Building custody for tokenised shares while further rules develop
Tokenisation and the new UK regime · Part 3 of 6
CASS 6 already sets the baseline for holding tokenised securities. What is still to come is an additional framework specific to them. A platform can design and test its custody model now, without waiting for that framework.
Palvinder Gill, Principal, Insight Regulatory Consulting Limited and Founder of cryptopru.com UK position checked on 7 October 2026.
This article assumes the platform has already concluded that it safeguards relevant specified investment cryptoassets (RSICs), meaning tokenised securities such as shares. Part 2 explains how to reach that conclusion. From 25 October 2027 that activity needs permission under article 9N of the Regulated Activities Order, as inserted by SI 2026/102.
The applicable rulebook is not missing. The FCA says that "for now, firms will be assessed under CASS 6", the existing custody rules for traditional investments. It will consult on additional rules for safeguarding RSICs in the first half of 2027 (FS26/1, 1.10 and Chapter 3 response). Its policy statements confirm that RSIC custody stays on CASS 6, with any client money under CASS 7 (PS26/11, Chapter 7 response; PS26/13, Chapter 5, paragraphs 5.1 to 5.4). CASS 6 already sets requirements for records and reconciliations, and for shortfalls: until a shortfall is resolved, the firm must set aside its own assets, its own money, or both, to cover its value for the affected clients (CASS 6.6, including 6.6.54R). The FCA's application gateway opened on 30 September 2026. For firms that will safeguard only RSICs, the form asks for a completed CASS 6 questionnaire. The questionnaire covers the holding structure, records, reconciliations, discrepancies and shortfalls, oversight of sub-custodians, staff training, and the return of assets on insolvency (form information, p. 51).
Map which rules apply today and from 25 October 2027
A platform may hold more than one kind of asset. Map each asset against the activity carried on and the rule that governs it, and separate today's requirements from those that start on 25 October 2027.
RSICs are under CASS 6 now and remain so until the RSIC-specific rules are made.
Qualifying cryptoassets safeguarded from a UK establishment, including stablecoins held for clients, fall under CASS 17 from 25 October 2027 (CASS 17.1.1R; PS26/11, instrument FCA 2026/42). CASS 17 does not apply today.
Client money is under CASS 7. The FCA expects each population to be kept separate (PS26/13, Chapter 5, paragraph 5.23).
A stablecoin used to settle a trade is not automatically a client custody holding. The exclusion for temporary holdings to facilitate settlement (article 9Q) needs to be analysed. PERG 18.6.6 says such a holding is unlikely to need to last more than 24 hours, and further guidance is due in the FCA's perimeter consultation planned for early in the fourth quarter of 2026 (PS26/18, Chapter 4 response).
What CASS 17 can inform, and what it cannot
CASS 17 is the FCA's final approach to custody risks specific to cryptoassets. It can inform selected controls, but it does not replace the CASS 6 obligations that apply, and it is not a forecast of the RSIC rules. Its main features are these:
Client assets are held on trust (CASS 17.3.3R). Each business day the firm calculates what it owes each client, confirms what it holds and reconciles the two (CASS 17.5.6R, 17.5.7R and 17.5.10R). The ledger may confirm what is held but may not be used to calculate what is owed (PS26/11, Chapter 7 response).
A shortfall must be made good within 24 hours of being identified, in the same class of cryptoasset, not in cash of equivalent value (CASS 17.5.13R(4)). Affected clients must be told, and the FCA notified in writing if the shortfall is not made good (CASS 17.5.15R and 17.5.16R).
Ownership and investor protection
The register of members is prima facie evidence of who owns a company's shares (Companies Act 2006, section 127). A platform cannot settle legal entitlement by choosing which database it prefers, so the ownership and registration model needs legal validation. Respondents to the FCA identified the hardest areas as evidencing ownership where traditional and tokenised records coexist, reconciling across custody chains, and returning assets in an insolvency (FS26/1, 3.13 to 3.16).
FSCS protection has not been extended to claims arising from safeguarding RSICs under the new regime (PS26/13, Chapter 12, paragraphs 12.29 to 12.31 and 12.39 and response). Whether other services have cover depends on the service. An investor should ask: if the platform fails, who can identify my entitlement, recover access and return the asset, and what protection applies to this particular service?
Running example (fictional, illustrative, not a legal determination). Platform P holds tokenised shares in Company A for investors, plus a stablecoin balance used only to settle trades. The shares are under CASS 6 now. Whether the stablecoin balance is excluded as a temporary settlement holding depends on article 9Q. Change one fact: if P also holds stablecoins for clients beyond settlement, P will have a CASS 17 population from 25 October 2027.
Practical judgement (the author's view, not an FCA position). Designing daily reconciliation and a same-class shortfall process now, informed by CASS 17, reduces the risk of rebuilding when the RSIC rules arrive. It must sit alongside CASS 6, not replace it.
Deciding how the custody model will work
The custody lead, legal adviser and technology lead should build a dated asset-flow map. It should assign every receipt, holding, transfer and reconciliation point to CASS 6, 7 or 17, or to none, both today and from 25 October 2027.
The legal adviser should validate the ownership and registration model, including which record evidences entitlement.
Before launch, run dry runs of a reconciliation break, a lost key and a provider failure. The evidence should cover entitlement records, segregated populations, access controls, exception logs, escalation, funding of shortfalls and the asset-return process. A pre-launch applicant can show designed controls and dry runs. It does not need to start unauthorised live custody to create evidence.
If the firm will safeguard only RSICs, the application lead should complete the CASS 6 questionnaire from the tested design. A mixed firm answers the qualifying-cryptoasset custody screens instead (Part 5). Either way, plan any article 40 variation of permission (PERG 2.7.10AG) and respond to the 2027 consultation.
The PS26/11 paper in cryptopru.com's Field Guide sets out CASS 17 in full, with a worked reconciliation example.
Key takeaways
CASS 6 is the baseline for custody of tokenised securities now. The additional RSIC rules, to be consulted on in the first half of 2027, are the uncertainty.
Map every asset to its rule population, both today and from 25 October 2027. Settlement holdings need analysis under the article 9Q exclusion, not an assumption.
Validate the ownership model in law, test the controls in dry runs, and tell investors what protection applies to their holding.
Sources
This is general information, not legal, tax or investment advice.
Next: Part 4, What your custody platform needs to fund before authorisation
Palvinder Gill is Principal of Insight Regulatory Consulting Limited and founder of cryptopru.com, a free toolkit for firms preparing FCA cryptoasset applications, to which this article refers.
Comments