UK Crypto Firms Have 5 Months to Apply or Stop Taking Customers in 2027. The Regulator Defines Custody as Control

What Happened

The Financial Conduct Authority (FCA) opened its cryptoasset authorisation gateway on Wednesday, September 30, starting a 5-month window for any firm that wants to serve United Kingdom customers after October 25, 2027 to apply for authorisation under the Financial Services and Markets Act 2000 (FSMA).

The window closes at 11:59 pm on February 28, 2027. 'Firms can now apply for authorisation and start preparing for regulation,' Dominic Cashman, the FCA's director of authorisation, said in the regulator's statement. The legal basis is the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made on February 4, which create 9 regulated activities, from issuing qualifying stablecoins and operating a trading platform to dealing, arranging, staking, and safeguarding (custody) of qualifying cryptoassets.

The gateway is not a formality. Registrations under the Money Laundering Regulations (MLRs), which have governed UK crypto firms since 2020, do not convert, so every firm starts from a blank application, and the FCA's own numbers show what that costs: of 391 MLR registration cases it had completed by August 1, 2026, 17% ended in registration and 67% in withdrawal, with the rest rejected or refused.

The latest 12 months ran higher, 13 registrations in 23 decisions or 56%, a sample FM Intelligence notes is too small to show why the mix changed. The regime also reaches offshore. His Majesty's Treasury (HM Treasury) declined to extend the overseas-persons exemption to crypto, so a non-UK exchange dealing with UK consumers needs authorisation unless it reaches them only through a UK-authorised intermediary or serves institutions alone.

The customers at stake are mostly on those platforms: the FCA counts about 4.5 million UK adults holding crypto, 73% of whom typically buy through a centralised exchange.

Custody, in the FCA's new rulebook, is whoever can move the coins. Borrow the test now, because the counterparties that fail it, or never sit for it, will be setting your exit date in 2027.

The Saving Provision Is the Real Deadline

February 28 matters because of what the Regulations call the saving provision. A firm that files inside the window may carry on as normal after October 25, 2027, including onboarding new customers, until the FCA determines its application; FSMA gives the regulator 6 months to decide a complete application and 12 for an incomplete one, so some decisions will land after commencement by design.

A firm that files after February 28 can still apply, but from October 25, 2027 it is limited to servicing existing contracts, with no new customers and no new business, until it is authorised. A firm that never applies must stop.

That turns the next 5 months into a public sorting. Every firm that serves UK retail has to decide whether to file, and the FCA has said it will steer MLR-registered firms toward FSMA authorisation rather than fresh registrations. The rulebook is largely set: final conduct rules came on June 30 in policy statements PS26/9 through PS26/13, and the perimeter guidance, PS26/18, on September 16.

It is not fully set. HM Treasury published a draft Miscellaneous Amendments instrument on September 15 that reworks the treatment of stablecoins, safeguarding, dealing, and financial promotions, and the FCA will consult again in October. Firms are filing against a moving target, which is a reason to expect withdrawals as well as refusals.

The MiCA Precedent: Roughly 1 in 5 Made It

The European Union ran the same exercise 3 months ago. The transitional period under its Markets in Crypto-Assets Regulation (MiCA) ended on July 1, 2026, after the European Securities and Markets Authority (ESMA) confirmed in April that there would be no extension. Counts published around the deadline put fully licensed providers between about 200 and 250, against more than 1,200 firms that had held national registrations: roughly 1 in 5 at best, and far fewer against the 3,000-plus registrations CoinDesk counted across the bloc in 2024, which is why its headline 2 days before the cutoff used the word 'wipeout.'

The rest were told to stop taking new clients and narrow to helping existing ones sell, transfer, or exit.

The UK's design is kinder to the firm than MiCA's was, and that is the strongest argument against reading July 1 as a preview. The saving provision gives applicants 13 months of runway instead of a cliff, the FCA finalised its rules before the window opened, and the EU register has kept growing since the deadline, to more than 300 by late September according to trackers that mirror ESMA's list.

But the UK funnel has its own history. A 17% pass rate under the MLRs and about 1 in 5 under MiCA sit in the same neighbourhood, and both regimes asked less of a firm than FSMA authorisation will. The customers of the firms that do not make it will find out in the order the FCA decides, not on a schedule of their choosing.

Custody Is Control: The Perimeter Test Worth Borrowing

The most useful sentence in the September 16 guidance is the one that defines safeguarding. The test turns on control, not ownership: a firm safeguards a cryptoasset when it holds it for another person and can bring about a transfer, whether or not it owns the asset or says it will never move it.

A self-custody tool falls outside the perimeter only if its provider has no means to effect a transfer. A provider that promises not to exercise control but technically can, because it can override the client's authority or devise a way to, meets the control test anyway. That is the regulator telling the market that the word 'non-custodial' on a website is not evidence.

The key path is.

What authorised custody buys is also spelled out. Under the adapted Client Assets Sourcebook rules (CASS 17), a safeguarding firm must hold client cryptoassets under a non-statutory trust, segregate them from its own, reconcile its records, manage private keys to a standard, and vet any third-party custodian, so that assets can be returned wholly and quickly if the firm fails.

UK customers of a licensed custodian will have a trust claim to specific coins rather than an unsecured claim against an exchange's estate. That is a real protection, and it is the one the customers of firms that exit, or never apply, will not have.

What This Means for You

If you are a UK customer, the action is a calendar, not a panic. Ask every platform you use 1 question in writing before February 28: have you applied to the FCA for authorisation under the Cryptoassets Regulations, and for which activities? A firm that answers no, or does not answer, has told you its plan, and the MiCA precedent says the exit will run on its timetable.

Move long-term holdings to keys you control before that timetable is announced, not during it, because the last weeks of a wind-down are when withdrawal queues, verification backlogs, and phishing against departing customers all peak. Bitget's staged reopening of withdrawals this week and the phishing wave that followed the Coldcard flaw in August both showed what an exit under pressure costs.

Then borrow the regulator's test for your own setup. Ask of every wallet, app, and service that touches your coins: can anyone other than me bring about a transfer? A hardware wallet whose seed you generated and hold passes. A collaborative-custody or multi-sig arrangement passes only if the provider's keys cannot reach the threshold without yours.

An exchange balance, a 'non-custodial' app whose vendor can push an update that moves funds, or a wrapper that converts your coins into a claim does not. The FCA has written that distinction into its rulebook as the line between a regulated business and a tool. It is also the line between a counterparty you depend on and an asset you hold.

Name the limit. Holding your own keys takes you out of the custody perimeter; it does not take you out of the regime. To buy, sell, or move value into sterling you still need an authorised venue, and after October 2027 that means one that applied and passed. Self-custody also carries failure modes that no trust deed fixes: the Coldcard seed flaw had drained at least $88.

6 million by early August from people whose setups met every word of the FCA's definition. For a UK holder with a modest balance and no appetite for key management, an authorised custodian with a CASS 17 trust may be the better outcome of this regime, not the worse one. The choice the gateway forces is not keys versus exchanges.

It is to decide, in the next 5 months and on evidence, which counterparties you will still have in 13 months.

What to Watch

The FCA's October consultation on further perimeter guidance and HM Treasury's draft Miscellaneous Amendments instrument will show how far the target moves while applications are in flight. Whether the large offshore platforms that serve UK retail announce applications before February 28 is the single best signal of who intends to stay.

The first determinations, likely in the second half of 2027, will set the pass rate that the MiCA and MLR funnels only estimate. Any firm that announces a UK exit before the window closes is the leading indicator; its customers will have the shortest runway of all.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.