The FCA Opened the Door on September 30. The Regime Still Starts in 2027
Two dates are doing too much work in the headlines. September 30, 2026 is when the Financial Conduct Authority starts taking authorization applications. October 25, 2027 is when the cryptoasset regime actually applies. Mix them up and you will file a year early or trade a year late.
Decrypt’s September 16 recap is the short version. The FCA published perimeter guidance on Wednesday, two weeks before the window. The window runs from September 30, 2026 to February 28, 2027. Miss February and you lose the transitional cover that lets you keep operating while the application is assessed. The statute does not start because a PDF landed this week.
Visa’s on-chain lending push is a product story. This is a perimeter story. You can have a card program and still be on the wrong side of “arranging” if the UK retail customer is in the flow.
The calendar, without the adjectives
The Paypers, September 17 puts the same dates in a slower register. The regime comes into force on 25 October 2027. The authorization gateway opens on 30 September 2026. The FCA’s point in publishing now is preparation, not a surprise go-live.
CryptoRank adds the policy-statement number: PS26/18. Firms that want the transitional arrangements must submit by 28 February 2027. September 30 is the opening of the process, not the deadline. Pre-application support exists. The FCA also plans to consult on targeted updates in October 2026 after recent government changes to the legislation.
That October 2026 consult is easy to skip in a slide. Do not skip it. If you file on day one of the window and the perimeter shifts in October, you will be amending while the clock toward February still runs.
The Paypers traces the paper trail. Rules and guidance were finalised in June 2026. The government brought cryptoassets into UK regulation with legislation in February 2026. A draft statutory instrument then revised the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, with targeted exclusions for some technical service providers. Perimeter guidance is how the FCA tells you which side of those exclusions you are on.
David Geale, the FCA’s executive director of consumers, payments and competition, said the quiet part in the press line Decrypt and Securities.io both carried: firms asked for clarity so they could prepare. Clarity here means “which activities need a permission,” not “here is a passport.”
What sits inside the perimeter
Decrypt, The Paypers, CryptoRank, and Securities.io list the same cluster.
Issuing qualifying stablecoins. Operating cryptoasset trading platforms. Dealing and arranging deals. Safeguarding, which is the custody word. Arranging staking.
If your deck says “we only do infrastructure,” read arranging and safeguarding twice. Technical-service exclusions exist because of the SI amendments The Paypers flagged. Exclusions are narrow. Marketing copy is not a legal test.
Securities.io spells out who the guidance is for, which is broader than “crypto startups in Shoreditch.” Firms already carrying out or planning regulated cryptoasset activities in the UK. Firms already authorised that may need extra permissions. Firms registered under the Money Laundering Regulations. E-money issuers and payment service providers. Traditional finance firms poking at crypto markets. Overseas firms serving UK consumers.
That last group is the one US and EU teams keep hoping does not apply. Decrypt is blunt. Overseas firms dealing, arranging, or safeguarding for UK retail customers are caught. There is no overseas persons exclusion waiting to save a landing page with sterling prices.
Coinbase’s community-bank stablecoin pitch is a US charter conversation. If that stack still touches a UK retail user, the FCA list above is not optional reading.
AML registration is not authorization
CryptoRank’s summary is the sentence compliance teams should tape to the stand-up board. Existing AML-registered firms must submit fresh applications. The MLR number you already have is not a grandfather clause for the 2027 regime.
Securities.io puts the same idea in the audience list: MLR-registered firms are in the guidance because they are not done. They are next. If you told a bank partner you were “FCA registered” and you meant AML registration, fix the language before the partner’s counsel reads PS26/18.
The new perimeter also pulls in Consumer Duty, governance, safeguarding rules, operational resilience, and SM&CR, per CryptoRank. Those are cost lines. Centralized exchanges, dealers, token projects, and anyone who has been pretending a DAO wrapper is a perimeter strategy will feel them. I am not going to forecast a headcount. I will say February 28 is a filing date, not a branding date.
Pre-application support is there because the FCA expects confused files. Use it if your activity map has a maybe. A maybe that becomes a no in 2027 is cheaper in a pre-app meeting than in a stop-business letter.
Transitional cover is the thing you can lose
Decrypt’s brief is the sharpest on the penalty for being late. Miss February 28, 2027 and you lose the transitional cover that lets you keep operating while the application is assessed. The regime date is still October 25, 2027. The practical date for anyone already serving UK users is the February filing.
That is a two-clock problem. Clock one: prepare the file for September 30 onward. Clock two: do not treat “we started a draft in October” as cover if February passes. Transitional relief is for people who applied, not for people who meant to.
Overseas teams serving UK retail without a UK entity will want a UK lawyer, not a Twitter thread. Decrypt’s “no overseas persons exclusion” line is the one that kills the old playbook of “we’re not in London so we’re not in scope.” If you deal, arrange, or safeguard for UK retail, you are in the catchment.
I would also stop promising token holders that staking “just works” through 2027. Arranging staking is on the activity list. If your front end routes a UK user into a staking flow, that is a permission question, not a UX question.
What to do before September 30
Map activities against the PS26/18 list in writing. Issuing, platform, dealing, arranging, safeguarding, staking. If two of those appear in a single product, say so. Do not hide arranging inside a help article.
Decide whether you need extra permissions on an existing authorization or a new application. Those are different forms. Securities.io called out already-authorised firms for a reason.
If you are MLR-registered only, start the authorization file. Do not wait for the October consult to “see if it gets easier.” The consult is targeted updates after the SI, not a pause button.
If you are overseas with UK retail, assume you are in. Budget for it. The exclusion you wanted is the one Decrypt says you do not have.
Watch the October 2026 consult, then freeze a version of the activity map. File inside the window with enough time to answer questions before February 28. Transitional cover is the prize. October 25, 2027 is when the rest of the market finds out who filed.
Stablecoins, staking, and the words that will show up in counsel’s email
Qualifying stablecoin issuance is on the list in every recap I used. If you issue, you are not a software vendor who “happens to touch” a token. You are in the perimeter. If you only integrate someone else’s token, you may still be arranging. That is the conversation to have with counsel before you file, not after a case officer asks why your white paper and your application describe two different firms.
Safeguarding is custody. If your app shows a balance and you control the keys, stop telling journalists you are “non-custodial enough.” Decrypt and The Paypers both put safeguarding in the activity list. Case officers can read a help center. They will.
Arranging staking is the one DeFi teams will try to define away. If a UK retail user clicks a button on your domain and ends up staked, you have a facts-and-circumstances problem. I am not going to litigate it in a blog post. I am going to say it is on the published list, which means it belongs on your internal map with a yes, no, or “ask the FCA in pre-app.”
The Paypers is also the reminder that the government already cut some technical service providers out via the SI. If you are a pure infrastructure shop, that exclusion is your homework. If you are a front end with a swap button, it is probably not yours. Do not borrow another company’s exclusion.
CryptoRank’s note on Consumer Duty and SM&CR is the cost forecast without numbers. Named individuals, complaints handling, operational resilience, safeguarding audits. Those land on October 25, 2027 for authorised firms, and they start eating calendar time the day you decide to file. A February application that has no SM&CR plan is how you spend spring in questions.
This is not investment advice and it is not a prediction about token prices. It is a calendar. The FCA put the calendar on the table two weeks before the door opens. Walk through the door on purpose, or plan to be dark for UK retail when the transitional cover is no longer there to hide behind. September 30 opens. February 28 is the date that actually hurts. October 25, 2027 is when the rest of the market learns who did the paperwork.
One operational note that does not fit a lawyer’s memo. If your UK site is a marketing page that deep-links to an EU or US app, you still have a UK retail question. Decrypt’s overseas line is about the customer, not about where the servers sit. Screenshot the journey. If a user in Manchester can click from your .com into dealing, arranging, or safeguarding, put that screenshot in the application pack. Case officers prefer pictures of the product over slogans about decentralization.
If you already have e-money or payments permission, Securities.io says you may still need extra crypto permissions. Do not assume the EMI licence covers qualifying stablecoins. File the gap. If you are TradFi “exploring,” freeze exploration that looks like arranging until the file is in. Exploring in a slide is fine. Exploring in a funded test with UK users is how you skip the transitional queue.
Pre-application support exists because the FCA knows the perimeter is wider than the conference circuit. Use it. Bring the activity map, the SI exclusion you think you have, and the overseas user count. Leave the token price chart at home.
