This guide separates holding crypto, offering crypto services, promoting products, moving customer funds and operating across borders. It is general information, not legal advice. The position is stated as at November 2026, and parts of the framework are still moving.
Key Takeaways
- Owning or using crypto in the UK is lawful, but specific business activities can trigger AML registration, promotion rules and sanctions duties.
- "Crypto company" is not a legal category. Regulators look at what the firm actually does.
- The new FSMA cryptoasset regime is scheduled to start on 25 October 2027.
- Map products, customers, funds flows and jurisdictions before launching or expanding.
What Cryptocurrency Law Covers
Key terms in plain language
The FCA describes cryptoassets as cryptographically secured digital representations of value or contractual rights that use distributed-ledger technology. Its categories include security tokens, e-money tokens and other tokens. Treatment depends on the token's characteristics and use.
Related terms carry different legal weight:
- Stablecoins: tokens designed to hold a stable value against one or more fiat currencies
- Custody: holding or controlling assets or keys for customers
- Staking and DeFi: earning returns on tokens, which can raise both regulatory and tax questions
- NFTs: often outside financial regulation, but not automatically so
"Qualifying cryptoasset" is context-specific. The financial-promotion definition and the new FSMA regime use different tests, so a token inside one is not automatically inside the other.
The questions that decide how an activity is regulated
- What is the asset, and what rights does it give the holder?
- Is the activity investment, payment, custody, lending, exchange or purely technology?
- Does the firm serve UK customers, operate from the UK, or serve several jurisdictions?
- Does it control customer assets, execute or arrange transactions, or only supply software?
The answers feed into a wide set of obligations:
- Financial services regulation
- AML and counter-terrorist financing
- Sanctions, tax and data protection
- Cybersecurity and consumer protection
- Advertising, contract and IP law
- Dispute resolution
Legal status is not legal protection
An asset can be perfectly lawful and still carry no safety net. The FCA warns that cryptoassets and NFTs are not FSCS-protected, and that consumers should not assume ordinary complaint routes apply.
The Property (Digital Assets etc) Act 2025 removes a categorical barrier to digital things being personal property. It does not declare every token to be property or decide who owns a given asset.
Blockchains also raise jurisdiction problems: which law applies, where a service is provided, which regulator can act, and how a customer gets redress.
Personal wallet versus exchange
Take two cases. An individual holding bitcoin in a personal wallet mainly has tax and record-keeping duties.
A business running an exchange or custody service faces a different checklist: MLR registration, the promotions route it uses, Travel Rule and sanctions handling, and (from October 2027) whether it needs FSMA authorisation. Same asset, entirely different analysis.
How Cryptocurrency Is Regulated in the UK
Who does what
- FCA: supervises in-scope crypto businesses under the Money Laundering Regulations (MLRs) today. From 25 October 2027 it becomes the principal authorisation and conduct regulator for the new FSMA regime.
- HM Treasury and Parliament: set the statutory perimeter. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were made on 4 February 2026.
- HMRC: handles crypto tax and reporting. It does not treat cryptoassets as currency or money.
- NCA and OFSI: NCA receives suspicious activity reports; OFSI administers financial sanctions, and its May 2026 guidance says cryptoassets may count as "funds" or "economic resources".
MLR registration is not authorisation
MLR registration is AML/CTF supervision only. It is not:
- A product-safety endorsement
- Entry into the Senior Managers and Certification Regime
- FSCS or Financial Ombudsman protection
FSMA authorisation is a separate permission. Existing MLR registrations do not convert automatically.
The FCA's own figures show how selective registration has been: in 2025, FCA FOI data records 20 applications and 6 approvals, with 9 still undecided. Those are annual counts, not a matched approval rate.
Financial promotions
Since 8 October 2023, firms marketing qualifying cryptoassets to UK consumers must use a lawful route, including overseas firms. The routes are:
- Communication by an authorised person
- Approval by an authorised person
- Communication by an FCA-registered crypto business
- An applicable exemption
The first three routes require risk warnings and positive frictions, including a cooling-off period.
Enforcement has followed. In October 2026 the FCA reported High Court undertakings in its HTX case. HTX had left the UK; settlement terms were confidential, with no admission of liability.
Stablecoins and the EU comparison
UK-issued qualifying stablecoins fall within the FCA framework. Where a sterling stablecoin becomes systemic, the Bank of England and FCA share roles.
The EU's MiCA is a separate regime. ESMA said the EU-wide transitional period ended on 1 July 2026, and MiCA authorisation is not UK authorisation. A firm expanding either way still needs fresh permissions, marketing analysis and operational planning.
Check the date: FCA rules, HM Treasury policy, legislation and consultations may change during 2026 and beyond. Verify against primary sources before relying on this article.
Compliance Requirements for UK Crypto Businesses
Start with a perimeter assessment
Write down the business model before anything else:
- Products and token functionality
- Customer types and custody arrangements
- Transaction flows and jurisdictions
- Outsourcing and revenue model
The FCA expects application materials to show how controls work in practice, including customer journeys, end-to-end funds flows and configured monitoring tools. Outsourcing does not transfer responsibility.
AML/CTF programme
These are current MLR obligations, not 2027 extras:
- Business-wide risk assessment
- Risk-based customer due diligence, with enhanced checks for higher-risk customers
- Beneficial-ownership checks
- Ongoing transaction monitoring and suspicious-activity escalation
- Record keeping, staff training and independent testing
Governance and the Travel Rule
The MLRs require a nominated officer or MLRO. Beyond that, define board oversight, risk ownership, escalation routes and management information. Document policies for:
- Sanctions screening, fraud and market abuse
- Complaints handling
- Data security and incident response
Part 7A of the MLRs requires information to accompany covered cryptoasset transfers between crypto businesses, with procedures for missing information and certain unhosted-wallet transfers. The FCA stresses that firms stay responsible even when counterparties sit in jurisdictions that have not implemented the rule.
Customer assets and communications
Cover wallet governance, private-key security, safeguarding where applicable, reconciliation, business continuity and cyber risk. Build a clear plan for hacks, lost keys, fraud or outages.
Review every marketing claim about returns, risks, fees, liquidity, security, decentralisation and regulatory status before it goes live.
Launch or expansion checklist
- Map each product to the relevant UK permission or registration.
- List every country where the firm, customers, counterparties, staff, infrastructure or payment providers sit.
- Complete a documented financial-crime and customer-risk assessment.
- Set up monitoring, testing, reporting and change management.
- Get specialist legal advice where classification is uncertain.
Fraxtional supports crypto and FinTech firms with director-led fractional compliance leadership. That includes a named fractional MLRO with FCA liaison, suspicious-activity reporting oversight and AML training while an internal team is built. The work complements legal counsel and cannot guarantee FCA registration.
Legal Risks for Consumers and Investors
Risks to understand
Common risks include:
- Volatility and irreversible transfers
- Scams, hacking and custody failure
- Platform insolvency and misleading promotions
- Privacy exposure
The regulatory-protection gap sits apart from these. Whether a product has complaints handling, compensation or safeguarding cover depends on the product, so avoid blanket assumptions.
The FCA's consumer research note (2,353 interviews) found 91% awareness of cryptoassets, 22% of users reporting staking, and 9% reporting payment by credit card or existing credit facility. These are survey findings, not measures of loss or fraud.
Tax and records
Tax is fact-dependent. HMRC guidance says:
- Staking receipts may be trading income or, absent a trade, generally income valued in sterling at receipt, with possible CGT on later disposal
- Airdrops received for nothing in return may not be income, while service-related airdrops may be
- DeFi lending returns depend on the transaction's structure
Keep records of acquisitions, disposals, swaps, staking, lending and airdrops. Separately, under HMRC's reporting framework (CARF), providers have collected user and transaction data since 1 January 2026, with the first report due by 31 May 2027.
Practical checks
- Verify the firm's regulatory status and what it covers
- Scrutinise promotions and risk warnings
- Understand custody arrangements and fees
- Preserve transaction records
- Use strong security controls
- Seek professional advice for complex or high-value activity
How Other Jurisdictions Approach Cryptocurrency
A quick comparison
- EU: MiCA is an EU-wide framework; unauthorised firms must stop covered services after transition.
- United States: SEC interpretation and CFTC guidance took effect 23 March 2026 and do not replace Howey; FinCEN still treats business exchangers as MSBs. The GENIUS Act (July 2025) covers payment stablecoins.
- Canada: provincial securities laws may apply case by case. A stablecoin act has Royal Assent, with the framework expected in 2027.
Where is crypto "illegal"?
Few answers are simple. It helps to distinguish:
- Bans on ownership or trading
- Limits on exchanges, mining, advertising or payments
- Banking or fiat-conversion restrictions
- Sanctions-based prohibitions on people, addresses, entities or jurisdictions
- Countries where crypto is permitted but heavily regulated
The Library of Congress survey dates from 2021 and has not been updated, so treat it as historical context rather than a live list. Its China material covers 2021 mining restrictions, not a finding on ownership. Check current official sources for any country.
Why a UK permission does not travel
A UK registration or compliance programme does not authorise activity elsewhere. Local marketing, onboarding, licensing, data transfers, tax, sanctions and outsourcing each need separate analysis. FATF's standards give direction, but domestic law gives them effect.
What Could Change in 2026
Pipeline, labelled by status
- Final policy (not yet in force): the FCA published PS26/9 to PS26/13 on 30 June 2026, covering disclosures and market abuse, stablecoin issuance, regulated activities, prudential rules and Handbook application. Commencement remains 25 October 2027.
- Guidance: PS26/18 on perimeter guidance, published 16 September 2026.
- Open window: the FCA authorisation gateway runs 30 September 2026 to 28 February 2027.
- Proposal: a draft HM Treasury miscellaneous-amendments instrument, laid 15 September 2026, with FCA consultation CP26/36 scheduled to close 18 November 2026.
- Draft: the Bank of England's systemic stablecoin policy statement and draft Code of Practice, with finalisation intended by end-2026.
Treat anything beyond these as speculation. Watch licensing, stablecoins, custody, staking, market abuse, DeFi, promotions and reporting, but do not assume outcomes.
Readiness plan
- Assign ownership for monitoring UK and overseas changes
- Keep an obligations register and implementation calendar
- Review products, contracts, disclosures, policies and communications when rules change
- Test whether EU, US or Canadian expansion creates new duties
- Keep evidence of compliance decisions and approvals
Fraxtional's risk assessments can cover cross-border operations and typically take 2 to 4 weeks, helping firms prepare for these changes. They do not predict legal outcomes.
Frequently Asked Questions
Is cryptocurrency against the law?
Legality depends on the country, asset and activity. Owning or using crypto is lawful in the UK, while certain business activities are regulated or restricted. Check current FCA and HMRC guidance.
In which countries are cryptocurrencies illegal?
Countries tend to restrict particular activities, such as trading, exchanges, payments, mining or advertising, rather than crypto in every form. Sanctions add further limits. Check current official sources, as older lists are outdated.
What was the Supreme Court's ruling on cryptocurrency?
No single worldwide ruling exists. India's Supreme Court in 2020 set aside the RBI's 2018 banking circular; that was neither a ban nor full legalisation. Cases like AA v Persons Unknown were High Court decisions.
What are the potential changes to crypto laws in 2026?
The FCA published final policy statements in June 2026, but the regime starts on 25 October 2027. Other items, such as the draft Treasury instrument and the Bank of England's stablecoin code, are proposals or drafts.
How is cryptocurrency regulated in the UK?
The FCA supervises AML registration and financial promotions, HMRC handles tax, and OFSI enforces sanctions. Rules depend on the specific activity rather than a general crypto label.
Do crypto businesses need to register with the FCA in the UK?
It depends on the activities. Many cryptoasset businesses need MLR registration now, and FSMA authorisation is separate and coming. Get a current perimeter assessment before operating or marketing in the UK.
