UK Crypto Regulation: FCA Consultation CP26/4 Part 2 Extends Handbook Rules to Cryptoasset Firms

The UK Financial Conduct Authority (FCA) has published Consultation Paper CP26/4 Part 2, the second phase of its comprehensive framework for regulating cryptoasset activities. This consultation proposes extending established FCA Handbook requirements—covering prudential standards, conduct of business, systems and controls, and client asset protection—to firms conducting regulated cryptoasset activities in the UK.

For crypto exchanges, custody providers, brokers, and international firms serving UK customers, CP26/4 Part 2 signals that the era of light-touch crypto regulation in the UK is ending. The FCA is methodically constructing a regulatory framework that will subject cryptoasset businesses to obligations comparable to those governing traditional financial services—adapted where necessary for the technical realities of distributed ledger technology.

Note on Sources: This analysis is based on the FCA’s published consultation paper and the broader UK regulatory framework under the Financial Services and Markets Act 2000 (FSMA 2000) as amended by the Financial Services and Markets Act 2023 (FSMA 2023). Where specific provisions of CP26/4 Part 2 are discussed, we cite the consultation directly. Where we discuss likely implementation approaches, we note that these reflect reasonable inference based on existing FCA precedent.

Key Takeaways

• Handbook extension confirmed: CP26/4 Part 2 proposes adapting existing FCA sourcebooks—including SYSC (systems and controls), COBS (conduct of business), PRIN (principles for businesses), and prudential requirements—to regulated cryptoasset activities.
• Building on Part 1: This consultation follows CP26/4 Part 1, which established the authorization gateway for cryptoasset firms. Part 2 addresses the ongoing compliance obligations for authorized firms.
• Proportionality signaled: The FCA indicates it will apply proportionality principles, but the baseline requirements appear substantial across all firm sizes.
• Territorial reach: International firms serving UK customers face potential authorization requirements, with limited exclusions.
• Consultation window open: Industry participants should engage with the consultation to shape final rules—the FCA explicitly invites feedback on implementation challenges.

Regulatory Context: How CP26/4 Part 2 Fits the UK Framework

The UK’s approach to crypto regulation has evolved significantly since the initial anti-money laundering registration regime under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs). That regime required cryptoasset businesses to register with the FCA for AML purposes but did not impose broader conduct or prudential requirements.

FSMA 2023 expanded the FCA’s statutory remit to encompass cryptoasset activities as regulated activities under FSMA 2000. This enabled the FCA to bring cryptoasset businesses within the full scope of UK financial services regulation—subject to implementing rules through its Handbook.

CP26/4 Part 1 addressed the authorization gateway: who needs FCA authorization, the application process, and threshold conditions. CP26/4 Part 2 now addresses what authorized firms must do on an ongoing basis—the operational rules governing day-to-day conduct.

Proposed Prudential Requirements for UK Crypto Firms

According to CP26/4 Part 2, the FCA proposes to establish prudential standards for cryptoasset firms drawing on concepts from the Investment Firms Prudential Regime (MIFIDPRU) and the Prudential sourcebook for MiFID Investment Firms. Key elements include:

Capital Requirements

The consultation proposes minimum capital requirements for cryptoasset firms, calibrated to:

• Fixed overhead requirements based on operational expenses;
• Additional capital for specific risk exposures, including operational risk and (where applicable) market risk from proprietary positions;
• Wind-down capital to ensure orderly cessation of activities if required.

The FCA has not published specific capital thresholds in the consultation summary available at time of writing. Firms should review the full consultation document for proposed quantitative requirements and consider responding if the figures appear disproportionate to their business model.

Liquidity Requirements

CP26/4 Part 2 proposes that cryptoasset firms maintain liquid assets sufficient to meet obligations as they fall due and to support orderly wind-down. The consultation invites feedback on appropriate liquidity calibration for firms with different business models (e.g., exchange versus custody-only services).

Wind-Down Planning

Authorized cryptoasset firms would be required to maintain and periodically test wind-down plans. These plans must demonstrate the firm’s ability to cease regulated activities without customer harm—including arrangements for returning client cryptoassets and fiat currency.

Conduct of Business Proposals

The consultation’s conduct of business proposals draw heavily from the existing COBS sourcebook, adapting requirements for the cryptoasset context. Based on CP26/4 Part 2:

Appropriateness and Suitability

Firms would be required to assess whether cryptoasset services are appropriate for retail customers before onboarding. This builds on the FCA’s existing approach under MiFID II for complex financial instruments and reflects the FCA’s view—stated in previous guidance—that cryptoassets carry material risks unsuitable for many retail investors.

The consultation distinguishes between:

• Appropriateness assessments: Required for non-advised services, testing customer knowledge and experience;
• Suitability assessments: Required where advice is provided, considering broader financial circumstances and objectives.

Risk Warnings and Disclosures

CP26/4 Part 2 proposes mandatory risk warnings for cryptoasset transactions, building on the cryptoasset financial promotions regime established in FCA Policy Statement PS22/10 and subsequent guidance. Firms would need to provide clear, prominent warnings about the risks of cryptoasset investment, including the risk of total loss.

Best Execution

Where firms execute cryptoasset transactions on behalf of clients, the consultation proposes best execution obligations. Firms would need to take all sufficient steps to obtain the best possible result for clients, considering:

• Price and costs (including spreads, fees, and gas costs);
• Speed and likelihood of execution;
• Size and nature of the order;
• Any other relevant considerations.

The FCA acknowledges that cryptoasset markets are fragmented across multiple venues and on-chain protocols, and invites feedback on how best execution should apply in this context.

Conflicts of Interest

Cryptoasset firms would be required to identify, prevent, and manage conflicts of interest. The consultation highlights specific conflict scenarios prevalent in crypto markets:

• Firms operating exchange platforms while also trading proprietarily;
• Token listings where the firm or connected persons hold the listed asset;
• Staking or DeFi yield services where firm and client interests may diverge.

Systems, Controls, and Governance Requirements

CP26/4 Part 2 proposes extending the SYSC sourcebook to cryptoasset firms, with adaptations for the technology and operational profile of crypto businesses:

Governance Arrangements

• Clear organizational structure with documented responsibilities;
• Compliance function with adequate authority and resources;
• Risk management function independent of business lines;
• Internal audit function (or equivalent arrangements for smaller firms).

Outsourcing and Third-Party Dependencies

The consultation recognizes that cryptoasset firms frequently rely on third-party infrastructure—including blockchain nodes, wallet technology providers, and custody solutions. Firms would need to:

• Conduct due diligence on material outsourcing arrangements;
• Maintain oversight of outsourced functions;
• Ensure business continuity arrangements address third-party dependencies.

Operational Resilience

Building on the FCA’s operational resilience framework (PS21/3), cryptoasset firms would need to identify important business services, set impact tolerances, and test their ability to remain within tolerance during severe but plausible scenarios. For crypto firms, relevant scenarios include:

• Cybersecurity incidents, including exchange hacks and wallet compromises;
• Blockchain network congestion or forks;
• Smart contract failures or exploits;
• Loss of access to banking or payment services.

Record-Keeping Requirements

The consultation proposes comprehensive record-keeping obligations, including transaction records, order records, communications with clients, and compliance documentation. Retention periods are proposed at [Seth: verify specific period in consultation] years, consistent with existing FCA requirements for comparable activities.

Client Asset Protection for Cryptoassets

Perhaps the most technically complex aspect of CP26/4 Part 2 concerns the protection of client cryptoassets. The consultation proposes adapting the Client Assets Sourcebook (CASS) principles while acknowledging the distinctive characteristics of assets held on distributed ledgers.

Segregation

Client cryptoassets must be segregated from firm assets. The FCA proposes that segregation should be both:

• Legal/operational: Clear records distinguishing client and firm assets;
• Technical: Where practicable, use of separate blockchain addresses for client assets.

The consultation invites feedback on scenarios where technical segregation may not be practical—for example, where pooled custody arrangements or protocol limitations apply.

Reconciliation

Firms would be required to conduct regular reconciliation of client asset records against on-chain balances. The consultation proposes daily reconciliation as the baseline, with immediate investigation and resolution of any discrepancies.

Client Asset Report

Consistent with CASS requirements for traditional client assets, firms would need to obtain an annual Client Asset Report from an independent auditor confirming compliance with client asset rules.

The FCA acknowledges that few auditors currently have the technical expertise to audit on-chain asset holdings and invites industry feedback on developing this capability.

Territorial Scope: When Is FCA Authorization Required?

CP26/4 Part 2 addresses the territorial application of UK crypto regulation—a critical question for international firms. Based on the consultation and existing FSMA principles (Section 19, FSMA 2000):

Authorization is required if a firm:

• Is established in the UK and conducts regulated cryptoasset activities; or
• Is established outside the UK but carries on regulated activities “by way of business” in the UK.

The “by way of business” test will likely consider factors including:

• Active marketing to UK persons;
• UK-directed websites or interfaces;
• Acceptance of UK payment methods;
• Material numbers of UK customers.

The FCA may provide exclusions for services provided on reverse solicitation basis (where the UK customer initiates contact without prior marketing), but such exclusions typically are narrow and closely scrutinized.

UK Approach Compared to EU MiCA

With the EU’s Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114) now fully applicable, firms operating across Europe must navigate both regimes. Key structural differences include:

Regulatory architecture: The UK extends existing FCA Handbook sourcebooks to crypto, leveraging established compliance concepts. MiCA creates a standalone regulation with crypto-specific definitions, requirements, and authorization categories.

Authorization: UK authorization under FSMA provides a single permission for cryptoasset activities. MiCA authorization creates a Crypto-Asset Service Provider (CASP) license with EU passporting rights—not available to UK-authorized firms post-Brexit absent an equivalence determination.

Stablecoin treatment: MiCA establishes specific regimes for Asset-Referenced Tokens (ARTs) and E-Money Tokens (EMTs) with detailed reserve, redemption, and authorization requirements. The UK approach to stablecoins is expected to be addressed through separate Bank of England and FCA initiatives.

Practical implication: Firms seeking to serve both UK and EU customers will likely need authorization in both jurisdictions until equivalence arrangements are established—if they are established at all.

DeFi Protocols: Potential Regulatory Capture

CP26/4 Part 2 does not create a blanket exemption for decentralized finance protocols. While the FCA’s approach to DeFi remains partially unclear, the consultation signals that:

• Protocols with identifiable controllers may fall within the regulatory perimeter;
• UK-based developers, promoters, or governance participants may create regulatory nexus;
• Claims of “decentralization” will be assessed based on operational reality, not labels.

This approach aligns with international regulatory thinking, including the Financial Action Task Force (FATF) Updated Guidance on Virtual Assets (October 2021), which notes that owners/operators of DeFi applications may constitute virtual asset service providers subject to AML requirements regardless of decentralization claims.

Protocols with material UK exposure—through team location, governance token distribution, or user base—should conduct careful analysis of their regulatory position.

Implementation Timeline

Based on CP26/4 Part 2 and standard FCA practice:

1. Consultation period: The FCA typically allows 12-16 weeks for consultation responses. [Seth: verify specific deadline from consultation document]
2. Policy statement: Following consultation close, the FCA will publish a policy statement confirming final rules, likely 6-12 months after consultation closes.
3. Transition period: Firms currently registered under the MLRs will likely receive a transition period to achieve full compliance—the length will depend on the complexity of requirements and industry feedback.

Firms should not assume that existing MLR registration provides any automatic pathway to authorization under the new regime.

Practical Implications

For UK-established crypto firms:

• Begin gap analysis now. Map current compliance arrangements against the proposed Handbook extensions.
• Prioritize client asset arrangements—segregation and reconciliation may require significant operational changes.
• Assess capital position against likely prudential requirements and model potential capital shortfalls.
• Respond to the consultation where requirements appear disproportionate or technically unworkable.

For international firms serving UK customers:

• Quantify UK market exposure. If material, evaluate the business case for FCA authorization versus market exit.
• Review marketing practices to understand potential “by way of business” exposure.
• Monitor for any territorial exclusions or de minimis thresholds in the final rules.

For DeFi protocols with UK nexus:

• Assess governance and operational structure honestly—the FCA will look past labels to substance.
• Consider whether restructuring to achieve genuine decentralization is feasible and desirable.
• Engage legal counsel to evaluate regulatory risk and potential engagement strategies.

For industry associations:

• Coordinate member responses to amplify concerns about proportionality and implementation challenges.
• Engage constructively with the FCA—regulators generally prefer workable rules that achieve policy objectives over unworkable rules that drive activity offshore.

Industry Costs and Benefits

The FCA’s consultation should include a cost-benefit analysis as required under Section 138I, FSMA 2000. Firms reviewing the consultation should assess whether the FCA’s cost estimates align with their operational reality and respond accordingly if they do not.

Anticipated compliance costs include:

• Regulatory capital requirements (opportunity cost of capital);
• Compliance staffing and systems;
• External audit costs, including Client Asset Reports;
• Legal and consulting fees for policy interpretation;
• Technology investment for client asset segregation and reconciliation.

The FCA argues these costs are justified by investor protection benefits and market integrity improvements. Industry participants may reasonably disagree on the calibration.

Conclusion

CP26/4 Part 2 confirms that the UK is constructing a comprehensive regulatory framework for cryptoasset activities, extending proven FCA Handbook requirements to digital asset businesses. This approach positions the UK as a jurisdiction with clear rules and high standards—potentially attractive to institutional participants seeking regulatory certainty, but demanding for firms accustomed to lighter-touch regimes.

The consultation window provides an opportunity for industry engagement. Firms that participate constructively may influence final rules; those that do not will live with the consequences. We encourage all affected parties to review the full consultation document and respond before the deadline.

CryptoLaw.blog will continue monitoring the UK regulatory landscape and provide updates as the FCA issues its policy statement and final rules.

---

This article is for informational and educational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship. Laws and regulations in the cryptocurrency space change rapidly—consult a qualified attorney for advice specific to your situation and jurisdiction. Seth Goettelman is licensed to practice law in Wisconsin and Florida.