FCA opens final crypto consultation ahead of September authorization gateway

The UK Financial Conduct Authority has launched its final consultation on crypto regulation, with plans to open an authorization gateway in September and begin enforcing new consumer duty rules by October 2027.

The regulator is seeking industry feedback until March 12 on how its consumer protection framework should apply to cryptoasset firms, marking a decisive shift toward comprehensive oversight of the sector.

Consumer duty becomes a pillar of UK crypto regulation

At the center of the consultation is how the FCA’s consumer duty introduced across traditional finance will be applied under UK crypto regulation.

The duty requires firms to act honestly, avoid foreseeable harm, and support customers in making informed decisions.

The regulator said the approach is designed to balance consumer protection with innovation.

“The consumer duty sets higher standards for firms, but it does not remove risk,” the FCA said in its consultation materials, noting that crypto investments can still result in total losses.

The FCA is consulting on the use of additional non-Handbook guidance to help crypto firms understand how to meet outcome-based requirements for retail customers.

This includes clarity around disclosures, product design, and how firms should communicate risks to consumers.

As part of UK crypto regulation, the regulator is also seeking feedback on how redress mechanisms should work when customers suffer harm, and how conflicts of interest should be managed in crypto businesses that combine trading, custody, and issuance activities.

Conduct standards, supervision, and firm accountability

Beyond consumer duty, the FCA is proposing a broader conduct framework that would bring crypto activities closer to traditional financial services oversight under UK crypto regulation.

This includes rules on safeguarding client assets, operational resilience, governance, and data reporting.

The regulator said crypto firms will be required to submit standardized data to enable ongoing supervision and risk monitoring.

These reporting requirements are intended to give the FCA greater visibility into market practices, custody arrangements, and financial crime controls.

The consultation also addresses the application of the Senior Managers and Certification Regime, which would require crypto firms to clearly assign responsibility to senior executives and ensure staff have appropriate skills and knowledge.

According to the FCA, competent governance is critical as crypto services become more integrated into the financial system.

The FCA is also examining restrictions on buying crypto on credit, citing concerns about consumer harm from leveraged exposure.

As part of UK crypto regulation, the regulator said it wants to reduce the risks associated with borrowing to invest in volatile assets.

Despite the expanded oversight, the FCA reiterated that cryptoassets remain largely unregulated today and continue to pose risks related to fraud and market abuse.

The consultation forms part of a broader effort to transition the sector into a regulated perimeter.

Ripple registration highlights transition to full authorization

The consultation follows a package of proposals released in December that outlined how UK crypto regulation would align crypto firms more closely with traditional financial services. Since then, the FCA has taken concrete steps toward implementation.

In January, the FCA granted Ripple registration under the UK’s Money Laundering Regulations, according to a notice published on its official website.

The approval followed the regulator’s decision to reopen the MLR application process in September, marking progress toward a clearer regulatory pathway.

The FCA has stated that under upcoming UK crypto regulation, firms wishing to operate in the UK will need full authorization once the new regime takes effect in October 2027. This requirement will apply even to firms already registered under MLRs.

Crypto firms will be expected to comply with consumer duty, financial crime controls, governance standards, and operational resilience requirements.

Firms authorized under the Financial Services and Markets Act will need to vary their permissions, while AML-registered firms must seek full approval.