FCA crypto authorisation opened on 30 September 2026. For the first time, crypto firms operating in the UK can apply to be brought into full FCA regulation — applications in by 28 February 2027, the new regime live on 25 October 2027. If you run paid acquisition for a crypto exchange, that is not only a compliance date. It is the moment the most valuable line of copy in a crypto campaign became legal to write.
Until 30 September, no UK crypto firm could claim to be authorised. The FCA’s consumer warning is blunt: crypto activity is “not regulated yet in the UK, there is no safety net if things go wrong.” That sentence was the whole problem for a legitimate exchange. Competing against a market saturated with scams, every operator looked the same — because none of them had a status to point at.
FCA authorised is that status. It is the differentiator the sector has never been able to buy, and every firm that walks through the gateway will put it in an ad. That is a good thing. It is also a claim — and in September the FCA announced closures of firms that made claims their operations could not support.
What actually changed on 30 September
The mechanism is simple. “From today, crypto firms can apply for authorisation from the FCA,” the regulator’s release reads, and it frames the shift in one sentence: for the first time, crypto firms operating in the UK will be brought into full FCA regulation, with clear standards covering consumer protection, safeguarding, market integrity and financial resilience.
The timetable is published, and it is short. Pre-application support opened in July. Policy statements landed through the summer. The application period began on 30 September and closes on 28 February 2027; the new regime is expected to come into force on 25 October 2027. Firms that miss the window do not carry on; they cannot keep operating under the new regime.
And then the sentence that ought to govern how you write the ad:
Authorisation is not automatic. Firms will need to clearly demonstrate that they meet the FCA’s requirements, and those that cannot show the necessary standards will not be authorised to operate in the UK market.
Dominic Cashman, the FCA’s director of authorisation, put the intent in one line: the new regime gives consumers “greater protections” and firms “a clear framework to operate in.” Firms can now apply — and start preparing for regulation.
The best claim crypto advertising has ever had
Crypto is the one vertical where trust is the product. A prospective investor who has been burned — or watched someone else get burned — does not respond to a better hook. They respond to a reason to believe this operator is real.
For years, an honest exchange had no such reason to offer. Every claim it could make about returns was a claim a scam could make louder. The “FCA authorised” line is different: it is a status only the regulator can confer, and it is the first one the sector has ever been able to put in a headline and mean.
That is why this is a marketing decision, not just a legal one. The firms that get through the gateway early get a claim their competitors will not have for months. The firms that get through it and use it carelessly get something else entirely.
21 firms closed since 2025 for wearing the badge
Five days before it opened the crypto gateway, the FCA announced that 21 CFD firms had closed since 2025, and that three more were cancelling their permissions. The FCA’s release is dated 25 September 2026. The reason is the whole argument, in the regulator’s own words: the firms were using UK authorisation “as a badge to make linked overseas companies look more trustworthy than they really are.”
The remedies ran from restricting their trading, through required independent reviews of their businesses, to enforcement investigations in the two most serious cases. A badge, in other words, is exactly the kind of claim that invites the closest look.
Read the two events together and the pattern is not subtle. The FCA is opening a new perimeter in which “authorised” becomes a badge — and it has spent the past year showing what it does when a firm wears a badge its operations cannot back.
| When | What happened | What it tells you |
|---|---|---|
| 25 Sep 2026 | FCA announces 21 CFD closures since 2025; 3 more cancelling | Authorisation used “as a badge” is the claim the FCA tests hardest. |
| 30 Sep 2026 | FCA opens crypto authorisation | “Authorised” becomes a legitimate marketing claim for a new perimeter. |
| 28 Feb 2027 | Crypto application window closes | Firms that miss it cannot keep operating under the new regime. |
| 25 Oct 2027 | New crypto regime in force | The date the claim has to be true — and provable. |
The FCA already runs an approval gate on the claim itself
Crypto promotions were never unregulated. The FCA’s rules for cryptoasset financial promotions (PS23/6) set what a crypto ad may say, and who may say it. Since 7 February 2024, a firm needs the FCA’s permission — “approver permission” — to approve the financial promotions of an unauthorised person under section 21 of FSMA.
That is an approval gate in the literal sense. Someone inside an authorised firm has to sign off the wording of the promotion before it runs. And the FCA does not only read the front end: its cryptoassets hub names “assessing firms’ compliance with ‘back end’ financial promotions rules” as a distinct supervisory activity — the ongoing-monitoring half of the regime.
Add the third layer: the FCA’s guidance moves the Consumer Duty onto cryptoasset firms — an outcomes standard, evidenced by what the firm actually did for a customer, not by what its policy document said it would do.
So the regulator has built a gate (who may approve), a monitoring regime (whether the promotion stayed compliant), and an outcomes standard (whether the result was good). All three are answered the same way — from a record.
What a status claim has to be able to prove
Picture the supervision conversation a year from now. The FCA asks about one authorised firm’s crypto promotion — not the campaign, one creative — and the questions are all about provenance.
- Which entity? The authorised legal person the claim refers to — not the brand name on the ad, and not an overseas affiliate with a similar logo.
- Which promotion? The specific creative, and the claim as it shipped — not the version sitting in the shared drive today.
- Who approved it? The named approver who exercised s.21 sign-off before it ran.
- When, and in which market? Promotion rules are national; one brand served across three markets is three claims.
- What did it say at serve time? Not what the landing page says now that the terms have changed.
Your ad platform answers none of these. It will tell you the creative reached four thousand people. It will not tell you who authorised the wording, because authorisation is not an event the platform records. A status claim without that record is a badge — and the FCA’s last crackdown was about badges.
Who actually owns the claim
The firm applies for authorisation. But the agency writes the ad. If you run paid acquisition for a crypto client, you produce the “FCA authorised” creative, place it across accounts the client does not personally touch, and ship it from your own ad manager. When the claim is questioned, the record of what you built and who cleared it is the record your client will ask you for.
This is the same structural point the SEC’s crypto-asset proposal made from the US side: your ads become the evidence. The UK gateway adds a specific, dated claim to that evidence. It is worth having the record before the claim is in market, not after.
Where Ott fits
Ott’s Activity Logging records the four fields a question like this resolves to: the actor, the value before and after, the timestamp, and the linked object. It is stored independently of the ad platform, so the answer survives a platform change, an account ban or a reporting outage, and it stays readable outside the tool that made the change. An MCP connection means an assistant working on your client’s accounts reads through the same structure rather than beside it.
For the crypto vertical specifically, this is where a records layer and a tracking layer separate. Ott carries Telegram joins, FTDs and per-campaign attribution alongside the change record, so the same system that answers “what did this claim cost” can answer “who made the change.”
Three limits, stated plainly. Ott is read-only — it records what happens in the accounts and in your operations; it does not write to ad platforms. On coverage, Meta is connected today, with Google Ads on the roadmap — so an agency running crypto spend across four platforms is getting the record for the surface it uses most. And we publish no retention number, which is the same gap we hold vendors to — a limit, not a hidden detail.
The pricing matches the problem: Ott meters by brands and seats, not per ad account, per data source or per Telegram join — so the number of accounts a crypto client adds does not change the cost of keeping the record. See what that looks like on the pricing page.
The gateway is open. The claim is yours. The record is the work.
FCA crypto authorisation is a genuine step change. It gives honest operators something they have never had: a status they can advertise, and a reason for a cautious investor to pick them over the firm next to them. Use it.
But note what the FCA paired it with. In the same week it opened the gateway, it announced action against 24 firms — 21 closed since 2025, three cancelling — for a status claim their operations could not support. The claim is now legitimate. The record is still the part you have to build — and it is far cheaper to build before the claim is in market, under a deadline, than to reconstruct after one is questioned.
You will be asked who approved a creative, in a market, on a date, on behalf of a named authorised entity. That is a record, not a report. It is worth building before anyone requires it. The US version of this argument is here: SEC regulation of crypto assets — your ads are now the evidence.