The FCA's authorisation gateway for cryptoasset firms opened on 30 September 2026. For most firms the regime will feel like a documentation project: perimeter analysis, financial crime controls, capital, policies. But an application also says something less visible, which is how the firm is governed, and whether its board can show that it understands and oversees what the firm is applying to do.
Why the timing matters more than it looks
The new regime comes into force on 25 October 2027. Applications filed by 28 February 2027 benefit from a saving provision if they have not been decided by then, and the FCA has indicated that it intends to reject inadequate applications. A rejected application needs time to be corrected and resubmitted. A board that leaves the application to the final weeks of the window leaves itself little room for a second attempt.
That puts weight on the early decisions: who owns the application, what the board has seen, and whether the governance the application describes actually exists.
Where governance is most likely to be tested
Accountability that exists on paper only
Firms need a clear allocation of responsibilities under the Senior Managers and Certification Regime, with key roles held by fit and proper individuals. In young, founder-led firms, one or two people often carry several roles informally. The application asks for that to be written down. The board's job is to be satisfied that the allocation is real: that each named person understands what they are accountable for and could evidence it if asked.
Challenge the board cannot evidence
Many crypto firms have boards made up of founders and investors, with limited independent challenge. That is common in early-stage firms, but a regulator reading an application will look for evidence that someone has asked difficult questions and that the answers changed something. A well-written governance section is not the same as a record of challenge.
The Consumer Duty applied to a new product set
The FCA's guidance on applying the Consumer Duty to cryptoasset firms is now final. For a firm that has never worked under the Duty, that raises questions the board should be able to answer. Do customers understand what they are buying, and the risks? Is what they pay fair for what they receive? How are vulnerable customers identified? How do financial promotions stay within the rules? Further FCA work on retail access is still to come, so these answers may need to be revisited.
An application is also a statement about governance. The strongest applicants will be the firms whose boards can show, with evidence, who is accountable, how challenge happens, and what the board has actually seen.
Dependencies the board has not mapped
Cryptoasset firms often rely on a small number of critical third parties: custodians, cloud providers, blockchain infrastructure, liquidity providers. The FCA's operational resilience guidance for cryptoasset firms is final, with further guidance on distributed ledger technology expected before go-live. Firms should review their third-party contracts and prepare for the incoming incident and third-party reporting regime. A board that cannot describe its critical dependencies, and what happens if one fails, will struggle to show it owns the firm's resilience.
Controls that must work from day one
The FCA expects firms to show that their controls work from the outset, including financial crime controls. Boards need to oversee that, not just approve a policy. The practical test is whether the board has seen evidence of how the controls perform, rather than a statement that they exist.
The regime is still moving. Further FCA guidance, including on decentralised finance and distributed ledger technology, is expected in the coming months. The board, not the compliance team alone, should own the decision about when to file and what it still needs to know.
Five questions worth asking before the application is filed
- Who holds each Senior Management Function for our crypto activity, and is the allocation of responsibilities written down and understood by the people named?
- What evidence could we show the FCA that the board has challenged management, and what changed as a result?
- How will the board know that customers understand the products and the risks, and receive fair value?
- Which third parties are critical to the service, and has the board seen the dependency picture and the failure scenarios?
- What has the board actually seen on how our financial crime and other controls perform in practice?
None of these requires technical knowledge of blockchain. They are the same questions a board of any regulated firm should be able to answer. What is different is that, for firms entering the regime, the answers will form part of the case for authorisation.
Where independent challenge can help
NJW Consulting does not draft applications, give legal advice or advise on whether a particular token or activity falls within the regime. Your lawyers and authorisation advisers do that. What we do is test board oversight: senior manager accountability, the quality and evidence of board challenge, Consumer Duty oversight, third-party and resilience oversight, and the evidence the board could show the FCA.
We are independent. We hold no vendor retainers and we neither pay nor receive referral fees, so the view a board receives is not shaped by a product or a commission.