FCA Opens Its Crypto Authorisation Gateway

The Financial Conduct Authority opened an application route for crypto firms on 30 September 2026. The FCA crypto authorisation gateway September 2026 is that opening. Firms that want to keep operating in the United Kingdom must apply by the end of February 2027. The new regime is planned for October 2027. CoinDesk calls the application window five months. Dominic Cashman, the FCA's director of authorisation, said firms can now apply and start preparing. This piece uses those facts and does not treat a single day inside February, or a single day inside October, as the deadline or the start.

What happened

A gateway is where a firm files for a permission. It is not the permission. Opening it on 30 September 2026 means filing has started. It does not mean a named firm has been approved, and it does not mean the October 2027 regime is already in force. Cashman's line matches that order. Firms can apply now, and they can start preparing now. Authorization, if it comes, is a later decision this announcement does not grant.

The firms in view are those that want to keep operating in the United Kingdom. A firm that does not serve that market is outside the deadline as these pages state it. A firm that wants to continue must apply by the end of February 2027. Month-end is the precision this article will use. It is a real cutoff. It is not the same as a single statutory day, and day-level dates beside this story are left out.

CoinDesk's five-month label describes the stretch from the 30 September opening to that February endpoint. This article did not invent the label by counting days it has chosen not to print. Five months is a plain way to say the window is longer than a news cycle and shorter than a year. The operative dates remain the ones stated here: open on 30 September 2026, apply by the end of February 2027, regime planned for October 2027.

"Planned for" matters. The regime month is a plan, not a claim that every rule is already final, and not a claim that October cannot move. Between the application deadline and that month, firms that filed on time would still be waiting on a system that is scheduled rather than switched on. The announcement does not fill the gap with interim permissions. It fills it with applying and preparing.

Firms are judged on consumer protection, safeguarding of customer assets, market integrity, and financial resilience. Consumer protection asks whether people are treated properly and can see the risks. Safeguarding asks whether client property is held so it can be returned, rather than tied to the firm's own fate. Market integrity asks whether the market the firm touches can be trusted. Financial resilience asks whether the firm can take a loss, or close, without the cost landing on customers by default.

Those four headings are the standard the accounts name. They are not a published scorecard. No weighting and no capital formula appear in the shared text. A firm can know the names of the tests and still not know how an examiner will apply them to a given product. Preparation, on Cashman's wording, is getting ready for a judgment. It is not the judgment.

Why it matters

The United Kingdom is telling crypto firms that continued operation runs through an application, not through waiting for the regime month and then asking to be treated as already inside it. The regime is planned for October 2027. For firms that intend to keep operating, the application is due by the end of February 2027. Treating October as the moment to start the paperwork reads the timetable backwards.

The tests matter more than the calendar once a firm accepts the calendar. A gateway that only collected forms would be an administrative opening. A gateway that judges protection, safeguarding, integrity, and resilience is a supervisory opening. The headings do not collapse into one another. A firm can keep assets separate and still offer a product people cannot understand. A firm can look able to absorb losses and still run a market that is easy to distort. An application written as one essay about being ready for regulation has not, on the face of the list, answered four questions.

Cashman runs authorisation. The words attributed to him are narrow, and the narrowness is the point. He said firms can now apply and start preparing. He is not, in the record used here, announcing approvals, naming a processing time, or promising that a complete file will be granted. Readers who want a conversion rate from applications to permissions will not find it.

What's next

From the 30 September 2026 opening through the end of February 2027, the step that belongs to firms is the one Cashman named. They can apply, and they can prepare against the four tests. The next dated plan in the shared record is the regime planned for October 2027. Nothing here says every firm that files will be authorized by that month, or that the plan cannot slip.

Left out on purpose are a day inside February treated as more precise than month-end, a day inside October treated as the start, and comments from individual firms about the gateway. The story that remains is the opening, the month-end application line, the four tests, and the statement that firms can apply and start preparing. For related regulatory context, see crypto custody proposal and reverse solicitation.

The FCA's announcement is here. CoinDesk's account is here.