Running a crypto exchange in the UK used to be as simple as getting on the FCA register. That era is over. With the Financial Services and Markets Act (FSMA) reforms moving from consultation to implementation, the FCA is shifting from a light-touch registration model to full-blown authorization for specific crypto activities. If you are operating or planning to launch an exchange serving UK customers, understanding the difference between current Money Laundering Regulations (MLR) registration and the upcoming FSMA permissions is no longer optional-it’s the difference between staying open and shutting down.

The core problem here isn’t just bureaucracy; it’s scope. The FCA has drawn clear lines around what constitutes a "qualifying cryptoasset" activity. If your platform falls into these buckets, the regulatory bar rises significantly. You aren’t just filing forms anymore; you’re building a compliance infrastructure that mirrors traditional financial services firms. Let’s break down exactly what this means for your business model, your costs, and your timeline.

Current State: MLR Registration vs. Future FSMA Authorization

Right now, if you run a cryptoasset exchange or a custodian wallet provider in the UK, you must register with the FCA under the Money Laundering Regulations (MLRs). This system has been live since January 2020. It’s a baseline check: do you have anti-money laundering (AML) controls? Do you follow Joint Money Laundering Steering Group (JMLSG) guidance? If yes, you get registered.

But this is changing. Under the new FSMA framework, registration won’t cut it for most exchanges. The FCA will require formal authorization for five core regulated activities:

• Operating a qualifying cryptoasset trading platform
• Dealing in qualifying cryptoassets as principal
• Dealing in qualifying cryptoassets as agent
• Arranging deals in qualifying cryptoassets
• Safeguarding qualifying cryptoassets

Additionally, staking and issuing stablecoins are separate regulated activities. If your exchange does more than just match buyers and sellers-say, you offer margin trading, lending, or custody services-you likely trigger multiple permission sets. The key takeaway? MLR registration is the floor, not the ceiling. FSMA authorization is the new standard for serious market participants.

Who Needs Authorization? The Territorial Scope Rules

One of the biggest headaches for international platforms is figuring out if they even need UK authorization. The answer depends heavily on who your customers are and how you serve them.

The FCA’s territorial scope provisions extend beyond UK-based firms. If you are an overseas firm dealing directly or indirectly with UK consumers, you generally need UK authorization for trading platforms, dealing, and arranging deals. A "consumer" here is strictly defined: individuals acting for purposes outside their trade, business, or profession. So, if a retail user in London signs up on your Singapore-based exchange, you’re in scope.

However, there’s a critical exception. If you deal with UK consumers through a UK-authorized intermediary who has the necessary permissions, you don’t need separate authorization. This prevents an "ever-growing chain" of firms from needing licenses. For institutional clients, the rules are looser. Overseas firms serving only UK institutions don’t need UK authorization for trading, dealing, or arranging services, provided those institutions aren’t acting as intermediaries to retail consumers.

High-Level Standards: What “Authorized” Actually Means

Getting authorized isn’t just about ticking boxes. The FCA applies the same high-level standards to crypto firms as it does to traditional banks and brokers. This includes Threshold Conditions (COND) and General Provisions (GEN). In practice, this means you need adequate resources, senior management competence, and effective systems and controls.

The Principles for Businesses (PRIN) apply, but with some twists. For example, Principles 1 (Integrity), 2 (Skill, Care and Diligence), 6 (Customers’ Interests), and 9 (Customers: Relationships of Trust) are disapplied for transactions on qualifying cryptoasset trading platforms by members. Why? Because the platform operator supervises the trading rules. For professional clients, Principles 6 and 9 are also disapplied where firms provide trading platform services, recognizing their sophistication.

Supervision (SUP) provisions add another layer. You’ll face information-gathering powers, CASS audit requirements (especially for stablecoin issuers and custodians), and potential skilled person appointments. CASS audits ensure client assets are properly segregated and protected. If you handle customer funds or cryptoassets, expect rigorous scrutiny on how you safeguard them.

Stablecoins and ETNs: Special Cases

Not all crypto activities are treated equally. Stablecoin issuance has a unique rule: you only need UK authorization if you carry on the activity from an establishment in the United Kingdom. It’s a physical presence test, not a consumer-focused one. This protects foreign-issued stablecoins from extraterritorial reach while ensuring oversight for those with a real UK footprint.

Crypto exchange-traded notes (cETNs) have also seen significant shifts. On October 8, 2025, the FCA lifted the ban on retail access to cETNs, reversing the 2021 restriction. Now, retail investors can buy crypto-backed ETNs, but only if they trade on FCA-approved, UK-based Recognised Investment Exchanges. This move signals the FCA’s willingness to integrate crypto into mainstream markets, provided the infrastructure meets traditional standards.

Application Process: What to Expect

Applying for FSMA authorization is a heavy lift. The FCA expects comprehensive documentation proving you understand and comply with:

1. JMLSG guidance on money laundering and terrorist financing prevention
2. FCA Financial Crime guide for firms
3. FCA Guidance FG17/6 on Politically Exposed Persons (PEPs)
4. FATF risk-based approach guidance
5. FATF VASP Guidance

Pre-application meetings are available, so use them. The FCA has held engagement events to clarify expectations, but don’t wing it. Your application should demonstrate a mature compliance culture, not just a checklist mentality. Expect timelines to be long-this isn’t a quick approval process. Industry assessments suggest significant compliance costs, particularly for overseas platforms that may need to restructure operations to meet UK requirements.

Strategic Implications for Exchange Operators

If you’re an overseas exchange targeting UK retail users, you have three main paths:

• Full Authorization: Apply for FSMA permissions. High cost, high barrier, but full market access.
• Intermediary Model: Partner with a UK-authorized firm to serve retail clients. Avoids direct authorization needs but adds dependency.
• Institutional Focus: Restrict UK access to institutional clients only. Simpler compliance, but limits market size.

For domestic UK exchanges, the focus should be on preparing for FSMA authorization now. Don’t wait until the final rules drop. Start mapping your activities against the five core regulated activities. Identify gaps in your AML/KYC processes, governance structures, and asset safeguarding protocols. Engage legal counsel early. The FCA’s approach is clear: crypto is finance, and it will be regulated like finance.

The bottom line? The days of operating in a regulatory gray zone are ending. Whether you choose to go full compliance, partner with intermediaries, or pivot to institutional clients, the decision must be strategic. The FCA isn’t trying to kill the industry-it’s trying to make it safe enough for mainstream adoption. Align with that goal, and you’ll survive the transition. Ignore it, and you’ll find yourself locked out of the UK market entirely.