Stablecoin Regulation UK: What You Need to Know in 2026

The UK's specific stablecoin regime became law in December 2025, with FCA authorisation for stablecoin issuers required from 25 October 2027. Non-systemic stablecoins are FCA-regulated; systemically important ones face joint Bank of England and FCA oversight.

That answer helps, but it doesn't resolve the problem most founders face in practice. You may be issuing a token, holding customer assets, converting stablecoins into pounds, operating a trading venue, or facilitating merchant payments. Those activities can sit across different permissions and supervisory expectations, even when they appear under one product name.

A business plan that says “we're launching a stablecoin platform” isn't a regulatory analysis. The useful question is more precise: which legal activity does each entity perform, for which customer, using which token, and under which operating arrangement? That distinction determines whether you need FCA authorisation, Money Laundering Regulations registration, payments permissions, or preparation for Bank of England supervision.

Table of Contents

• Understanding UK Stablecoin Regulation
  • Start with the activity, not the product label
• What Makes a Stablecoin Qualify Under UK Law
  • The two-part assessment
  • Stability is not a slogan
• FCA Supervision Versus Bank of England Oversight
  • Two supervisory tracks
• Navigating the Authorisation Pathway for Stablecoin Issuers
  • Build the permissions map
  • Assemble evidence that matches the operating model
• Reserve Requirements and Treasury Controls for Systemic Stablecoins
  • Translate the proposal into controls
  • Evidence beats assurance language
• Building Governance and Operational Resilience for Stablecoin Regulation
  • Use one readiness framework
• Common Pitfalls and How to Avoid Them
  • Treating one product as one permission
  • Writing policies before confirming facts
  • Underestimating the interview

Understanding UK Stablecoin Regulation

A founder comes in saying the business is "a stablecoin platform". On paper that sounds tidy. In regulatory terms, it usually hides four or five separate activities, each with its own perimeter question, evidence standard, and supervisory route.

Start with who does what. HM Treasury sets the legislative framework. The FCA authorises and supervises most qualifying stablecoin activity. The Bank of England matters if the stablecoin becomes systemic. Firms get into trouble when they treat those roles as substitutes instead of asking which entity performs which activity, for which customer, and under what operating model.

The UK did not build this regime through a single standalone Stablecoin Act. HM Treasury published cryptoasset regime proposals in October 2023, confirmed the broad direction on 21 November 2024, published draft statutory provisions on 29 April 2025, and laid final legislation before Parliament on 15 December 2025. Those measures create regulated activities for issuing qualifying stablecoins, operating cryptoasset trading platforms, and applying admissions and disclosures and market abuse requirements. The legislative sequence is set out in HM Treasury's published statutory provisions and policy note.

What changed in practice is the route to market. The UK has moved beyond a position centred mainly on anti money laundering registration and financial promotion controls. There is now a defined regulated route for issuing qualifying stablecoins from a UK establishment, instead of forcing firms to argue by analogy with payments, e-money, or promotion rules.

Start with the activity, not the product label

Take a common model. One group issues a pound referenced token, another entity holds customer wallets, the platform converts tokens into fiat, and the commercial team offers merchant checkout. Founders often describe all of that as stablecoin issuance. That description is too broad to support an application. Issuance, custody, exchange, platform operation, and payment functionality can trigger different permission questions, even where customers see one brand.

A workable first pass looks like this:

• Is the firm issuing the token from a UK establishment? If yes, assess the qualifying stablecoin issuance route and likely FCA authorisation.
• Is it safeguarding or holding cryptoassets for customers? Review the separate custody and safeguarding perimeter.
• Is it operating a trading venue or arranging transactions? Map platform, dealing, admissions, disclosures, and market abuse obligations.
• Is it facilitating payments? Check the payment services framework and how the token is used in the payment flow.
• Is it only providing services in UK qualifying stablecoins? Consider whether Money Laundering Regulations registration still applies where the firm does not hold a broader FSMA permission.

When firms turn that scoping exercise into an authorisation file, Glentorion's regulatory authorisation consultancy is one route for coordinating perimeter analysis, evidence, drafting, and senior management preparation. The adviser matters less than the discipline. Finish the permissions map before writing the application narrative.

What Makes a Stablecoin Qualify Under UK Law

The UK definition turns on substance, not the word used in a white paper. A qualifying stablecoin has two central characteristics: it references a particular fiat currency, and it seeks to maintain a stable value through backing assets.

Those tests should be applied to the token's legal and economic design. A marketing statement that describes a token as “stable” won't answer the question if the reserve assets, redemption model, governance arrangements, or stabilisation mechanism point elsewhere. Conversely, a token doesn't escape analysis just because its documentation calls it a utility token or a digital settlement instrument.

The two-part assessment

The fiat reference identifies the value anchor. A token linked to a particular currency raises a different regulatory question from a token that targets a basket, a commodity, an algorithmic formula, or no defined reference at all.

The backing-asset test is the operational gateway. Government materials describe qualifying stablecoins as backed by assets held to maintain a stable value against a particular fiat currency. That means the assessment should examine what assets exist, who controls them, how they are valued, how they are reconciled, and what a holder can claim when seeking redemption.

A useful design review should answer these questions before the architecture is fixed:

1. Reference: Which fiat currency does the token reference, and where is that reference documented?
2. Backing: Which assets support the value, and are they held for the relevant purpose?
3. Redemption: What contractual route allows a holder to request redemption, and who performs it?
4. Governance: Who can change the reserve policy, token mechanics, or redemption process?
5. Failure: What happens if the issuer becomes insolvent, a reserve account is restricted, or the peg is disrupted?

Stability is not a slogan

A token may trade below its intended reference or experience temporary volatility without that fact alone resolving its legal classification. The stronger question is whether the token was designed to seek stable value through backing assets and whether the operating model supports that objective.

Architecture changes can alter the analysis. Replacing identifiable backing assets with an unstable or discretionary mechanism, changing the referenced currency, or removing a meaningful redemption process may change the regulatory perimeter. Those changes should pass through formal change control, with legal, compliance, treasury, technology, and board review.

The practical mistake is to ask whether the token “looks like” a stablecoin. Ask instead whether its legal rights, reserve design, and operating arrangements satisfy the statutory characteristics. That answer should be recorded before the business commits to contracts, marketing, custody integrations, or a launch timetable.

FCA Supervision Versus Bank of England Oversight

The UK uses a risk-based supervisory split, not a technical distinction between blockchains or token standards. A qualifying stablecoin that remains non-systemic sits primarily with the FCA. If HM Treasury recognises it as systemic, the issuer moves into joint supervision by the Bank of England and the FCA.

The trigger is economically significant payment use and potential impact on UK financial stability. A token used mainly for buying and selling cryptoassets is not assessed in the same way as one that becomes widely used for payments. That makes the growth strategy part of the regulatory analysis.

Two supervisory tracks

The Bank of England has described a managed transition as firms grow. Its proposed initial temporary issuance guardrail is £40 billion for each systemic stablecoin. The FCA's consultation on stablecoin issuance and cryptoasset custody and the Bank's consultation announcement on systemic stablecoins show why this should be treated as a scaling and governance issue, not merely a classification exercise.

Practical rule: Model the route your token could enter, not only the route it occupies on launch day.

A credible business plan should track projected circulation, payment use, redemption stress, reserve liquidity, operational incidents, and governance capacity. It should also identify escalation criteria, board reporting, supervisory communications, and the data needed to demonstrate that the issuer understands its own risk profile.

The trade-off is straightforward. FCA-only preparation may be proportionate for a token designed principally for cryptoasset trading, but it shouldn't become an excuse to ignore payment expansion. A payments-led proposition should build joint-supervision readiness into its governance and treasury design from the outset.

Navigating the Authorisation Pathway for Stablecoin Issuers

A strong application begins with perimeter scoping, not policy drafting. If the firm issues a qualifying stablecoin from a UK establishment, FCA authorisation is expected to be required from 25 October 2027. That date gives applicants a planning point, but not a reason to postpone foundational work.

Build the permissions map

Start with a service inventory that names the legal entity, customer, token, contract, and control owner for each activity. Separate the following rather than placing them under one heading:

• Issuance: Who creates, burns, distributes, and redeems the token?
• Custody: Who controls private keys or holds cryptoassets for customers?
• Exchange: Who converts the token into fiat or another cryptoasset?
• Platform operation: Who operates the venue where customers trade?
• Payments: Who facilitates a transfer connected with goods, services, or a payment account?
• Marketing: Who communicates financial promotions to UK consumers?

This map should identify dependencies. A custody provider may be outsourced, but the issuer still needs to understand control, reconciliation, incident response, and customer-asset protection. A payment partner may perform fiat conversion, but contracts and customer journeys must show where responsibility sits.

Assemble evidence that matches the operating model

An FCA package should connect the business plan to actual controls. The core evidence usually includes:

1. Reserve and redemption design. Explain eligible backing assets, valuation, reconciliation, access to liquidity, and holder redemption.
2. Governance. Set out board responsibilities, senior-manager accountability, committee terms, conflicts management, and decision records.
3. Risk management. Cover market, liquidity, operational, technology, outsourcing, financial-crime, and consumer risks.
4. Operational resilience. Show important business services, tolerances, recovery arrangements, incident escalation, and testing.
5. Customer protection. Document disclosures, complaints, communications, vulnerability considerations, and outcome monitoring.
6. Financial assumptions. Make revenue, costs, capital, liquidity, and growth assumptions traceable to the operating model.

The FCA distinguishes conduct and prudential requirements for qualifying stablecoin issuers from the safeguarding regime for cryptoasset custodians. The FCA's prudential consultation for cryptoasset firms reinforces the practical consequence: a combined issuer, custodian, exchange, and payment proposition needs an activity-by-activity controls map.

Don't submit separate documents that contradict one another. The reserve policy, customer terms, risk register, financial model, outsourcing schedule, and governance chart should describe the same business. Interview preparation should test whether the responsible managers can explain not only what the policy says, but who performs each control and what evidence proves it happened.

Reserve Requirements and Treasury Controls for Systemic Stablecoins

Reserve design becomes materially more demanding when a sterling-denominated stablecoin could become systemic. The Bank of England's proposal allows issuers recognised as systemic at launch to hold up to 95% of backing assets in sterling-denominated UK government securities. The Bank's proposed regulatory regime for sterling-denominated systemic stablecoins sets out the relevant reserve-asset mechanic.

That ceiling isn't a generic “fully backed” statement. It changes how treasury teams must manage eligibility, concentration, liquidity, valuation, settlement, and access to cash for redemption.

Translate the proposal into controls

A reserve policy should identify:

• Eligible assets: Which instruments qualify, who approves additions or removals, and how eligibility is documented.
• Concentration: What limits apply by issuer, maturity, account, custodian, or instrument?
• Liquidity: How quickly can assets be converted or used to meet redemption demand?
• Valuation: Which prices, sources, frequency, and escalation rules apply?
• Reconciliation: Who compares token circulation, reserve balances, redemption requests, and transaction records?
• Authority: Which treasury decisions require management or board approval?
• Contingency: What happens during market disruption, custodian failure, settlement delay, or restricted account access?

The temporary nature of the proposed treatment also matters. Treasury architecture shouldn't assume that the initial permitted composition will remain the final operating model. A firm needs change scenarios covering reserve eligibility, liquidity buffers, account structures, reporting, and any transition expectations.

Evidence beats assurance language

Statements such as “the token is fully backed” leave the key questions unanswered. Regulators need to understand the legal claim, asset location, control rights, valuation process, redemption route, and failure arrangements.

The reserve register should reconcile to the token ledger and financial records. Exception reports should reach named decision-makers, and material breaks should trigger documented escalation. If the issuer uses a third-party custodian or treasury provider, the contract should support audit access, information rights, segregation expectations, incident notification, and orderly exit.

Reserve management is therefore not a back-office finance task. It is part of the issuer's consumer protection, prudential resilience, operational risk, and board-accountability framework.

Building Governance and Operational Resilience for Stablecoin Regulation

An authorisation gives the firm permission to operate within a framework. It doesn't prove that the organisation can manage a reserve shortfall, a wallet outage, a redemption surge, a cyber incident, or a change in systemic status.

The board should own the risk appetite and receive information that supports decisions. Senior managers should have defined responsibilities under the Senior Managers and Certification Regime, while operational teams need procedures they can execute under pressure. A policy that describes an ideal process but doesn't match the firm's systems will not help during an interview or an incident.

Use one readiness framework

Governance, resilience, and escalation should operate as one control system:

• Accountability: Assign each regulatory obligation to a named owner, with deputies and committee oversight.
• Evidence: Define the records that prove reserves, reconciliations, incidents, complaints, approvals, and customer communications were handled correctly.
• Resilience: Identify critical services, dependencies, recovery priorities, testing arrangements, and exit options.
• Escalation: Set thresholds for payment growth, reserve stress, operational incidents, control failures, and changes in token design.
• Supervision: Maintain reporting routes and a controlled process for responding to FCA or Bank of England information requests.

A stablecoin issuer should also connect outsourcing oversight to operational resilience. Critical wallet, custody, cloud, banking, payments, and data providers need due diligence, service-level expectations, concentration analysis, contingency plans, and termination arrangements.

Regulators don't assess governance from the organisation chart alone. They test whether decisions, controls, and evidence line up in real operations.

Management interviews are often revealing. Technical leaders may understand the protocol but struggle to explain redemption ownership. Finance leaders may understand reserves but not customer disclosures. Compliance teams may know the rules but lack evidence that operational teams follow them. Interview preparation should use the actual application, procedures, incident scenarios, and control reports, rather than rehearsed generalities.

Common Pitfalls and How to Avoid Them

The most expensive stablecoin mistakes happen before the application is submitted. Teams choose the token structure, sign commercial contracts, and draft customer materials before deciding which activities each entity performs. Later, the permissions analysis changes, and every connected document needs revision.

Treating one product as one permission

Issuance, custody, exchange, platform operation, payments, financial promotions, and MLR registration are not interchangeable. A firm can have a qualifying-stablecoin issuer route and still need separate analysis for wallet services, safeguarding, fiat conversion, payment transactions, or third-party distribution.

The cleanest remedy is an activity matrix with five columns: activity, legal entity, customer journey, permission or registration question, and control owner. Update it whenever the token, contract, customer location, outsourcing model, or payment flow changes.

Writing policies before confirming facts

Generic policies create a false sense of progress. A redemption policy that doesn't match bank-account access, a safeguarding procedure that omits reconciliation ownership, or an incident plan that names no decision-maker will be exposed quickly.

Use a controlled evidence register instead:

• Facts: What the business does today.
• Target arrangements: What will exist before launch.
• Open decisions: What management still needs to approve.
• Evidence owners: Who must provide contracts, diagrams, records, or testing results.
• Change impacts: Which documents require revision when a fact changes.

Underestimating the interview

Regulator interviews are not protocol demonstrations. Managers need to explain customer outcomes, reserve controls, conflicts, outsourcing dependencies, escalation thresholds, complaints, and failure handling in clear operational language.

Run scenario-based sessions around a redemption disruption, a reserve reconciliation break, an unavailable custodian, a material cyber incident, and growth into payment use. The purpose isn't to memorise answers. It's to reveal where accountability, evidence, or decision rights remain unclear.

Glentorion offers scoped regulatory authorisation support for financial and crypto businesses, including business-model assessment, application preparation and review, evidence coordination, document consistency checks, submission under an agreed mandate, and management interview preparation. That type of structured work is useful when the main risk isn't a missing policy, but fragmented facts and inconsistent explanations across the application.

Start with the permissions map, then test every policy and document against the operating model. That approach reduces rework because it exposes perimeter questions while the business can still change its design.

---

If you're planning a UK stablecoin launch or reviewing an existing cryptoasset model, visit Glentorion to discuss a scoped assessment of issuance, custody, payments, MLR registration, and potential FCA or Bank of England requirements. Glentorion can help organise the evidence, application materials, control responsibilities, and management preparation around the route your business needs.