The Forthcoming UK Cryptoasset Prudential Regime: Implications and Considerations for Firms

Skadden Publication / The Distributed Ledger: Blockchain, Digital Assets and Smart Contracts

Sebastian J. Barling Simon Toms Wilf Odgers

Executive Summary

  • What’s new: The UK FCA’s proposals for a new prudential regime for cryptoasset firms introduce capital, liquidity, risk management and governance requirements. 
  • Why it matters: The new regime will apply to firms that become authorised under the forthcoming UK cryptoasset regime, requiring them to maintain sufficient financial resources to absorb losses, safeguard client assets and ensure operational continuity. 
  • What to do next: Firms looking to become authorized under the new UK crypto regime will want to weigh prudential considerations in their business planning.

__________

The UK Financial Conduct Authority’s (FCA’s) recent consultation papers represent a significant step in the UK’s development of a licensing and supervision regime for cryptoasset services, which is intended to come into force in October 2027. This article summarises the key elements of the consultation and provides analysis of its implications for firms and groups considering establishing or scaling a UK cryptoasset entity.

As described in our earlier update, in December 2025 the FCA published Consultation Paper CP25/42 (the CP), which, in conjunction with Consultation Paper CP 25/15, sets out detailed proposals for a bespoke prudential regime for cryptoasset firms.

The CP outlines a prudential framework based on the existing Investment Firms Prudential Regime (IFPR), which applies to UK MiFID (Markets in Financial Instruments Directive) investment firms — but tailored to reflect the operational, custody, technology and financial risk characteristics of cryptoasset business models.

The regime introduces baseline permanent minimum capital requirements, activity-based “K-factor” style capital metrics, liquidity requirements, and enhanced governance and risk management obligations.

Key Proposals

The following is a summary of the key measures under the consultation (see our previous client alert on CP 25/15 for more details).

Scope and Overall Structure

The forthcoming UK cryptoasset regulatory framework will apply to firms authorised to carry on regulated cryptoasset activities, including, among others:

  • Cryptoasset custody.
  • Staking.
  • Operating cryptoasset trading platforms.
  • Dealing as principal or agent in cryptoassets.
  • Arranging cryptoasset transactions.

The prudential framework will be implemented through a new FCA sourcebook and is designed to ensure that authorised cryptoasset firms maintain sufficient financial resources to:

  • Absorb losses arising from operational failures, cyber incidents or market stress.
  • Effectively safeguard client assets.
  • Maintain operational continuity during periods of stress.
  • Execute an orderly wind-down without causing harm to clients or market integrity.

The regime will be explicitly risk-based and scalable, meaning firms with greater client asset exposures, transaction volumes or operational complexity will face correspondingly higher prudential requirements.

Permanent Minimum Capital Requirement

The FCA proposes that all authorised cryptoasset firms must maintain a permanent minimum requirement (PMR), which serves as a baseline prudential threshold regardless of business volume.

The level of PMR will depend on the nature of the cryptoasset activities undertaken, with higher thresholds applying to firms conducting activities that involve:

  • safeguarding client cryptoassets,
  • staking cryptoassets,
  • issuing stablecoins,
  • operating trading platforms, or
  • assuming principal risk.
This reflects the FCA’s assessment that these activities present elevated risks of client harm. The proposed levels of PMR for each activity are as follows:

PMR REGULATED ACTIVITY

£75,000

Dealing as agent in qualifying cryptoassets.

£75,000

Arranging deals in qualifying cryptoassets.

£150,000

Operating a cryptoasset trading platform.

£150,000

Qualifying cryptoassets staking.

£150,000

Safeguarding cryptoassets.

£350,000 Issuing qualifying stablecoints.

£750,000

Dealing as principal in qualifying cryptoassets.

The FCA also proposes detailed rules governing the composition of eligible own funds. Consistent with the structure of the IFPR, own funds are categorised into different tiers reflecting quality and loss absorbency, analogous to Common Equity Tier 1 (CET1), Additional Tier 1 (AT1) and Tier 2 capital.

Capital must be of high quality and capable of absorbing losses on a going-concern basis, with the highest proportion expected to be held in CET1-equivalent instruments. Eligible capital will typically include:

  • CET1-equivalent instruments, such as ordinary share capital and retained earnings.
  • Certain qualifying subordinated instruments, subject to strict eligibility criteria.
  • Deductions for illiquid assets and intragroup exposures that do not provide genuine loss-absorbing capacity.

The FCA emphasises that regulatory capital must be permanent, fully paid up and freely available to absorb losses. Firms will not be permitted to rely on contingent support from group entities or other arrangements that do not meet eligibility criteria. 

Activity-Based Capital Requirement

In addition to the PMR, firms will be subject to activity-based (or “K-factor”) capital requirements designed to ensure that capital scales appropriately with business risk. 

These requirements will be calculated using metrics analogous to the K-factor framework under the IFPR, but tailored to cryptoasset business models. The FCA proposes capital requirements linked to factors including:

  • The value of cryptoassets safeguarded on behalf of clients.
  • The volume and value of cryptoasset transactions facilitated by the firm.
  • Client money or asset handling exposures.
  • Counterparty exposures arising from principal trading activity.
  • Operational scale metrics that reflect the firm’s potential to cause harm.

These activity-based requirements are intended to ensure that firms with larger client asset exposures or operational footprints maintain proportionately higher capital buffers.

The FCA’s approach places particular emphasis on safeguarding exposures, reflecting concerns regarding operational failures, cyberrisks and the irreversible nature of cryptoasset transactions.

Own Funds and Overall Capital Requirements

The FCA proposes that firms must at all times maintain own funds equal to or greater than the highest of:

  • The PMR.
  • The activity-based capital requirement.
  • The firm’s own assessment of capital adequacy under its overall risk assessment process (more on this below).

This “overall financial adequacy rule” ensures that regulatory minimum thresholds operate as a floor rather than a ceiling, and that firms must hold additional capital where their specific risk profile warrants it.

Firms will also be required to monitor capital adequacy on an ongoing basis and notify the FCA promptly if their capital resources fall below required levels.

Liquidity Requirements and Liquid Asset Buffers

The FCA proposes baseline liquidity requirements designed to ensure that firms maintain sufficient liquid resources to meet obligations as they fall due and to support orderly wind-down.

Firms will be required to hold a minimum amount of core liquid assets, which may include cash and certain highly liquid financial instruments. The FCA signals that not all cryptoassets will qualify as liquid assets for prudential purposes, reflecting concerns regarding volatility, liquidity and valuation reliability.

Liquidity requirements will be calibrated to ensure that firms can continue operating during periods of financial stress and complete an orderly wind-down if necessary.

Firms will also be required to implement internal liquidity adequacy assessment processes, including stress testing and monitoring of liquidity risks.

Overall Risk Assessment Process

The proposed regime introduces a requirement for firms to conduct a comprehensive overall risk assessment, similar in structure to the Internal Capital and Risk Assessment (ICARA) framework under the IFPR. As under the ICARA process, firms must assess potential harms arising from their activities, determine the financial resources necessary to mitigate those harms, and ensure that capital and liquidity remain adequate on an ongoing basis.

This process includes:

  • Identifying potential sources of harm to clients and markets.
  • Assessing the financial resources required to mitigate those risks.
  • Conducting forward-looking stress testing and scenario analysis.
  • Developing credible wind-down plans.
  • Ensuring that capital and liquidity remain adequate at all times.

The overall risk assessment process must be documented, regularly reviewed and approved by senior management. Firms will also be required to take corrective action promptly where capital or liquidity resources are insufficient.

Although the structure is broadly the same as the ICARA under IFPR, it is likely that the areas of emphasis and calibration may differ to reflect the cryptoasset context. For example, particular weight may be placed on harms arising from safeguarding and custody activities, including operational failures, cyber incidents and loss, or compromise of private keys.

The irreversible nature of many cryptoasset transactions and the technological dependencies inherent in distributed ledger systems means that operational risk is likely to feature more prominently in the prudential assessment than in many tradition investment firm models.

Concentration Risk and Risk Management Requirements

The FCA proposes requirements designed to ensure that firms identify, monitor and manage concentration risks. This includes exposures to individual counterparties, cryptoasset issuers, custodians, liquidity providers and intragroup entities.

Cryptoasset firms often rely on concentrated infrastructure providers or liquidity sources. The FCA expects firms to assess these dependencies and ensure that concentration risks do not undermine financial resilience.

Firms will be required to implement appropriate risk management frameworks, including policies and controls designed to identify, monitor and mitigate prudential risks.

Group Consolidation and Supervision

The FCA has not included any proposals regarding how it will approach group consolidation and supervision in respect of UK cryptoasset firms, instead stating that it will expect firms to consider group risk as part of their overall assessment. This is presumably intended to ensure that risks arising from group structures are captured in any case, with the aim of preventing regulatory arbitrage.

It remains to be seen how the FCA intends to treat group consolidation in respect of UK cryptoasset firms that are part of wider groups. If taking the same approach to investment firms, the FCA may seek to impose additional requirements where group structures create increased prudential risk, including those relating to capital, liquidity or risk management.

In any event, it is likely that group structures and intragroup dependencies will be a key focus area in supervisory assessments.

Prudential Structuring Implications

The FCA’s proposed prudential regime will directly influence how UK cryptoasset firms are capitalised, and how groups allocate activities across jurisdictions and design financial resilience frameworks.

Unlike the current money laundering registration regime, the proposed framework imposes quantitative capital and liquidity requirements, and introduces forward-looking financial resilience obligations that must be satisfied at the level of the authorised UK firm.

For global cryptoasset groups, these requirements will necessitate deliberate structuring of UK subsidiaries, including to address capital allocation, booking arrangements, intragroup dependency and liquidity management needs.

See Annex A for some of the key prudential structuring issues that will apply in respect of UK cryptoasset entities under the new regime, what they mean for the entities and their groups, and what such entities and their groups should consider doing to ensure they are ready for authorisation under the new regime when it goes live.

Practical Considerations for Preparing for the Authorisation Process

Firms seeking authorisation under the forthcoming regime will need to demonstrate not only technical compliance with prudential rules but also a credible and well-integrated prudential framework. The FCA is likely to assess prudential readiness holistically, including regarding capital adequacy, liquidity resilience, governance and financial risk management.

The following practical considerations may assist firms in preparing for authorisation.

Confirm Prudential Structuring

As discussed in the previous section, the prudential requirements will directly influence how UK cryptoasset entities are structured, capitalised and operated. Firms should ensure that prudential considerations are embedded into entity design from the outset, rather than addressed as a compliance exercise after the operating model has been established.

In particular, firms should consider:

  • Ensuring that the UK entity is capitalised with sufficient eligible own funds, calibrated to its expected activity level.
  • Understanding how safeguarding, custody and trading activities will affect capital requirements.
  • Assessing liquidity needs, including wind-down funding requirements.
  • Ensuring that intragroup arrangements do not undermine the stand-alone financial resilience of the UK entity.

Failure to align entity structure and business model with prudential requirements at an early stage may necessitate restructuring during the authorisation process, potentially resulting in delays or increased capital requirements.

Identify and Manage Risks

The FCA will expect firms to demonstrate a mature understanding of their prudential risk profile at the point of authorisation. This includes implementation of an overall risk assessment framework that identifies potential harms, assesses capital and liquidity adequacy, and incorporates forward-looking stress scenarios.

Firms should ensure that overall risk assessment documentation is complete, internally consistent and aligned with financial projections included in the authorisation application. The FCA is likely to scrutinise assumptions, stress scenarios and wind-down modelling.

Developing these frameworks early will also enable firms to identify potential capital or liquidity constraints before submitting an application.

Engage Early With the FCA

Early and transparent engagement with the FCA can help facilitate a more efficient authorisation process. Firms should be prepared to articulate clearly their prudential framework, including:

  • Capital structure and own funds composition.
  • Activity-based capital modelling and projections.
  • Liquidity risk management and wind-down planning.
  • Governance and oversight of prudential risks.

The FCA will expect firms to demonstrate not only compliance with minimum requirements but also a clear and credible strategy for maintaining financial resilience as the business grows.

Firms should ensure that prudential analysis is internally coherent and consistent across regulatory submissions, financial projections and business plans.

Be Prepared for Areas of Particular Scrutiny

Based on the FCA’s supervisory approach to the IFPR, firms should anticipate particular scrutiny in several areas.

Forward-looking capital modelling and stress testing will be a key focus. Firms should ensure that projections are realistic, supported by clearly documented assumptions and capable of demonstrating resilience under severe but plausible stress scenarios.

Wind-down planning will also receive detailed scrutiny. Firms may want to ensure that wind-down plans are operationally credible and supported by realistic financial modelling, including sufficient liquidity to maintain operations and return client assets during wind-down.

The FCA is also likely to assess carefully the quality and permanence of regulatory capital. Firms should consider ensuring that capital held within the UK entity is fully loss-absorbing and compliant with eligibility criteria.

Finally, firms should expect scrutiny of governance arrangements, including the extent to which senior management understands and oversees prudential risks.

Build Out Internal Governance, Systems and Controls

The transition from no registration (or registration under the money laundering regime) to full prudential authorisation will require meaningful enhancement of internal governance and financial risk management capabilities.

Firms may want to ensure that systems and controls support ongoing monitoring of capital adequacy and liquidity sufficiency. This includes implementing regular internal reporting, escalation procedures and governance oversight.

Senior management should be able to demonstrate clear ownership of prudential risk and the ability to respond promptly to emerging financial stress.

Investing in appropriate governance and financial risk infrastructure at an early stage can significantly improve the efficiency of the authorisation process and reduce the risk of supervisory challenge.

Annex A

ISSUE WHAT IT MEANS WHAT TO DO

Entity-level capitalisation. The FCA proposes that UK cryptoasset firms must maintain permanent minimum capital and activity-based capital requirements using eligible own funds that are fully loss-absorbing and permanently available. This aligns with the conceptual approach under the IFPR but is calibrated to reflect cryptoasset-specific risks, particularly safeguarding and custody exposures.

Own funds must be of sufficient quality and permanence. Capital held elsewhere in the group, contingent parental support or intragroup receivables will not substitute for eligible regulatory capital held directly by the UK-authorised entity

Global cryptoasset groups will need to allocate permanent regulatory capital directly to UK subsidiaries. This may create structural capital inefficiencies, particularly where UK revenues are modest relative to global operations but prudential requirements are driven by safeguarding or transactional exposures rather than profitability.

Firms that previously operated using centralised global capital pools will need to adapt to a model in which capital is distributed across multiple regulated entities. This may also increase the overall group capital required to support international operations.

Groups should consider ensuring that UK cryptoasset firm subsidiaries are capitalised with appropriate instruments, typically ordinary share capital and retained earnings. Capital planning should be forward-looking and incorporate projected increases in activity-based capital requirements as client assets under safeguarding and transaction volumes grow.

Groups should also consider establishing internal capital management policies governing capital injections, dividend restrictions and capital contingency planning. Treasury and finance functions may want to ensure that capital held within the UK cryptoasset firm remains continuously compliant with regulatory thresholds, including under stressed market conditions.

Booking models. The FCA’s activity-based capital framework directly links prudential requirements to the scale and nature of activities conducted by the UK cryptoasset firm. Capital requirements will increase in proportion to metrics such as the value of client cryptoassets safeguarded, the volume of transactions facilitated and exposures arising from principal trading activity.

Custody and safeguarding activities are expected to be among the most capital-intensive, reflecting the FCA’s focus on protecting client assets and mitigating harm arising from operational failures, cyber incidents or loss of private keys.

The allocation of activities across group entities will have direct prudential consequences. UK entities that hold client assets, operate custody infrastructure or act as principal counterparties will face materially higher capital requirements than entities performing purely agency or introducing functions.

This creates strong incentives for firms to evaluate carefully where cryptoasset activities are conducted and how legal and operational responsibilities are allocated across jurisdictions.

Firms should consider conducting detailed prudential impact assessments when designing UK operating models. This includes analysing how safeguarding arrangements, custody structures and execution models affect regulatory capital requirements.

For example, firms may want to assess whether the UK entity will:

  • Safeguard client cryptoassets directly or rely on third-party or intragroup custodians.
  • Act as principal in transactions or operate on an agency basis.
  • Maintain operational control over private keys or rely on group infrastructure.

These decisions will directly influence capital requirements and ongoing financial resource needs. Firms may want to ensure that business model design and prudential planning are closely integrated.

Overall risk assessment obligations. The proposed regime requires firms to implement an ICARA-like overall risk assessment process, with forward-looking assessment of capital adequacy under both normal and stressed conditions. This represents a significant shift from static capital threshold compliance toward continuous prudential risk management.

UK cryptoasset firms must identify material sources of potential harm, assess the financial resources needed to mitigate those risks, and ensure sufficient capital and liquidity are available at all times.

Cryptoasset firms will need to implement sophisticated capital adequacy monitoring frameworks comparable to those used by investment firms and other regulated financial institutions. This may represent a substantial operational and governance uplift for firms transitioning from the existing money laundering registration regime.

Crypto-specific risk factors — including extreme price volatility, rapid changes in client behaviour, operational failures affecting private key access and cyber incidents — must be incorporated into capital adequacy assessments.

 Firms should consider developing integrated risk assessment frameworks involving finance, risk and operational teams. This includes:

  • Forward-looking capital projections under multiple growth and stress scenarios.
  • Reverse stress testing to identify scenarios that could render the business model unviable.
  • Clear escalation and remediation processes where capital adequacy is threatened.
  • Regular board-level review and approval of prudential adequacy assessments.

These frameworks should be embedded into business-as-usual financial management rather than treated as periodic regulatory exercises.

Liquidity requirements and wind-down financial planning. In addition to capital requirements, firms must maintain sufficient liquid resources to support ongoing operations and enable orderly wind-down if necessary. The FCA emphasises that firms must be able to exit the market without causing harm to clients or market integrity.

Cryptoasset firms may face elevated liquidity risks due to volatile client activity, operational dependencies on technology infrastructure and the need to ensure continuous safeguarding of client assets.

Firms will need to maintain conservative liquidity buffers and ensure access to sufficient liquid financial resources under both normal and stressed conditions. This may increase the cost of operating UK cryptoasset entities, particularly for firms with custody or safeguarding responsibilities.

Wind-down planning will require firms to estimate realistically the financial resources needed to return client assets, terminate contracts, maintain systems and complete operational closure in an orderly manner.

Firms may want to implement formal liquidity risk management frameworks, including monitoring of liquid asset buffers, stress testing of liquidity adequacy and contingency planning.

Wind-down plans should be supported by detailed financial modelling, including assumptions regarding wind-down duration, operational costs and potential adverse market conditions. Liquidity resources should be calibrated to ensure wind-down feasibility without reliance on uncertain external funding.

Group risk and financial independence of UK entities. The FCA’s prudential assessment approach reflects a supervisory focus on ensuring that UK-authorised cryptoasset entities remain financially resilient even when operating within complex global group structures.

Where UK entities rely heavily on intragroup services, infrastructure or operational support, the FCA may consider these dependencies when assessing prudential adequacy.

UK cryptoasset entities must be capable of maintaining financial resilience on a stand-alone basis. Reliance on discretionary parental support, intragroup funding or operational dependencies may increase prudential scrutiny and, in some cases, result in higher capital or liquidity expectations.

Groups may also face increased complexity in capital planning where multiple jurisdictions impose entity-level prudential requirements.

Firms should consider ensuring that UK cryptoasset entities maintain sufficient stand-alone financial resources and that intragroup arrangements are structured to support prudential resilience. This includes:

  • Ensuring that intragroup arrangements are contractually robust and operationally resilient.
  • Maintaining sufficient local capital and liquidity buffers.
  • Avoiding excessive reliance on short-term intragroup funding.
  • Aligning group treasury and capital management frameworks with entity-level prudential requirements.

Firms may also want to ensure that governance arrangements support effective oversight of prudential risks at both entity and group levels.

 

This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. This memorandum is considered advertising under applicable state laws.

BACK TO TOP