Crypto Compliance for UK Businesses: What the FCA Actually Requires
A practical guide to UK crypto compliance: MLR registration now, the 2027 regime coming, and the mistakes that cost businesses the most.
Running a crypto business in the UK isn’t as simple as registering a company and opening for trading. There’s a real, growing compliance framework you need to understand, and getting it wrong doesn’t just risk a fine — it can mean your business can’t legally operate at all. I’ve had readers reach out genuinely confused about what actually applies to them versus what’s still coming down the line, so here’s the practical breakdown.
**The Two Layers of UK Crypto Regulation Right Now**
As of 2026, UK crypto businesses sit under two overlapping regulatory layers. The first, already in force, is registration under the Money Laundering Regulations — the anti-money-laundering framework the FCA has enforced on crypto firms since 2020, focused specifically on customer due diligence, transaction monitoring, and reporting suspicious activity, rather than broader business conduct or capital requirements.
The second, newer layer is the full cryptoasset regulatory regime the FCA finalised on 30 June 2026, covering trading admissions, custody, stablecoin issuance, and prudential requirements. This second layer isn’t in force yet — the authorisation gateway opens 30 September 2026, with the full regime applying from 25 October 2027. Understanding which layer applies to you right now, versus which is coming, is the first thing to get straight before anything else.
**Do You Actually Need MLR Registration?**
If your business carries out specified cryptoasset activities in the UK — operating an exchange, providing custody services, or facilitating the transfer of cryptoassets on behalf of customers — you almost certainly need Money Laundering Regulations registration with the FCA right now, regardless of where the newer, broader regime stands. This isn’t optional or something you can defer until the fuller regime lands in 2027; operating without current MLR registration where it’s required is already illegal today.
The registration process requires demonstrating adequate anti-money-laundering controls, appointing a nominated officer responsible for compliance, and ongoing reporting obligations. Processing times have historically run long — budget for a genuinely lengthy application process, not something you can complete quickly before launching, and factor that timeline into any launch planning from the very start.
**What “Specified Activities” Actually Covers**
The definition matters more than it sounds, because a lot of businesses assume MLR registration only applies to obvious cases like running a full exchange. In practice, it covers a broader range: exchanging crypto for fiat currency or other crypto, operating a cryptoasset ATM, participating in an initial coin offering, and providing custodian wallet services all fall under the specified activities requiring registration.
If you’re building a product that touches any of these activities, even as a secondary feature of a broader business, get a proper legal assessment of whether you fall under MLR registration requirements before launching, rather than assuming a narrow reading of “we’re not really an exchange” will hold up under actual regulatory scrutiny.
**Preparing for the Fuller 2027 Regime Now**
Even though the fuller regime doesn’t bite until October 2027, waiting until then to start preparing is a genuine strategic mistake. The FCA’s application window opens 30 September 2026 through 28 February 2027, and firms that apply early, with a genuinely complete and well-prepared application, have historically fared better through regulatory approval processes than those submitting rushed applications close to a deadline.
Start by mapping your business activities against the specific regulated activity categories the new regime defines — trading, custody, stablecoin issuance, and advisory services each carry different capital and operational requirements. A firm offering multiple activities under one roof needs to satisfy the requirements for each category simultaneously, which is a meaningfully bigger compliance lift than a single-activity business faces.
**Capital Requirements You’ll Need to Plan For**
The prudential requirements scale with the type and scale of activity, but there are concrete figures worth knowing now for planning purposes. Stablecoin issuers face a permanent minimum capital requirement of £350,000. Other categories of regulated activity carry their own scaled requirements based on the volume and risk profile of the specific business.
Budget for this properly, and understand that capital requirements aren’t a one-time hurdle to clear at authorisation — they’re an ongoing obligation you need to maintain throughout operation, with regular reporting to demonstrate continued compliance, not just satisfied once at the point of initial approval.
**Custody and Client Asset Segregation**
If your business holds customer cryptoassets in any capacity, the new custody rules require segregating client assets from your own operational holdings — similar in principle to how client money rules already work for traditional financial firms. This isn’t just a bookkeeping preference; it’s a structural requirement intended to protect customer funds if your business fails, directly responding to exchange collapses where customer and company funds turned out to be commingled.
Setting up genuinely compliant segregation, with the operational and technical controls to demonstrate it clearly to regulators on request, takes real implementation time. Don’t treat this as a policy document you write once — build the actual technical and operational separation into how your systems work from the ground up.
**Market Abuse and Trading Rules**
If your business operates any kind of trading venue or facilitates trading between customers, the new market abuse provisions extend UK market abuse law — the kind already governing traditional securities markets — into crypto trading specifically. This means building surveillance capability to detect and report suspicious trading patterns, clear rules on what assets you admit for trading, and disclosure requirements before listing any new asset.
For smaller firms, this can be a genuinely significant operational lift, since building market surveillance infrastructure from scratch requires either substantial in-house engineering investment or a third-party compliance vendor relationship, both of which need budgeting well ahead of when you’ll actually need them operational.
**Common Compliance Mistakes I’ve Seen Firms Make**
The first, and most costly: assuming a narrow reading of “specified activities” excludes your business, without getting a proper legal assessment first. I’ve seen founders convince themselves their product is “just a wallet” or “just a marketplace” when a regulator’s actual reading of the specified activities list would classify it differently, leading to operating unregistered for months before the issue surfaces, at which point remediation is far more disruptive and costly than getting it right from the start.
The second: treating compliance as a one-time project rather than an ongoing operational function. MLR registration and the fuller regime both carry continuing obligations — updated risk assessments, ongoing transaction monitoring, periodic reporting — that need dedicated resourcing on an ongoing basis, not a single compliance sprint before launch followed by neglect. Firms that treat compliance as a permanent, resourced function within the business consistently fare better under regulatory scrutiny than those treating it as a box ticked once and forgotten.
The third: underestimating how long authorisation processes actually take. Both MLR registration and the anticipated FCA authorisation process under the fuller regime have historically run longer than firms initially budget for, and launching your go-to-market timeline around an optimistic best-case processing time, rather than a realistic one, is a recurring, avoidable planning mistake.
**Where to Find Authoritative, Current Information**
Regulation in this space moves genuinely fast, and any specific figure or requirement in this article should be checked against the FCA’s own published guidance before you rely on it for actual business decisions, since policy statements and consultation outcomes continue evolving as the fuller regime’s implementation details get finalised through 2026 and into 2027. The FCA’s dedicated cryptoasset regime page is the authoritative source, updated directly by the regulator rather than filtered through secondary commentary, and worth bookmarking if you’re actively building or operating in this space.
**What This Means for UK Crypto Businesses**
If you’re currently operating and only hold MLR registration, treat the coming 2027 regime as a genuine deadline requiring real preparation time, not a distant concern to revisit later. If you’re launching a new crypto business, build compliance planning into your earliest strategic decisions rather than treating it as something to bolt on once the product itself is built — retrofitting compliance onto an already-built product is consistently more expensive and disruptive than designing for it from the start.
Get proper regulatory legal advice specific to your exact business model rather than relying purely on general guidance like this article. UK crypto regulation genuinely varies in its application based on the specific activities your business carries out, and the cost of a wrong assumption here is far higher than the cost of proper legal counsel upfront.
**Disclaimer:** This article is for educational purposes only and does not constitute legal or financial advice. Regulatory requirements are complex and business-specific. Always consult a qualified regulatory adviser or solicitor before making compliance decisions for your business.
Stay ahead of the market
Join our community of nearly 5,000 across YouTube, LinkedIn, X, and Facebook — weekly crypto, AI, and digital lifestyle insights every Thursday. No spam. Unsubscribe any time.
Partner picks
Build a smarter digital stack
Explore curated AI, automation, wealth, and creator tools selected for practical value, transparent pricing, and clear use cases.
Disclosure: some links may be affiliate links. DigitechLifestyle may earn a commission at no additional cost to you.
