FCA Crypto Authorization Requirements for Exchanges: A Complete Guide

Running a cryptocurrency exchange in the United Kingdom is no longer just about building a secure platform and attracting users. It is about navigating one of the most rigorous regulatory landscapes in the world. If you are planning to launch or operate a crypto business in the UK, the Financial Conduct Authority (or FCA) is the gatekeeper you cannot ignore.

The rules have shifted dramatically in recent years. What started as a simple anti-money laundering registration has evolved into a complex authorization regime under the Financial Services and Markets Act 2000. For many exchanges, especially those serving retail customers from overseas, the question is no longer 'should we comply?' but 'how do we get authorized before we get shut down?'

Key Takeaways

• Dual Regulatory Pathways: You currently need MLR registration, but soon will require full FSMA authorization for most activities.
• Territorial Reach: Overseas firms serving UK retail consumers must get authorized, even if they are based abroad.
• Institutional Exemption: Serving only UK institutional clients may exempt you from certain trading platform authorizations.
• Stablecoin Specifics: Issuing stablecoins requires a physical presence in the UK, unlike other crypto services.
• High Compliance Bar: Expect costs and operational changes similar to traditional financial institutions.

The Current Baseline: MLR Registration

Right now, if you are operating a cryptoasset exchange provider or a custodian wallet provider in the UK, your primary legal obligation is registration under the Money Laundering Regulations (MLRs). This system has been live since January 2020. It is not an authorization in the traditional sense; it is a permission to operate without being prosecuted for money laundering failures.

To register, you must prove to the FCA that you have robust systems to prevent money laundering and terrorist financing. The FCA looks at four possible outcomes for any application: approval, rejection, withdrawal, or refusal. Most rejections happen because firms fail to demonstrate a clear understanding of the Joint Money Laundering Steering Group (JMLSG) guidance.

The JMLSG provides specific sectoral guidance in Part II, Chapter 22 for crypto businesses. You need to show you understand how to identify Politically Exposed Persons (PEPs), conduct risk-based due diligence, and report suspicious activity. The FCA also expects you to align with the Financial Action Task Force (FATF) guidelines on Virtual Asset Service Providers (VASPs).

Think of MLR registration as the entry ticket. It keeps you legal today, but it does not protect you from the future regulatory shifts coming via FSMA.

The Future: FSMA Authorization Requirements

The game is changing with the expansion of the Financial Services and Markets Act 2000 (FSMA) to cover crypto assets. This is not just a tweak; it is a complete overhaul. Under the new framework, specific crypto activities become 'regulated activities' requiring full FCA authorization, similar to banks or investment firms.

Here are the five core activities that will require authorization:

1. Operating a qualifying cryptoasset trading platform: Running a marketplace where users trade crypto assets.
2. Dealing in qualifying cryptoassets as principal: Trading crypto assets for your own account.
3. Dealing in qualifying cryptoassets as agent: Trading crypto assets on behalf of clients.
4. Arranging deals in qualifying cryptoassets: Facilitating transactions between buyers and sellers.
5. Safeguarding qualifying cryptoassets: Holding client funds or assets securely.

Additionally, two separate activities have their own distinct requirements:

• Qualifying cryptoasset staking: Offering staking services to earn rewards.
• Issuing qualifying stablecoins: Creating digital currencies pegged to fiat values.

This means your business model determines your regulatory burden. An exchange that only holds custody might have different obligations than one that offers staking and trading.

Territorial Scope: Do Overseas Firms Need Authorization?

This is where many international exchanges stumble. The FCA’s new rules extend beyond UK borders. If you are an overseas firm dealing directly or indirectly with UK consumers, you likely need UK authorization.

Who counts as a 'consumer'? The FCA defines this strictly: individuals acting for purposes outside their trade, business, or profession. In plain English, this means retail investors. If you sell Bitcoin to a person in London for personal investment, you are serving a consumer.

However, there is a crucial exception. If an overseas firm serves UK consumers through a UK-authorized intermediary (like a local broker who already has permissions), the overseas firm does not need separate authorization. This prevents an 'ever-growing chain' of firms from needing licenses.

What about institutional clients? If you serve only UK-based institutions (like hedge funds or corporations) and those institutions are not acting as intermediaries for retail consumers, you are generally exempt from authorization for trading platforms, dealing, and arranging activities. This recognizes that institutional players are sophisticated and can protect themselves.

But beware: for safeguarding and staking services, overseas firms still need authorization if they provide these services on behalf of UK consumers, even if the client is institutional, unless specific exceptions apply.

Special Rules for Stablecoin Issuers

Stablecoins are treated differently. While trading and custody rules focus on who you serve, stablecoin issuance focuses on where you are located. To issue a qualifying stablecoin in the UK, you must carry on the activity from an establishment in the United Kingdom.

This is a physical presence test. You cannot issue a UK-regulated stablecoin purely from an office in Singapore or Dubai. You need a real operational base in the UK. This reflects the systemic risk stablecoins pose to financial stability and the FCA’s desire to keep oversight close to home.

High-Level Standards: Principles for Businesses

Once authorized, you are held to the same high standards as traditional financial firms. The FCA applies Threshold Conditions (COND) and General Provisions (GEN) identically to crypto firms. This means you need adequate resources, proper governance, and effective risk management.

The Principles for Businesses (PRIN) also apply, but with some modifications. For example, Principles 1 (Integrity), 2 (Skill, Care and Diligence), 6 (Customers' Interests), and 9 (Customers: Relationships of Trust) are disapplied for transactions entered into on qualifying cryptoasset trading platforms by members. Why? Because the platform operator supervises the trading rules, reducing the direct fiduciary duty in each transaction.

For professional clients, Principles 6 and 9 are also disapplied when providing trading platform services, acknowledging their sophistication. However, for retail clients, these principles remain fully active. You must act in their best interest.

Supervision and Enforcement Powers

The FCA is not just granting licenses; it is actively supervising. The Supervision (SUP) provisions give them extensive powers:

• Information Gathering: They can demand data and reports.
• CASS Audits: Firms holding client assets must undergo regular audits to ensure segregation and safety.
• Skilled Person Appointments: The FCA can hire independent experts to investigate your operations.
• Permission Variation/Cancellation: They can change or revoke your license if you breach rules.

Recent developments show this enforcement muscle. In October 2025, the FCA allowed retail access to crypto exchange-traded notes (cETNs), reversing a 2021 ban. But this was conditional: cETNs must trade on FCA-approved, UK-based Recognised Investment Exchanges. This ensures that retail investors have access to regulated products with strong infrastructure.

How to Apply: Practical Steps

Preparing an application is intensive. Whether for MLR registration or future FSMA authorization, you need comprehensive documentation. Here is what the FCA expects:

1. Risk Assessment: Detailed analysis of money laundering and terrorist financing risks.
2. Compliance Framework: Policies aligned with JMLSG, FATF, and FCA Financial Crime guides.
3. Business Model Clarity: Clear description of services, target clients, and revenue streams.
4. Governance Structure: Organizational charts, key personnel CVs, and fit-and-proper assessments.
5. Technical Security: Evidence of cybersecurity measures and custody solutions.

Pre-application meetings are available. Use them. The FCA has hosted engagement events to help firms prepare. Don’t wait until you submit to ask questions. Engage early to avoid costly rejections.

Market Impact and Costs

Be prepared for significant compliance costs. The territorial scope provisions mean overseas platforms serving UK retail customers must either get authorized or exit the market. Many are restructuring to serve only institutional clients to avoid the burden.

For domestic firms, the shift from MLR to FSMA means upgrading systems, hiring compliance staff, and undergoing rigorous audits. The CASS requirements alone can add hundreds of thousands of pounds in annual costs. But this is the price of legitimacy. As the UK positions itself as a global hub for regulated crypto innovation, authorized firms gain trust and access to broader financial markets.

Next Steps for Your Business

If you are already registered under MLRs, start mapping your activities to the new FSMA categories. Identify which activities require authorization and assess your readiness. If you are an overseas firm, determine if you serve UK consumers directly. If yes, begin the authorization process now. If no, document your institutional-only client base meticulously.

Consult with legal experts specializing in UK financial regulation. The rules are complex, and mistakes are expensive. Build a compliance strategy that addresses both current MLR obligations and future FSMA requirements. The goal is not just to survive regulation, but to thrive within it.