PS26/11 — Regulated Cryptoasset Activities: Material Considerations for the Board

denouement | Board briefing | August 2026

The FCA has held the architecture and conceded at the margins. Our reading of the final conduct rules for UK cryptoasset firms, and what boards must settle before the authorisation gateway closes.

1. Purpose and headline judgement

The FCA published PS26/11 on 30 June 2026 (the FCA Board made the rules on 25 June 2026). It contains the final conduct rules for the regulated cryptoasset activities created by the Regulated Activities Order — operating a qualifying cryptoasset trading platform (QCATP), dealing as principal or agent, arranging, lending, borrowing, staking and safeguarding — together with the FCA's current position on decentralised finance (DeFi).

It responds to CP25/14, CP25/40 and CP26/4 and should be read alongside PS26/9 (admissions, disclosures and market abuse), PS26/12 (prudential) and PS26/13 (cross-cutting Handbook application, including Consumer Duty, SM&CR and regulatory reporting).

Our headline judgement is that the FCA has held the architecture and conceded at the margins. The consultation framework survives essentially intact; the concessions — removal of principal dealers from pre-trade transparency, a settlement float doubled from 1% to 2%, preservation of auto-staking, and a proposed deferral package — are targeted reliefs within an unmoved perimeter. Boards should plan against the framework as final, not as a draft to be lobbied.

2. Timetable — the binding constraint

The authorisation gateway is open: per the FCA's published timetable, applications under the savings provisions run from 30 September 2026 to 28 February 2027, and the rule instruments all come into force on 25 October 2027.

Three deferrals will be consulted on in September 2026, and each is proposed, not made: an extension of 3 months (to January 2028) for obtaining client consent to updated execution policies; 3 months (to January 2028) for the UK execution venue requirement; and 6 months (to April 2028) for the period during which cryptoassets admitted on UK QCATPs can be sold to retail clients without a QCDD.

A parallel proposal — which the FCA states "remains subject to change" — would give QCATP operators 6 additional months to admit legacy tokens with compliant disclosure documents. The board should budget and build to the October 2027 baseline and treat any deferral as contingency, not plan.

3. Perimeter and group structure

Overseas platforms serving UK consumers require UK authorisation. A firm seeking authorisation must have a UK presence, but the FCA has confirmed the branch route: an overseas-incorporated QCATP operator may be authorised via a UK branch, preserving access to the global order book — no separate UK order book is required (Chapter 2, Q1 response).

The price is high: branch authorisation "requires a whole-firm assessment and brings the regulated activities of the entire overseas entity into scope of UK regulation", including threshold conditions and prudential requirements at legal-entity level; one concession is that COBS and DISP are limited to UK-based users of branch-authorised platforms.

There is no equivalence or recognition framework for overseas venues — the FCA states it "is not in a position" to provide one. For any group with an offshore parent venue, the structural decision — UK subsidiary, branch of the overseas entity, or both — is the single largest strategic choice in the regime, assessed case-by-case at the gateway with no prescriptive FCA guidance on permitted models.

The FCA has also widened the arranging perimeter in the final rules. The consulted text caught executing and receiving-and-transmitting orders but left other arranging activities out of scope; the final rule requires any firm otherwise arranging deals to take all reasonable steps to ensure client orders are executed only on UK-authorised venues, closing what the FCA called a "significant" arbitrage gap.

Principal dealers serving retail clients must not systematically or predominantly source liquidity from an unauthorised group QCATP, and "pass-through" matched principal structures routing UK retail flow to unauthorised offshore venues are expressly blocked (Chapter 3, Q11 response).

4. Retail market access

Retail distribution is gated through UK QCATPs. From go-live, UK retail clients may only be dealt or arranged into qualifying cryptoassets (other than UK-issued qualifying stablecoins) that are admitted to trading for retail on a UK QCATP with an A&D-compliant disclosure document (QCDD), and firms must make the QCDD available before the client initiates the transaction (CRYPTO 3; Chapter 3, Q12 response).

Gatekeeping is, in the FCA's words, "broadly reserved" to QCATP operators — intermediaries cannot admit tokens to retail eligibility. However, a firm may arrange a sale offered on condition that the asset will be admitted with a QCDD, which accommodates primary distributions. This concentrates commercial power in the platforms and defines the retail product shelf for every intermediary.

5. Intermediary conduct — best execution clarified, PFOF finished

The FCA has held best execution but stripped out the mechanical reading. Firms are not required to run transaction-by-transaction checks; they must maintain effective overall execution arrangements evidenced by periodic post-trade analysis, and should check at least three reliable price sources from UK-authorised execution venues where available — without any obligation to execute there, and with offshore venues usable as additional reference points where they meet equivalent standards (Chapter 3, Q6–Q7 responses).

The outcome test is the one to plan around: firms must demonstrate outcomes "at least as good as" execution on the UK venues checked. Firms must disclose their capacity (principal or agent) per order, obtain express prior consent to execute outside a UK QCATP, and provide firm quotes with fees before executing as principal (the quote requirements are disapplied for matched principal trading on the firm's own QCATP, where the platform's non-discretionary rules set the price).

Payment for order flow is effectively prohibited: the FCA states that firms engaging in PFOF "are unlikely to meet" best execution, conflicts and inducement requirements — any PFOF-dependent revenue model is not viable for UK retail or professional clients (Q14 response).

6. Transparency — the principal dealer concession

The headline reversal in the paper: principal dealers are removed from market-facing pre-trade transparency, aligning with the TradFi non-equity approach in PS24/14 and PS25/17. Pre-trade transparency (best five bids and offers with volumes) survives only for large QCATP operators — those with entity-level average annual revenue of £10m or more over a rolling 3-year period (total revenue, not crypto revenue only).

Post-trade transparency stands for everyone, with publication as close to real time as technically possible and at most within 1 minute of execution, and any commercially sold data free in machine-readable form after 15 minutes (Chapter 4). The FCA has flagged it will revisit the dealer exemption if volume migrates off-platform.

7. Safeguarding — CASS 17 is the compliance centre of gravity

Custody is where the money and the accountability sit. The final regime confirms a mandatory trust over client cryptoassets, applying to any firm with the means to transfer the benefit of a cryptoasset — whether or not it holds the assets itself.

The board should note six points.

1. The settlement float is doubled: QCATPs may hold up to 2% of each client's cryptoassets, per client and per asset class, outside the trust for settlement only, with informed consent that clients can withdraw.

2. Reconciliations are required each business day, per client, trust and asset class, with independent data sources — the DLT cannot serve both sides of the reconciliation, and cannot be used at all for resource confirmation where third parties hold assets.

3. Shortfalls must be made whole in the same asset class within 24 hours of identifying the discrepancy (CASS 17.5.13R) — using the firm's own cryptoassets, own resources, or an appointed third party — with no materiality threshold and no carve-out by cause, creating a direct balance-sheet exposure to operational error; failure to meet the deadline triggers immediate written notification to the FCA and to each affected client, a strengthening of the consultation position, and for illiquid assets a firm may set aside an alternative asset of equal value only if clients agree.

4. Third-party custodians may be appointed only under a written, case-by-case policy demonstrating no increased risk of loss, and no security interest, lien or right of set-off may be granted to them — a direct constraint on prime-brokerage-style arrangements.

5. Accountability is personal: safeguarding carries a prescribed responsibility (PRz) under SM&CR (final rules in PS26/13), to which board approval of third-party appointments may be delegated.

6. There are two significant changes of position: custody of tokenised traditional securities (RSICs) is carved out of CASS 17 and stays under CASS 6 for now (existing Article 40 custodians must vary their permission to add Article 9N), and a new exception removes the trust requirement for firms holding only back-up keys where the client retains full control (CASS 17.3.12) — such firms remain subject to the means-of-access security rules and may not appoint third parties. Custody records must use the new blockchain-sensitive "safeguarding cryptoasset class" — returning an equivalent asset on a different blockchain requires client agreement.

8. Lending, borrowing and staking — retail protections confirmed

The retail package proceeds essentially as consulted. Lending and borrowing require appropriateness testing, per-service express consent (a one-time consent model was rejected), mandatory over-collateralisation with margin call and liquidation levels modelled so that neither is expected within the first 6 months, a 50% cap on firm-supplemented collateral (clients may top up their own collateral above it), negative balance protection aligned with the CfD regime (COBS 22.5.17R), and a prohibition on proprietary tokens in retail lending and borrowing — held despite an evenly split consultation.

The FCA also states expressly that it intends to limit the provision of margin trading and leveraged services to retail clients, kept under review — a product-perimeter statement any board planning retail products needs. Retail collateral must be safeguarded on trust; title transfer collateral arrangements are explicitly prohibited for retail clients and permitted for non-retail. Lent assets, by contrast, transfer to the firm's ownership and sit outside CASS protection entirely — a disclosure and reputational exposure the board should understand before approving any retail yield product.

On staking, the FCA moved. Per-instance consent is dropped: firms may take consent covering existing and future holdings of specified cryptoassets, preserving the auto-staking model — though blanket consent across unspecified assets is prohibited, and auto-staking terms must state the future-holdings right and the cancellation route. A new obligation added after consultation requires an annual (12-month) client statement covering staked amounts, rewards, fees and current terms. Slashing risk must be disclosed pre-service; the policy statement treats slashing purely as a disclosure item and is silent on firm liability for slashing losses.

9. DeFi and the perimeter still to come

The FCA will apply the rules to DeFi arrangements where an identifiable controlling person is carrying on a regulated activity, assessed case-by-case — "same risk, same regulatory outcome" — with 91% of respondents supportive.

The genuinely decentralised remain outside the perimeter. The load-bearing guidance is still outstanding: a DeFi guidance consultation (indicators of decentralisation) is due late 2026, final perimeter guidance under CP26/13 — including the temporary settlement exclusion under Article 9Q — is pending, and audit requirements for cryptoasset firms will be consulted on separately. The perimeter is settled in principle and unsettled in detail.

10. Cost

The FCA's final cost-benefit analysis puts total compliance costs at £920m (present value, 10 years) — up 17% from £788m at consultation, driven mainly by a larger expected firm population and higher per-firm familiarisation costs.

Benefit estimates rose too (average UK consumer holdings updated from £1,850 to £2,250), and an overarching combined CBA across the crypto consultations was published alongside the PS. Per-firm transition and ongoing estimates: custody £1.8m/£0.6m per year, trading platforms £1.9m/£2.0m, intermediaries £0.2m/£0.2m, lending and borrowing £0.4m/£0.7m, staking £0.3m/£0.2m.

The FCA describes these as mean averages and concedes firms "may in practice experience higher costs" — budgets should not anchor on them. The consultation-stage net benefit (+£352m; EANDCB £66.4m) was not restated in the final CBA.

11. What the board should do now

• Decide the structure. Confirm the UK entity/branch strategy before the gateway window (30 September 2026 – 28 February 2027); the branch route trades global liquidity access for whole-firm UK regulatory scope.

• Allocate the accountability. Appoint the safeguarding PRz holder and settle the delegation framework for third-party custody approvals ahead of authorisation.

• Size the balance-sheet exposure. Same-class shortfall top-up within 24 hours, with no materiality threshold, is a capital and liquidity question, not a compliance one — quantify it against custody volumes and illiquid asset lines.

• Commission the systems build now. Daily per-client reconciliations, 1-minute post-trade publication, 24-hour settlement initiation, T+0 client reporting with DTI identifiers, 5-year records (now including transaction hashes, wallet addresses and network fees), execution policy consents, per-asset staking consent flows and annual statements will not be assembled between deferral announcements and go-live.

• Respond to the September 2026 consultation. The deferral package is the last live opportunity to shape transition timing; treat it as a priority submission.