The UK’s road to crypto regulation

The UK is finalising its regulatory regime for cryptoassets. Syed Rahman of Rahman Ravelli outlines the stages involved in achieving this, the possible positive effects and how these can be obtained.

For some, the regulation of crypto cannot come soon enough. And now it is officially on its way.

Since its creation, the crypto sector has been subject to accusations that it is the financial equivalent of the Wild West – an area where gains from criminal activity could be both made and concealed. Now, however, the UK’s cryptoasset roadmap details the stages that will lead to a regulatory regime that is overseen by the Financial Conduct Authority (FCA). 

The new rules, which were published on June 30, will come into effect on October 25 next year. They will require  firms  carrying on regulated cryptoassets activities in or to the UK to obtain FCA authorisation. The rules represent the culmination of a series of FCA consultations and set out the final rules and guidance across key areas, including cryptoassets issuance and disclosure, stablecoins, trading and intermediation, custody, lending and borrowing, staking and prudential requirements.

Stages

The creation of the crypto regime has been some time in the planning. While it looks a near-certainty to come into existence in October 2027, there are various stages on the timeline between now and then that have to be addressed by the relevant parties.

These are:

• September 30, 2026 to February 28, 2027: The FCA’s authorisation gateway opens. During this stage, crypto firms must submit their applications to the FCA to prove that they are ready and able to comply with the regime’s new prudential and conduct rules.
• September 2026: Following its consultation on the regulatory perimeter, the FCA is expected to publish final guidance on how the new regime will apply to different cryptoassets activities.
• Late 2026: The FCA will consult on specific guidance regarding decentralised finance (DeFi). It will also consult on operational resilience; which is firms’ ability to manage disruptions (such as cyberattacks, system outages and extreme market volatility) in a way that prevents harm to consumers.
• October 25, 2027: The full regulatory regime officially comes into force. Until this point, the FCA’s oversight of crypto is largely limited to the issues of financial promotions and anti-money laundering (AML) controls.

Hopes

Hopes are high for the new regime in many quarters. This is understandable, given its importance and the possible positives that could result from it.

Many in the crypto sector itself will welcome it as a much-needed attempt to drive out the bad actors. The more traditional financial sector is likely to approve of responsibilities being imposed on crypto that are similar to those it has always had to meet. This, in turn, could lead to greater interaction between the two sectors. And the government is likely to trumpet the regime as a key factor in its attempts to have the UK viewed as a global crypto hub; which is something that was always going to require digital assets being subject to some form of financial regulatory framework.

So there is much riding on the new regime, both for the sector as a whole and the FCA. But its success cannot be taken as a given. At this stage, it remains to be seen whether regulation will be successful in driving the criminal element out of crypto. For many, the main question will be whether regulation will actually reduce crypto fraud or simply change how victims have to attempt to recover their money. 

Success

The success of the new regime will depend on how effectively the FCA can enforce it. Authorisation should raise standards among crypto businesses. But crypto is inherently cross-border, while the FCA’s jurisdiction is not. The real test will, therefore, be how effectively the regulator can police the perimeter and deal with overseas businesses that continue to provide services to UK consumers without the required authorisation. 

There is also a question of resources and the technical expertise that will be required – something that the FCA will need to consider.

One potential weakness is the distinction between regulating the crypto industry and tackling crypto-enabled crime. The new regime should make regulated businesses safer and impose greater accountability on legitimate market participants. It cannot, however, remove the decentralised and international characteristics that make crypto attractive to fraudsters in the first place. 

A fraudster does not need to (and will not) establish FCA authorisation. Assets can move rapidly though self-hosted wallets and overseas exchanges, often long before a victim realises what has happened. DeFI presents an even more difficult question as to whether there may be no conventional intermediary against which regulatory obligations can readily be enforced. That makes the interaction between regulation and asset recovery particularly important. 

The new regime should make the UK’s legitimate crypto market considerably more mature. But prevention is only part of the equation. The effectiveness of the regime will also depend on whether law enforcement agencies, regulators, exchanges and the courts can identify, trace and preserve cryptoassets quickly enough when fraud occurs.