Business scope and permission boundaries
Operating a multilateral trading platform that meets the definition under the new legislation requires an assessment of QCATP permissions, including relevant overseas situations involving the provision of a platform to UK consumers. It does not automatically become a traditional RIE, MTF or OTF, nor is a CEP registration number alone sufficient to continue operating.[5] [10]
Application value and choice of route
Select the minimum sufficient combination of permissions that lawfully supports the actual business, client scope and financial responsibilities, rather than treating the broadest permissions or fastest approval as the sole objective.
MLR registration enables in-scope UK exchange and custody businesses to launch lawfully and creates an FCA registration record that customers can check. It demonstrates that the business is subject to anti-money laundering supervision, not that FCA endorses a cryptoasset's value, safety or profitability, nor does it guarantee a bank account.[1] [3]
Existing UK MLR-registered businesses may lawfully communicate their own cryptoasset financial promotions where the conditions are met, without submitting all their own advertisements to an external approver. They must still comply with fair, clear and not misleading promotion rules, cannot approve advertisements for ineligible third parties and must not describe registration as investment protection.[11]
The final FSMA rules published in 2026 allow firms to prepare for 2027 permissions and capital based on their actual business models, rather than relying on unverified uniform licensing thresholds. Ren Gang Yong Sheng (Hong Kong) Limited, through Tang Shangyong (Mr Tang), can assist with scope analysis, document preparation and reform gap assessments. However, regulatory decisions are made independently by FCA, and consulting services do not guarantee approval.[6] [9]
Application conditions and entry requirements
Platform governance, trading rules, applicable best execution arrangements, admission due diligence, disclosure and market abuse monitoring must be implemented. Platform issuance, custody or proprietary business must be assessed separately against permissions and conflicts of interest; platform permission does not automatically cover all activities.[6]
Shareholders, directors and key personnel
The fit and proper assessment under provision 58A of current MLR covers sole traders, partners, directors, directors or senior managers responsible for MLR compliance, MLRO, beneficial owners and persons with equivalent influence. Relevant persons must submit the MLR individual form and truthfully disclose criminal, disciplinary, regulatory and financial matters; the annex is incorrect in describing everyone as a SMF applicant.[4]
Firms must appoint a MLRO / nominated officer with sufficient authority, independence, time and resources, and assign MLR compliance responsibility to a director or senior manager in line with the scale of the business. The same person may hold both responsibilities, but combining them is not mandatory; the MLRO must understand UK regulations and cryptoasset risks. The law does not mandate ICA, CFA or any other standard certificate.[3] [4]
The FCA expressly states that registration solely under MLR does not make SM&CR applicable, nor is there a requirement for the MLRO to be based in the United Kingdom. However, the ability of overseas personnel to oversee actual financial crime controls will be closely scrutinised. Application interviews are usually held at the FCA offices, with attendance in person expected. Using a temporary nominal MLRO, replacing that person immediately after registration, or assigning the role to the head of sales without being able to manage conflicts may all affect the assessment.[4]
The 2027 FSMA regime is subject to the relevant SM&CR and corporate governance rules. Individual approvals, statements of responsibilities, certification and conduct rules must be determined by entity and business function. There should be substantive evidence of the UK board’s decision-making authority within a multinational group, staffing and regulatory accessibility. It is inappropriate to claim that only one UK nominee director is needed or that all directors must be UK nationals.[6] [9]
Capital and financial resources
The final PMR for QCATP is GBP £150,000; the actual OFR must also be compared with FOR and KFR. If the same entity obtains permission to deal on own account, the applicable PMR may increase to GBP £750,000, while the application fee QCATP is Category 7, £28,150.[7] [15]
Registered office and operational substance
The application should accurately state the legal name, company number, head office, UK branch and actual business locations, and explain the trading, custody and compliance work performed at each location. A Companies House address, mailbox or virtual office arrangement alone does not demonstrate what cryptoasset business is conducted in the UK; FCA will assess the regulatory connection based on the specific activities.[1] [17]
For overseas groups, distinguish the roles of the registered entity, customer contracting entity, entity controlling assets, UK operational personnel and parent company. A purely MLR scope does not require every applicant to be a UK Ltd, and the FCA application-signing arrangements expressly include sole traders, general partnerships, LLP and LP. The FSMA regime for 2027 and systemic sterling stablecoins may impose more specific entity conditions, which must be assessed separately.[3] [9] [14]
Application document checklist
Legal and control structure documents include incorporation and registration details, articles of association or partnership agreements, a group structure chart, ownership and voting-rights charts at every level, and an explanation of beneficial ownership. They must identify the locations of UK and overseas entities, relevant regulatory status, other pending applications and outstanding Companies House charges. Listing only direct holders above 10% while omitting actual control is insufficient.[4]
The business plan must detail each product, target customers, charges, acquisition channels and future business, accompanied by complete account-opening and customer lifecycle processes. Fiat and cryptoasset fund-flow diagrams must track transactions from initiation to final settlement, identifying liquidity sources, banks, counterparties and all outsourced or group nodes.[4]
AML／CTF／CPF documentation includes methodologies for business-wide and customer risk assessments, CDD and EDD, PEP and sanctions screening, on-chain and fiat currency monitoring, internal escalation, SAR and Travel Rule procedures. Tool configurations, testing and calibration, sample records, training plans and record retention arrangements should be attached to demonstrate how policies are implemented in day-to-day operations.[4] [12]
Personal information must use the current MLR individual form, covering all applicable directors, partners, compliance officers, MLRO and beneficial owners. Employment histories, identity details, responsibilities, working hours and integrity disclosures should be consistent. Existing approvals at other businesses or letters of good standing from overseas regulators cannot replace the independent review by FCA.[3] [4]
Financial documentation must explain sources of own funds, financing obtained, management accounts and reasonable profit and loss, balance sheet and cash flow forecasts, separately identifying compliance, technology and staffing costs. Future FSMA applications must additionally include applicable PMR, FOR, K-factor, capital quality, liquidity and orderly wind-down calculations. Cash balances or customer reserves must not simply be described as regulatory capital.[4] [7]
Custody and technical documentation must explain private key control, MPC or other signing mechanisms, segregation of access rights, wallet and asset records, incident response and business continuity. Client agreements and marketing materials must accurately disclose regulatory status, risks of loss and the actual scope of protection; businesses involving client assets in 2027 must also prepare legal, reconciliation and operational evidence for the applicable CASS regime.[4] [6]
This is provided as a reference for organising the project; it cannot replace current official application forms or case-specific requests for additional materials. Please do not send identity documents or customer records through website forms.
Application process and key steps
The first step is to form a dual scope assessment covering the current MLR and the 2027 FSMA regime, determining the registrations and permissions required by entity, location, customer type and actual activity. Anyone wishing to start operating before implementation in 2027 must explain why short-term MLR remains commercially meaningful, rather than treating MLR as an automatic upgrade route.[1] [8]
The second step is to complete recruitment of key personnel, risk assessments, tool configuration, testing and governance sign-off, with pre-application discussions available through the free PASS. For those still wishing to apply for MLR after 2026-09-30, FCA requires prior contact with PASS to explain the plan and need for registration. PASS is not advance approval and cannot make unregistered business operations lawful.[3] [8]
The third step is to access Connect through My FCA and submit the relevant formal application and supporting documents. The current MLR application fee is Category 6, GBP £11,260; the three turnover bands in the appendix and the supposed limited-permission fee of £1,500 are no longer used. Applicants and management must still be able to explain personally all materials prepared by consultants.[3] [15]
Step four: the FCA case officer and anti-money laundering specialists review the application, request supplementary information and conduct interviews where appropriate. Material changes during the application must be proactively disclosed. Meeting minimum information requirements differs from meeting registration standards: insufficient materials may result in rejection, while failure to qualify after assessment may result in refusal. Withdrawal and refusal generally do not attract a fee refund; rejection for insufficient minimum information may attract a refund.[3] [17]
The fifth step is to check the public register entry after receiving the written registration notice and FRN, and begin operations only within the applicable scope. Those intending to continue newly regulated activities in 2027 must separately obtain FSMA permission. Valid applications within the window, saving and run-off arrangements each have conditions; a MLR registration number alone does not permit indefinite acceptance of new UK customers.[3] [5] [6]
FSMA application fees use the highest category applicable to the activities: arranging deals, dealing as agent and arranging staking fall within Category 4, £2,820; dealing as principal, safeguarding or arranging safeguarding, and stablecoin issuance fall within Category 6, £11,260; operating a qualifying trading platform falls within Category 7, £28,150. Applicants eligible for the FCA dual-application arrangement who agree to reuse FSMA information may pay a single fee equal to the higher of the MLR and FSMA application fees. The MLR form itself cannot be repurposed as a FSMA application.[8] [15]
Approval deadlines and project timelines
Provision 59 of current MLR requires FCA to notify the registration decision, or proposed refusal and right to make representations, within three months of receiving the application or requested further information. The practical guidance from FCA states that the three months run from receipt of all information needed to make a decision. There is no general twelve-month MLR backstop for incomplete submissions, and submissions missing minimum information may be returned. The period for representations on a proposed refusal must be at least 28 days, after which a final decision must be made within a reasonable period.[3] [16]
The general statutory deadline for a new FSMA Part 4A application is six months after receipt of a complete application; an incomplete application must be decided no later than twelve months after receipt of the original application. This clock is not the preparation period and does not guarantee approval within six months, nor does it mean that the current MLR is divided into six-month limited permission and twelve-month full authorisation.[18]
The FSMA application window runs from 2026-09-30 to 2027-02-28, with the main regime taking effect on 2027-10-25. Preparation depends on the readiness of tools, personnel, capital and documentation; several months may be used as a project estimate but must not be described as an official guarantee. FCA does not recommend submitting MLR after 2027-07-31, because the three-month review period may no longer be completed before the new regime begins.[5] [8] [29]
Valid applications made within the window that have not received a final decision may qualify conditionally for saving, with the legislation itself setting a maximum of two years from commencement. Those qualifying for run-off, including applicants outside the window who applied before commencement but have not been authorised, may only perform existing contracts and must not enter into new contracts with new or existing UK customers. Firms without a valid application before commencement cannot automatically benefit from transition; the two-year run-off is not a temporary licence to expand business.[5] [6] [19]
Changes to shareholders, directors and permissions
Material changes and errors concerning directors, MLRO, addresses, business models or submitted information must normally be updated with FCA within thirty days of occurrence or discovery under regulation 57 of MLR; an extension may be agreed with the regulator. Fitness and propriety obligations continue, and newly appointed key personnel do not automatically obtain FCA status merely by completing Companies House registration. Notifications relating solely to MLR use the relevant MLR process, rather than universally applying SMF Form A or Form C.[4] [17]
From 2026-06-30, the MLR control regime has been updated. It is first necessary to determine whether the control chain contains a beneficial owner within the meaning of provision 5 or 6. Where there is a beneficial owner, the relevant MLR control and fitness and propriety standards apply, generally involving direct or indirect holdings exceeding 25% and other forms of actual control. Chains without such a beneficial owner use the FSMA Directive-type thresholds and Part XII assessment. A uniform 25% alone is not an adequate description.[20] [21] [22]
The branch of current Schedule 6B for cases without a beneficial owner includes triggers such as acquiring 10% or significant influence, increasing holdings to 20%, 30% or 50%, and becoming a parent undertaking, with corresponding notifications for reductions or cessation of control. Acquisitions require the appropriate controller form and completion only after satisfying the regulatory approval procedure. The review is generally sixty working days after the acknowledgement notice from FCA, subject to lawful clock-stopping. The annex’s 33%, uniform three-month period and use of Form C to apply for an acquisition are all inaccurate.[21] [23]
Expanding custody or exchange activities, changing third-party arrangements or transferring customer contracts to a different legal entity requires reassessment of the coverage of the original registration and ongoing controls. MLR registration is not a directly transferable asset; adding FSMA activities in 2027 requires the corresponding authorisation or VoP process, and intragroup restructuring cannot be assumed to be exempt.[3] [6] [21]
Ongoing compliance and annual maintenance
Maintain controls over token admission, trading and inside information under the final A&D and MARC rules, and separately comply with applicable conduct and prudential reporting requirements. Additional obligations for large platforms depend on the conditions in the rules; it is inappropriate to claim that every platform has the same scope of on-chain monitoring obligations.[6]
Acquisition due diligence and transaction considerations
Acquisition due diligence should verify the target's legal entity, current registration status, regulatory restrictions, actual activities, historical enquiries, enforcement and risks of exit or withdrawal, cross-checking the public register against internal FCA correspondence. The 68 cumulative registration approvals recorded by FCA as at 2026-11-01 do not represent 68 currently active firms, still less 68 freely tradable licences. Transaction valuation should reflect actual permissions and readiness for authorisation in 2027.[1] [3]
Specialist due diligence on crypto businesses should trace all customer assets and fiat liabilities, and examine on-chain and internal ledger reconciliations, actual control of private keys, offline backups, MPC signing authority, hot wallet exposure, historical hacking losses and undisclosed reuse. It must also sample-check customer CDD, Travel Rule gaps, sanctions risks, alert backlogs, SAR handling, supplier contracts and banking service continuity arrangements, rather than reviewing only registration certificates and financial net assets.[4] [12]
Before completion, the buyer's control chain must be traced to assess the beneficial ownership or FSMA thresholds updated by 2026, implement regulatory conditions and plan MLRO and director succession. Purchasing a MLR business does not remove the requirement for a FSMA application in 2027. If an asset transfer introduces a new contracting entity, assess whether that entity requires separate registration or authorisation and whether contracts, personal data and client assets can lawfully be transferred.[6] [20] [21]
View the complete process for acquiring a licensed companyBusiness segments and applicable regimes
The following are specific permissions, organisational models or statutory categories covered by this topic. They do not necessarily each constitute a separate financial licence.
Frequently asked questions
Is MLR registration a full FCA crypto licence?+
No. The current remit primarily covers AML/CTF registration, supervision and enforcement, not endorsement of all products. New regulated activities in 2027 require FSMA permission; neither registration numbers nor former PI/EMI status convert automatically.[6] [24]
Should 2026-11 still apply for MLR first?+
If you wish to operate before the new regime is implemented and have well-developed materials, you may explain the need for short-term registration and contact PASS first. FCA recommends focusing primarily on FSMA authorisation after the new window opens. Whether applying for MLR is worthwhile depends on the expected completion date; it is not mandatory for everyone to go through MLR first.[8]
Is the minimum capital zero or £750,000?+
Current pure MLR has no uniform statutory minimum capital, but actual resources supporting compliance are still required. £750,000 is the PMR for dealing on own account in 2027; other permissions have tiers of £75,000, £150,000 or £350,000, and actual own funds may need to be higher.[4] [7]
Must MLRO be a UK resident and SMF17?+
SM&CR does not apply to firms with only MLR status. FCA expressly states that MLRO need not be based in the UK, but will closely assess overseas oversight and the ability to discharge duties. MLRO must pass a fit and proper assessment and have UK regulatory and crypto experience. The SMF requirements under FSMA in 2027 require separate assessment.[4] [6]
Does having UK clients necessarily trigger current MLR registration requirements?+
Having UK clients alone, without a UK office, agents or other activities, does not automatically constitute UK business under the current MLR. Promotions targeting UK consumers must still be lawful. In 2027, some cross-border retail services also have a broader FSMA territorial scope, so the old assessment cannot be applied indefinitely.[1] [5] [11]
Does MLR registration allow approval of promotions for others?+
The MLR route allows eligible businesses to communicate their own qualifying cryptoasset promotions; it does not make them FSMA-authorised approvers of advertisements. There are four lawful routes for financial promotions. External approvers' eligibility and applicable approval permissions must still be verified independently.[11]
Can customers receive compensation from FOS or FSCS?+
Registration solely under MLR does not automatically give crypto customers FOS or FSCS protection. Firms must explain the lack of coverage before starting a relationship or transaction. Rights such as FOS in 2027 must be assessed under the new permissions and applicable rules. Firms must not promise that all coin price losses, hacking losses or stablecoins are protected by FSCS.[6] [24]
Does approval actually take three months or twelve months?+
Current MLR centres on a statutory notification clock of approximately three months after FCA receives all required information; there is no general twelve-month guarantee for incomplete submissions. For new FSMA, the period is generally six months for complete applications and no later than twelve months from initial receipt for incomplete applications. Recruitment, technology development and supplementary submissions are separate project timelines.[3] [16] [18]
Can a business continue operating if it did not apply before 2027-02-28?+
Applications may be made outside the window, but this does not entitle applicants to expedited review by FCA or the saving available within the window. If a valid application made before implementation remains unapproved and the firm enters run-off, it may only perform existing contracts subject to the conditions and may not enter into new customer contracts. Those that never made a valid application must, in principle, complete their exit before implementation.[6] [19]
Does acquiring shares in 25% require no FCA approval?+
The assessment cannot rely solely on 25%; other ultimate control or significant influence may also trigger requirements. Following the 2026 update, chains without a beneficial owner also use FSMA thresholds, including 10% for acquisition and 20%, 30% and 50% for increases in holdings. Parent undertakings and actual voting arrangements must be examined on a look-through basis.[20] [21] [22]
Can REP-CRIM be omitted if annual income is low?+
FCA makes clear that all registered cryptoasset firms must submit annual REP-CRIM through RegData within sixty working days after ARD. CARF concerns HMRC tax reporting of users and transactions and is separately subject to its definitions and the 2027-05-31 first-reporting deadline. Neither report can substitute for the other.[24] [26]
Do the 70/30 stablecoin backing-asset requirements already apply to all exchanges?+
No. This is the Bank of England’s 2026 policy position on systemic sterling stablecoins; the final CoP text still requires confirmation. It is neither a capital requirement for MLR exchanges nor a universal reserve formula for ordinary non-systemic issuers or all global stablecoins.[13] [14]
Can a consultant guarantee approval or promise a 100% success rate?+
Consultants’ experience, PASS feedback or cumulative approval figures must not be promoted as a FCA guarantee. As at 2026-11-01, FCA had granted registration in 68 of the cumulative 395 decided MLR applications, and in 12 of 25 decisions over the preceding twelve months. These are application outcomes for different statistical periods, not any individual client’s probability of success.[1] [3]
Official basis and verification sources
Primarily based on FCA, PRA / Bank of England, GOV.UK and current legislation. Older third-party guides supplied by users are used to organise business material and do not override the latest official requirements.
Tang Shangyong (Mr Tang / Drew) · Business Manager
Global financial licence application, transaction and ongoing compliance services