The UK Brings Crypto and Buy Now Pay Later Under Regulation: What Businesses Need to Know
The United Kingdom has just completed two major expansions of its financial regulation. Cryptoasset services - until now largely outside the regulator's reach - will require full authorisation by the Financial Conduct Authority (FCA) from October 2027. And Buy Now Pay Later lending becomes a regulated consumer credit activity from 15 July 2026. Both reforms follow the same logic: products that grew to enormous scale outside the rules are being brought inside them, with real consequences for providers, investors and merchants.
A Complete Regulatory Regime for Crypto
The foundation is the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, which for the first time make the core crypto activities - operating a trading platform, dealing, custody, staking and issuing stablecoins - regulated activities under the Financial Services and Markets Act 2000. Until now, the FCA's role was essentially limited to anti-money laundering checks. From 25 October 2027, any firm providing these services in the UK, or to UK customers, will need a full FCA licence. Operating without one will be a criminal offence. In June 2026, the FCA published the final rules that give the regime its substance. Three elements stand out.
A market abuse regime for crypto. For the first time, insider dealing, market manipulation and the unlawful disclosure of inside information are prohibited in crypto markets - mirroring the protections that have long existed for securities, but adapted to assets that may have no traditional issuer. The rules reach conduct anywhere in the world if it affects assets traded on a UK platform. The intended effect is straightforward: to make crypto markets clean and trustworthy enough for mainstream participation.
Strict rules for stablecoins. Issuers of stablecoins must fully back their coins with assets held on trust for holders, honour redemptions promptly, and maintain minimum capital. The aim is to ensure that a “stable” coin genuinely is one - protecting holders if an issuer fails.
Bank-style standards for crypto firms. Crypto businesses will face capital and liquidity requirements, senior management accountability, consumer protection duties and client asset safeguards - the same categories of obligation that apply to traditional financial institutions. Customers will also gain access to the Financial Ombudsman Service when things go wrong.
The intended overall effect is to position the UK as a jurisdiction where crypto business is welcome, but only on regulated terms. Firms already in the market must apply for authorisation - existing anti-money laundering registrations will not carry over.
Buy Now Pay Later Becomes Regulated Credit
Buy Now Pay Later - interest-free credit repaid in a small number of instalments - has grown into a £13 billion market in the UK used by one in five adults, yet it operated entirely outside consumer credit regulation thanks to a legislative exemption. That exemption has now been removed for third-party lenders: from 15 July 2026, providing this credit is a regulated activity under the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001, and lenders must be authorised by the FCA. Merchants that simply offer BNPL at their checkout remain outside the regime.
The FCA's final rules impose three core obligations on lenders. They must give customers clear, upfront information about what they are signing up to - payment dates, amounts, and the consequences of missing a payment. They must check affordability before lending, so that credit is not extended to people who cannot repay it. And they must support borrowers who fall into financial difficulty, including directing them to free debt advice.
Borrowers gain meaningful new protections in return: the right to complain to the Financial Ombudsman Service, and the purchase protection of section 75 of the Consumer Credit Act 1974 - meaning the lender shares responsibility if goods bought on BNPL turn out to be faulty or never arrive.
The intended effect is to preserve BNPL as a useful, flexible payment tool while eliminating its main harm: invisible debt accumulating across multiple providers with no affordability checks and no route to redress.
Why It Matters
For crypto firms - including those based outside the UK but serving UK customers - the message is to start preparing now: assess whether your activities fall within the new perimeter and plan for authorisation well before October 2027. For BNPL providers, regulation is already a present reality, and unauthorised lending is now a criminal offence.
The UK reforms also land just as the EU's MiCA regime became fully mandatory in July 2026. Businesses active in both markets now face two mature but deliberately different rulebooks - and choosing where and how to be licensed has become a genuine strategic decision.