UK stablecoin payment rules: the carve-out is real, and it isn't for the dollars you'd actually accept

What HM Treasury laid before Parliament on September 15, 2026

The UK has been building its crypto regime in public for two years, and most of it has been about firms: who needs a licence, who holds what, who answers to whom. On September 15, 2026, HM Treasury laid the final draft of a statutory instrument with a duller name and a sharper effect — the Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026.

What it does is narrow. It takes transfers of UK qualifying stablecoins and removes them from three regulated activities: dealing as principal, dealing as agent, and arranging deals. Treasury's stated intent is to remove unnecessary regulatory barriers while keeping standards where the risk is material — the logic being that moving a regulated sterling token from one person to another to settle a bill is a payment, not a securities trade, and should not be regulated as if it were one.

That is the right instinct. Anyone who has watched a payment sit inside a "dealing" perimeter knows what it costs: every hop gets a permission, every permission gets a firm, and every firm gets a balance sheet in the middle of your money. Treasury also moved on a point it had proposed differently in April 2026. The earlier draft would have kept payment firms inside safeguarding permission and limited the temporary-settlement exclusion to holding that was ancillary to other crypto activities. The final draft instead draws a distinction that matters a lot in practice: brief payment execution is not continuing custody.

Then come the limits, and they are the story.

The three limits in the new UK stablecoin payment rules

Read the draft closely and the relief shrinks in three directions at once.

First, "qualifying" is doing enormous work. A UK qualifying stablecoin has to be issued through the regulated issuance activity by a firm that actually holds the relevant permission. That is not a description of a token's peg — it is a description of its issuer's licence. An overseas-issued token does not qualify on that basis alone, and neither does a coin that merely tracks sterling. So the two stablecoins a British business is overwhelmingly likely to be offered by a customer — USDC and USDT — are not inside this carve-out because of what they are pegged to. They would be inside it only if issued by a UK-permissioned issuer, which is not how they exist today.

Second, the shape of the transaction matters. If the recipient has to return the stablecoin at any point, the transaction stays regulated — the relief is for transfers that are final, not for arrangements that look like a loan wearing a payment's clothes. And swapping a qualifying stablecoin for another cryptoasset, say bitcoin, does not get the payment exclusion either. There is a separate carve-out for title-transfer collateral and repo arrangements, but it only applies where the original holder is not a consumer or an FCA-specified category, so retail participants do not get it. Financial-promotion rules broadly track the same exclusions, though the coverage is not identical.

Third, the clock. The dealing, arranging and financial-promotion amendments are drafted to commence on October 25, 2027 — the date the FCA's new regime for crypto firms begins. Amendments made through regulation 4 begin once the instrument is made. And the instrument has not been made: it is a draft laid before Parliament, and Parliament has to approve it first. Treasury's broader payments reform still has to define the longer-term rules for stablecoins used in payments.

Add those up and the relief is: for a class of sterling token that barely exists in circulation yet, on transfers that are final and not swaps, starting in late 2027, subject to approval. A British café weighing whether to take a customer's dollars in 2026 is not in that sentence anywhere.

What the FCA published the next morning

On September 16, 2026, the FCA published PS26/18, its final guidance on how the UK cryptoasset perimeter applies — the document firms have been waiting for since Parliament passed the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 on February 4, 2026. In the FCA's announcement, David Geale, executive director of consumers, payments and competition, framed the goal plainly: "We are building a crypto regime that firms, consumers and international partners can trust."

The operational dates are now fixed. The authorisation gateway opened on September 30, 2026. Firms that want transitional cover while their applications are assessed must file by February 28, 2027. The regime takes effect October 25, 2027. Existing anti-money-laundering registrations do not convert automatically — a business already on the FCA's crypto register still has to apply to keep carrying on newly specified activities. Authorised firms pick up the full weight of UK financial services supervision along the way: Consumer Duty, governance, safeguarding rules, operational resilience, and the Senior Managers and Certification Regime.

Now look at the five activities PS26/18 covers, in order:

• Issuing qualifying stablecoins
• Operating cryptoasset trading platforms
• Dealing and arranging deals in cryptoassets
• Safeguarding cryptoassets
• Arranging cryptoasset staking

Every one of them describes a party that stands between two other parties. Issue the token. Run the venue. Deal or arrange the trade. Hold the asset for someone else. Arrange the staking. That is what a regulatory perimeter is for, and it is a reasonable place to draw the line. But it tells a merchant something useful about their own exposure: the risk this whole apparatus is built to manage is intermediation risk — the risk created when somebody else is holding, routing or promising your money.

The FCA was also candid about what PS26/18 does not yet settle. The guidance does not reflect the changes the Government made to the legislation afterwards — including the very carve-out laid the day before. The regulator will consult in October 2026 on targeted perimeter updates covering UK qualifying stablecoins, proprietary trading and market making, certain technology providers, decentralised protocols, safeguarding arrangements involving central securities depositaries, and financial promotions, with updated guidance aimed at early 2027. Anyone carrying on stablecoin activity is told, in effect, to read the legislation as in force at the relevant time. For a detailed practitioner read of the draft SI and its consultation history, Hogan Lovells' note on the instrument is worth the ten minutes, and the FCA's own cryptoasset regime policy statements are the primary source.

What this means for a UK business that wants to get paid in dollars today

Here is the gap. A UK exporter invoicing a client in Dubai, a Manchester agency with a US retainer, a Brighton studio with customers in six countries — all of them are being offered dollars, not a sterling token issued by an FCA-permissioned issuer. The carve-out that arrived on September 15 does not reach them, and would not reach them until late 2027 even if it did.

Meanwhile the thing that actually blocks them has never been the perimeter. It has been the bank. We wrote about that at length when Parliament's inquiry into banks blocking crypto payments in the UK closed its evidence window: businesses were not being told their activity was illegal, they were being told their account was closed. De-risking is a commercial decision dressed as a compliance one, and no statutory instrument fixes it.

So the honest framing for a merchant is not "am I allowed to accept stablecoins." That is a question for your own solicitor and your own facts, and nothing in these documents answers it for you. The useful question is narrower and entirely within your control: between your customer's payment and your own account, how many parties get to hold the money? Every one of them is a party that can be caught by a perimeter, can fail an authorisation, can be told to wind down, or can simply decide your sector is not worth the file.

The variable a merchant controls: whether anyone holds the money at all

Read the five regulated activities again and notice which one is the load-bearing wall for payments: safeguarding cryptoassets. Holding someone else's asset is the activity that creates the obligation, the permission, the Consumer Duty exposure and the wind-down plan. It is also the activity most crypto payment processors are built around — customer pays the processor, processor holds a balance, processor pays the merchant on a schedule.

That model produces a perfectly ordinary commercial arrangement in good times and a queue of creditors in bad ones. It is the same structure that turned a processor shutting down into a merchant's problem rather than the processor's, and it is the reason "non-custodial" is a risk statement rather than a slogan.

Payzum removes that step. It is a non-custodial, crypto-only processor: the customer's payment settles on-chain directly into a wallet the merchant controls. Payzum never holds, pools or controls the funds — settlement is the payment. There is no Payzum balance to safeguard, no payout schedule to wait out, and no third-party float sitting between a customer in Singapore and a business in Leeds.

The practical consequences follow from the mechanics, not from marketing:

• Finality instead of reversibility. An on-chain payment confirms and is done. There is no 120-day chargeback window and no card-network dispute process to defend.
• Seconds instead of days. Typical confirmations run around 0.4s on Solana and ~2s on Base and Polygon, against one to three business days for card settlement.
• Dollar stability without a dollar account. Accept any supported crypto and use optional auto-conversion to USDC or USDT, so the amount you hold does not move between Tuesday and Friday.
• Reach that does not depend on a correspondent bank. Bitcoin, Ethereum, Solana, Polygon, Base, Arbitrum, Optimism, BNB Chain and Avalanche, with LTC and DOGE available for payouts.

How it works, step by step

1. Connect the wallet you already control. You supply the destination address. Payzum never takes custody, so there is no onboarding step where you fund a balance with someone else.
2. Pick the way you get paid. Online: hosted checkout (redirect, modal or inline), payment links and buttons with no code, invoices with expiry and overpayment detection, or recurring subscriptions. In person: POS with a fresh QR per sale, physical terminals, and PIN-protected cashier accounts with per-cashier analytics. For developers: a REST API with API keys and signed webhooks.
3. Decide what you hold. Turn on auto-conversion to USDC or USDT if you want dollar stability, or settle in the asset as paid. Payzum is crypto-only and does not settle to a fiat bank account — that step, if you want it, stays with your own exchange or off-ramp relationship.
4. Pay people out the same way. Mass payouts by CSV (BTC/LTC/DOGE) and EVM stablecoin payouts across Polygon, Arbitrum, Optimism, Base, BNB Chain and Avalanche, for contractors, affiliates or refunds — one batch, one file.

Three UK scenarios this actually changes

Regulation is abstract until it lands on an invoice. These are the shapes we see most often from British businesses right now:

• The agency with overseas retainers. A London design studio bills three clients in the Gulf and the US. Wires take days, arrive short after correspondent fees, and every quarter one of them gets held for review. With a payment link denominated in USDC, the client pays on Base and the funds are in the studio's own wallet inside a couple of seconds — no intermediary bank to ask why.
• The exporter selling into blocked corridors. A Midlands parts distributor has customers in markets where card acceptance is unreliable and correspondent banking is worse. An invoice with expiry and overpayment detection replaces the wire, and settlement is final on receipt rather than provisional for a week.
• The in-person business tired of the MDR. A Bristol venue running events with international attendees adds QR checkout at the door — a fresh QR per sale, any phone as the terminal, PIN accounts per cashier. No acquirer, no card-network fees, and no chargebacks arriving three months after the event.

In all three, the regulatory question the UK is currently legislating — who is dealing, arranging and safeguarding — has one fewer party to attach to, because there is no party in the middle holding the money.

Custodial processor vs non-custodial settlement — what the difference does

Objections worth taking seriously

"Doesn't non-custodial just move the compliance work onto me?"

It moves the control onto you, which is not the same thing. Your own obligations — tax, accounting, AML where it applies to your business, sanctions screening of counterparties — exist regardless of who holds the funds; a custodial processor does not discharge them for you, it just adds its own obligations on top and charges you for them. What non-custodial settlement removes is a specific, additional failure mode: a third party's authorisation, solvency or risk appetite standing between your customer's payment and your access to it. Payzum ships the operational side you do need — 2FA, signed webhooks, encrypted secrets, a full audit log, and KYC in product.

"Shouldn't I just wait for October 2027 and do this properly?"

Waiting is a legitimate choice, but be clear about what you are waiting for. The carve-out laid on September 15 concerns UK qualifying stablecoins — a category defined by its issuer's UK permission. If your customers pay in USDC or USDT, the 2027 commencement date does not change your position in the way the headlines suggest. And the FCA has said its own perimeter guidance on this point is coming in early 2027, after an October 2026 consultation. The rules that will govern sterling-token payments in 2028 are not the rules that govern a dollar invoice you need paid in November.