How should crypto firms sequence FCA authorization and AML controls ahead of the 2027 regime change?

How to sequence FCA authorization work around the 2027 rule change

The sequence should start with scope, not with drafting policies. Firms need to determine which products, services, and revenue lines will sit inside the new perimeter, then translate that into the permissions, senior management accountability, and evidential package the FCA will expect. That framing avoids building an AML programme that is technically sound but misaligned to the authorisation application.

For firms that already operate across regulated and unregulated activity, the key issue is boundary setting. A useful starting point is to map customer flows, custody points, and transaction types against the activities that will require authorisation, then test whether the proposed operating model can support the control evidence behind the application.

The most common sequencing mistake is treating authorisation as a legal filing exercise and AML as a separate compliance track. In practice, the authorisation file is stronger when AML ownership, governance, monitoring, escalation, and recordkeeping are being built at the same time, because those controls are part of the operating model rather than after-the-fact remediation.

What evidence should be ready before the application window opens?

By the time the application window opens, firms should be able to show not just intent, but operational readiness. That means a clear control map for customer due diligence, ongoing monitoring, suspicious activity escalation, sanctions screening where relevant, source-of-funds logic, and the governance that proves those controls are owned and tested.

Capital and governance evidence matter because the FCA will look for a business that can survive scrutiny after authorisation, not just pass a document review. If the firm cannot explain who approves risk appetite, who challenges alerts, and how issues are escalated, the AML story will look incomplete even if individual controls exist.

For practical planning, it helps to treat documentation as the output of control design rather than the starting point. Policies, procedures, MI packs, and board reporting should all point back to the same operating assumptions, so that the authorisation case and the AML programme tell one coherent story.

Why timing matters if firms want to benefit from the saving provision

Timing is part of the strategy because the saving provision rewards firms that file before the February 2027 deadline. That means the decisive work is front-loaded: perimeter analysis, permission mapping, control implementation, and evidence collection need to be far enough along that the application can be submitted while the firm can still rely on the transitional benefit.

Waiting too long creates a double problem. First, the firm may lose the practical advantage of filing early. Second, it compresses remediation into the same period when the business is trying to prove itself to the regulator, which is exactly when weak governance, thin monitoring, or inconsistent recordkeeping becomes most visible.

FATF Recommendations remain the clearest baseline for the AML side of the programme, while the FCA is the source of truth for perimeter and authorisation expectations. The practical lesson is to align internal milestones to the regulator's timetable, not to an internal launch date that leaves little room for review or rework.

Risk and Threat Considerations

Firms that sequence these workstreams badly can end up with a compliant-looking application supported by immature controls. That creates exposure not only to refusal or delay, but also to later supervisory scrutiny if the business is authorised on the basis of controls that were not yet operating effectively.

Failure mechanism: The firm separates legal authorisation work from AML build-out, so perimeter mapping, governance design, transaction monitoring, and escalation procedures are not mature enough to support the application or survive testing.

Impact: The result can be a weak authorisation case, avoidable remediation, delayed launch, or a control environment that is vulnerable to financial crime, poor oversight, and repeated supervisory challenge.

Practitioner Guidance

What to prioritise: Build a single programme plan that ties the regulatory perimeter, permission set, aml controls, and evidence pack to the same delivery milestones. If those tracks are owned separately, the application will usually drift out of sync with the controls that are meant to support it.

Decision rule: If a control cannot be evidenced in operation, do not treat it as “ready” for the authorisation pack. A policy without testing, ownership, or MI is a drafting artifact, not an operating control.

What good looks like: The firm can explain its business model, show how AML controls operate in practice, and demonstrate who is accountable for each decision point from onboarding to escalation. The authorisation narrative and the AML narrative should reinforce each other, not compete.

Practitioner takeaway: The strongest applications are built by sequencing scope, permissions, and AML maturity together, with enough lead time that the regulator sees a working control environment rather than a promised one.

Related resources from NHI Mgmt Group

• What breaks when crypto firms do not implement effective AML, customer due diligence, and transaction monitoring controls?
• Why do UK crypto firms need to treat AML and Travel Rule compliance as core operating controls?
• Why do crypto firms in Indonesia need strong AML, CDD, and Travel Rule controls?
• What happens when crypto firms rely on self-regulation without strong KYC and AML controls?