Fintech Regulation UK: The 2026 Compliance Guide

You're preparing to launch a wallet, payment service, crypto platform or embedded-finance product in the UK. The commercial model looks straightforward until one revenue line triggers payments rules, another creates a cryptoasset permission, and the customer journey brings Consumer Duty and financial promotions obligations into the same operating model. The central problem in fintech regulation UK isn't finding one licence. It's proving that every activity, customer interaction and control fits the correct regulatory perimeter.

A board should therefore treat authorisation as a business-design exercise, not an administrative filing. The strongest applications connect the business model to permissions, responsible people, financial assumptions, safeguarding arrangements, customer outcomes and evidence. The weakest applications describe an attractive product but leave the regulator to discover how it will operate in practice.

Table of Contents

• Mapping the UK Fintech Regulatory Architecture
  • The regulator depends on the operating model
• Navigating the FCA Authorisation Gateway
  • What the evidence package must prove
  • Statutory timing is not delivery timing
• The 2026 Cryptoasset Regulatory Perimeter
  • Map revenue lines to regulated activities
  • Build for the perimeter change
• Payment Rails and Customer Fund Safeguarding
  • Compare the permitted methods
  • Payments are becoming a layered perimeter
• Consumer Duty and Financial Promotions
  • Design customer outcomes into the product
  • Treat crypto marketing as a controlled activity
• Building an Evidence-Led Compliance Roadmap
  • Start with scope and gaps
  • Draft around the operating reality
  • Use next-action discipline
• Preparing for Regulator Interviews and Ongoing Governance

Mapping the UK Fintech Regulatory Architecture

The UK framework separates conduct supervision from prudential supervision, but fintech business models rarely respect neat organisational boundaries. A payment institution may need to demonstrate safeguarding and customer-outcome controls. A bank building a digital-asset proposition may face prudential expectations from the PRA alongside FCA conduct and perimeter requirements. A crypto business offering custody, trading or payments must examine each activity rather than rely on a broad description such as “digital assets”.

The modern structure comes from the Financial Services Act 2012, which came into force on 1 April 2013 and replaced the former single-regulator model with the FCA and PRA. The FCA's description of its role confirms that it was established on that date and took over conduct regulation, together with relevant prudential regulation, from the Financial Services Authority.

The regulator depends on the operating model

The FCA is the primary regulator for most non-bank fintech-facing activities. Its responsibilities include conduct, consumer protection, market integrity, authorisation and perimeter decisions. That makes it the regulator most founders encounter when applying for payment, e-money, investment, cryptoasset or other permissions.

The PRA has a different role. It focuses on the prudential soundness of banks, insurers and designated investment firms. If a fintech becomes a bank, or operates through a prudentially regulated entity, its capital, liquidity, risk management and resilience arrangements need to satisfy a more demanding prudential framework. The FCA remains relevant for conduct and market-facing obligations, so the split doesn't remove the need for coordination.

HM Treasury sets the legislative and policy context, while the regulators apply the relevant rules and supervisory expectations. The board's task is to turn that architecture into an activity map:

• Payments and e-money: identify whether the firm provides payment services, issues electronic money, holds customer funds or uses agents.
• Cryptoassets: separate custody, trading, dealing, issuance, staking, lending and other services instead of treating them as one product.
• Banking: establish which entity takes deposits, provides credit, controls customer relationships and bears prudential responsibility.
• Technology and outsourcing: document the provider, control owner, access rights, resilience arrangements and exit route for each critical dependency.

Board rule: approve the regulatory perimeter before approving the product roadmap. A product feature can alter the permission set, control framework and evidence burden.

The practical consequence is clear. Don't ask, “Which fintech licence do we need?” Ask, “Which legal entity performs each activity, for which customer, using which funds, technology and third party, and under whose accountability?” That question produces a defensible route to authorisation.

Navigating the FCA Authorisation Gateway

An FCA application can be processed within the statutory timetable and still be a poor application. The distinction matters because a deadline measures the regulator's handling of the case, not the applicant's readiness to receive approval.

The FCA's performance data for Q1 2025/26 records that 99.1% of applications across all metric areas were determined within the statutory deadline, with 12 metrics green and 2 amber, as reflected in the FCA's financial services register and authorisation information. That is useful for planning, but it isn't a promise of uncomplicated approval. A complete-looking form can still produce extensive gateway questions if the underlying evidence is inconsistent, incomplete or commercially unrealistic.

What the evidence package must prove

The regulator needs to understand how the firm will operate on a normal day, under stress and after a material change. Your application should therefore connect the following materials rather than present them as isolated documents:

• Business model: explain products, customers, distribution, revenue lines, transaction flows and the legal entities involved.
• Financial projections: reconcile income assumptions with staffing, technology, capital, liquidity, safeguarding and the expected path to sustainability.
• Governance: identify directors, senior managers, control functions, reporting lines, decision rights and arrangements for conflicts.
• Policies and procedures: show how the firm will perform the activities described, not merely state that it will comply with the rules.
• Operational arrangements: document systems, outsourcing, incident management, business continuity, customer support and management information.
• Customer protection: show how the firm identifies vulnerable customers, communicates risk, handles complaints and tests outcomes.

A common failure is drafting policies around a future operating model while the application describes current capability as if it already exists. Label the difference. State what is operational, what is contracted, what is being built and who owns the remaining implementation work.

Statutory timing is not delivery timing

Gateway queries often expose contradictions between the business plan, financial model, compliance manual and senior-management responsibilities. Each answer can trigger a change elsewhere in the pack. If the firm updates a product description but fails to update its permissions analysis, risk assessment and customer disclosures, the regulator sees a control problem rather than a drafting oversight.

Use a controlled evidence register. Give every material assertion an owner, source, status and next action. Then run cross-document checks for customer numbers, transaction assumptions, legal entities, outsourced functions, safeguarding flows and accountable individuals. The objective isn't to make the application longer. It's to make every important answer traceable.

Approval risk sits in the gaps between documents. Treat consistency as a control, not an editorial preference.

Management should also rehearse the questions the application invites. A senior manager who can explain a policy but can't describe the daily control, escalation threshold or management information has not demonstrated operational readiness. The board should budget for that preparation before submission, not after the first gateway query.

The 2026 Cryptoasset Regulatory Perimeter

The UK crypto perimeter has moved from a narrow focus on anti-money laundering registration and financial promotions towards a broader FSMA authorisation regime. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 were passed on 4 February 2026. The FCA says the regime brings a broad range of cryptoasset activities inside its regulatory perimeter for the first time, with the full scope of regulated activities scheduled to expand from 25 October 2027. These dates and the relevant activity categories are set out in the FCA's policy material on the cryptoasset regime.

Map revenue lines to regulated activities

The new perimeter changes the question for crypto founders. It's no longer enough to establish whether the business is registered for anti-money laundering purposes. The firm must identify whether its actual services involve regulated activities and whether the legal entity, permissions, controls and capital arrangements support those activities.

The mapping exercise should cover:

• Trading platforms: operating a venue can create obligations distinct from brokerage or bilateral dealing.
• Safeguarding and custody: holding or controlling customer cryptoassets requires a clear custody model, asset segregation approach, access-control design and incident response.
• Dealing: dealing as principal and dealing as agent are different operating models with different conflicts and execution implications.
• Stablecoin issuance: issuing qualifying stablecoins requires the firm to examine the relevant issuance, reserve, redemption and governance obligations.
• Staking: determine who controls the assets, who bears loss, how rewards are generated and whether the service is delivered directly or through a third party.
• Lending and borrowing: document the legal relationship, collateral, default process, valuation, liquidity and customer disclosures.
• Certain DeFi services: assess the actual functions performed by the firm, its governance arrangements and the degree of operational control.

A single app can contain several of these activities. The permission analysis must follow the operating model through onboarding, funding, execution, custody, settlement, rewards, withdrawals and complaints. Don't use the product name as a substitute for legal analysis.

Build for the perimeter change

Start with an activity matrix. For each revenue line, record the service description, customer type, asset flow, legal entity, relevant RAO category, proposed permission, responsible senior manager and supporting evidence. Then test whether the firm's controls match the activity. A custody policy that doesn't explain wallet governance, key access, reconciliations and recovery arrangements won't support a credible custody application.

Existing crypto businesses should also distinguish legacy permissions from the future regime. A firm may have built strong anti-money laundering controls while lacking the prudential, conduct, operational resilience, market-integrity or customer-asset arrangements expected under the expanded framework.

The correct perimeter is the one produced by the operating facts, not the one that creates the shortest application.

The board should approve a transition plan with explicit owners, decision points and evidence requirements. Treat the scheduled expansion from 25 October 2027 as a planning horizon, not as permission to defer analysis. Product launches, partnerships and marketing campaigns can create regulated exposure before the full operating model is ready.

Payment Rails and Customer Fund Safeguarding

Payment firms often treat safeguarding as a finance-team process. That's a mistake. It is an end-to-end control spanning onboarding, payment initiation, reconciliation, treasury, settlement, customer support, incident management and board reporting.

For UK payment institutions and e-money institutions, safeguarding rules require customer funds to be protected under regulation 23 of the Payment Services Regulations 2017 and/or regulation 20 of the Electronic Money Regulations 2011. The FCA's safeguarding requirements for payment and e-money institutions identifies two permitted methods and sets out the associated reporting expectations.

Compare the permitted methods

The method is only the starting point. The firm needs documented ownership of daily reconciliations, exception handling and escalation. It also needs to explain what happens when a payment is returned, a merchant dispute arises, a safeguarding account is unavailable or a third party fails.

The FCA requires monthly safeguarding reporting through My FCA within 15 business days after each calendar month end. Its 2025/2026 reforms introduce a £100,000 threshold over a 53-week period below which a firm is exempt from arranging a safeguarding audit. These are precise operational requirements, so the reporting calendar, data lineage and sign-off process should appear in the compliance operating model rather than remain as informal finance practice.

Payments are becoming a layered perimeter

Open banking illustrates why payment regulation can't be assessed in isolation. FCA research records around 13.3 million active open banking users as of March 2025, alongside more than 23 million one-off payments successfully processed and 3.7 million successful Variable Recurring Payment transactions in March alone. The FCA research note on open banking and open finance shows how market infrastructure, customer permissions and payment services increasingly intersect.

The FCA's May 2026 Regulatory Initiatives Grid points to legislation for Smart Data schemes in financial services and a long-term regulatory framework for Open Banking. The government's Payments Forward Plan also states that FCA standards and guidance on contactless payments came into force in March 2026, as reflected in the Regulatory Initiatives Grid.

A wallet provider, account-information service or crypto firm that touches payments should map each rail, permission and control. The important question is not whether the firm uses open banking. It is who initiates the payment, who holds funds, who bears settlement risk and how the firm proves customer consent.

Consumer Duty and Financial Promotions

A fintech can hold the right permission and still fail at the customer interface. Product design, pricing, onboarding, disclosures, support and marketing now form part of the supervisory picture. Consumer Duty and financial promotions should therefore sit in the product approval process, not in a late-stage compliance sign-off.

The FCA's Consumer Duty information for firms states that the Duty applies to open products and services from 31 July 2023 and to closed products and services from 31 July 2024. For this purpose, a product is only closed if it already had existing customers before 31 July 2023 and wasn't marketed or distributed, including by renewal, on or after that date. The Duty isn't retrospective and applies only to firms conducting regulated activities in the UK.

Design customer outcomes into the product

A board should ask for evidence, not assurances. Product teams should be able to show how they defined the target market, assessed fair value, tested customer understanding and identified foreseeable harm. Compliance teams should retain the test results, decisions, changes and approvals.

This matters particularly for products combining payments, cryptoassets and automated decision-making. A clear technical explanation doesn't necessarily produce customer understanding. The firm must test whether the intended audience can understand fees, risks, access conditions, asset protection and the circumstances in which the service may be restricted.

Treat crypto marketing as a controlled activity

The FCA says that all firms marketing cryptoassets to UK consumers, including overseas firms, have been subject to the UK financial promotions regime since 8 October 2023. Its guidance on marketing cryptoassets to UK consumers identifies four lawful routes:

1. A promotion communicated by an authorised person.
2. A promotion approved by an authorised person.
3. A promotion communicated by an FCA-registered cryptoasset business relying on Article 73ZA of the Financial Promotion Order.
4. A promotion relying on another applicable exemption in the Financial Promotion Order.

Marketing controls should cover social content, affiliates, referral partners, app-store descriptions, influencer material, landing pages and customer emails. Keep the approval record with the final communication, target audience, risk assessment and evidence supporting any factual claim.

Marketing isn't outside the regulated model. It's one of the clearest places where the regulator can test whether the product's stated value matches the customer's actual experience.

Building an Evidence-Led Compliance Roadmap

A credible application starts with decisions. Before drafting policies, the team needs agreement on the regulated activities, legal entities, customer groups, funds flow, technology architecture, outsourcing model and intended launch state. If those questions remain open, document them as decisions required, not as assumptions hidden in polished prose.

Start with scope and gaps

Create an activity and permission matrix before writing the main narrative. Include the relevant customer journey, legal entity, funds or asset flow, accountable owner, policy requirement and evidence status for each activity. This exposes perimeter gaps early and prevents the business plan from describing services that the permissions analysis doesn't cover.

Then gather the underlying evidence. The evidence pack should include corporate information, governance records, role descriptions, financial assumptions, customer research, vendor contracts, technology diagrams, risk assessments, safeguarding calculations and implementation plans. Don't accept a policy statement as evidence that the control exists.

Draft around the operating reality

Policies should distinguish current arrangements from to-be-established arrangements. A future control can support an application if the firm explains its owner, implementation date, dependencies, testing method and management oversight. A vague promise to “enhance controls before launch” won't demonstrate readiness.

Use specialist input selectively. Legal analysis may be needed for perimeter classification, technology specialists for architecture and resilience, finance specialists for projections and treasury, and compliance professionals for governance and controls. One person should own the integrated narrative, otherwise each specialist can produce a technically sound document that conflicts with the rest of the pack.

A practical workflow looks like this:

• Scope and gap analysis: confirm activities, jurisdictions, entities, customers and missing decisions.
• Data gathering: collect source documents and reconcile factual assumptions.
• Policy drafting: convert the operating model into procedures, controls and escalation routes.
• Independent review: test permissions, consistency, evidence quality and management accountability.
• Submission preparation: resolve findings, obtain approvals, record filing results and preserve the final pack.

Use next-action discipline

Every review finding should have an owner, required decision, supporting evidence and due date. Track dependencies across documents. If the board changes the target customer, funding model or custody arrangement, run an impact review across the business plan, financial model, risk assessment, policies and customer communications.

Software can help with intake, KYC and KYB checks, business planning, financial modelling, document control and cross-document consistency checks. A regulatory authorisation platform such as Glentorion can support those workflows, but professional judgement remains necessary for perimeter analysis, control design and management decisions.

The application is only as strong as the evidence trail behind its most important statements.

Preparing for Regulator Interviews and Ongoing Governance

The regulator interview tests whether the management team owns the application. Directors and senior managers should be able to explain the customer journey, key risks, control operation, financial assumptions, outsourcing dependencies and escalation process without reading from the policy pack.

Rehearse by assigning each topic to the accountable person. Ask the finance lead to explain liquidity and forecast sensitivities. Ask the operations lead to walk through a failed payment or custody incident. Ask the compliance lead to explain monitoring, complaints and regulatory reporting. Ask the board how it would respond if growth outpaced control capacity.

The same discipline continues after authorisation. Maintain a change register linking product changes, new jurisdictions, third-party arrangements, senior-manager responsibilities and regulatory developments to affected policies and evidence. A new staking feature, payment rail or distribution partner can alter the perimeter and customer-outcome analysis, even if the brand and app remain unchanged.

Ongoing governance should produce usable management information. The board needs visibility over safeguarding exceptions, complaints, incidents, customer outcomes, financial resilience, regulatory returns, open audit actions and material changes. It should also know which controls are designed but not yet operational.

Regulatory readiness is therefore a continuous operating discipline. Firms that preserve the reasoning behind their permissions and controls can respond to change. Firms that treat authorisation as a one-off document exercise usually discover their gaps during a product launch, a supervisory question or a serious incident.

---

Glentorion helps financial and crypto businesses scope their regulatory route, prepare and review evidence-led application packs, submit under mandate and ready management teams for regulator interviews. Visit Glentorion to discuss the permissions, evidence and governance work behind your UK fintech or crypto proposition.