UK's emerging cryptoasset regulations: trading, custody, issuance, and promotions in focus (Part 3)

In Part 3 of the UK’s crypto regulation landscape, Charles Kerrigan from CMS examines the fast-evolving framework for cryptoasset financial promotions, now fully active under the FCA’s rules. You can also read Part 1 and Part 2 of this series.

 

Financial promotions of cryptoassets

While the new licensing regime is being finalised, the UK has already taken action on crypto financial promotions. As of 8 October 2023, marketing any cryptoasset to UK consumers must comply with the UK’s financial promotions regime. This was a major change that brought ’qualifying cryptoassets’ within the scope of financial promotion laws, meaning crypto ads are regulated like other investment ads.

The New Promotion Rules: Under section 21 of FSMA, it’s a criminal offense to communicate an invitation or inducement to invest (a financial promotion) unless the content is approved by an authorised firm or an exemption applies. Previously, since crypto tokens were not ’controlled investments’ under the law, most crypto ads fell outside that regime. That changed with the Financial Services and Markets Act 2000 (Financial Promotion) (Amendment) Order 2023, which legally classified qualifying cryptoassets as controlled investments from 8 Oct 2023. The FCA simultaneously introduced specific conduct rules for crypto promotions (sometimes called the ’Cryptoasset Financial Promotions’ rules, CAFP) to ensure ads are clear, fair, and not misleading.

In practice, any firm (even overseas) promoting crypto to UK retail now has a few options: (1) become authorised itself and comply with promotions rules, (2) have its promotions approved by a UK-authorised firm, or (3) rely on an exemption (such as only targeting high-net-worth or sophisticated investors under those specific exemptions). Many big crypto exchanges that are not authorised had to act to get their ads approved by authorised firms or face having their marketing withdrawn.

Additionally, the FCA categorised crypto promotions as ’Restricted Mass Market Investments (RMMI)’, similar to peer-to-peer loans and certain crowdfunding investments. This imposes extra ’friction’ and risk warnings for retail communications. Key requirements include:

• Prominent risk warnings: all crypto ads must include standardised risk warnings (e.g., ’Don’t invest unless you’re prepared to lose all the money you invest’ in some communications), and a link to an FCA-mandated risk summary. The FCA has strict guidelines on wording and prominence, aiming to ensure consumers understand crypto is high risk and unregulated (in terms of no FSCS compensation, etc., until the new regime begins).
• Ban on incentives: firms cannot offer ’refer a friend’ bonuses or new joiner bonuses for crypto investing. These types of promotional incentives are deemed to potentially mislead consumers or encourage impulsive investment, so they’ve been banned under the crypto promo rules (similar to bans in CFD trading ads).
• 24-Hour cooling-off (delay): for first-time crypto investors, firms must enforce a cooling-off period of 24 hours for direct offer promotions. This means if an ad includes an immediate way to buy (a “Call to Action” like a buy button), first-time users who respond must wait at least 24 hours and reconfirm they want to proceed. The idea is to prevent spur-of-the-moment, emotionally driven crypto purchases. Consumers get a day to reconsider the info and risks.
• Appropriateness (knowledge) test: firms should assess whether a retail customer has the necessary knowledge/experience to understand the risks of crypto before allowing them to invest (unless they qualify as sophisticated/HNW). Often this is done via a questionnaire – sometimes called a ’positive friction’ test – where an investor must correctly answer questions about crypto risks. If they fail, the firm should issue a warning or bar them from proceeding.

These measures seek to slow down the consumer’s journey and inject risk awareness at each step. They remain in force as-is, and HM Treasury did not dial them back when bringing crypto under the promotion regime. The rules will be reviewed in the future (the government promised a post-implementation review of the crypto promotion regime), but for now, crypto is treated as a high-risk investment class for advertising purposes.

Temporary exemptions: The government introduced a temporary exemption (under Article 73ZA of the Financial Promotion Order (FPO)) which allows crypto businesses registered with the FCA under AML regulations (but which are not otherwise authorised) to communicate their own cryptoasset financial promotions to UK consumers until the broader regime is in place. This was a stopgap to avoid a scenario where UK consumers would see no information from unlicensed crypto firms. However, this exemption is temporary – the draft legislation will repeal it once the new licensing regime kicks in. The expectation is that by then, crypto firms intending to serve UK consumers will either become fully authorised or cease UK promotions. So, the current ability of some unlicensed exchanges to advertise under their AML registration is a short-lived transitional relief.

Enforcement: The FCA has been active in supervising crypto promotions since October 2023. Firms that failed to comply have been put on notice or added to warning lists. The FCA can take down websites or social media promotions that breach the rules and even pursue criminal charges for serious offenders. Compliance teams must ensure all marketing materials (websites, social posts, ads, app store descriptions) aimed at the UK are vetted for compliance with the new FINPROM rules. Given the global nature of crypto, many firms implemented geoblocking or tailored UK pages to meet this requirement after October 2023.

From a practical perspective, any crypto business engaging with UK consumers today already needs a compliant promotions strategy. This is one area where the regulation is not just a proposal – it is active. Firms should have updated their risk warnings, removed refer-a-friend schemes, instituted knowledge tests, and arranged for promotion approval if not authorised. The FCA even published guidance targeting “finfluencers” and social media promotions, clarifying that these rules apply to all who communicate crypto investments (individuals included).

Looking ahead, once the full cryptoasset regime is in force, authorised crypto firms will fall under regular FCA supervision for their marketing as well. The current RMMI approach may also evolve – if regulators see that the new conduct rules for authorised firms (e.g., Consumer Duty) sufficiently protect investors, they might relax some friction (subject to that promised review). But until then, crypto promotion in the UK remains heavily restricted to prevent over-hyped or misleading advertising.

Next steps and practical implications for market participants

The UK’s crypto regulatory overhaul is progressing rapidly. What should firms be doing now? Here are some practical considerations and steps:

• Engage with consultations: the FCA and HM Treasury have sought industry feedback on these proposals – through consultation papers and discussion papers (e.g., FCA DP25/1 on trading platforms/lending and borrowing/staking, CP25/14 on stablecoins and custody, etc.). Firms and trade associations should continue to engage, as there is still scope to shape the detailed rules. Topics like how to make DeFi work in a regulated context, or how to calibrate prudential rules for crypto’s volatility, will benefit from industry input. The FCA explicitly held policy sprints and roundtables with crypto stakeholders in 2024, and such engagement is ongoing.
• Prepare for authorisation: crypto businesses that intend to serve UK customers in the coming years should start preparing their FCA authorisation strategy. This means identifying which regulated activities you perform and will need permission for, as well as conducting a gap analysis of current practices against regulatory expectations. Obtaining approval under Part 4A FSMA can be a lengthy process – typically requiring detailed documentation on business models, governance, risk controls, IT security, financial resources, etc. The draft legislation includes transitional arrangements: firms already operating when the regime commences will get a window (around 6 months) to apply for authorisation (’T-day’ application window), during which they can continue operating. If they apply in time, firms can temporarily remain in business until the FCA decides on their application (and even have an extended wind-down period if ultimately rejected). But firms missing the window must cease new business immediately. Given this tight timeline, it’s prudent to start gathering the needed information and professional advice now to ensure a smooth application. Global firms might consider whether to apply via a UK subsidiary or to use an existing authorised entity (if they have one) to expand permissions.
• Operational and structural changes: many crypto firms may need to restructure or optimise their processes to meet the incoming standards. For instance, an exchange that also engages in proprietary trading might separate that activity or institute Chinese walls to manage conflicts. Custody arrangements might need updating to implement robust segregation and reconciliations. Smaller firms might need to hire more (and more experienced) risk and compliance personnel familiar with FCA expectations. It’s wise to look at analogous regulated firms (e.g., e-money institutions, securities brokers) and benchmark what governance and systems they have – boards with independent directors, internal audit and compliance functions, strong financial controls – and anticipate implementing similar frameworks. Investing in training staff on compliance duties and upgrading IT systems for surveillance and reporting will be investments well spent ahead of time.
• Client communications: firms should keep their clients informed that regulatory changes are coming. This can actually be a selling point – for example, telling customers that the exchange is working towards FCA authorisation and that this will bring them greater protections (like knowing their assets are segregated and the firm is financially sound). However, in the interim, also warn customers of any necessary changes (e.g., if certain services might be restricted for UK users, or if some tokens might be delisted if they cannot meet admission requirements in the future). Managing expectations will help maintain trust through the transition.
• Global coordination: many UK-based crypto businesses operate internationally, and vice versa. As the UK framework firms up, firms should consider how it interacts with regimes elsewhere (like the EU’s MiCA coming into effect through 2024–2026, and evolving U.S. regulations). Compliance teams may need to juggle multiple regulatory regimes. The good news is there’s convergence on broad principles – most major jurisdictions are moving toward registration/licencing, capital requirements, and conduct rules. Still, there will be differences in detail (e.g., the UK’s stance on staking being stricter than some, or the UK’s integration into FSMA vs the EU’s separate regulation). Firms might structure operations to compartmentalise UK business for compliance ease. The UK Treasury and US regulators are also in talks about cross-border collaboration, with US SEC Commissioner Hester Pierce proposing a ’cross-border sandbox’ to ’build on the promise’ of the ’digital securities sandbox’ (DSS), which was opened by the Bank of England and FCA in September 2024. Moreover, in  September 2025, the UK and US decided to establish the Transatlantic Taskforce for Markets of the Future ’to enhance collaboration on capital markets and digital assets, and other innovative financial activities’. Global firms should therefore keep an eye on these developments, which could facilitate cross-border innovation in a compliant way.
• Timeline and watchpoints: as of mid-2025, the draft legislation has been published, and the FCA’s rulemaking is in progress. We anticipate that during 2025, multiple Consultation Papers will roll out – including on topics like conduct of business (customer due diligence, complaints, etc.) for crypto firms, further prudential details (CRYPTOPRU), market abuse and disclosure rules, and the Senior Managers & Certification Regime (SMCR) applicability. By late 2025 or early 2026, the FCA plans to issue final Policy Statements on all these, and shortly thereafter, the regime will ’go live’ with an authorisation gateway open. Compliance teams should mark these milestones and ensure internal projects are timed accordingly (for example, aim to have custody processes revamp done by the time custody rules are finalised, etc.).

In short, the train has left the station for UK crypto regulation. Firms that proactively adapt will be well-placed to thrive in the new regulated era, offering consumers and institutional clients greater confidence. Those that cannot meet the standards may have to exit the UK market or refocus on jurisdictions with lighter rules (though the global trend is undeniably toward stricter oversight). The UK regulators have emphasised they want a ’competitive and sustainable’ crypto sector with long-term confidence.

Conclusion

The Chancellor said (at UK Fintech Week 2025), the goal is to make the UK ’the best place in the world to innovate — and the safest place for consumers’ in crypto. Those are supremely challenging things to do at the same time. Still, for crypto market participants, the compliance costs and oversight may open the doors to broader adoption and integration with traditional finance. Regulated status can bring deeper banking relationships, investor trust, and new opportunities (like exchange-traded crypto products, mainstream institutional participation, etc.) that have been elusive in a legal grey zone. Firms that embrace the changes and engage constructively with regulators can help shape a rulebook that works for both innovation and protection.

In the coming months, watch for final rules and the commencement of licencing. The message to fintechs and crypto businesses is clear – start preparing if you haven’t already. Legal and compliance teams should ensure they have a comprehensive roadmap to reach compliance by 2025–26—this includes everything from governance and capital planning to customer communications and IT upgrades.

 

About the author

The Blockchain Industry in the UK Landscape Overview names Charles Kerrigan as a leading influencer in the blockchain. He is part of teams working on investing and setting standards for emtech in EMEA, the US, and APAC.  At CMS, Charles is part of the firm’s specialist crypto and digital assets team.  He is on the board of the Investment Association Engine, a NED for various fintech and regtech firms, and teaches entrepreneurship in the Computer Science Department at UCL.  He widely published in mainstream and trade press and is the author of the textbook Crypto and Digital Assets Law and regulation.