The FCA intends to apply the High Level Standards (with adjustments) to cryptoasset firms. These include the Threshold Conditions (COND), Principles for Business (PRIN), General Provisions (GEN) and Supervision (SUP) Sourcebooks, which set out fundamental obligations applicable to all FCA authorised firms.

In relation to PRIN specifically, where there are requirements on firms for their customers, the FCA proposes that the definitions of ‘customer' and ‘client' will include a holder of a qualifying stablecoin.

The FCA also proposes disapplying certain Principles in relation to cryptoasset trading platforms (“CATPs”) in certain circumstances — for example Principle 6 (Customers' interests) and Principle 9 (Customers: relationships of trust) will not apply to an operator of a CATP for professional clients.  CATPs will, however, be subject to some of the Principles when dealing with retail investors.

The FCA proposes to apply SYSC and related sourcebooks to cryptoasset firms in a similar manner to other FCA-regulated firms, including:

• Code of Conduct (COCON)
• Fit and Proper Test (FIT)
• Senior Managers and Certification Regime (SM&CR), in particular SUP 10C
• Financial Crime guidance and reviews (FCG and FCTR)

The FCA intends to apply the following parts of SYSC to cryptoasset firms.

SYSC 8 (outsourcings) is not expressly included, but the CP says that outsourcings will be covered in the part of the CP dealing with operational resilience (see further below).

In relation to SYSC 10, the FCA notes that due to specific conflicts of interest risk arising from business models in the cryptoasset market (e.g. vertical integration), it intends to consult separately in late 2025 on the conflicts position.

The FCA also intends to apply SM&CR to all firms carrying out cryptoasset activities. Among other things, the FCA welcomes feedback on how to ensure the regime applies proportionately to cryptoasset firms based on size and complexity, noting that SM&CR rules apply differently depending on the tier a firm falls in (i.e. Limited, Core or Enhanced firms).

In relation to financial crime, the FCA intends to apply the same rules in place for other FSMA authorised firms to cryptoasset firms, including the rules and guidance under SYSC 6, FCG and FCTR.

All cryptoasset firms are expected to fall in scope of the operational resilience framework set out in the FCA Handbook (primarily, SYSC 15A). The CP highlights the FCA's expectations on firms to have a comprehending understanding and mapping of its resources underpinning important business services, and strong cyber resilience measures. A UK branch of an overseas firm would not be in scope of SYSC 15A.

Notably, the CP also clarifies that use of permissionless DLTs would not be considered an outsourcing arrangement under SYSC 8.1.1R. The FCA will further consult in Q1/Q2 of 2026 on non-Handbook guidance on the use of DLTs to provide greater clarity on their implications for operational resilience.

In a separate chapter of the CP, the FCA sets out further guidance for cryptoasset firms to help them implement operational resilience requirements within the Handbook (e.g. SYSC 15A on operational resilience and SYSC 8 on outsourcing), with reference to cryptoasset-specific considerations such as: private key security and validator risks; use of critical third-party services such as DLT providers (including permissionless DLTs); and blockchain forks in the context of communication strategies to manage operational disruptions.

The guidance helpfully sets out hypothetical examples of how various Handbook requirements—e.g. undertaking mapping exercises, identifying important business services (“IBS”), setting impact tolerances, and testing disruption scenarios—may apply to different kinds of cryptoasset firms.

For instance, the FCA provides an example of a qualifying stablecoin issuer which has the technical ability to freeze stablecoins (e.g. if stolen or linked to illicit activity), thus improving security and general compliance. In another example, the FCA posits that where a firm provides custodial staking services, an operation of validator nodes could be identified as an IBS.

The guidance notes that where a cryptoasset firm relies on decentralised third party providers and/or does not have direct contractual agreements in place in relation to a service (e.g. decentralised protocols), the firm should strengthen its internal controls and monitoring beyond traditional means, such as via enhanced transaction monitoring across on-chain and off-chain activities, stress-testing node connectivity and performing regular independent audits of smart contracts.

The FCA seeks feedback on whether stakeholders agree with the guidance set out in the CP and whether the FCA could provide clearer or better tailored examples.

The FCA proposes to apply the ESG Sourcebook to cryptoasset firms in the same way as other FSMA authorised firms. For example, cryptoasset firms will be required to ensure that any claims about sustainability characteristics of its products are fair, clear and not misleading (ESG 4.3.1R).

The FCA does not propose to introduce new climate-related or sustainability disclosures for cryptoasset firms, particularly in light of the difficulties in obtaining sustainability data in this nascent market.