The crypto authorisation queue is not a safety net yet

The UK crypto rulebook is starting to look less theoretical. There are consultation papers, legal instruments, pre-application meetings and a date on which the wider regime is expected to come into force. That can make the sector sound as though it is about to acquire the familiar grammar of mainstream finance: authorisation, supervision, disclosure and market abuse rules.

The more useful consumer point is quieter. A firm joining the authorisation queue is not the same as a customer's money being protected today.

The Financial Conduct Authority says the new cryptoasset regime is expected to come into force on 25 October 2027. Once it is in place, cryptoasset businesses within scope will need FCA authorisation to do business in the UK and will need to show that they can meet the regulator's standards. The FCA's newer implementation page says firms have been able to request pre-application meetings through its PASS service from 11 May 2026, with meetings expected to begin from July 2026.

That is an important staging post, but it is still staging. The FCA's April consultation on cryptoasset perimeter guidance says crypto firms will be able to start applying for authorisation from September 2026. The consultation, CP26/13, closed on 3 June 2026. It was designed to help firms understand when authorisation will be required under the future perimeter, including activities such as issuing qualifying stablecoin, safeguarding qualifying cryptoassets, operating trading platforms, dealing and arranging deals in qualifying cryptoassets, and arranging qualifying cryptoasset staking.

This is plumbing before public confidence. The legal base is the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made in February. Legislation.gov.uk describes the instrument as establishing a regulatory regime for certain cryptoasset activities. The structure includes public offers, admission to trading on qualifying cryptoasset trading platforms, stablecoin issuance, disclosure documents, market abuse provisions and FCA powers. In ordinary language, the state is building a rulebook for firms and markets that have often sat outside the usual boundaries.

The boundary matters because crypto has already acquired the look of normal consumer finance. Apps use familiar account language. Ads use tidy risk warnings. Some products borrow the vocabulary of payments, savings or yield, even when the underlying risk is much less familiar. A future authorisation regime may make the market less Wild West in some respects, but it does not turn every token, exchange or wallet into the equivalent of a bank account.

The FCA's own consumer material remains blunt. It says crypto is largely unregulated in the UK and that Financial Services Compensation Scheme cover is highly unlikely for crypto-related losses. It also warns that sudden market moves, firm failure, poor segregation of client funds and cyberattacks can all create losses. Those warnings sit awkwardly beside glossy app design, but that is precisely why the timing matters. Regulation arriving later does not backdate protection to today's balances or trades.

There is also a difference between firm authorisation and product approval. Authorisation can test governance, systems, financial resources, custody arrangements, market conduct and senior accountability. It can give the regulator clearer powers over firms that fall inside the perimeter. It does not make crypto prices stable, remove operational failures, or guarantee that a particular asset is useful, fair or suitable for any household. A regulated railway station can still have delayed trains; a regulated crypto venue can still host volatile assets.

The stablecoin discussion shows the nuance. HM Treasury has proposed amendments intended to avoid unnecessary regulatory burdens where UK-issued qualifying stablecoins are used for payments, while keeping lending and borrowing risks within view. That is not a simple green light for every tokenised payment idea. It is a sign that regulators are trying to separate payments use cases, market trading, safeguarding, lending and public offers instead of treating the entire sector as one object.

For readers, the durable change is not a hot take on whether crypto is good or bad. It is a shift in the questions around legitimacy. Before the regime starts, the relevant question is not whether a website says regulation is coming. It is whether the specific firm, activity and product are currently inside an enforceable regime, what protections apply if the firm fails, and whether any compensation scheme is actually available. After October 2027, the authorisation status of a firm may become a more visible part of that check, but even then it will not answer every risk question.

That distinction is easy to lose in marketing. A pre-application meeting sounds official. A consultation response sounds grown-up. A future rulebook sounds reassuring. They are all real developments, and they matter for a market that has often moved faster than the rulemaking around it. But a queue is not a badge, and a badge is not a guarantee.

The UK's crypto regime is therefore best read as a calendar, not a comfort blanket. The next milestones are about firms preparing to enter supervision. Consumers still face the present-tense reality of a high-risk market where familiar design can hide unfamiliar consequences. The useful habit is scepticism about timing: regulation is coming, but the safety net has not arrived simply because the application window is opening.