High level crypto programme roadmap
As the roadmap below illustrates, the work that will determine application quality starts well before the gateway opens. Firms should therefore already be identifying what needs to be built, strengthened or evidenced so the application is credible, complete and ready when the window opens.
What the regulator expects
The future regime is expected to require firms to pass through a full authorisation gateway for regulated cryptoasset activities. In practice, that means the FCA is likely to look beyond whether a firm understands the rules. It is likely to focus on whether the business model is clear, the governance is credible, the prudential position is supportable, and the control environment is sufficiently developed for the activity the firm wants to undertake.
The required submission is also expected to be broad. Firms should be ready to prepare core corporate and governance information, senior management materials, a Regulatory Business Plan, multi-year financial information and prudential analysis. Depending on the business model, they may also need to evidence areas such as safeguarding, customer-facing controls, financial crime, technology and operational resilience.
The FCA’s wider framing of firms being ready, willing and organised is key. The message is that firms should come to the process having done the work, with finalised documents, clear accountabilities and a developed view of their regulatory obligations, rather than expecting the application process itself to resolve underlying gaps.
What this means in practice for firms
In practice, firms should start by assessing the gap between their current state and the expected FCA requirements relevant to authorisation, then prioritise the workstreams most likely to drive timing and application quality.
For crypto-native firms, that often means translating an existing commercial model into the future UK crypto framework and identifying what needs to change to meet FCA expectations. For existing FSMA firms, it often means identifying what can genuinely be leveraged from the current framework and where crypto-specific uplift is still required.
In both cases, the practical objective is the same: define the work early, prioritise the critical path and avoid leaving the most complex issues to the formal application period.
Areas requiring early focus
Business model clarity
Firms need sufficient clarity on the proposed business model, product scope and operating model before drafting accelerates. Where those points are still evolving, the application is more likely to reflect open questions rather than a clearly defined proposition.
Prudential assessment and overall risk assessment
For many firms, prudential preparation will be one of the most substantial parts of the process. The application process requires firms to develop a coherent view of capital, liquidity, stress testing, recovery and wind-down, and to make sure that analysis aligns with the wider strategy, forecasts and risk profile.
Governance sign-off and internal challenge
Applications need more than drafting. Firms should build in enough time for senior review, challenge and formal sign-off so that the submission is complete, internally consistent and properly owned before it is filed.
Do not rush to submit an incomplete application
Submitting with unresolved gaps can create more delay rather than less. The stronger approach is to mobilise early, work through the critical issues properly, and submit from a position of greater completeness and control.
What firms should do now
The practical implication is that firms should not wait for the application gateway to open before beginning the core work. Mobilisation should start early, with a clear programme structure, defined ownership and enough senior decision-making capacity to keep momentum.
In practice, that means starting with a targeted gap assessment against the full range of FCA requirements and expectations relevant to authorisation, then identifying the workstreams most likely to determine timing and application quality. For many firms, they should initially prioritise the Regulatory Business Plan, prudential analysis and the key design decisions that shape the wider submission.
Most importantly, the application should be built as one coherent case rather than as separate documents prepared in isolation. Firms that mobilise early, prioritise the critical path and build in sufficient senior review and challenge are likely to be in a stronger position to submit a more complete, credible and internally consistent application. The gateway should therefore be treated as the point by which the core work is well advanced, not the point at which it begins.
Follow us
