FCA Outlines UK Cryptoasset Regulated Activities Under FSMA and the New Handbook Framework

Key Takeaways

• The FCA has published a guidance page explaining how the Treasury's new cryptoasset regulated activities fit within FSMA and the FCA Handbook.
• Final rules and guidance were published on 30 June 2026 and will apply to firms authorized under FSMA on or after 25 October 2027.
• For many cryptoasset firms this will be their first time under FSMA authorization, so compliance teams need to assess perimeter scope and begin preparing now.

Deep Dive

The FCA has published a guidance page explaining how the Treasury's new cryptoasset regulated activities fit within FSMA and the FCA Handbook. Final rules and guidance were published on 30 June 2026 and will apply to firms authorized under FSMA on or after 25 October 2027. For many cryptoasset firms this will be their first time under FSMA authorization, so compliance teams need to assess perimeter scope and begin preparing now.

The update confirms that the Treasury's Statutory Instrument will add new cryptoasset regulated activities to the Regulated Activities Order 2001 (RAO). Firms carrying out these activities in or to the UK will need FCA authorization. The nine activities are: issuing qualifying stablecoin in the UK; safeguarding qualifying cryptoassets and relevant specified investment cryptoassets; arranging for another person to safeguard them; operating a qualifying cryptoassets trading platform; dealing as principal; dealing as agent; arranging (bringing about) deals; making arrangements with a view to transactions; and qualifying cryptoasset staking. Compliance teams should map every business line against this list, since the regulatory perimeter is defined by activity and not by firm type.

The FCA published its final rules and guidance on 30 June 2026. It has also issued perimeter guidance to help firms determine when authorization may be required. The regime is described as applying to firms granted permission under FSMA on or after 25 October 2027. Because the page is high-level, firms should confirm the precise application dates and any application windows and transitional arrangements in the underlying policy statements and the Statutory Instrument. The FCA also intends to create a dedicated cryptoasset sourcebook, along with a table showing how other Handbook sourcebooks apply to cryptoasset firms.

For firms new to FSMA regulation, the main challenge is the shift to a full conduct and prudential framework with Handbook obligations, supervisory expectations, and individual accountability. The FCA explicitly flags its expectations of both firms and individuals. Recommended actions include:
- Performing a perimeter analysis against the RAO and the Statutory Instrument.
- Conducting a gap assessment against the new rules and the sourcebook structure.
- Reviewing governance, senior management responsibilities, and compliance resourcing.
- Planning the authorization application timeline.
- Engaging independent legal or compliance advisers, as the FCA suggests.

The main risks are carrying out regulated activities without authorization, which is a perimeter breach with potential criminal and enforcement consequences. Other risks are late or incomplete applications that delay market access, and underestimating the operational and governance uplift required. Firms with UK-facing services, including offshore entities serving UK customers, face particular exposure because the regime covers activities provided "in or to the UK". Early preparation will lower enforcement, reputational, and business continuity risk.

Source: Financial Conduct Authority