By CRYPTOVERSE Legal Consultancy
The application folder looks complete.
There is a regulatory business plan, an AML framework, financial projections, a custody policy and a collection of outsourcing agreements. The project manager tells the board that the company is ready to submit.
Then a director asks three questions:
“Has the investment assumed in the financial projections actually arrived?”
“Who can instruct our overseas technology provider to suspend trading?”
“Have we tested whether customers can recover their assets if that provider fails?”
The answers are less reassuring than the documents.
The company has prepared an application. Its board has yet to establish whether the business described in that application is ready.
What is an FCA crypto authorisation readiness audit?
An FCA crypto authorisation readiness audit is a structured assessment of whether a firm’s proposed permissions, operating arrangements, people, resources and supporting evidence are sufficiently developed and consistent for submission.
It should help the board answer a practical question:
Can we demonstrate that this business can operate as described, under the requirements applicable to it?
The FCA’s minimum standards include a suitable business model, effective supervision, appropriate resources and suitability. These Threshold Conditions arise under Schedule 6 of the Financial Services and Markets Act 2000, with supporting guidance in COND. FCA
The checklist below is our recommended preparation framework. It is not an FCA certification scheme, a prescribed audit format or a guarantee of authorisation.
Start with the correct regulatory route
The FCA’s published application period runs from 30 September 2026 to 28 February 2027, ahead of commencement of the expanded cryptoasset regime on 25 October 2027.
Existing MLR-registered firms must assess their need for FSMA authorisation. Firms already holding relevant FSMA authorisation should assess whether a variation of permission is required. Submitting an application does not, by itself, authorise the proposed activities. FCA
We recommend recording the applicant entity, proposed activities, customer groups and application route before reviewing individual policies. Otherwise, teams may prepare comprehensive documents for the wrong business or permission scope.
The board-level readiness checklist
For each area, record an accountable owner, evidence location, unresolved issue and proposed completion date.
| Review area | Question for the board | Suggested evidence |
| Regulatory perimeter | Have we mapped the actual services to the relevant permissions? | Activity analysis, transaction flows and permission schedule |
| Applicant and group structure | Which entity contracts with customers, holds assets and makes decisions? | Structure chart, customer agreements and intercompany arrangements |
| Ownership and funding | Can we explain ownership, control and the provenance of funding? | Ownership records, funding agreements and supporting financial records |
| Business model | Do the application, contracts and financial model describe the same business? | Reconciled business plan, product inventory and forecasts |
| Governance | Are responsibilities allocated to people with authority and capacity? | Role descriptions, committee terms and escalation arrangements |
| Financial resources | Have we assessed the applicable requirements and credible funding needs? | Prudential analysis, funding evidence and downside forecasts |
| Financial crime | Can the controls address the risks created by our customers and services? | Risk assessment, procedures, testing and escalation records |
| Customer assets | Where applicable, can we establish ownership, control and recoverability? | Custody analysis, asset records and reconciliation evidence |
| Outsourcing and technology | Can we oversee providers and respond if they fail? | Contracts, due diligence, access arrangements and exit plans |
| Conduct and customer outcomes | Have we assessed the rules relevant to our customers and distribution model? | Applicability assessment, disclosures and customer journey reviews |
| Operational resilience | Can we respond to disruption affecting important services? | Dependency maps, exercises and remediation records |
| Wind-down | Can we exit without relying on unrealistic assumptions? | Costed plan, funding analysis and customer exit procedures |
| Application consistency | Can management explain and substantiate the submission? | Evidence index, reconciliation review and management walkthrough |
The FCA’s published application-form information provides a useful reference for organising the submission review. Firms should use the current form and instructions applicable to their application. fca.org.uk
1. Test the business through actual transactions
We recommend selecting representative customer journeys and tracing them from beginning to end.
Examples might include:
- A customer depositing funds and buying cryptoassets.
- An institutional client executing an OTC transaction.
- A customer withdrawing assets from custody.
- A transaction triggering a financial crime alert.
- A customer seeking access during a platform outage.
At each stage, ask:
Who acts, through which entity, using which system, under which agreement, and with what control?
This exercise can expose differences between the legal structure and the operating model.
For example, the business plan may say that the UK company controls withdrawals, while the service agreement gives an overseas provider exclusive authority. The readiness review should identify and resolve that inconsistency.
2. Examine funding assumptions carefully
A forecast can balance while the underlying funding remains uncertain.
We recommend distinguishing:
- Funds already received.
- Funding commitments supported by executed documentation.
- Conditional commitments.
- Planned fundraising.
- Revenue assumptions dependent on authorisation or future launches.
Ask the finance team to explain how the business responds to delayed authorisation, slower customer growth, higher operating costs or reduced trading income.
Keep the assessment of applicable prudential requirements distinct from the commercial cash-flow analysis. The board should understand both, including assumptions about the availability of group support.
A parent company’s willingness to assist deserves scrutiny where the UK firm’s survival depends on it.
3. Check whether governance works in practice
An organisation chart shows reporting lines. A readiness review should establish how decisions are made.
We recommend asking the proposed management team:
- Who can stop a product launch?
- Who can challenge an unsuitable customer relationship?
- Who approves material changes to outsourcing?
- Who receives unresolved control failures?
- Who can commit resources to remediation?
The FCA identifies competence, capability, honesty, integrity and financial soundness as relevant considerations for individuals. It also notes that FSMA fitness and propriety requirements are broader than the MLR framework. FCA
For preparation purposes, test whether responsibilities are realistic given each person’s time, other roles and access to information.
4. Look for evidence that controls operate
We recommend separating four stages:
Designed → approved → implemented → tested.
A policy may be well drafted but remain unimplemented. A system may be configured but produce alerts that nobody reviews.
Useful testing could examine whether:
- Staff identify and escalate unusual activity.
- Asset records reconcile accurately.
- Complaints reach the responsible team.
- Access privileges match approved roles.
- Incident procedures work outside normal business hours.
- Outsourced providers supply the information needed for oversight.
Record failures and corrective action. A transparent account of testing provides a more useful basis for board challenge than a claim that every control is complete.
5. Identify activity-specific requirements
The readiness assessment should reflect the proposed business.
A trading platform, custodian, stablecoin issuer and broker may face different operational risks and evidence needs.
We recommend maintaining an applicability register that records:
- The relevant requirement.
- Why it applies—or the basis for concluding that it does not.
- The responsible owner.
- Implementation status.
- Supporting evidence.
- Outstanding interpretation questions.
This prevents a generic policy pack from becoming the substitute for analysing the firm’s actual activities.
How should the board assess the results?
We recommend using a simple rating method, supported by written findings.
| Rating | Suggested meaning |
| Green | Supported by evidence, with no identified material gap |
| Amber | A defined issue remains, with an owner and credible completion plan |
| Red | A material weakness prevents a reliable readiness conclusion |
These are internal management ratings.
Avoid averaging them into a reassuring overall score. One serious weakness in funding, governance or asset control may outweigh progress elsewhere.
The review should explain which issues affect submission readiness, which affect operational readiness and which require ongoing monitoring.
What should the board receive before submission?
We recommend a decision pack containing:
- An executive assessment of the proposed activities and readiness conclusion.
- A material findings register with owners, actions and evidence.
- An application consistency report identifying reconciled assumptions.
- An evidence index linking material assertions to supporting records.
- A timetable and contingency assessment covering delays and unresolved dependencies.
- A proposed board decision explaining the basis for proceeding or deferring.
Management should identify future commitments expressly. The board should understand what is operational today and what remains to be delivered.
Returning to the opening scenario
The company’s review identifies three material issues: uncertain funding, unclear authority over its provider and an untested customer asset recovery process.
Its next steps become concrete.
Finance substantiates the funding position. Management resolves contractual authority. Operations tests the recovery process and records the results.
The board can then evaluate evidence against the business it intends to submit.
The value of a readiness audit lies in making that decision informed, accountable and reviewable.
How CRYPTOVERSE can help
CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.
We support permission scoping, application consistency reviews, evidence assessment and remediation planning, helping boards understand what is ready and what still requires work.
Contact CRYPTOVERSE to discuss a UK crypto authorisation readiness review before submission.
FAQs
1. What is a UK crypto authorisation readiness audit?
A UK crypto authorisation readiness audit assesses whether a firm’s proposed permissions, operating arrangements, governance, financial resources and supporting evidence are sufficiently developed and consistent for an FCA application.
2. Is an independent FCA crypto readiness audit mandatory?
An independent readiness audit is not presented as a universal requirement in this preparation framework. Firms should separately identify any assurance requirements applicable to their circumstances.
3. What should a board review before submitting an FCA crypto application?
The board should review regulatory permissions, ownership, funding, business model, governance, financial resources, financial crime controls, customer assets, outsourcing, operational resilience and application consistency.
4. Can a complete application document pack still have readiness gaps?
Yes. Documents may contain inconsistent assumptions or describe arrangements that have not been implemented or tested. A readiness review should examine whether the supporting evidence reflects actual business operations.
5. Does a positive readiness assessment guarantee FCA authorisation?
No. A positive readiness assessment supports application preparation and board decision-making, but the FCA conducts its own assessment before deciding whether to grant authorisation.