What Counts as a Regulated Activity, Line by Line
Six activities commonly within the perimeter, stated plainly, with the boundary cases that cause most of the questions.
Authorisation attaches to specified activities. These are the ones that recur across frameworks, with the boundaries that cause disputes.
One: exchanging
Converting crypto for money or for other crypto, as a business. Covers both running a market and acting as principal.
Boundary: a person converting their own holdings is not exchanging as a business. Frequency and holding out to others are the tests.
Two: custody
Holding or controlling crypto assets belonging to another, or the means of access to them.
Boundary: software that gives a user sole control of their own keys is generally outside. Where the provider can move assets, it is inside.
Three: operating a trading platform
Bringing together multiple buyers and sellers in a system.
Boundary: a bulletin board where parties settle bilaterally has been treated differently from a venue that matches and settles.
Four: transfer services
Moving crypto assets on behalf of a customer.
Boundary: broadcasting a transaction the customer signed is not obviously the same as transferring on their behalf. Treatment varies.
Five: brokerage and arranging
Arranging deals in crypto assets for others, including introducing.
Boundary: this one catches intermediaries who do not consider themselves financial firms, including some referral arrangements.
Six: issuing and offering
Offering crypto assets to the public, which brings in disclosure obligations distinct from the above.
What the boundaries have in common
They turn on whether someone else’s assets or someone else’s trades are involved, and on whether the activity is carried on by way of business.
Why this matters to a customer
Because a platform performing a regulated activity without authorisation is operating unlawfully, and its customers carry the consequences of that.
Verifying which permissions a platform holds, rather than whether it holds some licence, is the useful check. A licensed exchange under a named supervisor lists its permissions on a public register.
Collect & Exchange names the framework it operates under, and a venue whose onboarding matches what the rules ask for is usually one whose permissions cover what it actually does.
This page restates a published requirement. It is not the requirement itself and it is not legal advice. Rules change, and some take effect on a date later than their publication.