FCA Crypto Authorization Requirements for Exchanges: A Complete Guide

If you run a crypto exchange or plan to launch one in the UK, the regulatory landscape is shifting under your feet. For years, the bar was relatively low: register with the Financial Conduct Authority (FCA) under the Money Laundering Regulations (MLRs). That was it. You proved you weren't laundering money, and you could operate. But that era is ending. The UK is moving toward a full-scale financial services framework for digital assets, meaning exchanges now face authorization requirements that look a lot more like those for traditional banks or stock brokers.

This isn't just bureaucratic noise. It’s a fundamental change in how you do business. If you’re serving UK retail customers, you can’t just slap on an anti-money laundering policy and hope for the best. You need to understand the distinction between simple registration and full authorization, know which activities trigger these new rules, and prepare for the operational heavy lifting required to stay compliant. Here is exactly what FCA crypto authorization requirements mean for exchanges right now and in the near future.

The Shift from Registration to Authorization

Let’s clear up the biggest confusion first. There are two different things happening here, and they often get mixed up.

First, there is the current baseline: MLR Registration. Since January 2020, any firm providing cryptoasset exchange services or custodian wallet services must register with the FCA. This focuses strictly on Anti-Money Laundering (AML) and Counter-Terrorist Financing (CTF). Think of this as getting your driver’s license: you prove you know the rules of the road so you don’t crash into other cars.

Second, and more importantly for the future, is FSMA Authorization. Under the Financial Services and Markets Act 2000 (FSMA), the FCA is expanding its remit to cover specific "regulated activities" involving crypto. This isn’t just about where the money comes from; it’s about how you treat the customer, how you safeguard their assets, and how you manage risk. This is the equivalent of becoming a licensed financial advisor. You need to show competence, solvency, and proper governance.

Which Activities Require Full Authorization?

Not every crypto business needs the same level of scrutiny. The draft legislation identifies five core regulated activities that will require full FCA authorization if you want to serve UK consumers. If your exchange does any of these, start preparing now:

• Operating a qualifying cryptoasset trading platform: This is the big one for exchanges. If you provide the venue where buyers and sellers meet, you are operating a trading platform.
• Dealing in qualifying cryptoassets as principal: When you trade on your own account, buying and selling for profit rather than just matching orders.
• Dealing in qualifying cryptoassets as agent: Executing trades on behalf of clients.
• Arranging deals in qualifying cryptoassets: Introducing parties to each other without necessarily taking on the counterparty risk yourself.
• Safeguarding qualifying cryptoassets: Holding customer keys or assets in custody.

Additionally, two newer areas are being brought into the fold: qualifying cryptoasset staking and issuing qualifying stablecoins. These have distinct rules, particularly around capital requirements and consumer disclosures.

Territorial Scope: Do Overseas Exchanges Need UK Authorization?

This is where many international founders get caught out. Just because you are based in Singapore, Dubai, or the Cayman Islands doesn’t mean you escape UK rules. The FCA looks at who you are serving.

If an overseas firm deals directly or indirectly with UK consumers, it generally requires UK authorization for operating a trading platform, dealing, or arranging deals. However, there is a crucial exception designed to stop a chain reaction of licensing. If an overseas firm serves UK consumers only through a UK-authorized intermediary that has the necessary permissions, the overseas firm might not need separate authorization. This prevents every single liquidity provider in a complex web from needing a UK license.

But be careful with the definition of "consumer." In this context, it refers to individuals acting outside their trade, business, or profession. If you only serve institutional clients-like hedge funds or corporate treasuries-you might fall outside the strictest territorial scope for certain activities, provided those institutions aren’t acting as pass-throughs for retail investors.

The Threshold Conditions: What Does "Authorized" Actually Mean?

Once you fall under the FSMA umbrella, you must meet the Threshold Conditions (COND). These are the high-level standards the FCA uses to decide if you are fit to be authorized. They mirror the standards for traditional finance, which means no shortcuts.

You need to demonstrate:

1. Legal Status: Your legal structure must be appropriate for the regulated activities.
2. Location: You need a suitable place of business. For some activities, especially stablecoin issuance, having an establishment in the UK is mandatory.
3. Sufficiency of Resources: You need adequate financial resources (capital) and non-financial resources (people, systems).
4. Governance: Your management must be fit and proper. This involves detailed background checks on directors and senior managers.
5. Suitability: You must conduct your business prudently and in accordance with high standards of integrity.

The FCA also applies Principles for Businesses (PRIN). Interestingly, some principles are modified for crypto platforms. For instance, Principle 6 (Customers’ Interests) and Principle 9 (Relationships of Trust) may be disapplied for transactions on a trading platform, recognizing that the platform operator supervises the trading rules rather than acting as a personal advisor to every trader.

Stablecoins and Custody: Special Rules Apply

Stablecoins are treated differently because they act like money. If you issue a qualifying stablecoin, you need authorization, but the territorial test is stricter: you usually need a physical presence in the UK. This avoids extraterritorial overreach but ensures tight control over the issuers whose tokens circulate in the British economy.

For custody, the focus shifts to Client Assets Sourcebook (CASS) audits. If you hold client assets, you must segregate them properly. The FCA wants to see that if you go bust, your customers' Bitcoin isn't lost in the bankruptcy proceedings of your company. This requires robust technical infrastructure and regular third-party audits.

Recent Changes: Retail Access to Crypto ETNs

It’s worth noting that the FCA’s stance has softened slightly on investment products. On October 8, 2025, the ban on retail access to crypto exchange-traded notes (cETNs) was lifted. Previously, since 2021, retail investors couldn’t buy derivatives or ETNs referencing unregulated crypto. Now, they can, provided these products trade on recognized UK investment exchanges.

Why does this matter for exchanges? Because it signals that the FCA is comfortable with crypto exposure when it goes through regulated market infrastructure. It suggests that the path to legitimacy for exchanges is through integration with traditional market structures, not bypassing them.

Preparing Your Application: Documentation and Expectations

Applying for authorization is document-heavy. The FCA expects you to show you’ve read the guidance. Specifically, you need to reference and comply with:

• JMLSG Guidance: Part II, Chapter 22 covers cryptoasset providers specifically.
• FCA Financial Crime Guide: For your AML controls.
• FG17/6: Guidance on Politically Exposed Persons (PEPs).
• FATF Recommendations: The global standard-setter’s risk-based approach.

Don’t wait until the deadline. Pre-application meetings are available. Use them. Ask questions about your specific business model. The FCA has been engaging with industry participants through events to clarify expectations. If you submit a generic application that doesn’t address your specific risks, expect delays or rejection.

What Should Exchanges Do Now?

The timeline for full FSMA implementation is still being finalized, but the direction is clear. Waiting for the final rulebook before starting your compliance overhaul is a mistake. Compliance takes time to build, audit, and implement.

Here is a practical checklist:

1. Audit Your Activities: Map every service you offer against the five regulated activities. Are you dealing? Arranging? Safeguarding?
2. Assess Your Client Base: Who are your users? If you have UK retail clients, assume you are in scope for territorial requirements.
3. Review Capital Needs: Traditional exchanges might need significantly more capital than under the old MLR regime. Talk to your CFO about the impact of prudential requirements.
4. Strengthen Governance: Ensure your board understands the fiduciary duties involved in holding client assets.
5. Update Contracts: Your terms of service need to reflect the new regulatory status and liability limits.

The UK market is becoming one of the most rigorous jurisdictions for crypto. While this raises the barrier to entry, it also filters out fly-by-night operators. For established exchanges, FCA authorization isn't just a hurdle; it's a badge of trust that can unlock institutional capital and mainstream adoption.