Technology & Digital Technology and digital platforms

Cryptoasset Business Regulation

Regulatory requirements for cryptoasset businesses in the UK - how token classification determines whether you need full FCA authorisation or Money Laundering Regulations registration only.

UK-wide
Guide summary

You must check what type of crypto tokens your business uses. Security tokens and e-money tokens need full FCA authorisation. Exchange tokens and utility tokens only need money laundering registration. Getting this wrong can lead to prison and unlimited fines.

  • Classify your crypto tokens correctly
  • Security and e-money tokens need full FCA authorisation
  • Exchange and utility tokens need money laundering registration only
  • Full authorisation takes 6 months and costs £11,150+
  • Money laundering registration takes 3 months and costs £11,150
  • Wrong classification risks prison and unlimited fines
  • FCA checks the real use of tokens, not just their name
  • You must meet ongoing conditions after authorisation
  • Application fees are non-refundable
  • Head office must be in the UK
On this page
UK-wide

Related guides in Digital & Technology

Software licensing compliance

Understand your legal obligations when using, developing, or distributing software - including open source licensing, commercial agreements, and …

Two regulatory pathways for cryptoasset businesses

The UK has a two-tier regulatory system for cryptoasset businesses. The pathway you follow depends entirely on token classification:

  • Security tokens and e-money tokens - Require full FCA authorisation under FSMA 2000 (6-month process, £11,150+ fees, Threshold Conditions)
  • Exchange tokens and utility tokens - Require only Money Laundering Regulations (MLR) registration with the FCA (3-month process, £11,150 fee)

Getting this classification wrong has severe consequences - operating without proper authorisation carries up to 2 years imprisonment and unlimited fines.

Full FCA authorisation (security and e-money tokens)

If your tokens are classified as security tokens or e-money tokens, you are conducting regulated activities and need full FCA authorisation before you start operating.

The authorisation process

Full FCA authorisation is a rigorous 6-month process with detailed requirements for governance, capital adequacy, and conduct standards.

Ongoing obligations after authorisation

Once authorised, fintech firms must comply with the FCA's Consumer Duty, which requires demonstrating good customer outcomes across product design, pricing, communications, and customer support.

MLR registration only (exchange and utility tokens)

If your tokens are exchange tokens (like Bitcoin) or utility tokens, you do not need FCA authorisation under FSMA. However, you must register with the FCA under the Money Laundering Regulations.

This applies to cryptoasset exchange providers and custodian wallet providers operating in the UK.

Data protection obligations

All cryptoasset businesses processing customer data must comply with UK GDPR and register with the ICO. This is a separate requirement from FCA authorisation or MLR registration.

Consequences of operating without authorisation

The FCA takes unauthorised financial activity seriously. Operating a cryptoasset business without the correct authorisation or registration has severe legal and financial consequences.

Get professional advice

Token classification is complex and fact-specific. The same token can be classified differently depending on how it's structured, marketed, and used. If you're unsure whether your tokens are security tokens, e-money tokens, exchange tokens, or utility tokens, seek legal advice before launching.

The FCA offers an Innovation Hub for fintech businesses seeking regulatory guidance, and the Financial Services Compensation Scheme (FSCS) does not cover most cryptoassets.

  1. 1

    Classify your tokens

    Determine whether your tokens are security tokens, e-money tokens, exchange tokens, or utility tokens using the FCA's classification framework. This determines your regulatory pathway.

  2. 2

    Check if you need FCA authorisation

    If your tokens are security or e-money tokens, you must apply for full FCA authorisation before you start operating. Review the list of regulated activities to confirm.

  3. 3

    Register under MLR if required

    If your tokens are exchange or utility tokens, register with the FCA as a cryptoasset business under the Money Laundering Regulations. Appoint a Money Laundering Reporting Officer (MLRO).

  4. 4

    Meet Threshold Conditions

    For full FCA authorisation, prepare evidence that you meet the Threshold Conditions covering suitability, appropriate resources, and effective supervision.

  5. 5

    Budget for authorisation costs

    FCA authorisation fees are £11,150 for cryptoasset businesses, plus annual fees. Legal and compliance costs can add £50,000-£200,000 for complex applications.

  6. 6

    Register with the ICO

    All cryptoasset businesses processing personal data must register with the ICO and pay the appropriate data protection fee (£52, £78, or £3,763 depending on size and turnover).

  7. 7

    Implement Consumer Duty compliance

    If you are FCA-authorised, build Consumer Duty into your product design, pricing, communications, and customer support from day one. Document how you deliver good customer outcomes.

  8. 8

    Check the FCA Warning List

    Before launching, check you're not on the FCA's Warning List of unauthorised firms. Consumers are advised not to deal with firms on this list.