Two regulatory pathways for cryptoasset businesses

The UK has a two-tier regulatory system for cryptoasset businesses. The pathway you follow depends entirely on token classification:

Security tokens and e-money tokens - Require full FCA authorisation under FSMA 2000 (6-month process, £11,150+ fees, Threshold Conditions)
Exchange tokens and utility tokens - Require only Money Laundering Regulations (MLR) registration with the FCA (3-month process, £11,150 fee)

Getting this classification wrong has severe consequences - operating without proper authorisation carries up to 2 years imprisonment and unlimited fines.

Cryptoasset Classification Framework

FCA token type classifications determining regulatory requirements - security tokens and e-money tokens require full authorisation, exchange and utility tokens require MLR registration only.

The FCA takes a 'substance over form' approach when classifying cryptoassets. The classification determines whether your business needs full FCA authorisation under FSMA or only MLR registration.

Security Tokens: REGULATED - Full FCA authorisation required
Security token definition: Tokens that amount to a 'Specified Investment' under RAO; provide rights such as ownership, repayment, or profit sharing
E-Money Tokens: REGULATED - Full FCA authorisation required
E-money token definition: Tokens meeting the definition of e-money under Electronic Money Regulations
Exchange Tokens: UNREGULATED - MLR registration only
Exchange token examples: Cryptocurrencies like Bitcoin, Litecoin; used as medium of exchange
Utility Tokens: UNREGULATED - MLR registration only
Utility token definition: Redeemable for access to specific product/service on DLT platform
Classification approach: FCA uses 'substance over form' to determine true nature of token
Key legislation: Financial Services and Markets Act 2000 (Regulated Activities) Order 2001

FCA Guidance on Cryptoassets (PS19/22)

Full FCA authorisation (security and e-money tokens)

If your tokens are classified as security tokens or e-money tokens, you are conducting regulated activities and need full FCA authorisation before you start operating.

FCA Regulated Activities

Activities that require FCA authorisation in the UK

The following activities require FCA authorisation when conducted in the UK:

Accepting deposits - Banks, building societies (RAO Article 5)
Dealing in investments as principal - Trading securities (Article 14)
Dealing in investments as agent - Broker services (Article 21)
Arranging deals in investments - Introducing clients, arranging transactions (Article 25)
Managing investments - Discretionary portfolio management (Article 37)
Safeguarding and administering investments - Custody services (Article 40)
Advising on investments - Investment advice (Article 53)
Mortgage lending and administration - Regulated mortgages (Articles 61(1), 61(2))
Mortgage advice - Advising on regulated mortgage contracts (Article 53A)
Insurance distribution - Selling/advising on insurance (Article 21A)
Consumer credit - Lending, credit broking, debt collection
Payment services - Payment initiation, account information (Article 9C)
Electronic money issuance - Issuing e-money (Article 9B)

Conducting regulated activities without authorisation is a criminal offence under FSMA 2000 s.23.

The authorisation process

Full FCA authorisation is a rigorous 6-month process with detailed requirements for governance, capital adequacy, and conduct standards.

FCA Threshold Conditions

Conditions that must be met for FCA authorisation

Legal status: Appropriate legal form (body corporate, partnership, individual)
Location of offices: Head office and registered office in UK
Effective supervision: FCA must be able to supervise effectively
Appropriate resources: Adequate financial and non-financial resources
Suitability: Fit and proper (competence, honesty, financial soundness)
Business model: Sustainable and viable business model

FCA Authorisation and Registration Fees 2025/26

Application fees for FCA authorisation and cryptoasset MLR registration, ranging from £280 to £222,940 depending on firm category.

FCA application fees are non-refundable, even if your application is unsuccessful. Fees are paid upfront via the FCA Connect system using credit or debit card.

Category 1 (Lowest tier): £280
Category 3 (Small Payment/E-Money Institutions): £1,120
Category 4 (Authorised Payment Institutions - Option 1): £2,790
Category 5 (Authorised Payment Institutions - Option 2, Authorised E-Money Institutions): £5,580
Category 6 (Cryptoasset Businesses - MLR registration): £11,150
Category 10 (UK Recognised Investment Exchanges): £222,940
Variation fees: 50% of Category 3 or 4 fee for permission variations
Fee structure: 10 pricing categories from £280 to £222,940
Payment method: Upfront payment via FCA Connect system (credit/debit card)
Refundability: Non-refundable, even if application unsuccessful
Fee year: 1 July 2025 to 30 June 2026
Next update: 1 July 2026 (annual CPI adjustment)

Ongoing periodic fees: After authorisation, firms pay annual periodic fees based on their tariff base (income from regulated activities). Estimated ongoing annual costs are approximately £30,000 for most cryptoasset firms.

FCA application fees guidance

Ongoing obligations after authorisation

Once authorised, fintech firms must comply with the FCA's Consumer Duty, which requires demonstrating good customer outcomes across product design, pricing, communications, and customer support.

FCA Consumer Duty for Fintech Firms

Consumer Duty principles requiring firms to design products for fair value, monitor customer outcomes, ensure appropriate friction in customer journeys, and communicate clearly.

The Consumer Duty applies to all FCA-authorised firms, including fintech and cryptoasset firms preparing for authorisation. The Duty requires firms to act to deliver good outcomes for retail customers.

Applicable to: All FCA-authorised firms, including fintech and cryptoasset firms
Core principle: Act to deliver good outcomes for retail customers
2025/26 FCA priority: Multi-firm reviews examining how firms have embedded Consumer Duty
Future changes (2026): Consultation on limiting Duty's application to UK customers only
Enforcement focus: Sector-specific reviews and support for firms in implementation

For cryptoasset firms specifically: Consumer Duty principles likely to inform design and marketing of cryptoasset products, expectations around fair value for token products, transparency of fees for custody and exchange services, and customer understanding requirements for complex products.

MLR registration only (exchange and utility tokens)

If your tokens are exchange tokens (like Bitcoin) or utility tokens, you do not need FCA authorisation under FSMA. However, you must register with the FCA under the Money Laundering Regulations.

This applies to cryptoasset exchange providers and custodian wallet providers operating in the UK.

Cryptoasset MLR Registration Process

Step-by-step process for registering cryptoasset businesses with the FCA under Money Laundering Regulations, including MLRO appointment and 3-month timeline.

Cryptoasset exchange and custodian wallet providers must register with the FCA under the Money Laundering Regulations (MLRs) before operating in the UK. The statutory decision timeline is 3 months after your application is assigned to a case officer.

Operating without registration is a breach of MLRs and can result in criminal penalties.

Statutory decision timeline: 3 months after assignment to case officer
Application fee (Category 6): £11,150 (non-refundable)
MLRO requirement: Mandatory under Regulation 21(3) MLRs
Effective date: Registration mandatory from 10 January 2020
Tax year: 2025/26

Data protection obligations

All cryptoasset businesses processing customer data must comply with UK GDPR and register with the ICO. This is a separate requirement from FCA authorisation or MLR registration.

Data protection fee: ICO registration

Legal requirement to pay data protection fee to ICO under Data Protection Act 2018.

Under the Data Protection (Charges and Information) Regulations 2018, most organizations that process personal data must pay an annual data protection fee to the Information Commissioner's Office (ICO).

Who must pay

Must pay if your business:

Processes personal information about individuals (customers, employees, suppliers)
Is not covered by a limited exemption

Personal data includes: Names, addresses, email addresses, phone numbers, IP addresses, employee records, customer orders, marketing lists.

Tier 1 fee (most small businesses): £52 per year - Turnover up to £632,000 AND 10 or fewer staff (from Feb 2025)
Tier 2 fee: £78 per year - Turnover up to £36 million AND 250 or fewer staff (from Feb 2025)
Tier 3 fee (large organizations): £3,763 per year - Turnover over £36 million OR over 250 staff (from Feb 2025)
Penalty for non-payment: Up to £4,350 plus the fee owed

When to register

Before you start processing personal data - this means from day one for most businesses. You process personal data if you:

Keep customer records (names, email addresses, order history)
Have employees (employment records, payroll, contact details)
Use suppliers (contact information)
Send marketing emails
Use cookies on your website
Store business contacts in a CRM

Exemptions

Very limited exemptions exist. You're exempt only if you:

Only process personal data for personal or household purposes (not business)
Only process data for accounts, records, and admin required by law (very narrow - consult ICO guidance)
Are an MP, elected representative, or judge (specific exemptions)

Most businesses are NOT exempt - if you have any customer or employee data, you likely need to pay.

Registration process

Self-assess your tier using ICO's online tool
Register online at ico.org.uk
Pay annual fee by Direct Debit or card
Receive registration confirmation - Your registration appears on ICO's public register
Renew annually - ICO will remind you when renewal is due

Renewal: Annual - ICO sends renewal reminder before expiry
Public register: Your registration is publicly searchable on ICO website
Direct Debit discount: £5 discount if paying by Direct Debit

Pay the data protection fee

Consequences of operating without authorisation

The FCA takes unauthorised financial activity seriously. Operating a cryptoasset business without the correct authorisation or registration has severe legal and financial consequences.

Get professional advice

Token classification is complex and fact-specific. The same token can be classified differently depending on how it's structured, marketed, and used. If you're unsure whether your tokens are security tokens, e-money tokens, exchange tokens, or utility tokens, seek legal advice before launching.

The FCA offers an Innovation Hub for fintech businesses seeking regulatory guidance, and the Financial Services Compensation Scheme (FSCS) does not cover most cryptoassets.

Classify your tokens

Determine whether your tokens are security tokens, e-money tokens, exchange tokens, or utility tokens using the FCA's classification framework. This determines your regulatory pathway.
Check if you need FCA authorisation

If your tokens are security or e-money tokens, you must apply for full FCA authorisation before you start operating. Review the list of regulated activities to confirm.
Register under MLR if required

If your tokens are exchange or utility tokens, register with the FCA as a cryptoasset business under the Money Laundering Regulations. Appoint a Money Laundering Reporting Officer (MLRO).
Meet Threshold Conditions

For full FCA authorisation, prepare evidence that you meet the Threshold Conditions covering suitability, appropriate resources, and effective supervision.
Budget for authorisation costs

FCA authorisation fees are £11,150 for cryptoasset businesses, plus annual fees. Legal and compliance costs can add £50,000-£200,000 for complex applications.
Register with the ICO

All cryptoasset businesses processing personal data must register with the ICO and pay the appropriate data protection fee (£52, £78, or £3,763 depending on size and turnover).
Implement Consumer Duty compliance

If you are FCA-authorised, build Consumer Duty into your product design, pricing, communications, and customer support from day one. Document how you deliver good customer outcomes.
Check the FCA Warning List

Before launching, check you're not on the FCA's Warning List of unauthorised firms. Consumers are advised not to deal with firms on this list.

Business Context Testing

Content Graph

Guvnor

Cryptoasset Business Regulation

Two regulatory pathways for cryptoasset businesses

Full FCA authorisation (security and e-money tokens)

The authorisation process

Ongoing obligations after authorisation

MLR registration only (exchange and utility tokens)

Data protection obligations

Consequences of operating without authorisation

Get professional advice

Classify your tokens

Check if you need FCA authorisation

Register under MLR if required

Meet Threshold Conditions

Budget for authorisation costs

Register with the ICO

Implement Consumer Duty compliance

Check the FCA Warning List

Compliance Assistant

🧪 Business Context Testing

◉ Content Graph

Two regulatory pathways for cryptoasset businesses

Full FCA authorisation (security and e-money tokens)

The authorisation process

Ongoing obligations after authorisation

MLR registration only (exchange and utility tokens)

Data protection obligations

Consequences of operating without authorisation

Get professional advice

Classify your tokens

Check if you need FCA authorisation

Register under MLR if required

Meet Threshold Conditions

Budget for authorisation costs

Register with the ICO

Implement Consumer Duty compliance

Check the FCA Warning List

Related guides in Digital & Technology

Business Context Testing

Content Graph