On 30 September 2026 the Financial Conduct Authority (FCA) finally opens its FSMA authorisations gateway for cryptoasset applications. The era of light-touch Money Laundering Regulations (MLR) oversight is officially ending. To operate legally past October 2027, every exchange, custodian, intermediary and stablecoin issuer serving UK clients must secure full FCA authorisation or Variation of Permission (VoP).

As AI-generated deepfakes, synthetic identity fraud and sophisticated document fabrication surge across digital onboarding channels, UK regulated firms are learning a hard lesson: purely automated RegTech tools are no longer enough to satisfy FCA scrutiny. While software can process volume, it cannot replace the nuanced risk judgment and human oversight that supervisors now demand under SYSC 8 and SM&CR rules.