Holding a client’s crypto assets for more than 24 hours during settlement now classifies a firm as a regulated custodian under U.K. law. That status requires a full safeguarding license under the Financial Services and Markets Act—regardless of whether the firm sees itself as a custodian. Platforms, apps, or software providers that facilitate trades but retain control of assets past that threshold will need authorization or face fines, suspensions, or permanent closure.
The Financial Conduct Authority’s final Cryptoasset Perimeter Guidance draws a hard line at the 24-hour mark. Even if a firm uses smart contracts or public blockchains, the mere ability to override client authority—hypothetically or in code—makes it a custodian. Decentralization is not a regulatory shield. The FCA explicitly dismissed such structures as determinative: “The fact that an arrangement involves smart contracts, public blockchains or some elements of decentralisation does not determine the perimeter position.”
Firms seeking to operate under the new regime have a five-month window—from Sept. 30, 2026, to Feb. 28, 2027—to apply for approval. Only those who apply in time benefit from “savings provisions,” allowing them to keep operating during the review. Miss the deadline, and the business must shut down unless and until formally authorized.
The rules extend beyond custodians. Stablecoin issuers must be U.K.-based and control the entire lifecycle—issuance, redemption, and reserve maintenance. Validators and node operators forfeit their technology-only exemption the moment they offer added-value services like dashboards, yield displays, or reward compounding. At that point, they must seek full approval for staking arrangements.
All applicable entities must be authorized by October 25, 2027, or exit the market. The FCA’s framework marks a decisive shift: crypto activity is no longer a gray zone. If you touch client assets for more than a day, you are a custodian. And if you’re a custodian, you’re regulated.
