FCA Crypto Rules 2026: What UK Boards Must Prepare Now
UK boards overseeing any cryptoasset activity must now govern it like a mainstream regulated financial service. The FCA’s final cryptoasset regime rules, published on 1 July 2026, require firms to operate governance, systems and controls, prudential resources and conduct standards equivalent to those expected of traditional financial services firms — with the authorisation gateway opening on 30 September 2026 and the full regime applying from 25 October 2027.
Boards that have treated crypto exposure as a niche, delegable matter now have a defined, dated compliance obligation to own.
What has the FCA actually announced?
According to the FCA’s own announcement, the rules are designed to “cement the UK’s place as a global hub” for cryptoasset activity by giving firms and consumers regulatory clarity previously absent from the UK market. Firms operating in scope must identify individuals holding key roles under a senior managers-style regime and demonstrate those individuals meet the FCA’s fit and proper requirements — directly extending director accountability into an asset class many boards have historically kept at arm’s length.
- Executive Action: Confirm whether any group entity falls within the new cryptoasset perimeter before the authorisation gateway opens.
- Require the CEO and general counsel to present a perimeter analysis to the board within the next reporting cycle.
- Approve a named senior manager accountable for cryptoasset conduct, in line with the fit and proper requirement.
Why does the implementation timeline matter for boards now?
According to law firm commentary on the FCA’s rules, the authorisation gateway opens on 30 September 2026 but the full regime does not apply until 25 October 2027 — a window that looks generous but is not. Firms wanting to operate under the new regime must complete perimeter analysis, authorisation planning and systems build well in advance, since gaps in governance, capital, operational resilience, financial crime controls and customer communications typically take longer to close than expected.
- Executive Action: Set an internal deadline at least three months ahead of the 30 September 2026 gateway opening for authorisation readiness.
- Commission a gap analysis across governance, capital, resilience and financial crime controls.
- Review INFORMD’s technology strategy review template to structure the systems build plan.
What must the board specifically approve?
Under the UK Corporate Governance Code, the board’s role is oversight and approval, not operational delivery — but that oversight now has a specific new object. Directors should expect to approve the authorisation application strategy, the allocation of senior manager responsibilities under the new regime, and the budget for closing identified compliance gaps. Failing to document this approval trail leaves individual directors exposed if the FCA later scrutinises the firm’s readiness.
- Executive Action: Minute board approval of the authorisation strategy and senior manager allocation separately from routine business.
- Require quarterly progress reporting against the authorisation plan until the gateway opens.
- Use INFORMD’s executive self-assessment tools to test board-level understanding of the new regime.
What happens to firms that are not ready?
Firms that miss the authorisation gateway risk being unable to operate cryptoasset activities in the UK market at all once the full regime takes effect in October 2027 — a genuine market-exit risk, not a fine on the margins. For firms with any digital asset exposure, whether direct or through customer-facing products, board-level readiness by autumn 2026 is now a commercial as well as a compliance imperative. INFORMD’s briefing library at /resources/ tracks FCA implementation milestones as they are confirmed.
INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.
Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk. For a structured readiness review, contact INFORMD.
The authorisation gateway opens on 30 September 2026, allowing firms to apply. The full regime, with all conduct and prudential requirements in force, applies from 25 October 2027.
Yes. Firms must allocate key roles under a senior managers-style regime and demonstrate those individuals meet the FCA’s fit and proper requirements, extending personal accountability to named directors and senior managers.
The authorisation application strategy, allocation of senior manager responsibilities, and budget for closing gaps in governance, capital, operational resilience and financial crime controls — each minuted as a distinct board decision.
Firms that fail to secure authorisation risk being unable to legally operate cryptoasset activities in the UK once the full regime applies from October 2027, making this a market-access risk rather than a routine compliance matter.
