What changed
The UK has moved cryptoasset activity into the core of the FCA Handbook. A single statutory instrument — the Financial Services and Markets Act 2000 (Cryptoassets) Regulations, passed by Parliament in February 2026 — creates a broad set of new regulated activities, and a package of six FCA publications finalised on 30 June 2026 (PS26/9 to PS26/13, plus finalised guidance FG26/7) sets out how the rulebook is extended to fit.
The FCA has largely chosen to stretch its existing framework over crypto rather than write a new one. Custody maps to CASS, with a new CASS 17 for cryptoasset safeguarding and a new CASS 16 for stablecoin backing assets. Prudential requirements sit in two new sourcebooks. Conduct runs through the Consumer Duty, COBS and SM&CR. For a firm already living inside CASS 6 and 7, this is difficult but recognisable territory.
The headline for firms is one of timing: the rules are now largely fixed, but they do not take effect until 25 October 2027. That is a genuine planning window, not an immediate cliff.
The classification of each holding decides the entire rule set — CASS 17 for qualifying cryptoassets, adapted CASS 6 for tokenised regulated investments.
One structural point matters more than any other. Custody has been split into two tracks. Genuine crypto-native assets (qualifying cryptoassets) fall under CASS 17. Tokenised versions of things that are already regulated investments — tokenised shares, bonds or fund units — are treated as relevant specified investment cryptoassets, and the FCA has decided not to apply CASS 17 to them at this stage; instead those firms must be authorised as cryptoasset custodians but apply the CASS 6 requirements. The classification of each holding therefore decides the entire rule set.
What firms should do
The date is far enough away to plan properly and close enough that firms with any crypto exposure should already be moving. A sensible sequence: classify every relevant holding, so you know whether CASS 17, adapted CASS 6, or unchanged CASS 6 applies; scope which of the new activities you will carry on and whether your permissions cover them, remembering that existing custodians will need to apply to add cryptoasset custody; run a gap analysis of systems, records, reconciliation and audit against the new requirements; and pressure-test the harder structural points — the trust model, sub-custody and delegation conditions, and legal title — where external legal input is most likely to be needed.
Two easily missed points: regulated cryptoasset activities sit outside FSCS protection, which the FCA itself flags as a disincentive to tokenisation; and where fiat flows alongside crypto custody, the CASS 7 client-money rules apply on top.
How ComplyPath can help
This is exactly the kind of change that rewards early, structured preparation. ComplyPath helps firms scope the perimeter, classify assets against the CASS 17 and CASS 6 tracks, run the gap analysis against the new safeguarding, prudential and conduct requirements, and build the governance and SM&CR arrangements the regime expects — turning a 2027 deadline into a controlled programme rather than a scramble.
Sources: FCA policy statements PS26/9 to PS26/13 and finalised guidance FG26/7 (30 June 2026); the Financial Services and Markets Act 2000 (Cryptoassets) Regulations; FCA Handbook CASS 16, CASS 17, the CRYPTO sourcebook and the COREPRU and CRYPTOPRU sourcebooks; FCA cryptoasset regime pages and Cryptoasset Roadmap.