Preparing a coherent FCA cryptoasset application
Tokenisation and the new UK regime · Part 5 of 6
The FCA has published advance information on its cryptoasset application form, and the September revision adds five items. The harder task is making the permissions, business plan, forecasts and custody model describe the same business.
Palvinder Gill, Principal, Insight Regulatory Consulting Limited and Founder of cryptopru.com UK position checked on 26 September 2026.
The FCA's document "Information about the authorisation application form for cryptoasset firms" is information only, not guidance. The version dated 17 September 2026 says that only "very minor changes to the detail of question wording" are still expected (p. 1). It is the version to prepare against, but the live form is the final check at submission. Page references below are to that version. The comparison with the July version is drawn from the author's line-by-line review of both published documents.
The timetable, and what a late application loses
The application period runs from 30 September 2026 to 28 February 2027 under the FCA's direction made under regulation 52 of SI 2026/102. A firm that applies within the period may rely on a saving provision while its application is undetermined, or refused but still open to review, provided no direction under regulation 55(3) has been given (regulation 53). The saving lasts for no more than two years from full commencement on 25 October 2027. A firm can still apply after the window closes, but it does not get the same saving. A business already carrying on the activity that files late is limited to what is needed to perform its existing contracts (regulations 55 and 56). Filing an application does not guarantee authorisation.
How the form is built, and what September added
The generic sections, covering firm details, permissions, senior managers, controllers, close links, forecasts, IT and significant events, did not change in September (pp. 3 to 31). Each permission then triggers its own cryptoasset components, which are shown in the FCA's diagram (p. 2). The September revision adds five items of information:
a personal account dealing attestation, required of every firm except stablecoin-only issuers (p. 36);
an appropriateness assessment for firms with retail customers (p. 37; COBS 4.12A.28R);
a risk analysis or legal advice for overseas firms applying through a UK branch (p. 38);
a CASS 6 questionnaire for firms that will safeguard only relevant specified investment cryptoassets (RSICs), meaning tokenised securities (p. 51); and
customer disclosures for trading platforms that deal as principal (p. 72).
It also adds a market abuse prevention attestation for intermediaries (p. 59).
Custody questions depend on the model. The screens on trust, reconciliation, third-party custodians and means of access (pp. 47 to 50) are written for firms that safeguard qualifying cryptoassets. The CASS 6 questionnaire is framed for firms that safeguard only RSICs. A mixed firm completes the qualifying-cryptoasset screens, and CASS 6 still governs the RSICs it holds. Use the component map and the firm's own business model to identify which questions apply (pp. 1 to 2 and 47 to 51; PS26/13, Chapter 5).
An attestation is a specific representation. The personal account dealing attestation, for example, states that the firm "will make adequate arrangements" and will provide documentation on request (p. 36). Give the exact representation each attestation requires. Two references in the September document should be checked against the rules before they are relied on. The lending and borrowing screen cites CRYPTO 10.2.5, which is the staking information rule; the lending and borrowing rule is CRYPTO 9.2.1R (p. 55). The large trading platform screen no longer carries its post-trade transparency heading, although CRYPTO 7.3 still applies (p. 71).
Running example (fictional, illustrative, not a legal determination). Platform P will safeguard only RSICs. One row of its evidence tracker reads: RSIC-only safeguarding; page 51 questionnaire; owner, the custody lead; reconcile the answers to the asset-flow map, the records design and the sub-custodian arrangements; sign-off by legal and compliance. Company A, which relies on P, asks P for its permission plan, its filing status and its contingency if authorisation is delayed.
Practical judgement (the author's view, not an FCA position). Each attestation should be backed by approved documentation and implementation evidence suited to the firm's stage of development. A pre-launch firm can show designed and tested controls. It should not describe controls it has not yet built as operating.
Deciding what goes in the submission
The application lead should keep an evidence tracker. For each permission it should record the relevant question, the source version, the document or attestation, the accountable owner, the approval status and any unresolved dependency.
The application lead, the finance lead and the custody lead should run a final consistency review. It should test whether the asset-flow diagram, contracts, financial model and business plan describe the same activities and the same customers.
At submission, check against the live form. Where a form reference and the rule differ, build to the rule and record the reason.
A firm relying on the saving provision should file within the application period. A founder who relies on a provider should confirm the provider's filing plan in writing.
The Application Pack on cryptopru.com lists each form entry by permission, flags the July to September changes and links each entry to its rule. It is a checklist, not a substitute for the firm's own review.
Key takeaways
Prepare against the 17 September 2026 information document, and make the final check against the live form.
Only applications made in the window get the saving provision, and it has conditions and a two-year limit. Later applications are possible, but an existing business that files late is limited to performing its existing contracts.
Identify which components apply from the business model, and test that the whole application describes one business.
Sources
FCA Handbook: COBS 4.12A.28R; CRYPTO 7.3, 9.2.1R and 10.2.5R.
This is general information, not legal, tax or investment advice.
Palvinder Gill is Principal of Insight Regulatory Consulting Limited and founder of cryptopru.com, a free toolkit for firms preparing FCA cryptoasset applications, to which this article refers.
Comments