FS26/1: tokenised securities custody has an interim answer, and it is CASS 6

What was published

On 14 September 2026, the FCA published Feedback Statement FS26/1, Tokenisation in Wholesale Markets, closing the joint Call for Input it issued with the Bank of England on 18 May 2026, which closed on 3 July. There were 123 responses, “from stakeholders across the industry” and “from individuals, including several legal academics”.

A feedback statement changes no rules, and this one is explicit that the substantive output is still ahead: a joint Tokenisation Roadmap, promised later this year, which “will include dates and detail on each workstream”. Respondents had asked for exactly that, and for the Roadmap to “move beyond pilots and sandboxes towards full production and permanence”.

But one sentence in chapter 3 is written in the present tense, and it is the sentence that matters most to anyone safeguarding tokenised securities.

“For now, firms will be assessed under CASS 6”

The Call for Input had asked whether safeguarding arrangements for relevant specified investment cryptoassets (RSICs) should align more closely to CASS 6, “which applies to traditional safe custody assets”, or to CASS 17, “which was developed to address the safeguarding of cryptoassets, taking into account the features that make them different from traditional assets”.

The answer came back one-sided. “Most respondents, including both traditional finance and digitally native cryptoasset firms, favoured a technology-neutral safeguarding regime broadly aligned with CASS 6.” The FCA's own response is to consult “on rules for safeguarding RSICs in the first half of 2027”, and then, plainly: “For now, firms will be assessed under CASS 6.”

Be careful about what that sentence does. It is a confirmation, not a change. RSICs are specified investments, so CASS 6 was already the applicable regime; the FCA has resolved an uncertainty rather than created an obligation. The value is that it is resolved in writing, before the consultation, and a firm can plan against it.

The argument is fungibility, is the argument.

The reasoning respondents gave is worth more than the conclusion. They did not argue for CASS 6 because it is familiar. They argued that divergence breaks the interchangeability that makes a tokenised security useful in the first place: “materially different safeguarding requirements between traditional and tokenised forms of the same security could make it difficult to use them interchangeably”, and would “create operational complexity for firms using both traditional and tokenised market infrastructure”.

A dissenting strand, and it should not be edited out. “Some respondents considered elements of the CASS 17 approach to be better suited to addressing those risks and cautioned against a fragmented approach to safeguarding requirements for different types of cryptoassets.” There was also “broad agreement that additional requirements relating to security, controls and the management of crypto-specific technology risks would be needed”—private key management chief among them. A CASS 6 baseline is not a CASS 6 copy-out.

What the 2027 consultation still has to answer

Paragraph 3.16 is the honest list of what is unresolved, and it is not trivial: reconciliation processes, shortfall treatment, sub-custody arrangements and insolvency outcomes, including “evidencing ownership and entitlement where traditional and tokenised records coexist”, operating “reconciliations across complex custody chains and DLT-based infrastructure”, and “ensuring assets can be identified and returned in an insolvency scenario”.

Respondents went further and suggested that “existing concepts such as trust arrangements, nominee structures and sub-custody requirements may need to be adapted”. That is a large piece of drafting to do in a single consultation, and it is the reason the interim CASS 6 position matters: it is what governs while that work happens.

Where the industry actually put the opportunity

The most useful corrective in FS26/1 is about what respondents did not say. Collateral “was by far the most frequently mentioned use case”. Meanwhile, the features that dominate public writing about tokenisation were barely featured: “24/7 trading and atomic settlement were rarely mentioned except where they relate to collateral”.

The FCA notes, for context, “one recent report from the US” that “found that market participants were holding an average of 7% excess collateral as a buffer”. The report is not named in FS26/1, so treat the figure as the FCA reports it rather than as an established number. Tokenised money market funds came up repeatedly, “mainly by buy-side firms”, with the argument that they “might be able to be used as collateral without having to be liquidated, limiting pro-cyclical effects in times of stress”.

Settlement, stablecoins and the finality gap

On settlemen,t the feedback was specific. The FCA's earlier position—that finality for digital securities depositories and non-systemic activity “could be determined contractually”—“was deemed insufficient, as only statutory finality provides insolvency protection against third parties”. The commercial consequence is concrete: respondents noted that securities pending settlement “are usually unable to be rehypothecated, lent, or used as margin, because of the uncertainty over the insolvency treatment”.

Against that, the FCA records progress. Since the Call for Input, “we have confirmed that stablecoins can be used as settlement assets in the DSS (subject to conditions and to Treasury amendments to regulations)”. The FCA has published a policy statement on UK-issued stablecoins and “will be consulting on resolution and insolvency for stablecoin issuers and cryptoasset custodians”. The Bank is also delivering a synchronisation service and consulting on extending RTGS and CHAPS settlement hours “to near 24/7”.

The DeFi answer, stated without hedging.

Respondents argued that the FCA's requirement for an accountable legal person behind every regulated activity was, in practice, not technology-neutral, because firms using decentralised finance could not meet it. The FCA did not move: “regulated activities require an identifiable person to be responsible for that activity, and we do not see a case to change the perimeter for these activities”.

It frames DeFi software providers sit alongside cloud providers—“regulated financial services activities – such as dealing, arranging and safeguarding – should continue to be delivered by regulated firms”, which may use third-party technology so long as “they take responsibility for regulatory outcomes such as operational resilience and KYC”. For traditional investment products, the FCA “cannot accept solutions where customers have no recourse when assets are lost or stolen”. It names “vulnerabilities in bridges, key-management systems, governance arrangements, oracle providers and cross-chain messaging layers”, and observes that the Coldcard incident “is notable because it sits outside the ‘protocol stack’ entirely, and highlights the importance of wallet security and self-custody risks”.

Timeline

• 18 May 2026. Joint FCA and Bank of England Call for Input published.

• 3 July 2026. Call for Input closed — 123 responses.

• 14 September 2026. FS26/1 published, with the tokenised gold Call for Input.

• Later in 2026. Joint Tokenisation Roadmap, with target dates — not yet published.

• First half of 2027. FCA consultation on rules for safeguarding RSICs.

The case against

“For now” carries a lot of weight in that sentence. The FCA has taken no final position on the end state, a meaningful minority of respondents preferred elements of CASS 17, and everyone agreed that crypto-specific overlays are needed on top of whatever baseline applies. A firm that reads “assessed under CASS 6” as “CASS 6 and nothing more” will be reading the consultation in 2027 with some surprise.

This note summarises FCA Feedback Statement FS26/1 of 14 September 2026 and quotes it directly where it matters. It is not legal advice.