Regulation
The FCA cryptoasset regime: fraud controls before October 2027
The UK's new cryptoasset regime commences on 25 October 2027 under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026. Firms can apply for authorisation from 30 September 2026 to 28 February 2027, and an existing registration under the Money Laundering Regulations does not convert automatically. This page sets out the published timeline and shows where phone-layer signals fit into the systems and controls a firm has to describe along the way. It explains what the regime asks for and is not legal advice.
The dates the FCA has published
- 11 May 2026. Firms can request a pre-application meeting through the FCA's Pre-Application Support Service. Meetings run from July 2026.
- 30 September 2026. The application period opens.
- 28 February 2027. The application period closes.
- 25 October 2027. The new regime commences.
Dates as published by the FCA, checked July 2026. The application period is set by FCA direction under Part 7 of the Treasury's statutory instrument, SI 2026/102. Firms can apply after the period closes, but the FCA has said it will not expedite late applications.
An MLR registration does not carry over
This is the detail most easily missed. The FCA has stated there will be no automatic conversion for firms registered under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. Those firms still need authorisation under FSMA. A registration granted in 2026 is not a shortcut through the gateway. Firms already authorised under FSMA for other activities need a variation of permission rather than a fresh application.
In practice that means an existing crypto firm's financial crime systems and controls get looked at again, in a new frame, against a published deadline. The FCA has also said that for MLR-registered firms the current systems and controls will help demonstrate compliance, so the work is incremental rather than a rebuild.
What the FCA has asked firms to do now
The regulator's published preparation list is specific, and two items on it are where a signal layer becomes relevant:
- Review the new regulated activities and determine what type of authorisation is required.
- Review the proposed scope of permissions against the business model and risk profile.
- Carry out a gap analysis against the expected FSMA requirements, identifying where existing arrangements need to be strengthened.
- Develop a realistic implementation plan agreed at board level, covering who is accountable, what changes, how it is delivered and when it completes.
- Assess the resources and costs of preparation, authorisation and ongoing compliance.
A gap analysis and a costed implementation plan both reward controls that are quick to add and cheap to run. That is the practical case for telecom signals in this window, not any claim that a regulator requires them.
Where telecom signals fit in a gap analysis
Nothing in the regime names a phone signal, and no vendor can honestly tell a firm that buying one satisfies a requirement. What a gap analysis does need is a defensible account of how the firm detects and prevents financial crime at each customer touchpoint. Telecom signals are among the cheapest evidence to produce at three of them.
Screening the number a new customer presents. A non-fixed VoIP number, an inactive line or a country that contradicts the rest of the application is a reason to route to review rather than approve. This is standard phone number validation for KYC and it produces a per-application audit record at negligible cost.
Screening the number arriving on an existing account, which is where account takeover converts a stolen password into durable control. Most firms check at sign-up and never again, so this is usually the widest gap on the list.
Re-checking contact data held against long-lived accounts. Firms with customer bases dating back years hold phone numbers that have since lapsed, ported or been reassigned, which quietly degrades every control built on top of them.
This is a different instrument from PS24/17
Worth stating plainly, because the two get conflated. PS24/17 is the FCA's Financial Crime Guide update published in November 2024, following feedback to CP24/9, and it applies to firms already within the FCA's perimeter. It is covered separately in our note on PS24/17 and phone-based risk signals. The cryptoasset regime described on this page is a separate framework created by the 2026 Regulations, with its own gateway and its own commencement date.
What Telebase returns today
Live signals
- Carrier serving the number
- Country of the number
- Number type: mobile, landline, fixedVoip, nonFixedVoip, tollFree or voicemail
- Active status, with the source of that status
One call returns all four. A UK number is the obvious worked example for this regime, and our UK phone number lookup page covers the carrier landscape in more detail.
GET https://api.telebase.io/lookup?phone=%2B447700900000 Authorization: Bearer tb_live_xxxxxxxxxxxxxxxxxxxxxxxx
{
"phoneNumber": "+447700900000",
"active": true,
"carrier": "EE",
"country": "GB",
"numberType": "mobile",
"simSwap": "UNKNOWN", // launching
"simSwapAt": null,
"_meta": { "activeSource": "LINE_STATUS" }
}
Where this page stops
Telebase is a signal provider, not an adviser. This page describes published dates and published FCA expectations, and it does not tell a firm what its permissions should be, whether a control is sufficient, or how a regulator will assess an application. Those are questions for a compliance team and, where appropriate, independent legal advice, which the FCA itself recommends firms consider as part of preparing an application.
Request early access