FCA sets 2027 start date for COREPRU risk guidance

The Financial Conduct Authority’s FG26/9 guidance sets out how FCA solo-regulated firms subject to COREPRU should complete the overall risk assessment required by COREPRU 7. The guidance comes into force on 25 October 2027.

FG26/9 applies to COREPRU firms, including those providing cryptoasset services, and to the compliance, risk and prudential teams responsible for the assessment. It also covers firms preparing for authorisation.

One process for financial resilience

The guidance is issued under section 139A of the Financial Services and Markets Act 2000. It is illustrative and non-exhaustive, does not prescribe a single methodology and does not replace applicable rules, guidance or law.

It describes an assessment that begins with the firm’s business model, strategy and activities, including regulated and unregulated activity, group arrangements and outsourced operations. The firm should identify risks capable of causing material harm to clients or the wider market, articulate its risk appetite and assess the resources needed for ongoing operations and an orderly wind-down.

The assessment is the principal mechanism for setting the own funds and liquid asset resources needed to comply with the overall financial adequacy rule. It covers the own funds threshold requirement and liquid asset threshold requirement, while firms must continue to meet applicable regulatory minimums, including the own funds requirement and basic liquid assets requirement.

COREPRU 7 already requires firms to carry out the overall risk assessment. FG26/9 explains how its separate elements should operate as a connected process rather than in isolation. The guidance links financial resource planning to risk appetite, early warning indicators, management-action triggers and wind-down planning.

The depth and documentation of the assessment should reflect the firm’s nature, scale and complexity. Firms must identify and assess risks on an ongoing basis and embed the assessment in business-model and strategic decision-making. Where a firm’s own assessment produces a figure below the applicable regulatory minimum, the guidance says it should evidence particularly robust challenge while still holding the minimum required amount.

The FCA said there is no response required because FG26/9 is finalised guidance rather than a live consultation. It followed consultation GC26/4, which closed on 30 July 2026. The FCA received eight responses from trade bodies, cryptoasset firms, consultancies and individuals and made changes to improve clarity on baseline requirements and cumulative cash flow.

FG26/9 builds on FG20/1 and supports the prudential rules in PS26/12 and the FCA Handbook. It is separate from the FCA’s guidance for CRYPTOPRU firms, identified on the publication page as FG26/10.

The FCA said it will monitor how firms apply FG26/9 through its supervisory review and evaluation process and may issue further sector-specific guidance. The next identified milestone is the guidance’s commencement on 25 October 2027.