Does your tokenised share need cryptoasset permission?
Updated: 5 days ago
Tokenisation and the new UK regime · Part 2 of 6
The answer depends on what the token is, what each business does with it, and whether an exclusion applies. The permission question may fall on the platform, on the company, or on both.
Palvinder Gill, Principal, Insight Regulatory Consulting Limited and Founder of cryptopru.com UK position checked on 26 September 2026.
The FCA's guidance on the new cryptoasset perimeter, PERG 18, has applied since 16 September 2026 (PS26/18; instrument FCA 2026/55). The perimeter it describes takes effect on 25 October 2027 under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102). PERG 18 answers the question through five tests, applied separately to each activity and each asset:
is the activity regulated;
is it carried on in the UK;
is it carried on by way of business;
does an exclusion apply;
and does an exemption apply (PERG 18.1.11).
The asset is classified first, because the classification decides which activities and exclusions are relevant at all (PERG 18.4.11).
Step 1: classify the asset
Start by asking whether the token is an asset in its own right or only a record of rights held elsewhere. PERG 18.4.4 asks whether the person who controls the token can exercise the rights, and whether transferring the token is how those rights move. A legally authoritative register does not, on its own, make a token more than a record.
If the token is an asset, the next question is whether it is a specified investment cryptoasset (SIC), which means a token that is also a regulated investment such as a share. A token is a SIC if it meets the qualifying-cryptoasset conditions in article 88F, including that it is fungible and transferable, with certain exclusions disregarded, and it is also a specified investment (Regulated Activities Order, articles 3 and 88F; PERG 18.4.6 to 18.4.10). A SIC is not a qualifying cryptoasset, so most of the new regime does not reach it.
Only if the token is a SIC do you ask the next question. Is it a relevant specified investment cryptoasset (RSIC), meaning a SIC that is a security or a contractually based investment (article 9N(5)(b))? An RSIC is a subset of SICs, not a separate category. A tokenised share will usually be an RSIC. An RSIC enters the new regime only through safeguarding. Issuing, dealing, arranging and advising remain under the existing securities perimeter (PERG 2).
Step 2: identify each business's activity
Safeguarding means holding a qualifying cryptoasset or RSIC on behalf of another person, with control through any means to bring about its transfer (article 9N(1)(a); PERG 18.6.1 to 18.6.2). What counts is actual technical and legal control, not the name of the service. Three points matter for tokenisation businesses:
Being able only to block a transfer is not control. Holding a key share below the signing threshold is not control either, unless the holder can require others to act. Legal rights to direct other key holders can therefore matter as much as technology (PERG 18.6.2).
There is no general exclusion for technology providers. The other exclusions still apply, including those for group activity (article 9O), temporary holdings to settle a transaction (article 9Q), agents acting under a mandate, and persons who do not hold themselves out as providing the service (article 9R) (PERG 18.6.6 to 18.6.9).
Arranging for someone else to safeguard is a separate activity (article 9N(1)(b); PERG 18.6.10). The UK test and the business test apply to each activity (PERG 18.2.1; 18.3).
Firms that already safeguard securities under article 40 will need a variation of permission to cover RSICs from 25 October 2027 (PERG 2.7.10AG). The FCA said it might revisit that point after the tokenisation Call for Input (PS26/18, Chapter 4 response). FS26/1, its feedback on that Call for Input, does not revisit it.
Running example (fictional, illustrative, not a legal determination). Company A issues shares in token form. Platform P maintains the token record. Supplier K holds one key share. Change one fact at a time. If the token only mirrors A's register and transfers happen through the register, the Step 1 question is live, and the analysis may move to the share itself. If P can start transfers without the investor, P faces the safeguarding question, subject to the UK test, the business test and the exclusions. If K's share is below the signing threshold and K cannot require others to sign, that fact alone does not make K a safeguarder. If K gains an override, the analysis starts again.
Company A does not become a safeguarder because of P's activity. It should still assess its own activities separately, including any arrangements it makes for its shareholders. Marketing the offer raises separate financial promotion questions, so classifying the token does not clear the company to promote it (PERG 18.1.8).
One further point is still moving. The draft Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026, laid before Parliament on 15 September 2026, would substitute a new SIC definition and add conditional relief for safeguarding under arrangements operated by a recognised or third-country CSD. At the date above it is a draft awaiting approval by both Houses, not law.
Practical judgement (the author's view, not an FCA position). A classification is only as good as the scenarios it has been tested against. Testing an ordinary transfer, a lost key and an administrator override shows who can start a transfer and who can only block one. That is the distinction the control test turns on.
Deciding who needs permission
Legal, compliance and engineering should jointly approve a token-and-service record before the permission list is fixed. It should cover the rights, the issuer, the holder, the transfer mechanism, the key arrangements, any legal powers to direct key holders, the exclusions considered and the supporting documents. Keep a dated diagram naming each entity.
Engineering should test an ordinary transfer, a lost-key event and an administrator override, and record who could start each transfer and who could only block it.
The founder should assess the company's own activities and financial promotions separately, and ask the platform for its classification, its permission plan, its application status and its continuity plan.
Reassess whenever the product, the key arrangements or the law change. Part 5 covers filing if permission is needed.
The Perimeter Read on cryptopru.com runs these classification questions in order and gives an indicative answer. It is a starting point, not a legal determination.
Key takeaways
Classify the asset first. If it is a SIC, then ask whether it is also an RSIC. A tokenised share that is an RSIC enters the new regime only through safeguarding.
The token's legal characteristics and each firm's own activities determine the permission analysis. Control is central to custody, but the exclusions and the wider perimeter tests still need to be checked.
The issuer's position is separate from the platform's. Check the company's own arrangements and financial promotions as well.
Sources
Frequently asked questions
When does the UK cryptoasset perimeter in PERG 18 take effect?
The FCA's PERG 18 guidance has applied since 16 September 2026 (PS26/18). The perimeter it describes takes effect on 25 October 2027 under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102).
What are the five PERG 18 tests for cryptoasset permission?
PERG 18 asks whether the activity is regulated, whether it is carried on in the UK, whether it is carried on by way of business, whether an exclusion applies and whether an exemption applies. The tests are applied separately to each activity and each asset, and the asset is classified first.
Is a tokenised share a relevant specified investment cryptoasset (RSIC)?
A tokenised share will usually be an RSIC, meaning a specified investment cryptoasset that is a security or a contractually based investment. An RSIC enters the new regime only through safeguarding, while issuing, dealing, arranging and advising remain under the existing securities perimeter.
What counts as safeguarding a tokenised share under the UK cryptoasset regime?
Safeguarding means holding a qualifying cryptoasset or RSIC on behalf of another person, with control through any means to bring about its transfer. Being able only to block a transfer is not control, and nor is holding a key share below the signing threshold unless the holder can require others to act.
Do firms that already safeguard securities need a new permission for tokenised shares?
Firms that already safeguard securities under article 40 will need a variation of permission to cover RSICs from 25 October 2027 (PERG 2.7.10AG). The FCA said it might revisit the point after its tokenisation Call for Input, but its feedback in FS26/1 does not do so.
This is general information, not legal, tax or investment advice.
Next: Part 3, Building custody for tokenised shares while further rules develop
Palvinder Gill is Principal of Insight Regulatory and runs cryptopru.com, a free toolkit for firms preparing FCA cryptoasset applications, to which this article refers.
Comments