Article 9N vs article 40: are you in scope of the UK crypto regime?
Every other decision about the UK cryptoasset regime — capital, systems, whether to apply at the gateway at all — depends on one question answered first: which regulated activity, if any, you are carrying on. For custody businesses that comes down to article 9N and article 40 of the Regulated Activities Order, and the relationship between the two is often described backwards.
Where the new activities live
The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102) insert a new Chapter 2B into Part 2 of the Regulated Activities Order 2001, immediately after article 9K. The new specified activities are:
- Article 9M — issuing qualifying stablecoin
- Article 9N — safeguarding of qualifying cryptoassets and relevant specified investment cryptoassets
- Article 9S — operating a qualifying cryptoasset trading platform
- Article 9T — dealing in qualifying cryptoassets as principal
- Article 9W — dealing in qualifying cryptoassets as agent
- Article 9Y — arranging deals in qualifying cryptoassets
- Article 9Z6 — qualifying cryptoasset staking
One numbering warning. The 2025 draft instrument used different article numbers, and commentary written before the SI was made in February 2026 sometimes calls the safeguarding activity article 9O. In the instrument as made, safeguarding is 9N and 9O is one of its exclusions.
Article 9N has two limbs
Article 9N(1) captures both safeguarding a qualifying cryptoasset or relevant specified investment cryptoasset on behalf of another person, and arranging for another person to carry on that activity. The second limb catches firms that never touch keys themselves but assemble the arrangement — easy to miss when mapping a group structure.
A relevant specified investment cryptoasset is defined in article 9N(5)(b) as a specified investment cryptoasset that is a security or a contractually based investment. That definition is what pulls tokenised securities into the new activity rather than leaving them with the traditional custody permission.
The article 40 boundary runs the other way
Article 40 of the RAO is the long-standing safeguarding and administering investments activity. It would be natural to assume the new regime carves article 40 business out of 9N. It does not. Regulation 40(6) of SI 2026/102 amends article 40 itself, inserting a new article 40(4) providing that references to assets in that article do not include qualifying cryptoassets or relevant specified investment cryptoassets.
The perimeter was therefore drawn by shrinking article 40, not by excluding article 40 business from 9N. The practical consequence for a custodian: where the token is itself the specified investment, custody sits in 9N; where the token merely evidences a conventional registered security, safeguarding that underlying security remains article 40 business. The FCA has set out its view of that line in draft perimeter guidance rather than final guidance.
The exclusions are narrow
- Article 9O — a group exclusion where the activity is carried on under arrangements operated by an authorised cryptoasset custodian connected with the firm, assuming a responsibility no less onerous. This is a group test, not a bare nominee test.
- Article 9P — introductions to an authorised cryptoasset custodian, and only from the arranging limb in 9N(1)(b).
- Article 9Q — temporary settlement arrangements.
- Article 9R — the residual exclusions, including where the firm is appointed merely to give instructions to a third party who has undertaken directly to the client to safeguard, and a holding-out filter in 9R(2) under which there is no 9N(1)(a) activity unless the firm holds itself out as engaging in the business of providing the service.
Overseas firms: section 418, not the overseas persons exclusion
Regulation 41(6) of the SI inserts new subsections into section 418 FSMA deeming certain overseas activity to be carried on in the UK. For safeguarding and staking, the test turns on whether the firm acts on behalf of a consumer and not at the direction of another firm holding Part 4A permission for that activity. For the trading, dealing and arranging activities, it turns on involvement in a sale or subscription to or by a consumer with no FCA-authorised intermediary interposed. Consumer is defined as an individual in the UK acting for purposes other than a trade, business or profession, so the deeming provisions are retail-facing.
Two related points matter to non-UK groups. The FCA states in its draft perimeter guidance that the overseas persons exclusion in article 72 of the RAO does not apply to any regulated cryptoasset activity. And regulation 41(4) disapplies the section 285 recognised body exemption for Chapter 2B activities.
What is not settled
The FCA consulted on cryptoasset perimeter guidance in CP26/13, published on 15 April 2026 and closed on 3 June 2026, and has said it intends to publish final guidance in autumn 2026. Separately, HM Treasury published a draft amending SI on 21 April 2026, with consultation closing 22 May 2026, which would add further exclusions — including one for nominee companies operated by central securities depositories, aligning the crypto position with the existing article 40 treatment. Neither is law today. If your perimeter analysis depends on either, record it as an assumption and revisit it when the final texts land.
The gateway is expected to open on 30 September 2026 and close on 28 February 2027, with the regime applying to firms granted FSMA permission on or after 25 October 2027. Registration under the Money Laundering Regulations does not convert. The perimeter call determines which permission you request — make it, in writing, before you start drafting the application.
The checklist behind this article
The working document behind this: an 11-page readiness checklist for the FCA cryptoasset gateway, with the rule, article number or published FCA statement cited behind every item, and the open questions marked as open rather than guessed at. Seven activity heads with RAO article numbers, permanent minimum requirement by activity, the application pack, SM&CR, and the eight failure modes the FCA has published. USD 149, with the updated edition free when the September 2026 fee notice and the autumn perimeter guidance land.