UK crypto regime from October 2027: a company that only holds bitcoin

Sources checked 6 November 2026. This page is education for a UK company that buys and holds its own bitcoin as a treasury asset. It is not legal, tax, accounting or investment advice, and it does not say whether to buy, hold or sell bitcoin. The classification of an activity depends on the actual facts, so take current legal advice if your business does more than hold its own treasury assets.

What changes, and when

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 created the UK legal framework for specified cryptoasset regulated activities. The full scope of the regime applies from 25 October 2027. The FCA published its final policy statements on 30 June 2026, including the rules on regulated cryptoasset activities. Its perimeter guidance followed in PS26/18, published on 16 September 2026.

The application gateway opened on 30 September 2026. Firms seeking the savings or transitional treatment described by the FCA needed to apply by 28 February 2027. An existing Money Laundering Regulations registration is not an automatic FSMA authorisation. These points are primarily for service providers, but a company using them should know which perimeter and transition its provider is relying on.

See the site timeline and the changes already in force.

If the company only holds its own bitcoin

The starting point is the activity, not a label such as treasury company or crypto firm. A company buying bitcoin with its own resources, keeping its own recovery material and later selling those assets is not, merely by doing that, offering custody, arranging deals for clients or operating a trading platform.

FCA perimeter guidance gives examples involving a person using their own funds to buy cryptoassets periodically in the hope their value will rise or to hedge personal investments. It says such own account investing would not ordinarily require authorisation solely on that basis. The own account guidance also makes clear that facts such as holding out to do business with other people, providing a service to others or carrying out activities in a way that meets another specified perimeter can change the analysis.

That means a company should not extrapolate its own position to all treasury activity. Managing others' money, taking client assets for safekeeping, arranging transactions for others or inviting business as a principal can raise different questions. A company about to add any of these activities should get legal analysis before it starts, not rely on this summary.

Activities the new framework covers

PS26/11 and PERG 18 discuss activities including issuing qualifying stablecoins, safeguarding qualifying cryptoassets and specified investments, arranging safeguarding, operating a qualifying cryptoasset trading platform, dealing as principal or agent, arranging deals and staking. Each has conditions and exclusions; reading a list label alone is not enough to decide whether authorisation is required.

For the narrow treasury case, two distinctions are particularly useful:

• Own account versus serving someone else. Buying or selling the company's own assets is different from running a customer facing dealing or arranging service. Article 9U contains exclusions for principal dealing, with conditions including how a person holds out or solicits business.
• Own custody versus safeguarding for others. PERG 18.6.3 describes a self custody solution provider that cannot itself transfer a customer's cryptoassets as not carrying on the safeguarding activity. Separately, a company controlling only its own keys is not, on that fact alone, safeguarding someone else's assets. Control over another person's recovery material or unilateral ability to move their assets needs the full analysis.

Read the complete PERG 18 perimeter guidance, not only these examples. Where the answer is finely balanced or involves clients, get a lawyer who has seen the actual arrangements.

Custody and provider checks

The company may decide directly from the 2027 rules to do little differently in its own right, while still facing changes at its exchange, broker or custodian. Check those arrangements early enough to avoid forced operational decisions.

Do not assume that FCA authorisation means bitcoin itself is protected like cash in a bank account, or that a compensation scheme will replace lost bitcoin. Read the exact protection and client asset terms that apply. For the company's own controls, see custody, provider and account checks and custodian due diligence.

CARF reporting: already relevant in 2026

The Cryptoasset Reporting Framework has a different start date and purpose from the 2027 FSMA regime. UK reporting cryptoasset service providers have had due diligence and record keeping requirements since 1 January 2026. The first reports covering 2026 are due by 31 May 2027. HMRC says it will use the reported information in the same way as other tax data.

HMRC updated its provider guidance on 2 November 2026. It removed the previous wording about reporting from 1 January 2027 because the online reporting service is not yet available. This is a change to the service status wording, not a reason to ignore the 2026 record keeping and due diligence start date or the first reporting deadline.

A company that is an entity user may be asked to provide:

• Its legal business name and main address.
• Its UK registration number, where applicable.
• Controlling person details in the circumstances described by HMRC.
• The same information separately to each provider used. HMRC says users must provide information even when the provider is not based in the UK.

HMRC says inaccurate details, or a failure to give details to a UK service provider, can lead to a penalty of up to £300; for non-UK service providers it says the penalty could be higher. Keep the provider request, the response and supporting records with the account records. Do not infer a reporting duty for the company merely from this summary: the duties described in these sources fall first on in scope service providers. The company separately needs its usual tax returns and transaction records. See company tax and the accountant's corner.

Public communications: a separate perimeter

PS23/6 created rules for financial promotions involving qualifying cryptoassets. Those rules have applied since 8 October 2023, so they are not a new October 2027 obligation. The promotions regime and the regulated activity authorisation regime answer different questions.

A treasury company can explain a transaction without automatically becoming a cryptoasset firm. It should still review public material that could invite or induce someone to acquire qualifying cryptoassets. Content aimed at UK consumers can require an authorised person to approve it or another lawful communication route, subject to the detailed exemptions and scope. FG23/3, the FCA's final guidance, includes a section on when companies communicating their own cryptoassets are carrying on regulated activities and a broader explanation of the promotion perimeter.

Do not describe a website announcement as harmonised investor protection or use a regulatory status outside its actual scope. If the company begins marketing an investment, a service or a token rather than giving factual corporate information, get a promotions review before publication.

What the October 2025 cETN change means

On 8 October 2025 the FCA allowed crypto exchange traded notes to be sold to retail consumers in the UK, subject to stated conditions and financial promotion rules. This is separate from the 2027 start date. A treasury company holding bitcoin itself is not thereby holding a cETN. If it instead considers an exchange traded product, that is a different asset and legal arrangement, with its own suitability, accounting and tax questions.

For the pre-existing comparison of UK and US company rules, see US versus UK rules compared. A director's duties, board authority and records still matter: they do not start in 2027. See directors' duties and board approval.

A practical review record

This is a factual preparation checklist, not a statement that every treasury company needs authorisation.

1. Write down exactly what the company does with its own bitcoin, and whether it handles anyone else's assets or arranges activity for anyone else.
2. Re-read that description if the business adds client services, a platform, staking, issuance, dealing or a public inducement to invest.
3. Map every provider to its legal entity, role, asset control, current registration and path to the new authorisation regime.
4. Reconcile holdings and account records independently, and test recovery and withdrawal arrangements with the existing dual control process.
5. Review banking and payment providers for continuity, keeping source of funds and transaction records ready. See company banking.
6. Record CARF entity information requests and responses, and the current reporting service notices.
7. Give the accountant a dated record of what changed and what did not, rather than treating a regulatory commencement date as an accounting switch.

Primary sources for this guide

Related site pages: UK regulation, what changed, US versus UK rules, custody, banking, directors' duties and the accountant's corner. See our sources policy and how to report an error.