For years, anyone running a crypto business in the UK walked a tightrope. You had to follow anti-money laundering rules from the Financial Conduct Authority (FCA), but you didn’t have a clear license to operate as a full financial service provider. That ambiguity ended on April 29, 2025.

On that date, HM Treasury published the draft Financial Services and Markets Act 2000 (Regulated Activities and Miscellaneous Provisions) (Cryptoassets) Order 2025. This isn't just another guidance document; it is a statutory instrument that brings specific crypto activities into the heart of UK financial regulation. If you are a firm dealing with digital assets, this change means your business model now requires formal authorization, not just registration.

The Core Shift: From Registration to Authorization

The biggest change is the move from the old Money Laundering Regulations register to full FCA authorization. Under the new framework, certain crypto activities are now defined as "specified investments" under the Financial Services and Markets Act 2000. This puts them on equal footing with traditional banking and investment services.

Why does this matter? Because authorization comes with stricter requirements. You need to prove you have enough capital, robust governance, and strong consumer protection measures. It’s no longer enough to show you can track customer identities; you must demonstrate operational resilience similar to a bank or an investment firm.

The draft order specifically targets two main types of assets:

• Qualifying cryptoassets: These are cryptocurrencies that meet specific criteria set by the Treasury, often excluding highly volatile or purely speculative tokens that don't offer investor protections.
• Qualifying stablecoins: Digital currencies pegged to fiat money or other stable assets, which pose higher risks to payment systems if they fail.

If your firm deals in these assets, you are now in the regulatory perimeter. The goal is to bring parity between crypto firms and traditional financial institutions. Consumers expect the same level of safety whether they buy shares or Bitcoin, and HM Treasury is enforcing that expectation.

Five Regulated Activities You Need to Know

Not every interaction with blockchain technology triggers these rules. The legislation defines five distinct regulated activities. If your business performs any of these, you need FCA approval.

Notice that "advisory" services aren't explicitly listed here as a separate regulated activity in the initial phase, though market abuse rules will later cover misleading statements. For now, the focus is on the mechanics of trading, holding, and issuing. If you run a wallet provider, you likely fall under custody. If you run a brokerage, you are dealing or arranging transactions.

Territorial Scope: Who Needs to Comply?

This is where things get tricky for international firms. The rules apply differently depending on whether you are based in the UK or abroad.

For most cryptoactivities-like operating an exchange or providing custody-the rules apply to non-UK firms if they target UK customers. This is known as the "territorial scope." If a US-based exchange actively markets to British residents, it may need to comply with these UK standards to avoid being blocked or penalized.

However, there is a major exception for stablecoin issuance. The draft order states that qualifying stablecoin issuance is only regulated for UK issuers. This creates a protective ring around the domestic payment system. Foreign-issued stablecoins can still be used by UK consumers, but the issuer itself doesn't face the same direct authorization hurdle unless it sets up a UK entity. This distinction aims to encourage UK-based innovation in stablecoins while preventing foreign instability from crashing local finances.

Decentralized Finance (DeFi): The Big Exclusion

One of the most debated aspects of global crypto regulation is how to handle DeFi. Should anonymous protocols be licensed? HM Treasury has taken a pragmatic approach: exclusion.

The draft legislation explicitly excludes truly decentralized finance models from authorization requirements. The logic is simple: if there is no central party to regulate, you can't authorize anyone. The FCA will assess whether a "sufficiently controlling party" exists. If a protocol is governed by a foundation or a company that makes key decisions, that entity might still be caught by the rules. But if the code runs autonomously without a human boss, it falls outside the current perimeter.

This doesn't mean DeFi is lawless. Market abuse provisions (which are coming later) could still catch fraudulent behavior. But for now, pure DeFi protocols won't need an FCA license. This keeps the UK attractive for developers who want to build open-source financial tools without navigating bureaucratic red tape.

Comparison with EU MiCA

Many people ask how this compares to the European Union's Markets in Crypto-Assets Regulation (MiCA). The similarities are striking. Both frameworks define similar regulated activities and aim for high consumer protection. However, the UK approach builds on its existing Financial Services and Markets Act 2000 structure rather than creating a standalone law like MiCA.

This integration has pros and cons. On the plus side, firms already familiar with UK financial regulations find the transition smoother. They don't need to learn a completely new legal language. On the downside, it means the rules are deeply embedded in complex existing statutes, which can make compliance more technical.

Also, while MiCA applies uniformly across all EU member states, the UK's regime allows for more tailored adjustments by the FCA. The UK government has signaled it wants London to remain a global hub for fintech, so regulators may offer more flexibility in implementation compared to the rigid EU standard.

Timeline and Next Steps

The draft order was labeled "near-final" by HM Treasury. They asked for technical feedback until May 23, 2025, focusing on drafting errors rather than fundamental changes. This suggests the core framework is locked in.

Following the final passage of the statutory instrument, the FCA will publish detailed rulebooks. A discussion paper released on May 2, 2025, hinted at upcoming guidelines on prudential requirements and conduct standards. Firms should prepare their applications now. The authorization process will mirror traditional financial services, meaning you'll need to submit detailed business plans, risk assessments, and proof of capital adequacy.

Additionally, look out for updates on market abuse and admissions/disclosures regimes. These are promised "in due course" and will add another layer of compliance, particularly around transparency and insider trading. Don't wait for those details to start building your compliance infrastructure. The clock started ticking in April 2025.

Practical Advice for Firms

If you are currently operating in the UK crypto space, here is what you should do immediately:

1. Audit your activities: Map your services against the five regulated activities. Are you holding keys? Facilitating trades? Issuing tokens?
2. Check your territorial reach: Do you serve UK customers? If yes, you likely need authorization regardless of where your headquarters are.
3. Assess your DeFi exposure: If you use smart contracts, determine if a central controller exists. If so, that controller needs a license.
4. Prepare for capital requirements: Start setting aside liquidity buffers. The FCA will expect you to withstand market shocks without failing.
5. Engage with legal experts: Law firms like Reed Smith and Hogan Lovells have noted that the scope definitions are nuanced. Professional advice is worth the cost to avoid misclassification.

The era of unregulated crypto experimentation in the UK is over. The new rules provide clarity, which is good for business, but they demand professionalism. Treat your crypto venture like a financial institution, because legally, it now is one.