Cryptoassets: the rules and your protection

Crypto is legal to buy, hold and sell in the UK, but it is largely unregulated. The Financial Conduct Authority (FCA) does not regulate most cryptoassets, and the Financial Services Compensation Scheme (FSCS) cannot protect you if a platform that exchanges or holds them goes out of business¹. The FCA's own position, restated as recently as September 2026, is that "Crypto is a high-risk investment and remains largely unregulated in the UK, except for anti-money laundering and financial promotion until October 2027"².

That gap matters because crypto is now a mainstream activity. A 2022 survey showed that around 10 per cent of UK adults, about five million people, hold or have held cryptoassets, with "cryptocurrencies" the most commonly held type at 79 per cent³. Owners tend to be younger than the general population: 76 per cent were under 45, compared with 45 per cent of the population as a whole, and most owners were male, at 69 per cent³.

This page explains what the rules do and do not cover: which firms must be registered with the FCA, what the advert rules require, why FSCS and the Financial Ombudsman Service generally cannot help, the tax position, and the one route that puts crypto inside a regulated wrapper, the cryptoasset exchange traded note held in an innovative finance ISA.

Most cryptoassets are not regulated in the UK

The starting point, and the fact that shapes everything else on this page, is that cryptoassets are largely unregulated¹. The FCA does not regulate most cryptoassets, so FSCS cannot protect you if a platform that exchanges or holds them goes out of business, and cryptoassets generally are not protected by organisations like the FCA or FSCS¹.

What regulation does exist is narrow. Crypto firms in the UK must register with the FCA for anti-money laundering purposes, and since October 2023 the FCA regulates how crypto can be promoted to consumers. Beyond that, buying, selling and holding most crypto is not a regulated financial service activity. The FCA states this plainly: crypto remains largely unregulated except for anti-money laundering and financial promotion, until October 2027².

The government's approach has been to bring cryptoassets inside the existing financial services framework step by step, rather than all at once. Its legislative approach is to bring cryptoassets within the framework established by the Financial Services and Markets Act 2000 by expanding the list of specified investments in the Regulated Activities Order³. The Treasury has also taken forward legislation via the Financial Services and Markets Bill to ensure the foundations are in place to regulate stablecoins and cryptoasset activities in the UK⁶.

Not everyone agrees with the direction. The Treasury Committee has strongly recommended that the Government regulate retail trading and investment activity in unbacked cryptoassets as gambling rather than as a financial service³. Its concern is that regulating this activity as a financial service will create a "halo" effect, leading consumers to believe the activity is safer than it is, or protected when it is not⁷. The Government firmly disagreed with the gambling recommendation in July 2023⁶.

For a consumer, the practical effect is this: the protections you may be used to from investing in shares or funds, such as FSCS cover if a firm fails and the right to take a complaint to the Financial Ombudsman Service, exist only where the activity itself is regulated. Dealing in investments is a regulated activity in the UK, so trading platforms require authorisation from, and are regulated by, the FCA⁸. A crypto exchange that only holds and swaps unregulated tokens is a different kind of business, and the protections are different too.

What counts as a cryptoasset

"Cryptoasset" is a broad term. In the 2022 survey that underpins the official picture of UK ownership, "cryptocurrencies" such as Bitcoin were the most commonly held type, at 79 per cent of holders, but the category also covers other kinds of token³. What unites them is that they use cryptography and distributed ledger technology, and that most of them sit outside the regulatory perimeter.

A few defined categories matter for consumers:

• Unbacked cryptocurrencies such as Bitcoin, the kind the Treasury Committee said should be regulated as gambling³. These have no asset or currency behind them, and their price is set entirely by the market.
• Stablecoins, designed to hold a steady value against a reference asset. The Bank of England has proposed rules for stablecoins, but explains that its rules "would only apply to those that are widely used for payment in the UK. Right now, there are none like this"⁹.
• UK cryptoasset exchange traded notes (ETNs), a regulated instrument whose return tracks an unregulated cryptoasset. Legislation defines a UK cryptoasset ETN as a debt security traded on a trading venue or a market operated by a UK recognised investment exchange, featuring no periodic coupon payments, whose return tracks the performance of an unregulated transferable cryptoasset, minus applicable fees⁵. The same definition appears in the Individual Savings Account Regulations 1998¹⁰.

The distinction between these categories is not academic. An unbacked cryptocurrency bought on an exchange is unregulated and unprotected. A UK cryptoasset ETN bought through a broker is a regulated security, listed on a recognised investment exchange, though as explained below even it is not FSCS protected. The wrapper you buy something in, and the venue it trades on, change what rules apply, even when the underlying exposure is the same crypto price movement.

The scale of the market also explains why government attention has grown. Illicit cryptoasset transactions linked to the UK in 2021 likely equated to at least £1.24 billion, around 1 per cent of total transaction value³. In April 2022 the Government announced its plan to make the UK a "global hub" for cryptoasset technology³.

The one part the FCA does regulate: crypto adverts and promotions

Since 8 October 2023, firms promoting cryptoassets in the UK must be authorised or registered by the FCA, and their promotions must be clear, fair and carry a risk warning. The Government signalled its intention to legislate for the regulation of cryptoasset promotions in January 2022, and laid the legislation in Parliament in March 2023³.

The rules bite on the promotion, not the product. A cryptoasset advert must include a prominent risk warning, and the prescribed risk summary states that:

The same risk summary applies to UK RIE cryptoasset exchange traded notes, with the FSCS stating it "doesn't protect this type of investment because it's not a type of investment that the FSCS can protect"¹¹. So even the regulated, exchange-listed form of crypto exposure carries an explicit warning that the safety net does not apply.

The FCA also polices the boundary between regulated and unregulated activity. There are currently no FCA registered peer-to-peer crypto businesses operating in the UK, and in September 2026 the FCA, with HMRC and the Metropolitan Police Service, targeted 3 premises suspected of illegal peer-to-peer crypto trading in London, following earlier action in April². Someone offering to trade crypto with you directly, outside a registered firm, is operating outside the regime the adverts rules were built for.

Before buying anything, you can check a firm's status on the FCA Register. A firm being registered for anti-money laundering is not the same as being authorised to provide regulated investment services, and the register shows which permissions a firm actually holds.

No FSCS or Financial Ombudsman protection if things go wrong

The FSCS is the UK's financial compensation scheme that protects customers of authorised financial services firms if they fail or have stopped trading¹². It follows rules set by UK regulators, the FCA and the Prudential Regulation Authority¹³. Its protection depends on two things: the firm being authorised, and the activity being one the scheme covers.

Crypto fails on both counts for most consumers. The FSCS states that cryptoassets are virtual currencies and not FCA regulated, which means they are not FSCS protected¹⁴. Its guidance is blunt: most cryptoassets, including virtual currencies like Bitcoin and Litecoin, are not FSCS protected because they are not regulated¹⁵. If your investment is stolen, there isn't an easy way to get your money back, and FSCS can't protect you¹.

The FSCS sets out a two-step check that shows where the line falls: first, check whether the firm is authorised, and second, find out whether the particular activity the authorised firm is carrying out for you is regulated by the Prudential Regulation Authority or the FCA¹³. A firm can be authorised for some activities and not others, and only the regulated activities can attract protection.

The Financial Ombudsman Service has the same boundary. It can consider complaints about regulated activities, and about how a bank handled a payment, but it cannot award compensation for losses on unregulated investments. The Ombudsman's own case material on cryptocurrency investment scams describes cryptocurrency as unregulated and a very high risk investment whose value can change dramatically¹⁶. That does not make the Ombudsman useless to a crypto investor, as the scams section below explains, but it cannot get back money lost on the crypto itself.

The dedicated pages on what happens to your crypto if the exchange fails and whether cryptoassets are protected by the FSCS cover the detail, and what happens if an investment platform fails explains how protection works for regulated investments by contrast.

Risks you take on: volatility, theft and lost access

The FCA's consumer guidance on cryptoassets lists the risks plainly. The market value of cryptoassets can be extremely volatile¹. You can't spend cryptoassets like cash, as few retailers accept cryptocurrency such as Bitcoin as payment¹. And there are scams involving cryptoasset investments that are hard to distinguish from genuine investment opportunities¹.

The volatility is not a marginal effect. The Treasury Committee reported that in 2017 the average volatility of the top ten crypto-assets by market capitalisation was more than 25 times that of the US equities market¹⁷. Unbacked cryptoassets pose significant risks to consumers, given their significant price volatility and associated risk of losses⁷. They can also consume very large amounts of energy, and are used by criminals in scams, fraud and money laundering⁷.

Theft is a specific and well-documented risk. Crypto exchanges are a tempting target for hackers, and security breaches have led to the theft of digital currency, with not all investors getting their money back¹. Because crypto transactions are generally irreversible and crypto is not held as a regulated client asset, there is no compensation route when an exchange is breached.

Lost access is a quieter risk that catches people out. If you store your cryptoassets on a password-protected personal hard drive or memory stick and you lose or forget the password, you may well have lost access to your investment altogether¹. There is no password reset service and no firm to call.

The Ombudsman's case material summarises the position in one line: cryptocurrency is unregulated and its value can change dramatically, so even when purchased legitimately, it's a very high risk investment¹⁶. The general pages on investment risk and diversification set out how risk is usually managed in a portfolio, and the FCA's rules on high-risk investments, covered in FCA rules on high-risk investments, show how the regulator treats products at this end of the risk spectrum.

Crypto scams and how to spot them

Crypto scams are not a fringe problem. Just over half of the investment scams the Financial Ombudsman Service saw in one quarter involved cryptocurrencies¹⁸. The FSCS lists the warning signs of a scam approach, and one of them is being contacted out of the blue by an unregulated firm, with cryptoasset providers named as an example¹⁵. Its red flags include being asked for money or payment details, a message from an unusual channel like WhatsApp, a phone number not on the firm's website, an email address that does not match the firm's domain, compensation offered in a foreign currency or by a firm in another country, and American spellings or spelling errors¹⁵.

The Treasury Committee heard evidence of the crypto-asset industry distributing misleading advertisements and being lax on their self-imposed "know your customer" rules¹⁷. The advert rules described above are the regulatory response, but they cannot stop a criminal pretending to be a legitimate firm.

If you have been scammed, the Ombudsman's guidance sets out the immediate steps:

1. Contact your bank or payment services provider immediately
2. Contact the police
3. Report the scam through the official fraud reporting service
4. Keep records of all contact and correspondence between you and the scammer¹⁹

One route remains open even though the crypto itself is unregulated. The Ombudsman can consider complaints about how a bank handled a scam payment, including unauthorised payments and identity theft¹⁹. So while it cannot recover the crypto, it can look at whether your bank should have questioned or stopped the payment. The wider warning signs are covered in investment scams and scams and fraud.

Tax on crypto: Capital Gains Tax and record keeping

Crypto is not tax-free just because it is unregulated. Disposing of cryptoassets, which includes selling them for pounds, swapping one token for another, or spending them, can create a Capital Gains Tax liability. HMRC's data shows how much money is now moving through this tax: in the 2024 to 2025 tax year there were 17,600 individuals making Capital Gains Tax-liable disposals of cryptoassets such as Bitcoin, Ethereum and Dogecoin, with total taxable capital gains of £1.38 billion⁴. Those taxpayers reported total cryptoasset disposal proceeds of £13.8 billion, with an average gain of £78,000 reported per individual⁴.

The gains are concentrated. 240 people reported more than £1 million in capital gains from cryptoassets in the 2024 to 2025 tax year, accounting for £717 million of cryptoasset gains between them⁴.

How you report and pay depends on whether you sold UK residential property in the same period²¹. For crypto alone, disposals are reported through the normal Capital Gains Tax routes, and keeping records of every purchase, sale and swap is essential, because each disposal needs its own gain or loss worked out.

Two changes are tightening the record-keeping burden. From January 2026, the UK began implementing the Cryptoasset Reporting Framework (CARF)⁴. Under it, UK reporting cryptoasset service providers will report information on UK tax resident customers to HMRC, with first reports due by 31 May 2027 for information collected from 1 January 2026 to 31 December 2026²². In practice, HMRC will increasingly know about crypto activity before you tell it, which makes accurate self-reporting and good records more important, not less.

On losses: capital losses from crypto can be set against capital gains, not against income. The narrowness of loss relief elsewhere in the tax system shows the pattern, for example losses from a UK furnished holiday lettings business are only available to set against profits from that same business⁴. Crypto losses follow the capital rules, and must be reported to HMRC to be usable. The general rules are covered in how investments are taxed and personal tax in the UK.

Crypto in an ISA: ETNs and the innovative finance ISA

There is one route that puts crypto exposure inside an ISA, and the rules around it changed in April 2026. From 6 April 2026, UK cryptoasset exchange traded notes may be held under an innovative finance account but not a stocks and shares account, with existing holdings receiving transitional treatment⁵. The legislation lists "investments in a UK cryptoasset exchange traded note" as a permitted investment of the innovative finance account type⁵.

A UK cryptoasset ETN is a debt security traded on a trading venue or a market operated by a UK recognised investment exchange, with no periodic coupon payments, whose return tracks the performance of an unregulated transferable cryptoasset minus applicable fees¹⁰. Unlike buying tokens on an exchange, an ETN is a regulated security bought through a broker, and it can sit inside a tax wrapper.

The innovative finance ISA is the wrapper it now sits in. Innovative finance ISAs, sometimes called crowdfunding ISAs, let you use your ISA allowance for peer-to-peer lending²³. The ISA regulations also provide that a cash, stocks and shares or innovative finance ISA may operate flexibly, allowing the investor to withdraw and replace funds in-year²⁴.

Two cautions apply. First, ISA membership does not import FSCS protection for the ETN itself: the risk summary for UK RIE cryptoasset exchange traded notes states that FSCS doesn't protect this type of investment¹¹. Second, the limits for Innovative Finance ISAs, LISAs and Stocks and Shares ISAs will remain the same from April 2027²⁵, so the change is about what you can hold, not how much. The detail on the instrument itself is in crypto exchange-traded notes, and the wrapper is explained in ISAs.

Industry codes of conduct are voluntary

Because most crypto activity sits outside the regulatory perimeter, parts of the industry have tried to fill the gap with self-regulation. Crypto UK was established in February 2018 as the first self-regulatory industry body for the crypto-asset industry, with founding members including Coinbase, Coinshares, eToro and CEX.IO¹⁷. Its code of conduct requires that any member exchange keeps 90-plus per cent of customer currency in cold storage¹⁷.

The limit of a voluntary code is exactly that it is voluntary. The Treasury Committee noted that "as these standards are wholly voluntary, there are inevitably firms ignoring them"¹⁷. A consumer dealing with a member firm gets whatever protection the code provides, and a consumer dealing with a non-member gets none of it, and there is no regulator standing behind either.

The Financial Ombudsman Service uses a definition that captures what these codes are: voluntary codes and statements of practice issued by professional industry bodies²⁶. Such codes can set useful standards, but they are not law, and a breach of a voluntary code is not itself something a regulator or the Ombudsman can act on where the underlying activity is unregulated.

The industry has argued for a dedicated regime rather than the existing one. Crypto UK noted that a separate framework "can be tailored to meet the exact requirements of industry and [...] perhaps provides the most flexibility"²⁷. The two routes identified for regulating crypto-assets in the UK were incorporating crypto-asset activity into the existing regulation, or designing a new framework specifically for crypto-assets, and regulating under the existing framework requires the activities to be specified as regulated activities in the Regulated Activities Order²⁷. That is broadly the route the government has since taken.

For a consumer, the practical rule is simple: check what a firm is actually registered or authorised for on the FCA Register, and treat any code of conduct as a description of the firm's intentions rather than a guarantee you can enforce.