United Kingdom: technology regulation at a glance

Framework: Transitional: FCA MLR 2017 registration for cryptoasset firms (in force since Jan 2020) and FCA financial promotions regime for qualifying cryptoassets (in force since 8 Oct 2023), with the comprehensive Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102, made 4 Feb 2026) bringing cryptoassets under FSMA — gateway opens 30 Sept 2026 and the new authorisation regime takes full effect on 25 October 2027.

Crypto is legal in the UK and is currently governed by a patchwork: mandatory FCA registration for AML/CTF supervision under the Money Laundering Regulations 2017, the financial promotions regime (qualifying cryptoassets in scope since October 2023), and HMRC's existing tax treatment. A dedicated comprehensive FSMA-based regime was made into law in February 2026 but is not yet in force — the FCA authorisation gateway opens 30 September 2026, and the full regulated-activity regime (issuance of qualifying stablecoins, custody, exchanges, dealing, arranging, staking) becomes operative on 25 October 2027. Until then, most crypto activities sit outside conduct-of-business regulation other than AML and promotions rules.

Framework: Pro-Innovation Sectoral Approach: DSIT AI Regulatory Principles (2024) applied by existing sectoral regulators (ICO, FCA, CMA, Ofcom, MHRA); AI Security Institute under DSIT; Regulating for Growth Bill (proposed, May 2026 King's Speech)

The UK has deliberately avoided a standalone comprehensive AI Act, instead relying on a principles-based, sector-led framework in which existing regulators apply current law to AI within their respective remits. This approach was formalised in the March 2023 DSIT White Paper and its February 2024 government response, which established five cross-cutting AI regulatory principles. The May 2026 King's Speech announced the Regulating for Growth Bill, which will create statutory AI sandbox powers and coordination mechanisms, but does not establish a single AI regulator or overarching AI law.

Framework: UK GDPR (retained EU law), Data Protection Act 2018 (DPA 2018), and Data (Use and Access) Act 2025 (DUAA 2025); supervised by the Information Commissioner's Office (ICO), which is being restructured into the 'Information Commission' under DUAA 2025

The United Kingdom operates a comprehensive data-protection regime built on the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, both retained and adapted post-Brexit. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and is being commenced in stages; it amends the UK GDPR and DPA 2018 (notably on automated decision-making, international transfers, and PECR) without replacing the core framework. The ICO is the independent supervisory authority and continues active enforcement, including fines of up to £17.5 million or 4% of global turnover.

Framework: Payment Services Regulations 2017 (SI 2017/752) and Electronic Money Regulations 2011 (SI 2011/99), administered by the Financial Conduct Authority (FCA); payment systems oversight by the Payment Systems Regulator (PSR), pending absorption into FCA

The United Kingdom operates a mature, comprehensive licensing regime for digital payments and fintech. The FCA authorises and supervises payment institutions and e-money institutions under the PSR 2017 and EMRs 2011, with major rule updates in force from May 2026 covering safeguarding, BNPL, and open banking. A structural reform to merge the PSR into the FCA was consulted on in September 2025 and is progressing.

Framework: UK Immigration Rules (Appendix V: Visitor; Appendix Skilled Worker; Appendix Global Talent; Appendix Innovator Founder) administered by the Home Office / UK Visas and Immigration (UKVI)

The United Kingdom has no dedicated digital nomad or remote-worker visa as of May 2026. Remote workers from abroad must use existing routes: the Standard Visitor visa permits incidental remote work for an overseas employer (up to 6 months, not as the primary purpose of the visit); long-term residence requires a sponsored Skilled Worker visa, the merit-based Global Talent visa, or the Innovator Founder visa for entrepreneurs. There is no general freelancer or self-employed pathway equivalent to a nomad visa.

Framework: Online Safety Act 2023 (Royal Assent 26 October 2023), enforced by Ofcom as the designated online safety regulator

The United Kingdom enacted the Online Safety Act 2023 (OSA), one of the world's most extensive online safety regimes, imposing statutory duties of care on user-to-user platforms and search services. Ofcom is phasing implementation across three tranches: illegal-harms duties (March 2025), children's safety duties (July 2025), and a forthcoming categorisation register for the largest platforms (July 2026). Enforcement is active, with over 90 investigations opened and six fines issued by early 2026.

Framework: Network and Information Systems (NIS) Regulations 2018 (SI 2018/506), enforced by the ICO (for digital service providers) and sector competent authorities; supplemented by the Telecommunications Security Act 2021 and sector-specific FCA/PRA operational resilience rules. The Cyber Security and Resilience (Network and Information Systems) Bill, introduced 12 November 2025, is progressing through Parliament and would deliver the most significant overhaul since 2018.

The UK's primary cross-sector cybersecurity obligation rests on the NIS Regulations 2018, which require operators of essential services (energy, transport, health, water, digital infrastructure) and relevant digital service providers (cloud, online marketplaces, search engines) to implement proportionate security measures and report significant incidents to competent authorities within 72 hours. Layer on top are sector-specific duties: the Telecommunications Security Act 2021 for public telecoms networks, and FCA/PRA operational resilience rules for financial services. The Cyber Security and Resilience Bill, introduced to Parliament in November 2025 and advancing through the Lords as of mid-2026, will expand scope to managed service providers and data centres, impose a tighter two-stage incident reporting regime (24 h initial + 72 h full report), and align broadly with the EU NIS2 Directive, with Royal Assent expected in 2026 but phased implementation likely extending to 2028.

Framework: Companies Act 2006 (as amended by the Economic Crime and Corporate Transparency Act 2023), administered by Companies House

The UK offers one of the most accessible company formation regimes globally. Foreign nationals can incorporate a private limited company (Ltd) fully online through Companies House with no foreign-ownership restrictions, no minimum share capital for private companies, and typical approval within 24 hours. Since 18 November 2025, mandatory identity verification for all directors and persons with significant control (PSCs) has been phased in under the Economic Crime and Corporate Transparency Act 2023.