FCA cryptoasset authorisation: turn the gateway dates into an evidence plan

By Alexander Akkarie. Content reviewed on 26 October 2026.

The FCA cryptoasset application window is open. A useful preparation plan connects each proposed activity to evidence that the business can operate it: the responsible entity, the people making decisions, the controls they use and the resources that pay for them.

That takes more than a list of policies. If a custody policy requires two approvals but the withdrawal system accepts one, the application has a control gap. If the business plan includes staking revenue but the operating model excludes staking, it has a scope gap. Both can survive a document-completion checklist.

My analysis reflects the FCA material available on 26 October 2026. The dates matter, but the work starts with those inconsistencies.

What has changed, and what the dates mean

The FCA says the application window runs from 30 September 2026 to 28 February 2027, ahead of the new regime starting on 25 October 2027. Existing Money Laundering Regulations registration does not convert automatically into FSMA authorisation. An already authorised firm may need a variation of permission for the relevant cryptoasset activities. Applications go through Connect. Check the firm's route against the FCA's gateway guidance.

The FCA's preparation guidance asks firms to consider the proposed business model, assess gaps and establish an accountable plan with board oversight. It also asks firms to consider the costs and resources required. Existing financial-crime arrangements are part of the work; they do not answer every question about the future business.

Do not treat the window as a timetable for writing all the evidence at the end. A control that fails in November may require a design change, implementation, testing and a fresh review of the operating model. The repair can take longer than updating the policy that describes it.

Start with the activity and the legal entity

Write down what the applicant will actually do for customers. Product labels are too broad. For a custody service, identify who receives an instruction, controls the relevant access, authorises a transfer, records it and handles a disputed or failed transaction. Where a group company or supplier performs a step, identify the entity and the applicant's oversight of it.

Have the appropriate legal and compliance owners determine the permission analysis from those facts. This article does not determine whether a particular custody or staking arrangement falls within the perimeter. The preparation method is to make the underlying facts specific enough for that decision to be checked.

Then give each material activity one working record:

This is a proposed preparation record, not an FCA form. Its value is the connection between the entries. A supplier name without an operating responsibility tells the reviewer little about who can stop a bad transaction.

Follow one custody withdrawal through the evidence

Consider a fictional applicant preparing a custody service. Its own design requires two different authorised people to approve a withdrawal. The example is illustrative, not a statement that this exact control is the FCA's universal requirement or a report of a client engagement.

The policy is approved. The system configuration appears to require two approvals. In a negative test, however, the same privileged user can submit the instruction and approve it through a second role. The transfer is accepted. The positive test worked; the separation the policy promised did not.

Keep the failed result. It explains why the configuration changed and which condition the retest addresses. The final evidence should identify the test date, system version, roles used, expected outcome, actual outcome and reviewer. Redact secrets and customer information while preserving enough detail to understand the result.

A screen showing a rejected transfer proves little if the test used a different permission set from the proposed live service. The reviewer needs to connect the control design to the deployed or proposed configuration and to the test conditions. If a planned component is not yet available, describe that dependency honestly and explain how and when it will be tested.

The emergency-account gap requires a separate answer. Management could redesign recovery so individual authority remains traceable, or change the proposed operating arrangements. Simply marking the normal withdrawal test as passed would leave the exception that bypasses it untouched.

The FCA's application-form information document covers areas including the regulatory business plan, financial forecasts, IT controls and compliance monitoring. It is useful for planning the evidence across those sections. It is an information document, not the submission channel or a guarantee that a completed pack will be accepted.

Test whether the application tells one consistent story

Now suppose the fictional firm's commercial plan adds staking before submission. The operating team still thinks the application covers custody alone. The forecast includes staking income, while staffing and supplier costs assume the original service.

The change should reopen three connected decisions. First, legal and compliance need to assess what the additional service means for the activity and permission analysis. Second, operations and technology need to describe the new customer journey, dependencies, decisions and failure handling. Third, finance needs to update the income, costs and funding assumptions for that same scope.

Record the old and new scope versions. Identify every application section affected, its owner and the evidence needed before the revised version can be approved. A global search for the word “staking” will not find an unchanged staffing assumption that has become wrong.

If management removes staking from the proposed launch, the forecast must remove the related income and costs, and the customer proposition must reflect that choice. If it retains staking, it needs a supported operating and financial plan for it. The application should not combine the revenues of the broader business with the resources of the narrower one.

This consistency test also helps with suppliers. A business plan may say the applicant retains oversight, while the incident procedure gives the supplier sole discretion over an important customer decision. Resolve who decides, what information they receive and how the applicant can act when the supplier is unavailable.

Give the board a decision it can make

Bring the board a short account of what is ready, what failed and what changes the proposed business. In the custody example, normal two-person approval has been retested, emergency access remains unresolved and the staking scope decision still affects the forecast. Those are three different states with different next actions.

For each open item, name the owner, the evidence needed to close it, the delivery date and the consequence of delay. Where a decision changes the proposed launch, make that choice explicit. A board can decide to narrow a service, fund a missing capability or wait for a necessary test. It cannot make a useful decision from a percentage-complete figure that treats a missing signature and an unworkable recovery route as equivalent.

The FCA offers optional pre-application support through PASS, subject to its process. A discussion can help a firm explain its business and preparation; it does not guarantee authorisation. Prepare the business-model and activity analysis before relying on that conversation. See the gateway guidance.

For the next preparation meeting, choose one material activity and follow it from customer instruction to operating evidence and financial assumptions. The point where those accounts disagree is often the most useful next piece of work.