UK crypto custody: one permission, two client-asset rulebooks
The FCA's safeguarding permission is usually described in three words — custody of cryptoassets. Its actual statutory name is longer, and the extra words change the analysis. Article 9N is headed "Safeguarding of qualifying cryptoassets and relevant specified investment cryptoassets". Every published seven-head summary we have seen drops the second half of that name, and the firms most affected by the omission are tokenised-securities custodians who concluded the cryptoasset regime does not reach them because their instruments are already specified investments. On custody, it does.
Why the permission is wider than the token definition
Article 88F(2) of the amended RAO defines a qualifying cryptoasset as one that is "(a) fungible, (b) transferable, (c) not solely a record of value or contractual rights, including rights in another cryptoasset, and (d) not excluded by paragraph (4)". Paragraph 88F(4) then pushes specified investment cryptoassets outside that definition, along with electronic money, fiat currency including central bank digital currency, and closed-loop tokens redeemable only with the issuer.
So tokenised securities are out of the qualifying-cryptoasset perimeter — and then back in, for custody purposes only, through the second limb of article 9N's title. A firm can be outside the token definition entirely and still need a 9N permission.
CASS 17 does not follow the permission all the way
PS26/11, published 30 June 2026, refers at paragraph 1.3 to "the application of safeguarding requirements under CASS 17 with adjustments to reflect cryptoasset custody". CASS 17 is the new client-assets chapter for cryptoasset custodians, and reporting of the policy statement indicates that client money arising from safeguarding activity is picked up under the existing CASS 7 regime.
The part worth checking against chapter 7 of PS26/11 before you build anything is this: law-firm analysis of the policy statement reports that the FCA decided not to apply CASS 17 to relevant specified investment cryptoasset custody at this stage, and that firms holding those assets fall under CASS 6, the existing chapter for specified investments, instead. We flag that as reporting of the policy statement rather than as text we have read in the instrument. If it is right, the consequence for a mixed book is that one permission generates two client-asset rulebooks, two sets of reconciliations and two records regimes — a materially different operating model from the one most custody firms have scoped.
What sits outside safeguarding altogether
Chapter 2B carries several carve-outs that decide whether the permission is needed at all:
- Article 9N(2)(c) — a right of return under a title transfer cryptoasset collateral arrangement, or under a buy-back agreement, is not safeguarding. But 9N(2)(d) switches that off where the counterparty is a consumer or an FCA-specified person. The same trade is inside or outside the perimeter depending on who is on the other side of it.
- Article 9R(2) — no 9N(1)(a) activity unless "P holds itself out as engaging in the business of providing a service". A holding-out gate on the first limb only.
- Article 9O — group custody. Article 9Q — temporary settlement holding.
- Article 9R(4) — recognised CSDs.
PS26/11 at paragraphs 2.40 to 2.41 notes that UK qualifying cryptoasset trading platforms may operate a settlement "float" subject to conditions and limitations, and that article 9Q "provides for a temporary settlement exclusion from the perimeter of the safeguarding activity". Reporting of the final rules says the own-funds allocation permitted against a float was raised to 2% of safeguarded cryptoassets; we have not read that figure in the policy statement text ourselves, so confirm it there before you model it.
What a safeguarding permission costs
Under PS26/12 the permanent minimum requirement for safeguarding is GBP 150,000, the same band as operating a trading platform and staking. Own funds are the higher of the PMR, the fixed overheads requirement and the K-factor requirement, and for custodians the relevant K-factor is K-RCS at 0.04% of assets safeguarded. On GBP 500m of client cryptoassets that is GBP 200,000, above the PMR — so for any custodian of scale the PMR is not the binding number. Where a firm holds several permissions, the highest applicable PMR applies rather than the sum.
Separately, SM&CR Enhanced thresholds are GBP 100bn in safe custody assets and client cryptoassets combined, and GBP 20bn in backing assets calculated as a three-year rolling average. The FCA does not anticipate many firms, if any, meeting them, so a custodian planning on the Enhanced regime is almost certainly planning for the wrong tier.
When this bites
Regulation 1(2) of SI 2026/102 brings the Regulations into force on 25 October 2027. The FCA's regulation 52 direction runs the application period from 9:00am on 30 September 2026 to 11:59pm on 28 February 2027 — but regulation 52(5) is explicit that a direction "does not prevent applications for a relevant cryptoasset permission being made outside the relevant application period". What ends in February 2027 is eligibility for the regulation 53 saving, not the ability to apply. For a custodian, the longer pole is usually not the application date but the reconciliation and records build that CASS demands, and that build depends on a scoping answer — which assets, under which chapter — that many firms have not yet reached.
The checklist behind this article
The UK FCA Cryptoasset Gateway readiness checklist covers the custody file specifically: both limbs of article 9N, the 9N(2)(c) and (d) title transfer position, the client-assets scoping question above, and the prudential arithmetic. Every item is cited to the article, regulation or policy statement behind it, every figure is marked as instrument text or as reporting of it, and the points still genuinely open — including the CASS treatment of tokenised-securities custody — are marked open rather than answered with something plausible. USD 149, with updated editions free as the position develops.
If you safeguard qualifying cryptoassets only, for one client type, on your own infrastructure, the checklist is enough and you do not need us. If you hold tokenised securities alongside them, run title transfer collateral across a mixed consumer and institutional book, or custody through a group entity, the 48-hour gap check takes your actual arrangements.