UK Tokenization Regulation: FCA Crypto Registration, FSMA 2023, and the Digital Securities Sandbox

Overview

The United Kingdom’s approach to digital asset regulation has been deliberate and sequential, building a comprehensive framework through layered statutory powers rather than a single omnibus act. The Financial Services and Markets Act 2023 (FSMA 2023) granted HM Treasury wide-ranging powers to designate digital assets as specified investments and to create new regulated activities for cryptoassets — establishing the legislative foundation for a framework expected to reach full scope by 2025–2026.

For compliance officers, the UK’s current regulatory state is transitional: some requirements are already in force (FCA registration, financial promotions, Travel Rule), while the full regulatory regime for cryptoassets and stablecoins is being implemented in phases. The Digital Securities Sandbox (DSS) provides the most progressive avenue for tokenized securities market infrastructure — allowing firms to test DLT-based settlement without full compliance with existing rules that assume paper-based securities infrastructure.

Brexit context is essential: UK firms that previously passported into the EU under MiFID II must now hold local authorization in EU member states for EU client business. Conversely, MiCA-authorized EU firms cannot passport into the UK — UK rules apply independently.

Primary Regulator: FCA

The Financial Conduct Authority (FCA) is the UK’s primary conduct regulator for financial services firms and markets. It regulates approximately 50,000 firms and sets conduct standards for all financial services, including — increasingly — digital asset businesses.

The Prudential Regulation Authority (PRA) at the Bank of England regulates systemically important firms (banks, large insurers, major investment firms), and has issued specific guidance on crypto-asset exposure for UK banks and insurers. The Bank of England’s Financial Policy Committee retains macro-prudential oversight including of systemic risks from tokenization and stablecoins.

FCA Crypto AML Registration (January 2020)

The UK added cryptoasset exchange providers and custodian wallet providers to the scope of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) from January 2020. This was the UK’s first direct regulation of cryptoasset businesses, focused exclusively on AML/CFT obligations.

Registration process: Cryptoasset businesses caught by the definition must register with the FCA under the MLRs. The FCA assesses applicants against AML/CFT systems and controls, fit-and-proper standards for beneficial owners, officers, and managers, and business model sustainability. The registration is not a full authorization — it does not permit promotion of speculative cryptoassets to retail clients (that requires separate permission under the financial promotions regime from October 2023).

FCA’s enforcement record: The FCA has been notably rigorous in its MLR registration process. Of approximately 300 applications received in the 2020–2022 period, over 85% were either refused or withdrawn — a rejection rate that significantly exceeded industry expectations and drove several crypto businesses out of the UK market.

As of 2024, approximately 42 firms hold full FCA MLR registration. Many more operate under temporary registration status while their applications are assessed.

Financial Promotions Regime (October 2023)

From October 8, 2023, the promotion of cryptoassets to UK consumers became a regulated activity under FSMA 2000 and the Financial Promotion Order. Cryptoasset businesses (whether FCA-registered or not) may only promote cryptoassets if they:

1. Are FCA-authorized for the relevant activities, or
2. Are FCA-registered under the MLRs and have their promotions approved by an FCA-authorized firm, or
3. Benefit from a specific exemption

The financial promotions rules require: fair, clear, and not misleading promotions; prominent risk warnings (“Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you are unlikely to be protected if something goes wrong”); a 24-hour cooling-off period for first-time retail investors; and a personalised risk warning for direct offer promotions.

This regime applies to all promotions targeting UK consumers, including overseas promotions viewed in the UK — giving it extraterritorial reach comparable to the EU’s MiCA marketing provisions.

FSMA 2023: Regulatory Architecture

The Financial Services and Markets Act 2023 amended FSMA 2000 to include cryptoassets as a category of “specified investment” that HM Treasury can bring within the regulated activities framework by statutory instrument. Key provisions already exercised or in development:

Phase 1 — Stablecoins: HM Treasury has designated fiat-backed stablecoins (those pegged to GBP, USD, or other currencies) as a new “digital settlement asset” category. The Bank of England regulates systemic stablecoin systems; the FCA regulates non-systemic stablecoin issuers and custodians. Phase 1 rules are in force from 2024.

Phase 2 — Full Cryptoasset Regime: HM Treasury is implementing a comprehensive regulatory framework for cryptoasset service providers (exchanges, custodians, brokers, lending platforms) through secondary legislation under FSMA 2023 powers. This regime — expected in 2025 — will replace the MLR registration model with a full FCA authorization requirement, with conduct of business rules, capital requirements, and prudential standards.

Digital Securities Sandbox (DSS)

The Digital Securities Sandbox, launched under the Financial Services and Markets Act 2023 and jointly operated by the FCA and Bank of England, is the UK’s most significant innovation for tokenized securities market infrastructure. The DSS allows firms to issue, trade, and settle tokenized securities without full compliance with rules that presuppose traditional paper-based or CREST-based settlement infrastructure.

First cohort (2024): Eight firms were selected for the first DSS cohort, including major market infrastructure operators and new entrants. Participants can apply for modifications or disapplications of existing legislative provisions (including parts of the Companies Act, Financial Services and Markets Act, and related secondary legislation) to the extent those provisions are incompatible with DLT-based operations.

DSS structure: Firms operate under a bespoke “financial market infrastructure sandbox” arrangement with specific parameters agreed with regulators. Participants must meet minimum standards for governance, operational resilience, participant access, and settlement finality — adapted to DLT-native models.

The DSS represents a model for legislative adaptation: rather than requiring new primary legislation for every DLT-incompatible rule, the DSS grants regulators the power to modify or disapply existing rules for sandbox participants, with sunset provisions and a mechanism for successful models to be mainstreamed into permanent legislation.

Travel Rule

The UK implemented the FATF Travel Rule through an amendment to the MLRs, effective from September 1, 2023. Cryptoasset businesses must transmit originator and beneficiary information for transfers above £1,000 (approximately USD 1,260). Unlike the EU’s zero-threshold under TFR, the UK’s £1,000 threshold provides a practical de minimis for low-value transfers.

The FCA has issued guidance on Travel Rule compliance and has begun engaging MLR-registered firms on their implementation status through supervisory monitoring visits.

AML/KYC Requirements

MLR-registered cryptoasset businesses must implement:

• CDD: Verification of customer identity and beneficial ownership at onboarding; simplified CDD for lower-risk circumstances; EDD for high-risk customers, PEPs, and high-risk jurisdictions
• Ongoing monitoring: Risk-based transaction monitoring; review of CDD on trigger events
• Suspicious Activity Reports (SARs): Filed with the National Crime Agency (NCA) via the UK Financial Intelligence Unit (UKFIU)
• Sanctions screening: Real-time screening against OFSI (Office of Financial Sanctions Implementation) consolidated list and UN sanctions list

Compliance Checklist: UK Tokenization Operations

• Register with the FCA under the Money Laundering Regulations if operating a cryptoasset exchange or custodian wallet service
• If promoting cryptoassets to UK retail consumers: either obtain FCA authorization, ensure promotions are approved by an FCA-authorized firm, or confirm exemption applies; implement required risk warnings and cooling-off period
• Implement AML/CFT program compliant with MLRs: CDD, EDD, transaction monitoring, SAR filing with NCA
• Implement Travel Rule above £1,000 threshold
• Assess eligibility for Digital Securities Sandbox (DSS) if operating tokenized securities market infrastructure
• For stablecoin issuance: engage FCA and Bank of England on Phase 1 regulatory requirements
• Monitor Phase 2 full cryptoasset regime development and prepare for FCA authorization application
• For EU client business post-Brexit: obtain separate EU authorization (MiCA CASP or MiFID investment firm) — UK registration does not passport into EU
• Establish PRA engagement if firm is systemically significant or bank-owned
• Ensure financial promotions approved by FCA-authorized approver if not directly authorized

Authority References

• FCA — Cryptoassets regulatory guidance
• BIS — Digital finance and crypto regulation

For UK vs. EU regulatory comparison for tokenized fund distribution, see the Licensing Matrix. For DSS participant analysis, see Platform Benchmarks. For FSMA 2023 terminology, see the Regulatory Encyclopedia. For the EU’s parallel MiCA framework, see our MiCA analysis.