UK crypto firms can start applying for authorization or varying their existing permissions through the Financial Conduct Authority's Connect system as of September 30. The application window follows the FCA's finalized crypto rules, published June 30, with the full regime expected to go live on October 25, 2027. Applying now does not grant authorization or bring any of the new protections into force — it just starts the clock.
What the FCA finalized in June
The rules land hardest on custody and lending. Under the forthcoming framework, covered crypto custody generally requires a safeguarding trust under CASS 17 of the FCA's Client Assets Sourcebook. That's the same chapter that governs how client money is held in traditional finance, and it puts crypto custodians on a similar footing.
Lending gets more granular treatment. Retail collateral supporting an in-scope crypto borrowing service has to stay safeguarded, with one narrow exception for debt discharge. A qualifying cryptoasset lending service can lean on an exemption from the trust requirement for as long as the lending continues — see CASS 17.3.4 — but the collateral doesn't leave the protected perimeter just because it's been pledged.
The borrowing carve-out, and its limits
The trickiest part is ownership. For qualifying cryptoasset borrowing, firms can't take full ownership of pledged Bitcoin unless the retail client has given express prior consent to an ownership transfer that discharges the debt. Even with a written agreement in hand, the safeguarding requirement continues until the firm actually exercises that right.
The FCA is also drawing a line around what counts. The collateral protection applies to qualifying cryptoasset borrowing, a defined service — it can't be stretched to cover every cash loan marketed as Bitcoin-backed. And the core lending and borrowing chapter generally applies to retail clients who aren't overseas retail clients, while certain records and transfer requirements have broader reach.
Recovery depends on the firm's balance sheet
One thing the rules don't fix: if a firm fails, getting assets back still depends on whether there are enough assets to return. Newly regulated crypto activities also remain outside Financial Services Compensation Scheme coverage. That's a gap worth flagging to clients who assume regulation means a backstop.
The FCA's perimeter guidance adds a reminder that characterization isn't a label firms choose. The legal substance of an arrangement and the roles of its participants determine what it actually is — a point aimed at structures that dress up lending as something else.
The long runway to October 2027
Firms now have a formal channel to file, but the meaningful deadline sits more than a year out. The FCA has said the regime begins October 25, 2027. Between now and then, applications will be processed, permissions varied, and the CASS 17 machinery built out. The question left open is how many firms file early and how many wait — and whether the FCA's review capacity can handle the queue.
