For fintech firms operating in the UK, the regulatory landscape is moving quickly

The FCA’s new cryptoasset regime is now entering a critical phase, while firms operating in the Buy Now Pay Later (BNPL) market are moving from preparation into implementation.

At the same time, fintechs serving customers across Europe face further change, with the revised Consumer Credit Directive (CCD2) due to apply from 20 November 2026.

For businesses managing several regulatory workstreams at once, the challenge is not simply understanding what the rules say. It is having the right expertise, resources and capacity to turn those requirements into practical action.

Here’s what to look out for.

1. Cryptoasset authorisation: action is needed now

The FCA’s application window for the UK’s new cryptoasset regulatory regime opened on 30 September 2026 and closes on 28 February 2027. The new regime is expected to come into force on 25 October 2027.

For firms already operating in the market, this is not a deadline to put in the diary for later. The FCA has made clear that firms should be preparing now and applying as early as possible within the application period.

Importantly, existing registrations or permissions do not automatically convert into authorisation under the new regime. Firms currently registered under the Money Laundering Regulations, for example, will need to consider whether they require authorisation for activities that fall within the new regulatory perimeter.

That means firms should already be asking some fundamental questions:

• Which of our activities will fall within the new regime?
• What permissions will we need?
• Are our governance arrangements sufficiently robust?
• Where are the gaps in our policies, procedures and controls?
• Do we have the internal resource to prepare a high-quality application?

For businesses that have not yet started this exercise, the window for preparation is narrowing.

2. Don’t leave compliance gaps until the deadline

The new cryptoasset regime represents a significant expansion of regulatory requirements. The FCA’s guidance covers activities including safeguarding cryptoassets, operating cryptoasset trading platforms, dealing and arranging deals, and arranging cryptoasset staking, alongside the issuance of qualifying stablecoins and other regulated activities.

For firms within scope, compliance cannot simply be treated as an application-form exercise.

The application process requires firms to demonstrate that they have appropriate governance, systems and controls in place. Once authorised, firms will also be expected to maintain those standards and comply with ongoing regulatory and reporting requirements.

This is where a gap analysis can make a real difference.

Rather than waiting until an application deadline is approaching, firms can map their existing framework against the requirements, identify areas requiring improvement and create a prioritised programme of work.

That could involve reviewing safeguarding arrangements, strengthening governance, updating policies and procedures, assessing operational controls or translating regulatory expectations into clear responsibilities for internal teams.

3. BNPL: the deadline has passed, now comes implementation

For BNPL providers, the regulatory milestone has already arrived.

The FCA began regulating Deferred Payment Credit, commonly known as BNPL, on 15 July 2026. From that date, firms providing in-scope DPC agreements have needed the relevant authorisation or temporary permission to enter into new agreements.

The focus has therefore shifted.

For firms already operating under the new regime, the priority is embedding the requirements into day-to-day operations. That includes customer communications, disclosures, affordability and responsible lending processes, support for customers experiencing financial difficulty, complaints arrangements and appropriate systems and controls.

In other words, regulatory implementation is now an operational issue as much as a legal or compliance one.

4. EU requirements are adding to the pressure

UK regulatory change is not happening in isolation.

For fintechs serving customers in EU markets, Directive (EU) 2023/2225 — the revised Consumer Credit Directive, commonly referred to as CCD2 — is due to apply from 20 November 2026. The Directive replaces the previous Consumer Credit Directive and introduces updated rules around consumer credit.

For businesses operating across multiple jurisdictions, this creates another regulatory workstream to manage alongside UK requirements.

The practical challenge is often less about any single deadline and more about the cumulative effect of several changes landing at once. Compliance teams may be working simultaneously on authorisation applications, policy updates, customer communications, governance reviews, systems changes and regulatory implementation.

Without sufficient resource, even well-designed compliance programmes can become bottlenecks.

CASE STUDY: Stargling Bank

When growth outpaces compliance.

The risks of leaving regulatory controls behind are illustrated by the FCA’s action against Starling Bank.

In October 2024, the FCA fined Starling almost £29 million after identifying serious weaknesses in its financial-crime systems and controls. The bank had grown rapidly, from approximately 43,000 customers in 2017 to 3.6 million in 2023, but the FCA found that its controls had not kept pace.

Among the issues identified, Starling repeatedly breached an FCA requirement preventing it from opening accounts for high-risk customers. More than 54,000 accounts for 49,000 high-risk customers were opened between September 2021 and November 2023.

The case demonstrates an important lesson for fast-growing fintechs: regulatory compliance needs to scale alongside the business. When systems, controls or specialist resource fail to keep pace with growth, the consequences can extend well beyond the compliance function.

For fintechs facing multiple regulatory changes simultaneously, having sufficient expertise and capacity to implement requirements effectively is therefore critical.

CASE STUDY: Euro Exchange Securities

In June 2026, the FCA required Euro Exchange Securities UK Ltd to stop carrying out regulated electronic-money and payment services and obtained court-appointed interim managers. The FCA cited serious concerns including systemic weaknesses in financial-crime controls and safeguarding arrangements, as well as concerns relating to ownership and governance.

In September 2026, the FCA announced that it had opened an investigation into potential offences involving the firm. The regulator said its concerns included potentially inadequate money-laundering risk assessments, customer due diligence, ongoing monitoring, governance, resourcing and allocation of responsibilities, record keeping and escalation mechanisms. Importantly, the FCA explicitly stated that it had not reached conclusions about whether the firm had breached the relevant requirements.

How Obelisk can help

As a leading alternative legal service provider since 2010, Obelisk provides flexible access to regulatory and legal expertise when fintech businesses need additional capacity.

That support might be required for a defined project, such as a cryptoasset authorisation programme or regulatory gap analysis. It could involve specialist input into policies and controls, assistance with implementation or additional resource for an internal compliance team.

The FCA’s cryptoasset application window is now open, running until 28 February 2027, while the new regime itself is expected to take effect on 25 October 2027. BNPL regulation is already in force, and CCD2 is approaching its November 2026 application date.

The question is not simply whether firms need to prepare. It is whether they have the capacity to prepare effectively, thoroughly and on time.

We’re here to help.

Need legal help?