The rule.
Section 21 of the Financial Services and Markets Act 2000 restricts who may communicate a financial promotion. Since October 2023, qualifying cryptoassets are controlled investments — so crypto marketing aimed at UK consumers is a financial promotion and falls inside this perimeter.
“(1) A person (‘A’) must not, in the course of business, communicate an invitation or inducement to engage in investment activity.
(2) But subsection (1) does not apply if—
(a) A is an authorised person; or
(b) the content of the communication is approved for the purposes of this section by an authorised person.”
This is the rule that sits underneath every other FCA requirement. The prescribed risk warning, the cooling-off period, the incentives ban — all of them assume you have already cleared the perimeter. If you have not, the content rules are moot: communicating the promotion is itself unlawful under FSMA s25, carrying up to two years’ imprisonment and an unlimited fine.
What it requires.
A crypto financial promotion communicated in or to the UK must satisfy one of three gateways — or be kept out of the UK entirely.
Gateway one — authorised. The communicator is itself an FCA-authorised person with the relevant permission. Registration under the Money Laundering Regulations is not authorisation for financial promotions; few crypto-native firms qualify.
Gateway two — approved. The content is approved by an authorised firm that holds the Section 21 approval permission for cryptoassets specifically, and the visible approval marker appears on the asset: “This financial promotion has been approved by [name], FCA Reference [number].”
Gateway three — exempt. A Financial Promotion Order exemption applies (certified high-net-worth or self-certified sophisticated investors), the audience genuinely meets the criteria, and you can evidence the audience gate. Mass-market retail does not qualify.
The fourth option — geo-fence. If none of the gateways applies, the only compliant route is to keep UK consumers from reaching the asset: IP blocking, non-UK ad targeting, no UK-language localisation, KOL contract restrictions, and excluding GBP / UK-card payment methods.
Common violations.
A non-UK exchange runs a clean landing page — prescribed risk warning at the top — with Meta ads geo-targeted to London and Manchester.
The content is compliant; the firm holds no UK authorisation and no approval. Reach into the UK without a gateway is the breach, regardless of the warning. The most common offshore-funnel finding. Citation: FSMA s21(3); PERG 8.
A token project obtains Section 21 approval but ships the landing page with no approval marker anywhere on it.
An approval you cannot see on the asset is, for enforcement purposes, an approval that is not there. Citation: COBS 4.12A.18R.
A promotion carries a valid-looking approval marker — from a firm authorised for payment services, not cryptoassets.
Since the February 2024 reform, an approver can only approve asset classes within its permission. A non-crypto approval has limited validity for a crypto promotion. Citation: FCA Section 21 Approval Permission regime.
A presale page claims a “sophisticated investor” exemption with a single unchecked tick-box and no certification flow.
An exemption you cannot evidence at audience level is not an exemption. The burden of proving the gate sits with the communicator. Citation: FPO Articles 48–50A; COBS 4.12A.10R.
How to comply.
Before any copy work, decide which of the three gateways the asset relies on — or geo-fence. Treat “does this reach UK consumers?” as an upstream design decision, not a post-hoc check.
If relying on approval, confirm in writing that the authorised firm holds the Section 21 approval permission for cryptoassets specifically — not payments, not generic investments — and that what it approved matches what you publish.
Put the marker where it cannot be missed — footer or near-CTA, on every approved asset — with the firm name and FCA reference number.
Use a certification flow, not a tick-box, and keep the records. The FCA references documented compliance processes in mitigation; the audit trail is the defence.
A “UK users prohibited” line in the terms is not geo-fencing. Combine IP blocking, ad-targeting exclusions, no UK-language localisation, KOL contract restrictions, and payment-method exclusions.
Frequently asked questions.
Does Section 21 apply if my company is based outside the UK?
Yes. Section 21 turns on whether the promotion is communicated in or to the UK, not on where the firm is incorporated. A page produced offshore but reachable by UK consumers — via UK geo-targeted ads, UK-language localisation, UK-resident influencers, or a UK app-store listing — is inside the perimeter. The FCA's February 2026 High Court action against HTX, a Panama-based exchange targeting UK users, confirms reach beats entity location.
What are the lawful ways to communicate a crypto financial promotion in the UK?
There are three gateways under Section 21: the communicator is itself FCA-authorised; or the content is approved by an authorised person under the Section 21 approval regime and carries the visible approval marker; or a Financial Promotion Order exemption applies and the audience genuinely meets the criteria. If none applies, the only compliant route is to geo-fence the promotion out of the UK effectively.
What is the penalty for breaching Section 21?
Communicating an unlawful financial promotion is a criminal offence under Section 25 FSMA, carrying up to two years' imprisonment and an unlimited fine. The FCA can also order simultaneous cross-platform takedowns and pursue overseas firms through the High Court. A perimeter breach is unlawful regardless of how careful the wording is — clearing the perimeter is the prerequisite, not the polish.
Related rules.
-
What you must say once you are inside the perimeter.
-
The structural first-time-investor delay.
-
The gated signup journey.
-
Why UK growth funnels need their own playbook.
-
When a club shirt or stadium board becomes a financial promotion — and who is liable.
This page is an operator-grade heuristic, not legal advice. The Section 21 perimeter carries criminal liability under FSMA s25; for a binding view on authorisation, approval or exemption, retain qualified UK counsel.