FCA guidance links crypto firms’ risks to resources and wind-down

The FCA’s FG26/10 guidance gives cryptoasset firms regulated under CRYPTOPRU a framework for connecting their business model to financial-resource assessments, stress testing, recovery and wind-down planning. It takes effect on 25 October 2027.

Issued under section 139A of the Financial Services and Markets Act 2000, FG26/10 supports firms’ existing obligations under CRYPTOPRU 7. It is non-Handbook guidance, not a new obligation or a prescribed methodology.

The mechanism: from business model to resources

The affected cohort includes cryptoasset custodians, custodial staking firms and stablecoin issuers regulated under CRYPTOPRU. The FCA also identifies risk, compliance and prudential teams as users, alongside firms new to financial regulation.

FG26/10 says an overall risk assessment should begin with the firm’s business model and strategy. That means examining the assumptions underpinning the business plan, how the firm expects to generate returns and vulnerabilities that could affect its ability to operate. The assessment should be forward-looking and reflect the nature, scale and complexity of the firm’s activities.

The guidance then connects that assessment to financial resources. The FCA says firms should identify risks that may cause material harm, consider how changes in operations or the wider business environment could alter those risks and assess how risks can be reduced. The resulting analysis is intended to help firms calculate their financial-resource requirements and understand the implications of their wind-down plans.

This is the practical mechanism: the firm’s strategy provides the starting point, risk identification and stress testing provide the evidence, and the financial-resource and wind-down analysis show whether the business can remain viable or exit in an orderly way.

FG26/10 does not prescribe one method for making those judgments. Its contents are illustrative and non-exhaustive, and the FCA says firms should read the guidance with CRYPTOPRU 7, other applicable requirements, FG20/1 and the Wind-down Planning Guide.

Stress testing carries the analysis into recovery

The FCA calls stress testing critical to developing an overall risk assessment. Firms should use severe but plausible stresses to assess the financial impact of a range of stress events on the business.

That instruction gives the assessment a forward-looking test. It requires the firm to examine how its identified vulnerabilities affect financial resources under pressure, rather than treating the assessment as a description of the business at a single point in time. The source does not set a universal scenario library or evidence standard, leaving firms to develop an approach suited to their activities.

A reverse stress test adds a viability threshold. FG26/10 says it is intended to identify the point at which a firm’s business model stops being viable. That result can inform recovery actions and the circumstances in which wind-down planning becomes relevant.

The consequence for an operator is analytical rather than a new prescribed control. A compliance or prudential lead will need to show how the firm’s business model informs the risks selected for assessment, how severe-but-plausible stresses affect its financial position and how the results relate to recovery and wind-down planning. That traceability is an inference from the FCA’s stated purpose for the guidance, not a separate requirement named by FG26/10.

The distinction matters because CRYPTOPRU 7 remains the source of the obligation to complete an overall risk assessment. FG26/10 explains how firms should approach that obligation; it does not replace the rules or applicable law.

The legal status leaves room for firm-specific evidence

The FCA has chosen guidance rather than a fixed template. Firms must therefore apply the document proportionately, while retaining responsibility for explaining why their assessment reflects their own business and activities.

The document’s legal status limits its direct effect, but it does not make the analysis irrelevant. The FCA says the guidance is intended to help firms develop their assessments, calculate financial-resource requirements and understand wind-down implications. Those are the points at which the document can influence how firms organise evidence and connect prudential analysis to management decisions.

The FCA said it received 11 consultation responses, mostly from cryptoasset firms, membership bodies and professional advisers. It added examples on de-banking risk and legal risk before finalising the guidance. It also developed FG26/10 alongside FG26/9, the corresponding guidance for firms under the COREPRU sourcebook.

The FCA will monitor how firms use FG26/10 and may provide further clarification. That monitoring is the next test of how much convergence develops in firms’ assessments, particularly where the guidance leaves methodology open.

FCA clarification or monitoring of firms’ applications will confirm how much evidence the regulator expects for stress testing, recovery actions and wind-down planning; the source currently leaves those standards firm-specific.