By CRYPTOVERSE Legal Consultancy
An FCA crypto regulatory business plan should explain what the applicant does, which permissions it needs and how its governance, resources and controls support the proposed operations. Its statements must agree with the application forms, financial forecasts, contracts and implementation evidence.
The FCA’s published cryptoasset authorisation application information identifies the regulatory business plan, or RBP, as a document to upload. The application’s other components depend on the firm and its proposed activities. www.fca.org.uk
For founders, this creates a practical challenge: turning a commercial proposition into a clear explanation of a regulated business.
A persuasive market opportunity is useful context. The application also needs to show who performs each function, how customers and assets move through the business, what can go wrong and who controls those risks.
What Is an FCA Crypto Regulatory Business Plan?
A regulatory business plan is the applicant’s explanation of its operating model and the arrangements supporting its proposed activities.
It should allow a reader to understand:
- The applicant and its ownership;
- Products, customers and geographic scope;
- Requested permissions;
- Contractual and transaction roles;
- Governance and personnel;
- Financial resources;
- Technology and outsourcing;
- Risks and controls; and
- Implementation dependencies.
The FCA’s threshold conditions address matters including effective supervision, appropriate resources, suitability and the business model. The RBP should be prepared with those questions in mind. FCA
The following structure is a practical drafting framework. It must be adapted to the applicable route, forms and requirements.
1. Begin With a Precise Business Summary
The opening should identify the applicant and explain its services in plain language.
Avoid broad descriptions such as:
“We provide an innovative digital asset ecosystem.”
A more useful illustrative description would be:
“The applicant proposes to execute cryptoasset transactions as agent for corporate customers. Customers will hold assets with an independent custodian. The applicant will receive transaction fees and will not control customer signing credentials.”
That explanation immediately raises the right assessment questions. Its accuracy must then be checked against the actual contracts and technical arrangements.
Include the intended launch activities separately from later expansion.
2. Connect the Business Model to the Requested Permissions
The RBP should explain why the proposed permissions match the firm’s functions.
A supporting matrix can help:
| Business function | Performing entity | Relevant permission assessment | Supporting document |
| Transaction execution | [Entity] | [Assessment] | [Agreement or procedure] |
| Asset safeguarding | [Entity] | [Assessment] | [Custody model] |
| Transaction arranging | [Entity] | [Assessment] | [Customer journey] |
| Staking arrangements | [Entity] | [Assessment] | [Mandate and controls] |
Use the completed perimeter assessment rather than inferring permissions from commercial labels.
The FCA’s PS26/18 provides final guidance on when cryptoasset activities require authorisation. www.fca.org.uk
A plan that describes functions outside its requested scope needs correction or further legal analysis before submission.
3. Explain Ownership and Group Responsibilities
Identify shareholders, controllers and relevant group entities. Explain how the applicant depends on its affiliates.
Distinguish:
- Ownership of the applicant;
- Ownership of technology and intellectual property;
- Customer contracting responsibilities;
- Employment of key personnel;
- Control over customer assets; and
- Provision of shared services.
For international groups, the RBP should explain how the applicant oversees overseas functions.
The FCA’s FG26/7 addresses international cryptoasset firms and their assessment against authorisation standards. www.fca.org.uk
A group chart should support the narrative, but it cannot replace an explanation of responsibilities.
4. Define the Customers and Products
Describe who can use each service and how eligibility is established.
Explain relevant distinctions between individuals, corporate customers, institutions and intermediaries serving underlying clients.
For each product, identify:
- Assets supported;
- Customer rights;
- Fees and revenue;
- Execution or redemption arrangements;
- Custody responsibilities;
- Restrictions; and
- Material risks.
Do not describe a product as available at launch if it remains a speculative development.
Supporting evidence: Product terms, eligibility procedures, asset assessments and approved launch decisions.
5. Show the Complete Customer and Transaction Journey
Explain onboarding, deposits, instructions, execution, settlement, withdrawals and account closure.
Use separate fiat and cryptoasset diagrams where the flows differ.
The FCA’s MLR registration guidance expressly addresses full transaction lifecycles and outsourcing information. Those expectations should be applied within the MLR route; an FSMA applicant must separately follow its applicable requirements. FCA
A useful flow description answers:
- Who receives the customer’s instruction?
- Who becomes the transaction counterparty?
- Where are assets held?
- Who can authorise a transfer?
- When does ownership change?
- What happens if settlement fails?
The diagrams, contracts and procedures should provide consistent answers.
6. Describe Governance That Reflects Real Authority
Explain how the firm makes decisions and supervises risks.
Include reporting lines, board oversight, relevant committee arrangements and escalation procedures.
For each key role, state:
- The responsibilities;
- Whether the appointment is completed or proposed;
- Relevant experience;
- Time commitment;
- Authority; and
- Resources available.
A practical governance section should explain what happens when compliance identifies a serious concern or operations need to suspend a service.
Supporting evidence: Role descriptions, appointment records, reporting arrangements and management approvals.
7. Connect Forecasts to the Operating Model
Financial projections should follow the business described in the RBP.
Explain assumptions concerning:
- Customer numbers;
- Transaction volumes;
- Fees and margins;
- Personnel;
- Suppliers and technology;
- Compliance expenditure;
- Funding; and
- Downside scenarios.
Relevant firms must assess the applicable COREPRU and CRYPTOPRU framework. www.fca.org.uk
Avoid treating projected revenue as a substitute for available funding.
An illustrative inconsistency would be a plan promising continuous monitoring and customer support while budgeting for insufficient personnel and no supporting service provider.
8. Explain Financial Crime Controls Through Procedures
The RBP should summarise the financial crime framework and refer to detailed documents.
It should explain how the business identifies risks, checks customers, monitors activity, investigates alerts and escalates concerns.
For MLR registration, the FCA expects arrangements tailored to the cryptoasset business and relevant personnel competence. www.fca.org.uk
Rather than stating only that “industry-leading tools will be used”, identify their functions, implementation status, oversight and limitations.
Supporting evidence: Risk assessments, configuration records, testing, anonymised investigations and training.
9. Explain Technology and Outsourcing Dependencies
Describe the systems supporting the service and the responsibilities retained by the applicant.
Important subjects include access controls, wallet architecture, change management, incident response and recovery.
For material suppliers, explain:
- The service provided;
- Due diligence;
- Contractual responsibilities;
- Monitoring;
- Information access;
- Failure scenarios; and
- Exit arrangements.
The FCA’s MLR registration form includes outsourcing information and oversight questions. An authorisation applicant should map its arrangements to the relevant FSMA questions and standards. fca.org.uk
Record planned suppliers as planned. Do not imply that negotiations have produced executed agreements.
10. Address Activity-Specific Risks
The RBP should identify the controls arising from its particular model.
| Model | Questions the plan should explain |
| Custody | Who controls assets, how ownership is treated and how records reconcile |
| Trading platform | How participants trade, assets are admitted and misconduct is monitored |
| Dealing or arranging | How orders, pricing, counterparties and settlement are handled |
| Stablecoin issuance | How issuance, backing and redemption operate |
| Staking | How authority, rewards, withdrawals and loss risks are managed |
The FCA’s policy package separates core and activity-specific requirements. Use the relevant provisions rather than importing the same control description into every plan. www.fca.org.uk
11. Record Implementation Status Honestly
Every important arrangement should have a clear status:
Implemented · Tested · Approved · In development · Dependent on a future event
Where work remains outstanding, identify its owner, completion date and effect on readiness.
The FCA encourages a realistic, board-agreed implementation plan and assessment of preparation and ongoing compliance resources. www.fca.org.uk
A credible explanation of a dependency is stronger than an unsupported assertion that everything is complete.
How to Support the Plan’s Claims
Use a claim-to-evidence register.
| Claim | Evidence to consider |
| Funding is available | Financial records and executed commitments |
| Monitoring is operational | Configuration and testing records |
| Management oversight is effective | Reports, decisions and escalation records |
| Suppliers are controlled | Assessments, contracts and monitoring |
| Recovery arrangements work | Exercises and remediation results |
| Customer terms match the service | Contract and operational review |
This register helps reviewers identify statements that require qualification or further verification.
Common Drafting Weaknesses
Avoid:
- Generic language that does not explain functions;
- Unclear applicant and group responsibilities;
- Contradictory descriptions of asset control;
- Forecasts disconnected from resources;
- Unsupported claims about implementation;
- Expansion plans mixed with launch activities; and
- Policies copied from another business model.
Length does not determine quality. The plan should be sufficiently detailed to explain the business while using cross-references to avoid repetition.
Final Review and Management Sign-Off
The FCA expects final, thoroughly reviewed and appropriately signed-off documents. www.fca.org.uk
Before approval, compare the RBP against forms, forecasts, contracts, policies and technical descriptions.
Management should confirm the factual model and understand the commitments represented. Advisers can support drafting and review, but the applicant must operate the arrangements described.
How CRYPTOVERSE Can Help
CRYPTOVERSE provides specialist legal and regulatory support for UK FCA cryptoasset authorisation.
Our business plan support can include regulatory scoping, operating-model review, drafting, evidence mapping and consistency checks across the application.
Request a regulatory business plan consultation with CRYPTOVERSE to turn your proposed services into a clear, supportable application narrative.
FAQs
1. Is an investor pitch deck sufficient?
It can provide background, but a regulatory plan needs detailed operating arrangements, risks, resources and controls.
2. Can we adapt an overseas business plan?
Yes, subject to assessing UK requirements and the applicant’s actual responsibilities.
3. Is there a universal required page count?
Follow the applicable instructions. Detail should reflect the model’s complexity rather than an arbitrary length.
4. Can the plan describe future implementation?
Yes, where appropriately disclosed and assessed against readiness requirements. Planned arrangements must not be presented as operational.
5. What should an FCA crypto regulatory business plan include?
An FCA crypto regulatory business plan should cover the business model, requested permissions, ownership structure, governance, financial forecasts, customer journeys, financial crime controls, technology, outsourcing arrangements, risk management and implementation status. It should also provide supporting evidence and remain consistent with the application forms, contracts and operational procedures.