical‑presence test + capital buffer | UK entity registration, reserve asset proof, audit |
Common Pitfalls & Pro Tips
Even seasoned firms stumble over a few recurring issues:
- Mixing retail and professional client flows. The FCA treats them differently; keep separate order‑books to avoid breaching Principles 6 and 9.
- Under‑estimating the CASS audit scope. Auditors will ask for real‑time proof of segregation - prepare a live dashboard.
- Assuming overseas licences are enough. The territorial test focuses on the consumer, not the provider’s location.
- Skipping the senior‑manager regime. A clear allocation of responsibility (SMCR) is now mandatory for all authorised crypto firms.
Pro tip: run a mock FCA inspection using the “FCA Checklist for Crypto Firms” (available from the FCA’s consultation portal). It surfaces gaps before the regulator does.
Next Steps for Your Exchange
- Confirm your business model fits one of the five regulated activities.
- Complete the MLR registration if you haven’t already - this is the minimum entry point.
- Map your AML/CTF processes against JMLSG and FATF guidance.
- Start drafting a full FSMA authorisation package - business plan, capital calculations, governance structure.
- Engage a qualified auditor for a pre‑submission CASS audit if you hold customer assets.
- Schedule a pre‑application meeting with the FCA’s Crypto Team (use the FCA portal).
By tackling these tasks now, you’ll avoid a scramble when the FSMA regime becomes mandatory.
Frequently Asked Questions
Do I need both MLR registration and FSMA authorisation?
Yes. MLR registration is the baseline AML requirement that applies today. FSMA authorisation adds a full financial‑services licence for specific crypto activities and will become compulsory once the new regime is live.
What counts as a “qualifying crypto‑asset” under the FCA?
The FCA defines a qualifying crypto‑asset as a digital token that can be traded on a regulated platform, used for investment, or delivered as a stablecoin with a clear reserve backing. Tokens used solely for utility or access to a service are generally excluded.
Can I operate from outside the UK and still serve UK retail users?
Only if you work through a UK‑authorised intermediary. Directly offering exchange services, dealing, or arranging deals to UK retail customers triggers the FCA’s territorial scope and requires a UK licence.
What is the CASS audit and why do I need it?
CASS (Crypto‑Asset Safeguarding Standards) audit verifies that a firm segregates client crypto‑assets, holds adequate insurance, and maintains accurate records. It is mandatory for custodial wallet providers and any exchange that safeguards user funds.
When will the FSMA authorisation regime take effect?
The FCA plans a phased rollout beginning in early 2026, with full enforcement expected by the end of 2026. Firms are encouraged to submit applications early to avoid a rush.
Sanjay Lago
May 23, 2025 AT 13:38Wow, this guide really breaks down the FCA crypto regs in a way that's easy to follow. I love how you listed the current MLR steps and the upcoming FSMA stuff side by side. It makes planning the next moves a lot less scary, especially for startups in India. Definitely gonna share this with my dev team – they’ll thank me later! Keep the updates coming, the crypto world moves fast.
arnab nath
May 23, 2025 AT 14:19Looks like the FCA is just a puppet for the global banking cartel trying to choke crypto innovation.
Nathan Van Myall
May 23, 2025 AT 15:01Interesting breakdown. I’m curious how the threshold conditions for FSMA will affect capital requirements for midsize firms. The guide could add a quick chart comparing the current MLR costs versus projected FSMA licensing fees.
debby martha
May 23, 2025 AT 15:43Not bad, but feels a bit too textbook. Some real‑world examples would make it more relatable.
Orlando Lucas
May 23, 2025 AT 16:24Reading through this, I’m reminded of the age‑old philosophical tension between freedom and security. On one hand, regulators aim to protect investors and the financial system; on the other, over‑regulation can stifle innovation and the very decentralisation ethos that crypto promises. The FCA’s two‑step approach-first the AML‑focused MLR, then the broader FSMA framework-mirrors a classic liberal paradox: grant freedom after ensuring safety. Yet the timeline is crucial; a rushed FSMA rollout could force firms into compliance “just to survive,” rather than to genuinely improve governance. It also raises questions about jurisdiction: if an overseas exchange serves UK retail users, does the FCA’s reach undermine the principle of proportionality? The guide’s checklist is a solid operational tool, but firms must also grapple with the strategic implication of choosing where to locate key functions. Are you ready to embed a UK‑based entity just to satisfy a physical‑presence test for stablecoin issuance? Or will you pivot to a purely non‑retail model to avoid the licence altogether? In any case, the regulatory landscape is moving from a laissez‑faire attitude toward a more structured, accountable environment, which could ultimately benefit market confidence if executed wisely. The key takeaway is to start early, document everything, and treat compliance as a competitive advantage rather than a cost centre.
Manas Patil
May 23, 2025 AT 17:06Spot on! Leveraging the FCA’s tiered model lets us embed robust AML controls now while we architect a scalable governance framework for FSMA. The CASS audit, in particular, is a critical data‑point for custodial wallets – think of it as the “security audit” of the crypto world, ensuring asset segregation meets the same rigor as traditional banking. By aligning with JMLSG and FATF guidelines today, firms can future‑proof their capital adequacy calculations for the upcoming threshold conditions. Moreover, the physical‑presence test for stablecoins is essentially a proxy for ensuring regulatory oversight over reserve assets. In practice, a multi‑jurisdictional approach – UK entity for licensing, offshore tech hub for development – can optimise both compliance and operational efficiency. Keep the jargon flowing; it helps us internalise the regulatory lexicon early.
Annie McCullough
May 23, 2025 AT 17:48🙌👍 great insights really love the way you broke it down 🧐👍🚀
Lady Celeste
May 23, 2025 AT 18:29Another compliance nightmare to add to the list, just what we needed.
Ethan Chambers
May 23, 2025 AT 19:11Honestly, this whole FCA crypto push feels like a retro‑grade attempt to re‑impose old‑school banking gatekeeping on a disruptive tech. It’s almost comical how they’re trying to shoe‑horn a decentralized ecosystem into a legacy‑heavy regulatory mold. I’m all for consumer protection, but the tone of the guidance reads like a bureaucratic novella – dense, condescending, and prone to stifle genuine innovation. Still, you’ve done a decent job summarising the key points, albeit in a way that will probably be glossed over by the very entities it targets.
gayle Smith
May 23, 2025 AT 19:53From a risk‑engineering perspective, the FCA’s emphasis on CASS audit and asset segregation aligns with traditional custodial risk models. However, the jargon around “physical‑presence test” and “threshold conditions” could be clarified with concrete examples-e.g., how many staff or what type of office space constitutes a sufficient presence for a stablecoin issuer? The guide could benefit from a decision‑tree that maps business models to the specific documentation requirements, reducing ambiguity for fintech founders.
Rama Julianto
May 23, 2025 AT 20:34Listen up, if you’re still ignoring the FCA’s checklist you’re basically inviting a regulator‑led audit that will burn through your runway. The MLR registration isn’t optional-treat it as a baseline fire‑wall. And when you start handling customer assets, the CASS audit is non‑negotiable; you’ll be slapped with hefty fines for any segregation slip‑up. Get a qualified auditor now, draft your AML policies with leather‑bound seriousness, and stop treating compliance as an after‑thought. Your investors will thank you, even if it feels like an aggressive sprint.
Helen Fitzgerald
May 23, 2025 AT 21:16Hey team! This is a fantastic start, and I love how you’ve laid out the steps step‑by‑step. Let’s keep the momentum going by setting up a quick workshop on the CASS audit requirements – that way everyone on the product side knows exactly what data they need to collect. Also, don’t forget to loop in your legal counsel early; they’ll help you navigate the senior‑manager regime without any surprises. You’ve got this, and the community is here to support you!
Jon Asher
May 23, 2025 AT 21:58Great overview! I’m especially glad you highlighted the difference between retail and institutional customers – that’s a common source of confusion. The simple language makes it easy for a non‑technical founder to get a grip on the timeline.
hrishchika Kumar
May 23, 2025 AT 22:39Absolutely! It’s like painting a vivid tapestry of regulatory steps, each thread adding color and depth. Your checklist feels like a roadmap that guides startups through a bustling bazaar of compliance, turning a potentially chaotic journey into a harmonious stroll. I especially love the way you’ve woven in the cultural nuance of UK‑centric requirements while keeping the tone upbeat and encouraging. Keep sprinkling that creative flair – it makes the dense legalese much more digestible!
Nina Hall
May 23, 2025 AT 23:21Super helpful! This guide gives me confidence that we can tackle the FCA hurdles without losing our spark. Thanks for breaking everything down so clearly.
Lena Vega
May 24, 2025 AT 00:03Thanks, very concise.
Emily Kondrk
May 24, 2025 AT 00:44Okay, let’s peel back the layers of this regulatory onion, because what we’re really looking at is a concerted effort by shadowy financial elites to reassert control over a technology that was built to bypass exactly that kind of oversight. The FCA’s MLR registration, on the surface, seems like a routine AML compliance step, but if you dig deeper, you’ll see it’s a gateway that feeds data straight into a centralized monitoring apparatus-think of it as a digital leash for crypto wallets.
Now, fast forward to the upcoming FSMA authorisation. The draft amendments aren’t just about ensuring capital adequacy; they’re about embedding a licensing regime that mirrors the old banking charter system, forcing crypto firms to kowtow to the same capital buffers and governance structures that the big banks have fought to maintain for decades. This isn’t about protecting consumers; it’s about preserving the status quo.
Consider the “physical‑presence test” for stablecoin issuers. This clause is a thinly veiled attempt to force crypto projects to set up brick‑and‑mortar offices in the UK, effectively handing the government a foothold in the decentralized economy. It’s a classic move-create a regulatory hurdle that only well‑funded entities can surmount, pushing out the grassroots innovators who truly embody the decentralisation ethos.
The CASS audit requirement is another tool of control. By mandating a third‑party audit of asset segregation, the FCA not only imposes additional costs but also creates a dependency on audit firms that are often intertwined with the major financial institutions. Those audit firms become gatekeepers, deciding who gets the green light and who gets stuck in limbo.
And let’s not forget the shadowy interplay between the FCA and the Bank of England. The two institutions have been coordinating behind closed doors, crafting a regulatory framework that aligns with the broader “Great Reset” narrative-centralising financial power while masquerading as consumer protection. The timing of the FSMA rollout in 2026 coincides suspiciously with a series of policy shifts aimed at consolidating financial oversight under a single sovereign entity.
What does this mean for us, the crypto community? It means we must stay vigilant, keep our code open, and build resilient, jurisdiction‑agnostic solutions. The more we decentralise the infrastructure-especially the layers that handle compliance reporting-the less leverage regulators have to impose draconian controls.
In short, the FCA’s roadmap is less a guide and more a playbook for co‑optation. It’s essential to read between the lines, understand the hidden agenda, and strategise accordingly. Keep your wallets diversified, your governance models flexible, and your community informed, because the battle for financial sovereignty is far from over.
Laura Myers
May 24, 2025 AT 01:26Wow, that was a marathon of a comment- love the passion! While I agree that vigilance is key, I’d also add that engaging with the FCA early, especially through those free pre‑application meetings, can demystify a lot of the intimidating language. A collaborative approach might soften the blow of the inevitable regulatory churn.
Leo McCloskey
May 24, 2025 AT 02:08Honestly, the guide reads like a bureaucratic textbook, full of jargon, and it assumes every firm has the resources to hire consultants, auditors, and legal counsel. The regulatory maze is presented as a linear checklist, ignoring the complex realities of smaller startups that lack the capital for extensive compliance frameworks; therefore, the advice may be more aspirational than actionable, especially for fledgling projects.
Anjali Govind
May 24, 2025 AT 02:49Interesting points! I’m wondering how the proposed FSMA requirements will affect cross‑border token offerings that aim to stay compliant in multiple jurisdictions. It’d be useful to see a side‑by‑side comparison of FCA obligations versus EU MiCA rules.