UK’s emerging cryptoasset regulations: trading, custody, issuance, and promotions in focus (Part 2)

In Part 2 of the UK’s crypto regulations landscape, Charles Kerrigan from CMS explores the new rules that reshape crypto custody, including safeguarding and FCA authorisation. You can read Part 1 here.

 

Custody and safeguarding of cryptoassets

The safekeeping of customers’ cryptoassets is another critical pillar of the new regime. Under the current law, crypto custody providers in the UK only need to register under the Money Laundering Regulations for AML purposes. Going forward, providing custody of cryptoassets will require full FCA authorisation, and with that comes a suite of investor protection obligations.

Scope of custody regulation: The regulated activity is framed as ’[s]afeguarding or safeguarding and administering (or arranging the same) a cryptoasset other than a fiat-backed stablecoin and/or means of access to the cryptoasset (custody)’. If your business holds customers’ crypto (or the means to access it, like private keys) – whether as an exchange, wallet provider, custodian, trustee, or even as a borrower holding collateral – you likely fall in this category. The definition covers having control, which allows you to move the asset for someone else’s benefit. Notably, the rules explicitly bring in scenarios like crypto lending arrangements: if a customer lends crypto to a platform and the platform has a contractual obligation to return it later, the platform is deemed to be safeguarding that cryptoasset for the customer (since the customer retains a right to its return). This inclusion ensures that even if an asset is off the customer’s wallet (e.g., lent out for yield), the firm holding it is responsible for safeguarding it.

By contrast, a pure self-hosted wallet or non-custodial service where the user alone controls the keys is not caught; only third-party custody is intended to be regulated. The law will also allow for technical arrangements, such as multi-signature or MPC (multi-party computation) custody setups are covered if any one party to the scheme can unilaterally move the coins. But if no single provider can move assets (i.e., it truly requires multiple independent approvals outside a single firm’s control), in that case, an individual provider in that scheme might not be seen as ’safeguarding’ on its own. These nuances will likely be clarified in FCA guidance.

Custody standards – learning from Traditional Finance: Once authorised, crypto custodians will have to comply with stringent safeguarding rules, akin to the Client Assets Sourcebook (CASS) rules that apply to securities and money custodians. Industry briefings suggest the FCA will impose requirements such as:

• Segregation of assets: firms must segregate client cryptoassets from their own assets and from other clients’ assets. Each client’s holdings should be clearly identified and ring-fenced. This is to prevent loss or misuse of client assets and to ease restitution if a firm fails (so client assets aren’t treated as the firm’s in insolvency).
• Daily reconciliation: just as securities custodians reconcile accounts daily, crypto custodians will need to reconcile their on-chain or off-chain records of customer assets daily to ensure they match what should be held. Discrepancies must be investigated promptly. This may require robust internal ledgers mapping each client to blockchain addresses or cold storage accounts.
• Acknowledgment of trust letters: traditional custodians obtain ’acknowledgment of trust’ letters from banks where they hold client money, acknowledging the money is held on trust for clients. Similar letters or arrangements might be needed with third-party crypto storage providers (e.g., if using a third-party custody service or cloud HSM, etc.) to acknowledge that the assets are held for the firm’s clients. The idea is to protect client assets from claims by those third parties or their creditors.
• Robust custody agreements: firms must have clear agreements with clients outlining the custody terms, risks, and how assets can be used (if at all). For instance, can the custodian lend out the assets (rehypothecation) or not? Under new rules, rehypothecation may be restricted for retail client assets, unless clearly agreed and perhaps only under certain conditions.
• Operational resilience & security: custodians will need state-of-the-art cybersecurity and multi-layer controls to prevent theft or loss of keys. The FCA will expect thorough risk assessments for key generation, storage (e.g., the use of cold vs. hot wallets), transaction approval processes, and incident response in case of breaches. Given past hacks in the crypto industry, this will be an area of intense scrutiny.
• Prudential and insurance requirements: safeguarding firms might have to hold a minimum amount of capital (or insurance) to cover potential losses of client assets. The FCA, in its May 2025 consultation (CP25/15), proposed a new ’Cryptoasset Prudential’ regime (CRYPTOPRU) for capital and liquidity requirements. This could require crypto firms, including custodians, to maintain capital based on factors like assets under custody or operational risk, similar to how investment firms are regulated. Firms may also be encouraged or required to obtain insurance against hacks or loss, where available.

These requirements will feel familiar to traditional finance compliance teams but may pose challenges for crypto-native companies that grew in a more laissez-faire environment. Many crypto businesses will need to invest in compliance infrastructure and possibly reorganise to meet these standards. On the positive side, these rules directly address some of the high-profile issues (exchange failures, asset commingling, lost keys) in the sector. Clients should gain more confidence that their coins are protected and not being misused. HM Treasury’s view is that clear custody standards and consumer protections must apply, just as in other financial sectors.

Interaction with existing AML regime: Currently, crypto exchange and wallet providers in the UK are only registered for anti-money laundering (AML) supervision. Under the new regime, once a firm becomes an authorised cryptoasset firm, it will no longer need the separate AML registration – authorisation will cover that. However, AML obligations themselves won’t disappear; firms will still have to do KYC, transaction monitoring, and comply with the AML laws, just as any authorised firm does. In fact, an authorised crypto firm must notify the FCA that it’s carrying on crypto business (to aid AML supervision) and must continue meeting AML rules in the Money Laundering Regulations. So, from a compliance perspective, AML is still critical – the change is mostly administrative (one fewer registration), but the FCA will keep a close eye on crypto AML compliance under the broader licence.

Cryptoasset issuance and disclosure

The new proposals concern who can issue cryptoassets and disclosures. The proposals are different for stablecoins used as payment (which the UK treats as a class of their own), and other cryptoasset issuances to the public (e.g., ICOs or token launches).

Fiat-Backed stablecoins

The UK moved early to regulate stablecoins that reference fiat currency, referring to them as ’Digital Settlement Assets’ (DSAs) in legislation. The Financial Services and Markets Act 2023 already provided a framework for bringing fiat-referenced stablecoins into regulation. Building on that, HM Treasury in October 2023 confirmed it will regulate fiat-backed stablecoins in a manner ’as if they were securities’ in many respects. However, as mentioned previously, stablecoins will not be brought into the scope of UK payments regulations due to the additional regulatory burdens that this would impose.

Under the draft Cryptoassets Order, a new regulated activity is ’issuing a qualifying stablecoin’ from the UK. This covers issuing, or undertaking to redeem, or maintaining the value of a stablecoin (or arranging another to do so). In practice, any issuer of a pound-pegged stablecoin (or a dollar-pegged one issuing from the UK) will need to be authorised by the FCA. They will be subject to prudential requirements (ensuring the coin is fully backed by high-quality reserve assets), similar to how an e-money issuer or bank would need to hold capital against their liabilities. The UK chose not to treat stablecoins simply as e-money; instead, it sees them akin to regulated securities with ’prospectus-style’ disclosure and ongoing reporting. That means a stablecoin issuer likely must publish full disclosure documents about the coin (reserves, governance, redemption rights, risk factors, etc.) and possibly regular attestations of reserves – much like a prospectus and periodic reports for a security. This approach is stricter than the EU’s MiCA, which imposes its own regime for stablecoins, but with certain issuance volume caps, etc. The UK appears to be aiming for a gold-standard transparency and robustness for any stablecoin entering the UK market. The government explicitly wants high standards for GBP-backed stablecoins, reflecting a cautious approach to anything that could be a widely used form of money.

Non-UK stablecoin issuers (e.g., a USD stablecoin issued entirely abroad) won’t themselves require UK authorisation unless they have a UK establishment. However, if such coins are used in the UK, the exchanges or wallets dealing with them will be regulated, and those firms can only use or list approved stablecoins that meet standards. Therefore, indirectly, foreign stablecoin issuers have an incentive to meet UK criteria if they want their coins supported in the market.

HM Treasury has also addressed the failure of systemic stablecoin firms: consultation proposals were issued on how to handle the insolvency or failure of a major stablecoin (that is, for example, one that could impact financial stability). This might involve Bank of England oversight or special administration regimes, ensuring an orderly wind-down that protects coinholders.

For stablecoin issuers and projects, the message is: if you plan to issue a fiat-pegged crypto in the UK, you will need to build a compliance framework akin to a payments institution or securities issuer. That includes reserve management, audit, transparency, and an FCA-authorised entity.

Public token offerings and crypto promotions

Beyond stablecoins, the UK is designing rules for other cryptoasset issuances to the public. Currently, a token generation event (TGE) or initial coin offering (ICO) is not a regulated activity in the UK if the token is not a security. Many projects simply sell tokens to the public with minimal disclosure. Under the future regime, making a public offer of a cryptoasset (that is not already a security or e-money) will become regulated.

HM Treasury plans to create a Public Offer and Admissions to Trading (POATR) regime tailored to cryptoassets. In essence:

• Offering cryptoassets to the public in the UK must be either via a regulated trading venue or otherwise providing an approved disclosure document. The likely model is that a crypto exchange could admit a token for trading if an ’admission document’ is prepared (similar to how stock exchanges require a prospectus or listing particulars). The FCA will set high-level disclosure rules, while the trading venue might set detailed requirements for the content of the token’s whitepaper or admission document.
• These crypto disclosure documents won’t necessarily mirror full prospectuses used for shares – the Treasury expects them to be ’lighter’, but still meaningful. They should include key info on the token’s purpose, technology, governance, supply, and risks. The liability for the document’s content will fall on whoever prepares it (either the issuer or possibly the exchange if it takes on that role). If a token is admitted to trading without such a document, it would likely be a breach of the regime (similar to an unapproved securities offering).
• Certain exemptions or limited offers might not trigger the complete disclosure requirement – e.g., offerings below a small amount, offers only to institutional or high-net-worth investors, or private token distributions below a threshold, could be carved out (analogous to existing prospectus exemptions). But any wider retail-facing token sale will be caught.
• Once admitted, ongoing disclosure might be required – e.g., material developments affecting the project should be reported to the market (similar to how listed companies must release price-sensitive news). And if the project’s token is traded, insiders will be subject to market abuse laws – trading on inside information about a crypto project, or manipulating token prices, will be illegal just as it is for stocks. Trading venues will likely need rules to suspend or delist tokens that don’t comply with disclosure obligations.

Overall, this is moving toward an equity-like regime for significant crypto tokens, characterised by initial disclosure, ongoing transparency, and accountability. While the details are still forthcoming, crypto ventures eyeing UK markets should prepare for more rigorous ’whitepapers with accountability’. It won’t be as simple as posting a litepaper on a website – there will be formats to follow and legal liability if disclosures are misleading.

Notably, these rules were foreshadowed in the Treasury’s 2023 consultation and confirmed in principle in 2024. The market abuse extension (extending the UK Market Abuse Regulation to crypto) and the admissions/disclosure regime are slated to be rolled out after the core regime in 2026*. This sequence means that the priority is to regulate exchanges, custodians, etc., and shortly thereafter implement the complementary rules that ensure the assets traded on those venues are subject to proper oversight.

Part III will focus on the UK's new crypto promotions regime, which has been in force since October 2023, introducing stricter standards for marketing to retail investors.

Stay tuned!

 *The FCA Crypto Roadmap says that the crypto regime will go live at some point in 2026. Therefore, it looks unlikely that the extension and admissions/disclosure regime will still go live this year. The FCA notes in CP25/25 (Sep 2025) that they will consult separately on admissions/disclosure and the market abuse regime- consultation doesn't appear to have started yet.

 

About the author 

The Blockchain Industry in the UK Landscape Overview names Charles Kerrigan as a leading influencer in the blockchain. He is part of teams working on investing and setting standards for emtech in EMEA, the US, and APAC.  At CMS, Charles is part of the firm’s specialist crypto and digital assets team.  He is on the board of the Investment Association Engine, a NED for various fintech and regtech firms, and teaches entrepreneurship in the Computer Science Department at UCL.  He widely published in mainstream and trade press and is the author of the textbook Crypto and Digital Assets Law and regulation.