For the best part of fifteen years, buying cryptocurrency in Britain has felt like buying a second-hand car from a chap in a lay-by. He seems friendly enough. The paperwork looks official. And the moment your money leaves your hand, you discover nobody, anywhere, is responsible for anything.
That is finally changing. Parliament passed regulations in February 2026 dragging crypto firms into the same legal universe as banks, insurers and building societies. The Financial Conduct Authority published the full rulebook on 30 June 2026, and the whole thing goes live on 25 October 2027. It took years, several consultations and an enormous quantity of civil service biscuits, but the wild bit is ending.
The headlines have been useless. Some papers ran with “Britain cracks down on crypto”, others with “Britain goes soft on crypto”, and both were written by people who had not read past the press release. The truth is more interesting, and for anyone thinking about dipping a toe in, considerably more useful.
Why crypto regulation in the UK matters more than you would think
You might be thinking this has nothing to do with you. Fair enough. But roughly 4.5 million British adults hold some sort of cryptoasset, about 8% of us, down from 12% the year before, according to FCA research published in December 2025.
Here is the bit that made me sit up. That same research found around a third of crypto owners believed they could complain to the FCA if something went wrong. They could not. There was no complaint to make, no ombudsman to write to, no compensation scheme, nothing. Millions of people were walking about with a comfort blanket that did not exist.
That gap between what people assumed and what was true is the whole reason crypto regulation in the UK finally happened. Not because the Treasury developed a sudden enthusiasm for magic internet money, but because ordinary people were putting real savings into a market with roughly the consumer protections of a car boot sale.
What the new rules are for, and what they are definitely not for
This is where most people go wrong, so let me be precise about it.
What the rules actually cover
The new regime regulates the firms, not the coins. That distinction is everything. From October 2027, a business wanting to run a crypto trading platform for British customers, look after your coins, issue a sterling stablecoin, arrange staking or act as a middleman needs proper authorisation from the FCA. Not a registration. Not a nod. Full authorisation, the same kind your bank holds.
Those firms must hold capital, pass stress tests, keep customer assets properly separated, publish honest disclosures, and follow a brand new market abuse regime covering insider dealing and price manipulation. The Consumer Duty applies too, the FCA rule requiring firms to act in good faith, avoid foreseeable harm and actually help customers rather than fleece them. Crucially, customers of authorised crypto firms will be able to take complaints to the Financial Ombudsman Service, a door that did not exist before.
What the rules absolutely do not do
They do not make crypto safe. David Geale of the FCA said it about as plainly as a regulator ever says anything: firms will be held to similar standards to other financial providers, but they cannot regulate away risk. Bitcoin can still halve in a fortnight. Nobody is stopping it.
They do not give you compensation if a firm goes bust. The FCA has confirmed it is not extending the Financial Services Compensation Scheme to crypto activities. Your building society savings are covered to £85,000. Your Bitcoin is covered to precisely nothing.
They do not police your own wallet. If you hold your own coins and send them to the wrong address, that is between you and the blockchain. The FCA regulates businesses, not your kitchen table.
And they do not apply yet. This is the single most important sentence in this article. Until 25 October 2027, the FCA’s powers over crypto remain limited to anti-money laundering supervision and advertising rules. Everything else is still coming.
Life before the rulebook, or the years nobody was in charge
To appreciate how big a shift this is, you need to remember what came before, which was essentially nothing.
Bitcoin arrived in 2009. For over a decade, a British person buying cryptocurrency was operating in a legal vacuum. No licence to hold, no register to check, no standards to meet. Anyone with a website and a bank account could set up shop. Some were serious businesses. Some were three lads and a laptop. Some were criminals. From the outside, they looked identical.
It reminded me of the years before the MOT test came in. Cars were sold, cars were driven, and whether the brakes worked was a personal matter between you and providence. The MOT did not make driving safe. It just meant somebody, once a year, had to actually look.
Crypto had no MOT. Exchanges collapsed and customers discovered they were simply unsecured creditors in a queue. Firms advertised guaranteed returns of 40% to 100% and people believed them, because nobody had told them otherwise. The courts were even scratching their heads over whether a Bitcoin counted as “property” at all, since it fitted neither of the two categories English law had used since roughly the reign of Queen Victoria.
The version history of UK crypto law, release by release
The FCA crypto rules did not arrive in one go. They came in stages, rather like software updates, each one patching a hole the previous version had left wide open.
Version 1.0: the money laundering register, January 2020
The first move was narrow. Crypto exchanges and wallet providers serving UK customers had to register with the FCA under the money laundering regulations. That meant identity checks, source of funds questions, and record keeping.
The benefit was real but small. It made life harder for money launderers and created a public list you could check. The problem was that firms started waving “FCA registered” about as if it were a seal of quality. It was not. It meant the anti-crime paperwork was in order and said nothing whatsoever about whether your money was safe, a point the FCA had to keep making publicly.
Version 2.0: the derivatives ban, January 2021
The FCA banned the sale of crypto derivatives and exchange traded notes to ordinary retail investors, citing extreme volatility, widespread market abuse, and the awkward fact that there was no reliable way to value the underlying assets.
The benefit was that it stopped beginners being sold geared-up products that could wipe them out faster than the coins themselves. The cost was that Britain locked itself out of products becoming perfectly normal elsewhere, a tension that took four years to resolve.
Version 3.0: the advertising crackdown, October 2023
This is the version most beginners have actually met, even if they did not know its name. From 8 October 2023, any firm marketing crypto to UK consumers, including firms based abroad, had to play by the financial promotions rules.
That meant a compulsory risk warning telling you not to invest unless you are prepared to lose all your money. It meant a ban on “refer a friend” and new joiner bonuses, because free money is a rotten reason to buy an investment. It meant firms had to assess whether you actually understood what you were buying. And it introduced a 24-hour cooling-off period for first-time customers, so you cannot see an advert at eleven at night and own a currency you have never heard of by ten past.
The benefit over version 2.0 was that it tackled how people were actually being reeled in, which was advertising, not derivatives. In the first year the FCA issued over 1,700 alerts and took down more than 900 scam crypto websites and over 50 apps.
Version 4.0: property rights and a reopened door, 2025
Two things happened in 2025 that pulled in opposite directions, which is very British.
On 8 October, the FCA lifted its four-year ban on crypto exchange traded notes for retail investors, provided they are listed on a UK recognised investment exchange with the proper promotion rules attached. The reasoning was that the market had matured and grown-ups should make their own choices. Fair enough, though these products still carry no FSCS protection whatsoever.
Then on 2 December, the Property (Digital Assets etc) Act 2025 received Royal Assent and came into force immediately. It is a remarkably short law that does one enormous thing: it confirms a digital asset can be personal property even though it is neither an object you can hold nor a right you enforce through the courts. A third category, in other words.
The benefit here is easy to underestimate. If your coins are stolen, or your exchange collapses, or you die and your family has to sort out your estate, the law now recognises that you owned something. Before this, that was arguable. Now it is not.
Version 5.0: crypto becomes a proper regulated activity, February 2026
On 4 February 2026, Parliament passed the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. This is the big one. It created nine new regulated activities covering dealing, arranging deals, running a trading platform, custody, issuing qualifying stablecoins and arranging staking, and it brought them inside the same legal perimeter as every other financial service in the country.
The benefit over everything before it is the difference between a warning sign and a fence. Previous versions told people crypto was risky. This one says that doing this business without permission is against the law.
Version 6.0: the rulebook lands, June 2026
Regulations set the boundary but do not tell firms what to do inside it. That arrived on 30 June 2026, when the FCA published its final policy statements covering capital requirements, market integrity, consumer protection and stablecoin standards. After consultation it simplified several bits, notably the capital rules for stablecoin issuers, and tailored the trading rules to how crypto markets actually behave rather than how a share dealing desk behaves.
The Bank of England moved in the same month, dropping its unpopular proposal to cap individuals at £20,000 per systemic stablecoin and replacing it with a temporary limit on total issuance per coin, set at around £40 billion. Industry called that a win, and given the original proposal, they were not wrong.
Version 7.0: the switch flips, October 2027
Firms can apply between 30 September 2026 and 28 February 2027, and the FCA will work through applications in the order received, which has caused a certain amount of scrambling. The mandatory regime starts on 25 October 2027. Existing money laundering registrations do not convert automatically, so a firm that fails to apply, or fails to pass, cannot legally serve UK customers.
How the new system actually works, step by step
Let me lay out the machinery, because once you see it, the whole thing becomes obvious.
Step one. Parliament defines which activities need permission. Running a platform, holding customer coins, issuing a stablecoin, arranging staking, dealing, arranging deals. If a firm does one of these for British customers as a business it is in scope, and being based in Dubai does not get it off the hook.
Step two. The FCA writes the detailed rules, which it has now done. How much capital, how customer assets are safeguarded, what must be disclosed, what counts as market manipulation, how complaints are handled.
Step three. Firms apply through the authorisation gateway during the window, showing governance arrangements, financial resources, systems and controls, and a named senior person accountable for complaints. This is not a form, it is closer to an audit. The FCA then grants or refuses permission, and refusal means the firm stops serving UK customers.
Step four. From 25 October 2027, only authorised firms can operate. You will be able to look a crypto platform up on the Financial Services Register, exactly as you would a mortgage broker, and see what it is actually permitted to do.
Step five. Once inside the fence, the firm owes you the Consumer Duty, honest disclosure, fair complaint handling, and access to the Financial Ombudsman Service if it lets you down. It does not owe you your money back if the price falls, and there is still no FSCS.
Step six, separate but worth knowing. Since 1 January 2026, the UK has been operating the OECD’s Cryptoasset Reporting Framework. Crypto providers must now collect your name, date of birth, address, tax residence and tax reference number, and report your transactions to HMRC. The first reports are due by 31 May 2027 and will be swapped between tax authorities internationally. If you have been hoping HMRC would not notice, that ship has sailed, been reported, and had its details cross-referenced against your self assessment.
What comes next
The FCA is publishing further guidance in September 2026 on exactly where the regulatory boundary sits, which matters enormously for decentralised finance, wallets and web interfaces. Consultations on decentralised finance and on the financial crime guide follow later this year.
The Bank of England expects to finalise its code of practice for systemic sterling stablecoins by the end of 2026, with that regime live in 2027. Critics, including a fairly pointed piece in Forbes, argue Britain has written the world’s most cautious stablecoin rules and arrived three years after everyone else, ceding ground to dollar stablecoins and the European Union’s MiCA regime. There is something in that. There is also something to be said for not being first over a cliff.
Further out, I would watch two things. Whether the FSCS position ever softens, and whether crypto exchange traded notes make it back into ordinary stocks and shares ISAs, since HMRC restricted them to Innovative Finance ISAs and pensions from 6 April 2026 but said it would keep the question under review.
Security, vulnerabilities, and why you should still be careful
Now the part I would want my own family to read twice, because a rulebook is not a suit of armour.
Fraud is getting worse, not better. UK Finance’s Annual Fraud Report for 2026 put total fraud losses at £1.28 billion in 2025 across more than four million cases, roughly eight every minute. Investment scam losses, covering crypto, gold, property and the rest, hit £221.5 million, up 40% in a single year. The trade body blames artificial intelligence, which has made convincing fakes almost free to produce.
The classic crypto scam has barely changed in a decade. A platform promises returns that would embarrass a Premium Bond. You put money in, the dashboard shows lovely gains, then you try to withdraw and find there is a fee, or a tax, or a compliance charge to pay first. You pay it. There is another one. Eventually the website vanishes. In August 2026 a London court wound up Key Coin Assets Ltd after nine people reported paying it over £300,000 between them. The FCA had flagged the firm as unauthorised almost two years earlier. Nobody had checked.
So check. It takes ninety seconds. The FCA Firm Checker tells you whether a firm is registered or authorised, and the Warning List names firms known to be operating without permission. If you are scammed, report it through Report Fraud, which replaced Action Fraud on 4 December 2025 and is run by the City of London Police. The number, 0300 123 2040, has not changed.
Then there are the risks no regulator can touch. If you hold your own coins there is no password reset, so lose the recovery phrase and the money is gone permanently, with no branch to visit and nobody to plead with. Address poisoning is a nasty one: criminals plant a near-identical wallet address in your transaction history, hoping you copy the wrong one. One investor lost over twelve million dollars that way in January 2026.
Two more things, specific to right now. We are in a gap: the rules exist on paper but do not bite until October 2027, so a firm can still tell you it is “FCA registered” when that only ever meant its anti-money-laundering paperwork passed muster. And be sceptical of anyone using the new regime as a sales pitch. “Crypto is regulated now” will open an enormous number of cold calls over the next eighteen months. It is not true yet, and even when it is, it will not mean what they want you to think it means.
The summary
Britain has spent six years building a fence around a field that had none. The February 2026 regulations decided where it goes, the June 2026 rulebook decided how high. Firms apply for the gate key between September 2026 and February 2027, and the fence becomes legally binding on 25 October 2027.
What that buys you as a beginner is worthwhile. Firms with capital behind them. Customer assets kept separate from company money. Honest disclosure. Rules against market manipulation. A real complaints process ending at the Financial Ombudsman Service. And, thanks to the Property (Digital Assets etc) Act 2025, a clear legal right to call your coins your own.
What it does not buy you is a safety net. No FSCS. No protection from prices falling off a cliff. No refund if you send coins to a scammer, because you authorised that transaction yourself. Crypto regulation in the UK makes the shop safer. It does not make the goods any less volatile.
My advice, from someone who has watched a great many financial fashions come and go, is unchanged. Never put in money you need. Check the register before you hand anything over. Treat guaranteed returns as an admission of guilt. And remember that the difference between an investment and a gamble is usually just how honest you are being with yourself about which one you are doing.
The Wild West is being fenced. That is good news. Just remember that a fence keeps the cattle in, not the weather out.
Walter
Leave a Reply