UK Crypto Custody Rules: What FCA's New Safeguarding Regime Means for Exchanges

The FCA's new safeguarding regime forces every UK crypto exchange to ring-fence client cryptoassets in trust, separate from company funds, under a rulebook known as CASS 17. Firms must apply from 30 September 2026, and the regime becomes mandatory on 25 October 2027, meaning UK crypto custody rules now carry the same seriousness as the client money protections that have governed banks and brokers for decades. For the estimated 12% of UK adults, roughly 7 million people, who already hold cryptoassets, this is the clearest signal yet that the Financial Conduct Authority intends to treat digital asset custody as core financial infrastructure rather than an unregulated sideline.

What the FCA Safeguarding Regime Requires

The FCA safeguarding regime, formalised through Policy Statements PS26/10 and PS26/11 published on 30 June 2026, inserts a new chapter, CASS 17, into the FCA's Client Assets Sourcebook specifically for cryptoasset custodians. Any firm holding client crypto for longer than a day during trade settlement is treated as a regulated custodian and must obtain a full safeguarding permission.

Under CASS 17, firms must:

Hold client cryptoassets in trust, legally separated from the firm's own balance sheet
Maintain accurate books and records with regular internal reconciliations
Adopt a technology-agnostic approach to private key management, so no single custody method is mandated
Commission annual audits from an independent external auditor
Submit monthly regulatory returns to the FCA

The regulator has also raised the amount of own funds a firm can hold to support a settlement float model to 2% of safeguarded cryptoassets, giving exchanges a small operational buffer while still requiring the bulk of client holdings to remain ring-fenced. Notably, the FCA has not yet applied CASS 17 to custody of regulated specified investment cryptoassets; those firms continue under the existing CASS 6 regime for now, a targeted carve-out that shows the FCA is phasing in custody standards rather than imposing a single blanket rule.

The legal foundation for all of this is the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, which brings custody, trading platform operation, intermediation, staking and lending within the FCA's regulatory perimeter for the first time. Authorisation applications open on 30 September 2026 and run until 28 February 2027, giving firms a defined window to secure permissions before the regime's substantive provisions commence.

Why the FCA Cryptoasset Rules Matter for Retail Investors

The FCA cryptoasset rules matter because they determine what happens to an investor's coins if an exchange fails. Ring-fenced, trust-held assets under CASS 17 should not form part of a failed firm's assets available to general creditors, giving retail holders a materially stronger claim than they had under the previous, largely unregulated custody arrangements.

This protection is reinforced by the Property (Digital Assets etc) Act 2025, which gave cryptoassets recognised status as personal property under UK law, strengthening legal claims in cases of insolvency, theft or civil dispute. However, UK crypto investor protection still has a significant gap: the FCA has confirmed it is not extending Financial Services Compensation Scheme or Financial Ombudsman Service coverage to cryptoasset activities. In practice, this means that even with segregated custody, an investor whose exchange collapses due to fraud, hacking or mismanagement has no compensation scheme to fall back on in the way a bank depositor would. The FCA's long-standing risk warning remains blunt: consumers should not invest unless they are prepared to lose the entire amount.

News Analysis: How UK Exchanges Are Responding

The FCA itself has described the overhaul as a "landmark" clampdown, confirming that every crypto platform, exchange, custodian and staker will need a full financial licence to deal with UK clients once the regime takes effect. That represents a fundamental shift from the lighter-touch anti-money laundering registration that has applied to UK crypto firms since 2020.

James Morris, a financial regulation partner at law firm Linklaters, has argued that folding crypto custody into the Client Assets Sourcebook is a deliberate attempt to apply decades of banking-grade client money discipline to digital assets, rather than inventing a parallel, lighter framework. That view is echoed across the legal advisory market: analysts covering the FCA's final rules note that technology-first crypto firms often have sophisticated blockchain infrastructure but limited experience with the back-office reconciliation, record-keeping and audit trails that CASS compliance demands.

That gap explains why compliance deadline pressure is falling hardest on smaller exchanges. According to the FCA, more than 250 registered UK crypto firms currently fall within scope of the new safeguarding regime, as of 5 August 2026. Larger, well-capitalised platforms with existing institutional custody arrangements are better placed to absorb the cost of annual independent audits and monthly regulatory reporting. Smaller and newer exchanges face a starker choice: invest heavily in compliance infrastructure before the 28 February 2027 application deadline, partner with an FCA-regulated custodian, or exit the UK market altogether.

The Social Impact: Who Feels This Change

Crypto ownership in the UK has grown quickly, from 4.4% of adults in 2021 to 10% in 2022 and roughly 12%, around 7 million people, today, according to HMRC-linked survey data. That growth has been concentrated among younger, often lower-income investors who are more likely to hold small balances on a single retail app rather than spread risk across institutional custodians.

For this group, the safeguarding regime is genuinely consequential. A first-time investor putting a few hundred pounds into Bitcoin through a mobile app has, until now, had little practical recourse if that platform mismanaged client funds. Ring-fenced custody under CASS 17 narrows that risk considerably. At the same time, the absence of FSCS and Financial Ombudsman Service coverage means the protection is procedural rather than financial: it reduces the chance of loss through custodial failure, but it does not guarantee compensation if losses occur regardless. Financial advisers working with lower-income and first-time investors should treat this distinction as a core part of any conversation about crypto risk, not a footnote.

What UK Investors Should Check Before Using an Exchange

Before depositing funds with any UK crypto platform, investors should verify the following:

Whether the firm is registered with the FCA under the Money Laundering Regulations and has applied, or intends to apply, for full authorisation once the application window opens on 30 September 2026
Whether client assets are held in a segregated trust structure, separate from the firm's operating funds
How frequently the exchange reconciles client balances and whether it publishes independent audit results
Whether the platform has clearly stated that FSCS and Financial Ombudsman Service protections do not apply to crypto holdings
What proportion of assets are held in cold storage versus hot wallets, and how private keys are managed

Readers researching wider household finance decisions alongside crypto exposure may find it useful to review finance coverage from Baba International on savings, pensions and everyday money management, since crypto should typically sit alongside, not replace, more conventional financial planning.

What to Do Now

UK crypto holders should take three concrete steps in response to this regime change. First, check whether your existing exchange is on the FCA's cryptoasset register and confirm its stated custody arrangements before adding new funds. Second, avoid concentrating large balances on any single unregulated or newly registered platform ahead of the 28 February 2027 authorisation deadline, since firms that fail to secure permissions may be forced to wind down UK operations. Third, keep records of transaction confirmations and account statements now, so that if a platform does run into difficulty, you have documentary evidence to support any claim during an insolvency process. Investors with meaningful crypto exposure should also review their overall portfolio balance against pensions and cash savings, given that crypto still sits outside FSCS protection entirely.

Conclusion

The FCA's safeguarding regime marks the most significant tightening of UK crypto custody rules to date, converting a patchwork of informal wallet practices into a formal, audited, trust-based system modelled on established client money law. It gives retail investors a stronger structural claim over their assets if an exchange fails, while leaving a clear gap around compensation that every UK crypto investor needs to understand. Exchanges now have a defined runway, applications from 30 September 2026 through to the regime's commencement on 25 October 2027, to prove they can meet the standard or step aside.

Baba International Editorial Team

Our editorial team specialises in UK and EU personal finance, health policy, and economic analysis. All content is researched using authoritative sources including the ONS, NHS, Bank of England, ECB, and Eurostat.

Frequently Asked Questions

When do the FCA's crypto safeguarding rules take effect?

The FCA published final rules on 30 June 2026. Firms can apply for authorisation from 30 September 2026 to 28 February 2027, with the substantive safeguarding requirements under CASS 17 commencing on 25 October 2027.

Does the FCA safeguarding regime protect my crypto if an exchange collapses?

It significantly improves your position because client cryptoassets must be held in trust, separate from company funds. However, cryptoassets are not covered by the Financial Services Compensation Scheme or the Financial Ombudsman Service, so there is no compensation guarantee if losses still occur.

How many UK crypto firms are affected by the new rules?

According to the FCA, more than 250 registered UK crypto firms fall under the new safeguarding regime as of 5 August 2026, ranging from large established exchanges to smaller platforms that will need to significantly upgrade compliance infrastructure.

What should I check before using a UK crypto exchange?

Confirm the firm is FCA-registered and pursuing full authorisation, check that client assets are held in a segregated trust structure with regular independent audits, and understand that FSCS and Financial Ombudsman Service protections do not apply to your crypto holdings.