I keep coming back to one question when I read about UK crypto rules: does the activity need permission or not? The FCA's CP26/13 paper answers that for a long list of crypto businesses, and Coin Knowledge walked through its 97 pages in a May 15, 2026 video. The paper came out in April 2026 as a consultation, so the rules it describes were proposals open to comment. The perimeter question sits under every other argument about UK crypto rules: if an activity falls outside the line, the rest of the regime never reaches it.
What the perimeter guidance is for
The full title is Cryptoasset Perimeter Guidance, and the FCA published it in April 2026 as consultation paper CP26/13. It runs to 97 pages, and most of them answer one question for a firm: does this activity need authorisation or not?
The paper gives four aims: a clearer view for firms on whether they need authorisation, effective competition through firms understanding what they must do to operate in the UK, appropriate consumer protection, and markets that are fair, transparent, orderly and resilient.
Authorisation here means Part 4A permission under the Financial Services and Markets Act, the UK law that sets out which financial activities are regulated. The decision tree in the paper ends in one of two boxes: Part 4A authorisation needed, or Part 4A authorisation not needed. Every definition and exclusion in the document exists to push a business into one of those two.
I find it worth keeping that limited purpose in mind. Perimeter guidance tells a firm whether it is inside the regime. It does not tell the firm how to behave once it is in, and it does not license anyone to assume that an activity outside the perimeter is safe.
The activities that need permission
The paper confirms a set of new regulated crypto activities:
- issuing a qualifying stablecoin
- safeguarding cryptoassets, and arranging cryptoasset safeguarding
- operating a cryptoasset trading platform, shortened in the paper to CATP
- dealing in cryptoassets as a principal or as an agent
- arranging deals in qualifying cryptoassets
- arranging qualifying crypto staking
Dealing as a principal means trading from your own book; dealing as an agent means acting for a customer. The paper covers both. A CATP is what most readers would call an exchange, a platform where cryptoassets change hands.
The word arranging does most of the work in that list. If you put the facilities in place for a trade, you are covered whether you are the counterparty or the middleman, and the paper leans on that definition later to reach lending desks and DeFi front ends. I think it is the most consequential phrase in the whole document, because it catches businesses that never hold a customer's coins for a single second.
What UK crypto rules leave out
The paper excludes several groups of digital assets, and the reasons differ from group to group.
| Asset | Why it sits outside |
|---|---|
| Shares or bonds recorded on a blockchain | They are already specified investments under traditional finance rules |
| Electronic money | Digital fiat used by payment services such as PayPal |
| Sterling, other currencies and CBDCs | Currency of the UK or any other territory, so a digital pound would sit in a different framework |
| Tokens you cannot transfer or sell | They cannot be sold for money or other cryptoassets, except by redeeming with the issuer |
| Loyalty points, closed-loop game tokens, reward schemes | They only buy goods or services from the issuer or a limited network with direct agreements with it |
The currency exclusion is the one to watch if you care about a digital pound. The paper says a CBDC, a central bank digital currency, would be regulated under a different framework, most likely by the Bank of England, rather than being treated as an ordinary cryptoasset.
The last row covers a large slice of everyday token use. Blockchain-based loyalty points, closed-loop games that issue tokens and reward schemes all stay outside, and the reason is narrow: you cannot trade them on an open exchange for a profit. They buy goods or services from the issuer, or from a limited network of businesses that have direct agreements with that issuer.
The electronic money exclusion keeps PayPal-style digital fiat in the payment rules, and the specified investments exclusion keeps tokenised shares and bonds under the securities rules that already apply to them. Nothing here says those assets are unrestricted. It says a different regulator's rulebook, or a different part of this one, picks them up.
The test for a qualifying cryptoasset
The paper includes a diagram for sorting an asset in or out, and the tests run in order. The asset has to be a cryptoasset under section 417 of FSMA, fungible, transferable, more than a record of value or contractual rights, and outside the exclusions above.
Fungible means one unit is interchangeable with another, the way one pound coin is with any other pound coin. Transferable means you can send it to someone else. The record-of-value test separates a token that carries a claim from one that is only an entry in a database.
Only an asset that passes every test ends up inside the perimeter, and the diagram's final branches are the two boxes: authorisation needed, or not needed. I like that the FCA published this as a flowchart rather than a paragraph, because the sequence is the point. A token that fails on fungibility never reaches the exclusion list, and one that passes every earlier test can still drop out at the end because of how it is used.
For someone holding a token rather than advising on it, the practical version of the test comes down to whether anyone can sell it, who accepts it and what rights it carries. A token with no route to a buyer is a very different object from one listed on a trading platform.
Custody turns on who can move the coins
The custody section is where the paper breaks with the old shorthand. The common line in crypto is that whoever holds the private keys holds the coins, a private key being the string of characters that lets someone move assets out of a wallet. The FCA focused on practical control instead.
Under the paper, a firm is conducting a regulated activity if it safeguards and administers cryptoassets, or if it has the practical means to control them. The target is identifiable businesses that custody crypto on behalf of customers: centralised exchanges and institutional custody platforms, which is what most people would expect to see caught.
The technology is the interesting part. Some exchanges use MPC shard technology, where key material is split into shares held by different parties so that no single share is a working key, and the customer technically keeps a portion. That arrangement gave firms an argument that they were not custodians at all, because the customer held part of the key.
The paper closes that argument. If the firm can move, freeze or control the funds, it has the requisite degree of control regardless of how the keys are divided, and it is captured by the new safeguarding rule. The paper also says a business with the power to access your crypto must exercise it from a UK legal entity and follow strict rules to protect client capital.
I think that is the right place to draw the line, because practical control is what a customer can observe: who can stop a withdrawal, who can move a balance, who decides when funds come back. It does assume that practical control can be established after the fact, which in a dispute comes down to terms of service, access logs and who signs the transactions. A firm that genuinely cannot touch a customer's coins is in a different position from one that simply says so.
DeFi, arranging deals and lending
Arranging deals is a broad legal term. It covers any intermediary that provides the facilities for a trade to happen, and it lands hard on DeFi, where platforms often do not hold your funds but route your trade through smart contracts, which are programs that run on a blockchain and execute when conditions are met. Because the platform never holds the coins, plenty of people assumed DeFi sat outside any crypto regulation. The paper uses the act of arranging the deal to pull it back in.
The limit is identification. The FCA is looking for an identifiable person or business operating the service. If it can name the business running a DeFi platform and that business offers crypto services to UK consumers, the business has to comply with the new rules or risk being blocked. If a protocol is genuinely decentralised, with unidentifiable founders and no central corporate entity collecting fees, the FCA says it cannot regulate it.
That argument assumes the operator really is unidentifiable. A public front end, a treasury collecting fees or a team with names attached all change the answer, so I would not read the decentralised carve-out as a safe harbour for a project with a company behind it. Some platforms may choose to restrict UK users to avoid the compliance burden, which is a plausible response and one that leaves UK customers outside the service rather than protected by it.
Crypto lending and borrowing get a short, important clarification. They are not standalone regulated activities. Platforms offering them generally fall inside the dealing, arranging and safeguarding perimeters instead, because the FCA treats these transactions as financial deals rather than traditional loans. When you dispose of an asset in exchange for a yield, you are engaging in a deal, and the platform arranging it is regulated on that basis.
Staking: pooled services and your own node
The paper separates commercial staking services from the technical infrastructure that makes staking work. A centralised business that pools customer cryptoassets, runs the underlying validator nodes and takes a cut of the staking rewards is inside the perimeter, and it has to meet the Consumer Duty rules, the FCA's standard requiring firms to act to deliver good outcomes for retail customers.
The exemption runs the other way. If you operate your own validator node and manage your own technical infrastructure, you are outside the perimeter, because you are providing security to the blockchain network rather than offering a financial service to others. The creator calls this "a positive step".
Staking also appears in the list of regulated activities as arranging qualifying crypto staking. Put the two halves together and the split is fairly clear: a platform that arranges staking for customers is doing something the paper covers, while the person running a node for themselves is not. Being outside the perimeter does not change the tax treatment of staking rewards, which is a separate question handled by tax rules.
The timetable to October 2027
The paper sets out a schedule that runs from the consultation to the start of the regime.
| Date | What happens |
|---|---|
| April 2026 | The FCA publishes CP26/13, all 97 pages of it |
| June 3, 2026 | The consultation closes and feedback is invited on the proposed guidance in Appendix 1 |
| September 2026 to February 2027 | A five-month window for firms to apply for FCA authorisation |
| October 25, 2027 | The full regime is expected to come into legal force |
By that calendar, the comment period has closed and the application window is the item that matters now. Firms that want to keep serving UK customers have that five-month stretch to file, and the paper puts the regime itself a little over a year after the window shuts. A firm that waits until October 2027 to think about it has left it late.
The paper does not say what authorisation costs or what happens to a firm that misses the window, so check the FCA's own updates if either matters to your plans.
What I would check before relying on any of it
Start with the entity. The paper says a business with the power to access your crypto must exercise it from a UK legal entity, so check which company holds the assets and where it is registered, not just whether the brand is familiar. The FCA publishes a register of authorised firms, and matching a name against it takes a minute.
Then look at control in plain language. Whether the platform can freeze a withdrawal, whether it can move a balance without you, and who signs the transactions all matter. Under the paper, those answers decide whether a firm is a custodian, not the technical description of how many key shares you hold.
For staking, the question is who runs the validator and who takes a cut. A pooled service that manages nodes for you sits inside the regime and carries Consumer Duty obligations. A node you run yourself does not. Neither answer tells you whether the yield is worth the risk, which is a separate judgement.
For DeFi, look for an operator you could name. If there is a company behind the front end, a fee collector or a team with public identities, the decentralised exemption is unlikely to hold and UK access may be restricted or withdrawn. If there genuinely is nobody to identify, you are dealing with a service that sits outside the regime, and outside its protections too.
The date I would write down is October 25, 2027. Everything before it is a firm preparing for a regime that has not started. Everything after it is a market where the difference between an authorised business and an unauthorised one should be visible, and where the perimeter test in CP26/13 decides which side of the line a product sits on.
