What you need to do when preparing for the new cryptoasset regulatory regime

This is a significant change for the UK cryptoasset market, bringing in new standards, enhancing consumer protection and supporting sustainable growth. 

To carry out the new cryptoasset regulated activities, firms will need to be authorised by us (through a new application or a variation of permission if already authorised). 

Whether your firm is already authorised under FSMA or is currently operating under the Money Laundering, Terrorist Financing, and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs), you should start preparing now to submit a timely, good-quality application during the application period.

What we expect firms to be doing now

We encourage firms to develop a clear and credible plan that shows they have considered what the new regime will require of them, and how they will be ready.

Firms that intend to apply for authorisation should: 

• Review the new cryptoasset regulated activities and determine what type of authorisation is required. 
• Review your proposed scope of permissions and ensure this aligns with your business model and risk profile.
• Carry out a gap analysis against the expected FSMA requirements, identifying where existing arrangements need to be strengthened. 
• Develop a realistic implementation plan, agreed at board level, that sets out:  
  • who is accountable 
  • what needs to change 
  • how changes will be delivered 
  • when changes will be completed
• Assess the resources and costs associated with preparation, authorisation and ongoing compliance.  
• Where appropriate, invest in legal, compliance or regulatory advice to support your preparations.

Apply as soon as possible

We encourage firms to apply as soon as possible within the application period to avoid disruption to your business. 

We also encourage firms to read our information on how the application process works. 

Firms that apply outside of the application period or submit poor quality applications may face: 

• Having your application rejected if it does not contain the minimum information we ask for. 
• Delays in the assessment of your application. 
• Refusal of authorisation. 
• For existing cryptoasset firms, the inability to continue carrying on cryptoasset activities when the new regime comes into force. 

Read our further information for firms that do not apply for, or obtain, authorisation.