CP26/13 closes on 3 June 2026. The authorisation gateway opens 30 September, with applications running to 28 February 2027, ahead of the regime switching on in October 2027. But the control that is already live and already enforced is the financial-promotions regime — and marketing is the line item that fails first.
There are two clocks running on UK crypto regulation, and most firms are watching the wrong one.
The loud clock is the new authorisation regime. On 3 June 2026 — this Wednesday — the FCA’s consultation CP26/13 on cryptoasset perimeter guidance closes. Final guidance is expected in September. The authorisations gateway opens on 30 September 2026, and the application window runs to 28 February 2027, ahead of the regime coming fully into force in October 2027. That is the timeline every law firm is briefing on, and it is real. But it is also eighteen months out, and authorisation is a corporate-legal exercise, not a marketing one.
The quiet clock is the one that already went off. The FCA’s cryptoasset financial-promotions regime has been live and enforced since October 2023. It is the law today — not in 2027 — and it bites the marketing function directly, on every banner, landing page, email, app-store listing, and influencer post that reaches a UK consumer. The firms that get hurt between now and the gateway will not be hurt by the perimeter guidance. They will be hurt by a non-compliant promotion that was live this week.
Under Section 21 of the Financial Services and Markets Act, communicating a financial promotion for a qualifying cryptoasset to UK consumers is prohibited unless it is made or approved by an authorised person and complies with the FCA’s rules in COBS 4.12A. In practice that means four hard controls, all of which are marketing-owned:
A prominent risk warning in the prescribed form — the specific wording, not a paraphrase, displayed prominently rather than buried. A 24-hour cooling-off period for first-time investors with a firm, which reshapes the entire onboarding funnel. A personalised risk warning pop-up naming the consumer. And the incentives ban — no refer-a-friend bonuses, no “new joiner” cashback, no “trade £100 get £10” mechanics aimed at UK retail. That last one quietly kills the growth playbook most exchanges still run by default.
None of this is ambiguous. The FCA published the rules, the prescribed wording, and the deadlines years ago. What is ambiguous — and what CP26/13 is now tightening — is the perimeter: which firms, interfaces, wallets, and DeFi front-ends count as in-scope. The direction of travel is wider, not narrower.
A consultation closing is not a non-event for marketers, even though it reads like a lawyer’s deadline. Two things happen the moment CP26/13 closes and final guidance lands in September:
First, the perimeter gets clearer, and clarity is enforceable. The grey zone that let some firms argue their interface wasn’t making a promotion shrinks. A claim that was defensible under ambiguity becomes a breach under guidance.
Second, the gateway makes promotions a credentialing question. From 30 September, the firms applying for authorisation will be assessed partly on whether they have been operating cleanly — and a documented history of compliant financial promotions is part of that story. A trail of borderline promotions becomes a live liability in an application file, not just a marketing risk. The marketing archive turns into evidence.
Five moves, in priority order, for any crypto firm touching UK consumers between now and 30 September:
1. Audit every live promotion against the prescribed wording. Not the spirit of the risk warning — the exact prescribed text, in the prescribed prominence. Most non-compliance here is unforced: a paraphrased warning, a warning below the fold, a warning missing from a paid social variant.
2. Map the incentives ban across the whole growth stack. Referral codes, affiliate payouts, KOL contracts with audience-bonus clauses, seasonal cashback, gamified “streak” rewards. Any of these aimed at UK retail is exposed. This is where the real revenue conversation happens, because it forces a growth-model change, not a copy edit.
3. Pin down who approves. If the firm is not itself FCA-authorised, every promotion must be approved by an authorised approver under the s21 gateway — and the supply of willing approvers has tightened sharply. Knowing your approval route is now an operational dependency, not a footnote.
4. Align the UK promotion with the MiCA promotion. Firms running both EU and UK funnels are about to maintain two divergent rule sets — MiCA Article 60 on one side, COBS 4.12A on the other — from the same creative pipeline. The cross-border firm that treats these as one undifferentiated “crypto disclaimer” gets both wrong.
5. Build the promotions archive as an audit trail now. Versioned, dated, with the approval record attached, before the gateway opens. The firm that can hand the FCA a clean, documented promotions history in its authorisation file is in a materially stronger position than the firm reconstructing one under deadline.
There is a structural gap between the lawyer’s answer (“here is what the rule says”) and the operator’s answer (“here is what your live promotion has to become, and what your growth model has to give up”). A white-shoe firm will sell a £100k memo on the perimeter. Almost none of them have ever shipped a compliant crypto promotion in production or rebuilt a referral funnel around the incentives ban.
NorthPoint sits in the operator’s seat — exchange-grade crypto marketing that is fluent in the FCA regime as a marketer, not a lawyer. The free FCA rule library quotes the live rule text, the common violations, and how to comply. Run a check, read the rules, and fix the live promotions before the perimeter tightens. The consultation closing Wednesday doesn’t change what’s already enforceable. It just removes the excuses.
— Jukka Blomberg, Helsinki, 1 June 2026
The live rule library: risk warning, cooling-off, personalised warning, incentives ban — quoted text, common violations, how to comply.
The line item that fails first is marketing. The EU-side version of the same deadline pressure.
Paste copy or fetch a URL. Verdict in seconds across MiCA, FCA, and GDPR. No signup.
The subscription with unlimited Pro audits across six jurisdictions, including the FCA regime. From €2,500/mo.