Introduction & Summary
At present, the FCA’s oversight of crypto is largely limited to financial promotions and AML obligations. CP25/25, together with the proposed HMT statutory regime, is intended to transform this limited remit into a comprehensive regulatory architecture covering governance, conduct, resilience, and redress. CP25/25 proposes a significant expansion in the FCA’s regulation of the cryptoasset industry.
Under the new regime firms conducting qualifying cryptoasset activities will need to be authorised by the FCA (whether or not they are already authorised for the purposes of their other regulated financial services activities). The FCA says its new rules will not differentiate between different types of cryptoassets – activity-specific rules will be consulted on later this year. The aim of the FCA’s proposals is to ensure that cryptoasset firms have the appropriate systems, controls, processes, financial resources, and people in place to conduct their activities safely and responsibly. Its approach is generally to apply similar standards to those applicable to other regulated activities, tailored to reflect the unique nature of cryptoassets. This is consistent with the FCA’s “same risk, same regulatory outcome” policy.
This note (i) outlines the key features of the consultation; (ii) identifies points of ambiguity, tension, and risk; and (iii) suggests actionable next steps.
Key Takeaways
The FCA proposes to apply SM&CR, SYSC (including operational resilience), COCON, FIT, and parts of GEN, COND to crypto firms, while deferring full application of the Consumer Duty (Principle 12) for further discussion.
The consultation is only one part of the broader FCA Crypto Roadmap, alongside other FCA consultation or discussion papers, such as:
- CP25/14 – Stablecoin issuance and cryptoasset custody
- CP25/15 – Prudential regime for cryptoasset firms
- DP25/1 – Regulating Cryptoasset Activities
Areas of uncertainty include how permissionless DLT will map into outsourcing rules, how FOS access may be structured (particularly for cross-border firms), and the scope of product governance / COBS adaptation.
Firms should initiate gap analyses, governance redesign, and consultation response planning now, given tight timelines and integration with related regulatory initiatives.
They will also need to be prepared for material additional compliance costs under the new regime: the FCA estimates average implementation costs per firm of £100k (with an additional £65k cost for cryptoasset custodians) and average ongoing annual costs of £30k.
Proposed Changes
Scope & Consultation Structure
- The perimeter for regulation is defined by the draft RAO SI and discussed further in the Policy Note which accompanies the draft SI.
- CP25/25 includes a consultation exercise on the application of the FCA’s Handbook’s High Level Standards, Business Standards, Regulatory Processes, and Regulatory/Registry Guides (ending on 12 November 2025), and a discussion exercise on how other parts of the Handbook might be applied, including the Consumer Duty, COBS, PROD, and DISP rules, and possible access under the new regime to the Financial Ombudsman Service. The discussion period ends on 15 October 2025, and will be followed by a further consultation on what the FCA decides to propose in this area.
Application of High-Level Standards
- FCA Principles for Businesses (PRIN) apply, but Principle 12 (Consumer Duty) is excluded for now.
- GEN, COND, COCON, and FIT apply in full.
SM&CR, SYSC, and Operational Resilience
- SM&CR applies in full, requiring Statements of Responsibility, responsibility maps, fitness/propriety testing, and conduct training.
- SYSC modules on governance, outsourcing, risk management, conflicts, and SYSC 15A (operational resilience) will apply to all crypto firms.
- Permissionless DLT is not automatically outsourcing under SYSC 8, but firms remain accountable for resilience.
Conduct, Product Governance & Consumer Duty
- The FCA is not applying the Consumer Duty immediately but seeks views on tailored conduct rules or phased Duty application.
- FCA is considering how COBS and PROD should apply to crypto distribution chains and token issuance.
Complaints, Redress & FOS Access
- FCA proposes applying DISP complaint-handling rules.
- It is exploring granting crypto customers access to the Financial Ombudsman Service (FOS) whilst noting the potential restrictions that may exist for customers of overseas cryptoasset firms.
Fees & Future Consultations
- A consultation on FCA fees for crypto firms will be launched in November 2025.
- Further consultations will follow on activity-specific conduct standards, admissions/disclosure obligations, and a crypto market abuse regime.
Points of Uncertainty & Risk
- DLT governance: unclear boundaries of responsibility when firms rely on decentralised protocols.
- Cross-border FOS access: potential conflicts with overseas regimes.
- Product governance: challenges applying COBS/PROD frameworks to token ecosystems.
- Compliance burden: significant resource and system upgrades required for smaller firms.
- Interplay with CP25/14 and CP25/15: prudential, custody, and conduct obligations must be integrated.
Recommendations & Next Steps
- Gap analysis against SM&CR, SYSC, and DISP expectations.
- Governance redesign: draft Statements of Responsibility, responsibility maps, and fit-and-proper frameworks.
- Outsourcing review: assess wallet tech, DLT dependencies, cloud reliance, and ensure oversight rights.
- Resilience testing: simulate severe but plausible crypto-specific disruptions.
- Consultation responses: prepare submissions on Consumer Duty, FOS access, and conduct rules.
- Track consultations: monitor November 2025 fees consultation and 2026 rulemaking.
For further information, please contact ukreg@proskauer.com.