The FCA Publishes Crypto Guidance: What a "Regulatory Regime" Actually Means

The UK's Financial Conduct Authority has published guidance telling crypto firms how the country's new regulatory regime applies to them — which activities are covered, what obligations come attached, and how a firm is supposed to get permission to operate.

If you hold crypto through a UK app, that sentence matters more than it sounds. It is the difference between a company that has told a regulator what it does and been checked, and a company that has simply launched a website.

You can read the FCA's own announcement here: Crypto firms get guidance on how new regime applies. Our shorter news summary is at UK FCA issues guidance for crypto firms on the new regulatory regime.

The news itself will age. The underlying machinery will not. So the rest of this post is about that machinery: what a financial regulator actually does, what "authorised" means and does not mean, and how to read any regulatory headline — UK, EU, US or elsewhere — without either panicking or assuming you are now protected from everything.

First, who the FCA is

The Financial Conduct Authority is the UK's main conduct regulator for financial services. "Conduct" means how firms behave towards customers: what they promise, how they advertise, whether they hold client money properly, how they handle complaints.

It is not a police force and not an insurer. It writes rules, grants and refuses permissions, supervises firms, and takes enforcement action when rules are broken.

A useful mental model: a referee. The referee does not guarantee you win the match. The referee guarantees there are rules, that they are written down, and that someone is watching.

The idea that explains everything: the regulatory perimeter

Every financial regulator works with a boundary called the regulatory perimeter. Inside the perimeter, an activity is regulated: you need permission to do it, and rules apply once you have permission. Outside, it is not.

The perimeter is defined by activities, not by vibes. "Crypto" is not an activity. Examples of activities are:

• operating a trading venue where customers buy and sell assets
• holding customer assets on their behalf (custody)
• issuing a token that claims to keep a stable value
• lending or borrowing against customer assets
• advising people on what to buy

This is why regulation arrives in pieces rather than all at once. Legislators and regulators pick activities off one by one and bring them inside the line. A firm can be regulated for one thing and completely unregulated for another, at the same time, under the same brand.

That single fact causes more consumer confusion than anything else in this field.

Registration versus authorisation

The UK has had a form of crypto oversight for years, but it was narrow. Firms doing certain cryptoasset business had to register with the FCA under anti-money-laundering rules. That registration is essentially about financial crime: know-your-customer checks, monitoring for suspicious transactions, sanctions screening.

A full authorisation regime is a much wider thing. Broadly, the categories of obligation look like this:

The UK already applied its financial promotions rules to cryptoasset marketing from October 2023, which is why UK crypto ads carry risk warnings and cooling-off screens for first-time investors. Guidance like this week's fits into a longer sequence: AML registration, then marketing rules, then a broader activity-based regime.

The practical consequence for firms is cost. Capital requirements, compliance staff, audits and reporting are expensive. Some firms will absorb it, some will restructure, and some will exit the market. That is not a prediction about any particular company — it is simply what has happened in every jurisdiction that has moved from light-touch to full authorisation.

What authorisation protects you from — and what it does not

This is the part worth writing down.

Authorisation generally addresses:

• whether the firm has been checked before it is allowed to serve you
• whether your assets are supposed to be segregated and properly recorded
• whether marketing can legally overstate the product
• whether there is a complaints process and a supervisor to escalate to

Authorisation does not address:

• the price of anything you own
• losses from a market falling
• your own decisions
• risks at firms in other countries that happen to be accessible from your phone
• what you do when you move assets into your own self-custodied wallet, where no firm is involved at all

That last point is important and often missed. Consumer protection rules attach to firms. When you hold your own keys, there is no intermediary to regulate — and no intermediary to complain to. Self-custody trades one kind of risk for another. Neither choice is "safe"; they are simply different risk shapes.

It is also worth knowing that deposit-protection style schemes, which cover certain bank deposits in many countries, generally do not extend to the market value of cryptoassets. A firm being authorised does not mean your holdings are insured against falling in value. Read what a specific firm says it covers, in writing, rather than assuming.

How to read a regulatory headline

When the next one lands, five questions get you most of the way to understanding it.

1. Which activity is being regulated? Custody? Trading venues? Stablecoin issuance? Marketing? The answer tells you who is affected.
2. Is this a law, a rule, or guidance? Laws come from legislatures. Rules come from regulators with legal force. Guidance explains how the regulator interprets existing rules. Guidance is influential but it is not new law.
3. Who does it apply to — and where? Most regimes apply to firms serving customers in that jurisdiction, regardless of where the firm's office is.
4. When does it bite? Regimes almost always have transition periods, application windows and phased start dates. A headline today may describe something that takes effect in eighteen months.
5. What happens to non-compliant firms? Usually: apply, change the product, geoblock the country, or shut down.

Run those five questions over any announcement and you will be better informed than most commentary about it.

The wider map

The UK is not doing this in isolation. The European Union's Markets in Crypto-Assets regulation, known as MiCA, created a single authorisation framework across member states with specific chapters for stablecoin issuers and service providers. The United States has moved through a mix of enforcement, agency rulemaking and legislative proposals, with the balance shifting over time.

Different regimes, same underlying logic: define the activities, require permission, attach obligations, supervise, enforce.

This divergence is itself a risk factor. A service that is straightforwardly legal in one country can be unavailable in another, and the rules can change again. That is what we mean by regulatory risk — not only the dramatic scenario of a ban, but the everyday reality that the rules governing a product you use can be rewritten by people you have never met. It affects access, features, fees and sometimes the viability of a business model.

If you want the longer view of how regulation, tokenised real-world assets and the current policy cycle interact, our lesson on RWA, DePIN, ZK everywhere and the regulatory reset covers the direction of travel in more depth.

The reporting side, which is separate

One thing regulatory regimes are frequently confused with: tax.

Financial regulation governs how firms behave. Tax rules govern what you owe and what you must report. They are written by different bodies and they change on different timetables. A firm becoming authorised does not change your tax position; new international reporting standards mean exchanges increasingly pass information about customer accounts to tax authorities automatically.

If that is unfamiliar territory, start with crypto tax rules across the US, EU and UK and then check your own jurisdiction's official guidance. We explain mechanics; we do not file returns, and nothing here is tax advice.

What to actually do with this

Nothing dramatic. Three habits are enough.

First, know the status of any firm holding your assets. Most regulators publish a public register of authorised firms and a warning list of ones they have concerns about. Look your provider up on the official register directly rather than trusting a link in an email or advert.

Second, distinguish between "registered for anti-money-laundering purposes" and "authorised to provide this specific service". Firms sometimes describe the first in language that sounds like the second.

Third, when a regime changes, read the emails your provider sends. Transition periods are when products get withdrawn, features get restricted and account terms get rewritten. Those notices are boring and they are the ones that matter.

Regulation does not make crypto safe. It makes some risks visible, assigns responsibility for others, and gives you somewhere to complain. Knowing which risks it covers — and which stay with you — is the part nobody else can do for you.