Opinion by: Katherine Kirkpatrick Bos, general counsel at StarkWare

As Washington takes a softer stance on crypto, regulators are counting down to even stricter regulations in the UK. The United Kingdom’s Financial Conduct Authority (FCA) is working on plans for a new “gateway” authorization regime by 2026, targeting a broader spectrum of crypto activities. 

It is easy to disregard this if you aren’t in the UK, but as frameworks are formed, regulators may look to other jurisdictions for lessons and inspiration. Crypto is global, and one of the challenges and opportunities is the need to pay careful attention to many jurisdictions at once.

Bigger net than Anti-Money Laundering

For some time, the FCA’s crypto focus was primarily on Anti-Money Laundering (AML) checks. Even that was no walk in the park — only around 14% of firms seeking mandatory registration have made the cut since 2020.

The AML register was essentially a narrow lens; it was not a licensing or supervisory regime. Now, the FCA wants to go further. According to Matthew Long, the director of payments and digital assets at the FCA, by 2026, the regulator plans to regulate a broader range of crypto activities — possibly including stablecoin issuance, payment services, lending, exchanges, and more.

Does that sound like a significant leap beyond AML? It is. Although AML or broader anti-fraud measures, as appropriate, are important things to consider for any centralized crypto company, a more sophisticated regulatory regime may offer opportunities or pitfalls depending on the sophistication of the company. And here’s the real kicker: The shape of these rules remains in flux, meaning that what’s “in scope” can still shift. 

What does this mean for builders? Anyone building layer 2 (L2) or other structures that could theoretically touch financial flows — like bridging or crosschain swaps — could find themselves in the crosshairs.

Borderless implications

“That’s the UK; I’m in the US (or Singapore, or Cayman, somewhere else).” Just as the FCA looks at international models to inform its path forward, these frameworks have a knack for going global. Consider how quickly ideas around data protection spread after the European Union’s General Data Protection Regulation (GDPR) proliferated. Crypto is similarly borderless.

Recent: UK trade bodies ask government to make crypto a ‘strategic priority’

If the UK crafts a robust enough regime, other jurisdictions could borrow from it. If a business serve users outside its home turf, its user base is global, so ignoring the UK’s rules won’t be justifiable. 

Take stablecoins: If the FCA mandates strict reserve disclosures or near-real-time audits, stablecoin issuers may need to apply those standards across the board. Uniformity is easier than fragmentation, and that’s how local UK rules become the de facto global baseline.

No more snooze button for builders

Developer teams may see these headlines and assume: “Custodians, fiat on-ramps — that’s not me; I just deploy contracts.” Tempting but short-sighted. Many apps now host lending pools, stablecoin liquidity, and staking services. Those are precisely the kinds of activities regulators might categorize as “payment services” or “lending.” 

If a protocol is a key piece of that puzzle, it may be in line for questions from regulators. FCA may not knock on your door tomorrow, but builders should be consider:

Control and custody: If an infra manages users’ funds — even briefly — that could be considered “custodial,” then that risk should be factored into the overall product design.

Payment-like functionality: Depending on the overall architecture and centralization, a license may be required, if a DApp mimics or facilitates payments, stable transfers, or lending.

Geographic scope: You may not have a UK entity but consider your user base. Does your front end target UK customers? If yes, you can’t just opt out of the rules. We cannot forget the FCA’s stringent marketing rules for crypto, introduced in 2023.

The compliance silver lining 

We always talk about regulation like it’s a four-letter word, but building with regulation – either current or future – in mind, can give you a head start. Teams that develop features like appropriate and rigorous geofencing, Know Your Customer (KYC) plug-ins, or risk analytics stand to gain if key markets insist on specific layers of user protection. 

If you’re creating an app, L2, bridging service, or other protocol, offering optional compliance toggles can be a competitive advantage. Consider telling institutional partners you’ve already built the necessary guardrails. Yes, it’s extra effort, and you must balance community optics, mission, UX, and other primary product considerations. Still, it also means you won’t need to scramble to retrofit everything when the final rulebook lands.

Frantic code rewrites are no fun. If you know the rules might change, it is better to build a flexible architecture now.

Convergence or patchwork?

Here’s the big question: Will we see global convergence or a messy patchwork of contradictory rules?

The FCA has hinted at coordination with other bodies (like the International Organization of Securities Commissions, or IOSCO) and is watching the law that instituted uniform EU rules for crypto, Markets in Crypto-Assets Regulation (MiCA) across the EU. That suggests some appetite for alignment. 

A “worst-case scenario” is a total balkanization that forces developers to run region-specific versions of their apps or builders to leverage confusing and inefficient jurisdictional arbitrage. The implications will be felt throughout crypto, especially for smaller teams that can’t afford to code half a dozen separate compliance modules. 

We can’t say yet which outcome is more likely. Still, we can be sure larger economies (including the EU) will continue to progressively shape the crypto legal environment they deem fit for their purposes. And yes, they’ll undoubtedly swap notes on what seems to work (and what doesn’t).

Don’t wait for 2026

Whether or not this new impending gateway regime directly affects devs, it’s a wake-up call that purely permissionless, unregulated innovation might give way to a more structured future where oversight rules. If 14% AML approval rates were onerous, imagine how difficult it would get when regulators expand into stablecoins, payment services, crypto lending, and beyond.

The upside is that crypto has grown enough to command the attention of the highest levels of TradFi. That growth is being used to fuel mainstream adoption, which is excellent for builders serious about the space and their goals. If you want to be a part of that future, don’t ignore the FCA’s plans and the broader regulatory development globally.

Watch the consultations, read the draft proposals, and open lines of communication with qualified counsel. By the time 2026 arrives you’ll be a step ahead of the curve and not blindsided. 

The message is clear: Build preemptively, not retrospectively. Be proactive, not reactive.

Opinion by: Katherine Kirkpatrick Bos, general counsel at StarkWare.

This article is for general information purposes and is not intended to be and should not be taken as legal or investment advice. The views, thoughts, and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.