Crypto Asset Regulation: A 2026 Global Guide

In 2026, the UK is moving from limited anti-money-laundering and financial-promotion controls towards a broad FCA-authorised regime, with the wider mandatory framework scheduled for 25 October 2027. The FCA estimated that 8% of UK adults, about 4.5 million people, owned cryptoassets as of August 2025, while a later finding put ownership at 12% of UK adults.

What does that mean for a founder building an exchange, wallet, stablecoin, tokenised investment or payment product? The answer isn't “get a crypto licence”. In major jurisdictions such as the UK, the EU and the US, cryptoassets are increasingly treated as a distinct category of financial instrument or financial activity rather than merely property or commodities. The resulting authorisation requirements depend on what the business does, where it does it, which customers it serves and how assets move through its operating model.

The conventional guide usually starts with legal definitions. That approach misses the problem founders encounter in practice. Regulators don't review an abstract token in isolation. They review governance, custody, financial resilience, technology, disclosures, market conduct, outsourcing and evidence that management can control the business it has designed.

Crypto asset regulation is becoming more specific, not more uniform. International standards may converge around financial crime, prudential risk and operational resilience, but national regulators still draw different boundaries. A model that appears workable in London may require a different entity, permission set, control framework and customer journey in the EU, the US, the UAE or another market.

Table of Contents

• Why Crypto Asset Regulation Remains Fragmented Across Jurisdictions
  • The perimeter follows the activity
  • Why jurisdiction changes the answer
• Classifying Digital Assets Under Modern Frameworks
  • Start with rights and functions
  • Stablecoins create multiple supervisory routes
  • Misclassification produces operational risk
• Comparing Major Jurisdictions, UK, EU, and US Approaches
  • A side-by-side operating view
  • Home-state advantage is limited
• Practical Steps for Issuers and Service Providers
  • 1. Scope the activity and route
  • 2. Build the legal structure around accountability
  • 3. Make controls demonstrable
  • 4. Test the application as an operating system
• Impact on Market Structure and Institutional Adoption
  • From vertically integrated platforms to controlled interfaces
  • Institutional adoption needs production evidence
  • The danger of regulatory arbitrage
• Common Misconceptions About Regulatory Compliance

Why Crypto Asset Regulation Remains Fragmented Across Jurisdictions

What happens when a UK electronic money institution passports a stablecoin wallet to Germany and lists the same token on a US venue? The code may be identical, but the compliance work is not. The UK analysis can involve FCA safeguarding and financial promotions, the EU may require a MiCA crypto-asset service provider authorisation, and the US may raise federal and state money transmission questions. The operating model, customer journey and entity structure determine the result.

The perimeter follows the activity

A crypto company is not one regulated object. Supervisors examine the functions performed across the model. Issuance, custody, dealing, arranging, operating a trading venue, staking and payments-related services can each create different regulatory questions.

The UK shows how quickly this perimeter is expanding. Parliament passed the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 on 4 February 2026, and the FCA said the regulations brought a broad range of cryptoasset activities within its regulatory perimeter for the first time. The FCA policy statement on the cryptoasset regime identifies activities including qualifying stablecoin issuance, safeguarding, trading-platform operation, dealing, arranging deals and staking.

The practical consequence is a distinction between the company name and the work the company performs. One business calling itself a “crypto platform” may provide software only. Another may control customer assets, execute orders and promote products to UK consumers. The second model will face different permissions, governance expectations and evidence requests.

Practical rule: Map the customer journey, control points and movement of assets before choosing the legal entity. The product name does not establish the regulatory perimeter.

Why jurisdiction changes the answer

A UK business must address the FCA perimeter, UK financial promotions, customer-asset controls and the transition towards full authorisation. An EU business operates within a more harmonised framework built around MiCA, while still assessing how cryptoasset services interact with existing financial-services rules and national supervision. A US business faces a more fragmented federal and state environment, where the relevant regulator may depend on the asset, activity and location.

That creates a trade-off between standardisation and local fit. Global standards from the Financial Stability Board, IOSCO, the Basel Committee and FATF can support a shared control baseline for financial crime, prudential risk and operational resilience. They do not create automatic passporting or remove local licensing analysis. A global policy manual must therefore be supplemented by jurisdiction-specific procedures, accountable local management and evidence adapted to each regulator.

The UK timetable also shows why regulation should be managed as an implementation programme rather than a filing event. FCA cryptoasset promotions rules took effect on 8 October 2023, the application window for the new regime opens at 7am on 30 September 2026, and firms intending to operate under the mandatory regime must prepare for 25 October 2027, according to the FCA's regime timetable and firm guidance.

A late application often exposes gaps in the operating model. Governance documents may describe planned controls, while safeguarding processes, financial assumptions and escalation routes remain untested. Supervisors will want evidence of who makes decisions, which controls operate today, what remains to be implemented and how management will detect and respond to failure. There is no single crypto licence that resolves these questions across markets. Firms need jurisdiction-specific operating models built around the activities they perform.

Classifying Digital Assets Under Modern Frameworks

Classification is the first control decision, not a legal formality. It determines which rules may apply to the issuer, intermediary, custodian, promoter and customer relationship. It also determines which facts an application must explain.

A utility token may give access to a service, but marketing language, redemption rights, governance features and the economic relationship with purchasers can change the analysis. A token linked to assets or cashflows may raise securities, collective-investment or payments questions. A stablecoin can create issuance, reserve, redemption, safeguarding and disclosure obligations even where the operator doesn't describe it as an investment.

Start with rights and functions

A sound classification exercise examines what the asset does and what the business promises. The useful questions include:

• Rights: Does the holder receive access, redemption, income, voting power, a claim on assets or another economic benefit?
• Stability mechanism: Is value linked to fiat currency, assets, another token, an algorithm or a reserve arrangement?
• Control: Who issues the asset, changes its rules, validates transactions, manages reserves or decides customer outcomes?
• Intermediation: Does the firm merely provide technology, or does it arrange, execute, match, settle, safeguard or hold client assets?
• Distribution: Who can buy the asset, where are they located and how is the product promoted?

A governance token isn't automatically outside financial regulation because it uses a decentralised protocol. Conversely, a token isn't automatically a security because purchasers expect it to appreciate. Regulators look at the rights, economic substance and activities surrounding the asset.

CBDCs require a separate analysis. A central bank digital currency is not just another privately issued stablecoin, and a tokenised deposit isn't automatically the same as either category. The legal issuer, settlement asset, redemption promise, balance-sheet treatment and access arrangements matter.

Stablecoins create multiple supervisory routes

The UK framework distinguishes between non-systemic and systemic qualifying stablecoins. The Bank of England and FCA approach to systemic stablecoin issuers explains that non-systemic UK-issued qualifying stablecoins fall under FCA rules covering issuance, backing assets, redemption, safeguarding and disclosures. A stablecoin recognised by HM Treasury as systemic because of its widespread payments use and potential effect on financial stability will be subject to joint FCA and Bank of England regulation.

That distinction changes the business plan. A non-systemic issuer still needs credible reserve governance, redemption processes, safeguarding and customer disclosures. A systemic model must also anticipate central-bank involvement and financial-stability expectations. An operator that treats the reserve as a treasury detail may find that its core product, liquidity and governance assumptions are incomplete.

Misclassification produces operational risk

Misclassification can lead to the wrong entity, wrong permissions, wrong disclosures and wrong outsourcing structure. It can also create a misleading application narrative. If one document calls a service “technology provision” while another describes the company as executing customer orders, the inconsistency will attract attention.

The correct output isn't merely a label. It should be a classification memorandum linked to the operating model, customer terms, financial promotions, control owners and regulatory perimeter. The firm should record assumptions, unresolved questions and the facts that would trigger a reassessment.

Comparing Major Jurisdictions, UK, EU, and US Approaches

The UK, EU and US offer three different planning environments. The UK is building a broad FCA-led regime. The EU uses a bloc-wide MiCA framework for relevant cryptoasset activities, while the US continues to require analysis across federal agencies and state authorities. These models may pursue similar outcomes, but they don't produce the same application route.

A side-by-side operating view

The UK is the clearest example of a perimeter expanding around activities rather than company labels. The FCA's perimeter guidance states that firms carrying on newly covered activities by way of business in the UK will need authorisation unless an exemption or transitional run-off applies. The named activities include stablecoin issuance, trading-platform operation, dealing, arranging, safeguarding and staking.

The EU approach offers a more coherent regional framework, but “harmonised” doesn't mean frictionless. A firm still needs to determine whether its product is a cryptoasset under MiCA or a financial instrument under an existing framework. Tokenised securities, tokenised deposits, stablecoins, staking and decentralised services can sit at boundaries where legal analysis and operational design must work together.

The US presents a different problem. The firm may need to assess securities, commodities, money transmission, financial crime and consumer-protection obligations through separate federal and state lenses. A New York-facing business can't assume that a structure acceptable in another US state will resolve its BitLicense, money-transmission or consumer-protection analysis. Nor should a federal strategy be treated as a complete state licensing plan.

Home-state advantage is limited

A home jurisdiction can provide a credible supervisory base, access to local banking and a clearer route to market. It doesn't remove the need to analyse customers, solicitation, service delivery, outsourcing and asset flows in other countries.

The idea of a single “crypto licence” breaks down here. Firms need a permission architecture, not a badge. That architecture should identify:

1. The entity providing each service.
2. The jurisdiction where the service is performed.
3. The customer type and location.
4. The assets or money controlled.
5. The promotions route.
6. The local outsourcing and safeguarding arrangements.
7. The evidence available to each supervisor.

The UK financial promotions regime shows how a business can face restrictions before the wider authorisation regime is fully operational. UK crypto promotions can lawfully reach consumers through an FCA-authorised firm, an unauthorised person using an authorised approver, an FCA-registered cryptoasset business relying on the Article 73ZA exemption, or another Financial Promotion Order exemption. Breaching section 21 of FSMA is a criminal offence punishable by up to 2 years' imprisonment, an unlimited fine, or both, as set out in the FCA's financial promotions and fiat ramp guidance.

The practical lesson is simple. Product launch, marketing launch and regulatory launch are separate decisions.

Practical Steps for Issuers and Service Providers

A strong authorisation project begins with facts, not templates. Regulators can usually identify when a business plan was written before the operating model was settled. The application then becomes a collection of aspirations rather than evidence.

1. Scope the activity and route

Write the customer journey from acquisition to exit. Identify who markets the product, who contracts with the customer, who executes transactions, who holds keys, who controls reserves, who handles complaints and who can stop the service.

Then map each function to the jurisdictions involved. Don't begin with “Which licence do we need?” Begin with “Which regulated activities are we carrying on, through which entity, and for which customers?”

The FCA's application window opens at 7am on 30 September 2026, so UK firms should use the period before filing to resolve the perimeter and evidence questions rather than assemble documents. The FCA's consumer research records that 27% of UK adults had ever bought cryptoassets, 12% held them, and 30% of crypto owners held them for tax reasons. Those findings reinforce the need to design disclosures for real customer motivations, not an imagined audience of traders.

2. Build the legal structure around accountability

The regulated entity needs clear responsibility for compliance, risk, financial resources, technology, safeguarding and customer outcomes. A parent company, foundation, protocol developer or overseas service provider may be relevant, but the applicant must still show who controls the regulated activity.

Separate current arrangements from planned arrangements. A regulator can accept a phased implementation plan where it is specific, owned and testable. It won't help to state that transaction monitoring, reconciliation or incident management “will be implemented” without an accountable owner, target state, dependency and testing approach.

Supervisors don't approve an organisational chart. They assess whether named people can control the risks represented by that chart.

3. Make controls demonstrable

KYC and AML procedures should connect to onboarding decisions, transaction monitoring, sanctions controls, escalation routes and record retention. For a custodian, the evidence must also cover key management, access controls, segregation, reconciliation, incident response and recovery. For a trading platform, it should cover listing, order handling, conflicts, market surveillance, outages and customer communications.

The same principle applies to financial resilience. Capital and liquidity assumptions should connect to volumes, staffing, technology, outsourcing, wind-down and stress scenarios. Don't insert optimistic forecasts into a spreadsheet and call that prudential planning. Explain why the assumptions are reasonable and what management will do if they fail.

4. Test the application as an operating system

A submission should be internally consistent across the business plan, financial model, policies, customer terms, governance documents and forms. A change to the custody model may affect risk disclosures, outsourcing, insurance, reconciliation, complaints and financial projections.

Before submission, conduct a controlled review:

• Trace responsibilities: Confirm that every material control has an accountable individual and escalation route.
• Reconcile documents: Check that services, customer types, jurisdictions and volumes match across all materials.
• Test evidence: Retain samples, logs, committee records, reconciliations and control results where available.
• Prepare management: Ensure responsible staff can explain what happens during a failed transaction, lost key, suspicious activity alert, service outage or customer complaint.
• Record decisions: Maintain an issues register showing open questions, agreed assumptions, owners and closure evidence.

Firms should also plan for ongoing reporting and change management. Authorisation isn't permission to stop improving the control environment. The UK regime will expand from 25 October 2027, and the FCA has said that firms carrying on newly regulated activities by way of business will need authorisation unless an exemption applies. Treat the application as the first version of a supervisory record, not the final compliance deliverable.

Impact on Market Structure and Institutional Adoption

Regulation changes who can participate, how services are bundled and where risk sits. It can make the market safer, but it can also increase fixed costs and favour firms with stronger governance, capital and operational infrastructure.

From vertically integrated platforms to controlled interfaces

Early crypto businesses often combined issuance, brokerage, custody, lending, settlement and market making. Supervisory scrutiny makes that model harder to defend unless the firm can identify conflicts, segregate responsibilities and demonstrate independent controls.

The likely result is greater separation between functions. Custody providers may specialise in safeguarding. Trading venues may establish stronger listing and surveillance processes. Banks and payment firms may provide fiat access or settlement. Issuers may rely on authorised intermediaries rather than controlling every part of distribution.

That separation has a cost. Each interface creates contractual, operational and reconciliation dependencies. The benefit is that risk ownership becomes easier to identify and customers may gain clearer protections. The strongest structures won't merely add compliance staff. They'll design the business so that control responsibilities can be tested.

Institutional adoption needs production evidence

A partnership announcement or proof of concept doesn't demonstrate genuine institutional adoption. Production adoption requires approved risk appetite, board accountability, client-asset arrangements, operational resilience, financial crime controls, incident response and a credible answer to what happens when a service or counterparty fails.

Tokenised securities, stablecoins and tokenised deposits also raise different questions. A tokenised security may involve ownership, custody, settlement finality and market infrastructure. A stablecoin may centre on reserves, redemption and safeguarding. A tokenised deposit may involve the issuing bank's balance sheet and payment arrangements. Treating all three as interchangeable creates legal and operational blind spots.

The danger of regulatory arbitrage

Moving an entity to a lighter-touch jurisdiction may reduce immediate licensing friction. It doesn't necessarily remove exposure where the firm markets to customers elsewhere, serves local residents, relies on local infrastructure or controls assets across borders.

Global standards and supervisory cooperation also make superficial arbitrage less durable. The better strategy is to choose a jurisdiction whose rules match the intended customers, products, banking relationships and risk appetite. Then build local operating substance rather than placing a nominal entity above an unchanged cross-border business.

The FCA's operational signal is already visible in demand for route selection. It said that 58 wholesale, cryptoasset and payments firms had applied for pre-application support since April 2025, according to the UK legislation and regulatory materials concerning the new perimeter. That points to a market where firms are moving from general policy discussion towards concrete questions about application readiness, business models and supervisory expectations.

The winners won't necessarily be the firms with the most complex technology. They'll be the firms that can make their technology, legal structure and controls intelligible to supervisors and institutional counterparties.

Common Misconceptions About Regulatory Compliance

“Code is law” doesn't remove responsibility from the people who design, operate, market or control a protocol. Smart contracts can automate execution, but they don't automatically resolve consumer protection, financial promotions, custody, sanctions or governance questions.

Compliance is a one-time setup is equally unsafe. Regulators expect continuing evidence that controls work, risks are reassessed and management responds to incidents, complaints, changes in outsourcing and new products.

A small jurisdiction is a safe harbour is another weak assumption. A firm can still face obligations where it serves customers, communicates promotions or performs regulated activities, even when its legal entity sits elsewhere.

Finally, cryptoassets aren't purely speculative instruments. The regulatory perimeter now reaches stablecoins, custody, trading platforms, staking and other infrastructure with potential relevance to payments and markets. The practical question isn't whether regulation will touch the technology. It's whether the business can demonstrate responsible control as the technology becomes part of financial infrastructure.

---

Glentorion helps crypto and financial businesses scope jurisdiction-specific authorisation routes, prepare application packs, refine governance and operating procedures, and ready management teams for regulator interviews. Visit Glentorion to discuss how a structured regulatory workflow can turn your crypto asset regulation plan into documented, submission-ready work.