The FCA opens crypto authorisation — and the clone window opens with it

On 30 September 2026 the Financial Conduct Authority opened applications for authorisation of crypto firms, bringing the sector into full FCA regulation for the first time — with standards covering consumer protection, safeguarding of customer assets, market integrity and financial resilience.

The timetable is what matters for brand protection. Firms that intend to keep operating in the UK should apply by 28 February 2027; the new regime comes into force on 25 October 2027. The FCA expects to determine applications submitted in the window before that date, and existing firms that apply in time can continue providing cryptoasset services — including taking on new business — while their application is still being assessed, if no decision has been made by the time the regime starts. The regulator is explicit that “authorisation is not automatic”: firms that cannot show the required standards will not be authorised.

Thirteen months of ambiguous status

Until October 2027, the UK crypto market will contain firms in several states at once: registered under the existing anti-money-laundering regime, applied for authorisation, under assessment, continuing under the transitional arrangement, authorised — or refused. Each of these is legitimate for someone. None of them is easy for a retail customer to check from an advert, a Telegram channel or a landing page.

That is the environment in which impersonation thrives. UK financial services already has a well-worn pattern for it — the clone firm: a fraudster copies a real, regulated firm’s name, reference number and branding, swaps in its own website, phone number or payment details, and sells under the real firm’s credibility. The FCA’s Warning List is full of them. A new regulated status for crypto adds a fresh inventory of names worth copying — and the firms that announce their applications first, loudly, become the most visible templates.

What the clones will claim

Expect the fakes to borrow the language of the transition rather than of full authorisation: “FCA application submitted”, “authorisation in progress”, “operating under FCA transitional arrangements”. These are harder to disprove at a glance than a false claim of full authorisation, and they piggyback on real press coverage of the gateway opening.

What this means for you

If you run a crypto or trading brand that serves UK customers, the opportunity is to act before the wave rather than after it:

• Publish one canonical status page. State exactly where you are in the process, your official domains and channels, and how customers can verify you. It gives platforms, hosts and customers something concrete to measure fakes against.
• Start monitoring now. Lookalike domains, social profiles, app listings and ads using your name alongside “FCA” are the early signal. Registration of such domains typically precedes the scam by weeks.
• Prepare the evidence pack. Register entries, trademark registrations, your official domain list and authorisation for your representative — assembled in advance, so a takedown goes out the same day a clone appears, not after the first victims report it.