FCA Crypto Custody Requirements: Wallet Control, MPC Arrangements and Customer Asset Protection

By CRYPTOVERSE Legal Consultancy

FCA crypto custody requirements depend on who can control the movement of cryptoassets, how the service operates and which assets are involved.

Terms such as “non-custodial”, “MPC wallet” or “wallet infrastructure” do not settle the regulatory assessment. The application should explain the technical architecture, contractual rights and decision-making arrangements behind those descriptions.

For management, the central question is:

Who can bring about a transfer of the cryptoassets, through which mechanisms, and under whose authority?

This article explains how to assess safeguarding permissions and prepare evidence supporting customer asset protection.

1. Distinguish Registration From Authorisation

The expanded crypto regime commences on 25 October 2027. Its authorisation gateway opened on 30 September 2026, with the relevant application period currently ending on 28 February 2027.

Existing MLR registration does not automatically convert into FSMA authorisation. Firms already authorised under FSMA need to apply to vary their permissions where appropriate. FCA

A custody business should therefore identify:

• Its current obligations.
• The proposed applicant entity.
• The assets and services involved.
• Required safeguarding or arranging permissions.
• Changes to contracts, systems and governance.
• Relevant transitional arrangements.

Current custodial wallet registration and future safeguarding authorisation require separate analysis.

2. Apply the Safeguarding Control Test

PERG 18.6.2G explains that safeguarding requires the ability, through any means, to bring about a transfer of the benefit of a cryptoasset. This can include holding access credentials or operating arrangements involving others’ key shares.

Merely preventing a transfer—negative control—is insufficient by itself. However, additional mechanisms for achieving the signing threshold can establish the requisite control.

PERG 18.6.1G also explains that customer ownership is not decisive: safeguarding may arise where the firm acts on another’s behalf and that person has a right to return. handbook.fca.org.uk

For practical assessment, examine technical capabilities alongside customer rights. A promise not to exercise a capability does not explain whether the capability exists.

3. Analyse MPC Arrangements in Detail

Multi-party computation can distribute signing capabilities across several parties. The regulatory assessment needs the actual arrangement.

Prepare a control map identifying:

A firm holding one share may have different powers from another firm holding one share. The wider permissions, contractual rights and recovery mechanisms can change the assessment.

Have legal and technical reviewers examine the same architecture. Record assumptions and unresolved points.

4. Verify Claims of Self-Custody

Under PERG 18.6.3G, genuine self-custody involves the customer exercising control without the provider having means to bring about a transfer. The guidance calls for examination of the engineering where a firm describes its service as self-custody. handbook.fca.org.uk

For internal review, test:

• Recovery paths.
• Administrative privileges.
• Signing policies.
• Customer authentication.
• Upgrade mechanisms.
• Privileged access.
• Provider and group intervention.

The outcome should be documented in terms management can understand.

If the design changes, reassess the conclusion. Introducing a recovery or override function can materially affect the facts underlying the original analysis.

5. Assess Arranging and Exclusions Separately

The custody assessment should also consider arranging safeguarding and any applicable exclusions.

PERG 18.6 addresses conditional exclusions, including group activity and temporary settlement arrangements. Their conditions require examination; common ownership or short holding duration alone should not be treated as sufficient. handbook.fca.org.uk

For application preparation, identify:

• Who contracts with the customer.
• Who appoints the safeguarding provider.
• What the applicant arranges.
• Which entity accepts responsibility.
• How long control exists.
• What happens when settlement fails.

Record the legal basis and supporting facts for any exclusion relied upon.

6. Identify the Correct Customer Asset Rules

The FCA’s final package introduces CASS 17 for qualifying cryptoasset custody.

At the outset of the expanded regime, custody of relevant specified investment cryptoassets requires the cryptoasset custodian authorisation route but applies CASS 6, rather than CASS 17. Associated money also requires separate assessment. FCA

Create an asset classification schedule before drafting custody procedures.

For each asset or balance, identify:

• Its legal classification.
• The relevant permission.
• The applicable protection framework.
• The customer’s rights.
• The entity holding or controlling it.
• The records needed to support that treatment.

This helps prevent a single generic custody policy from concealing materially different arrangements.

7. Align Legal Protection With Wallet Operations

CASS 17.3.3R generally requires safeguarding as trustee unless a permitted exception applies. CASS 17.3.14R addresses documented trust arrangements, while CASS 17.3.17R addresses their objectives and operation, including identification and separation of trust assets subject to the relevant provisions. fca.org.uk

For practical preparation, coordinate:

• Customer terms.
• Trust documentation.
• Wallet allocation.
• Internal records.
• Provider contracts.
• Operational procedures.

An omnibus wallet should be assessed through the complete legal and record-keeping arrangement. An individual wallet address alone does not establish the customer’s legal protection.

Check whether the documents accurately explain how customer entitlements are recorded and how assets would be identified during disruption.

8. Design Withdrawal and Access Controls

Suggested implementation topics include:

• Separation of initiation and approval.
• Authentication.
• Privileged access.
• Address changes.
• Transaction limits.
• Exceptional approvals.
• Access removal.
• Logging.
• Recovery.

These controls should reflect the firm’s architecture and applicable requirements.

For example, test whether a person who initiates a withdrawal can also change approval settings. Examine whether recovery credentials create an alternative route around normal controls.

Retain evidence of configuration and testing. Clearly distinguish proposed controls from implemented arrangements.

9. Reconcile Assets With Customer Entitlements

CASS 17.5 addresses records and reconciliations. Its provisions include investigating discrepancies, documenting reconciliation results and addressing shortfalls. fca.org.uk

For practical design, establish how the firm compares:

• Customer entitlement records.
• Wallet balances.
• Provider statements.
• Transfers in progress.
• Relevant fees and adjustments.

Explain how incomplete transactions, network events and delayed provider information are handled.

A useful test introduces a discrepancy deliberately. Can staff identify it, explain its cause, escalate it and record the resolution?

The process should show who owns unresolved differences and how management receives information about material issues.

10. Oversee Providers and Recovery Arrangements

Custody infrastructure may involve wallet vendors, cloud providers, sub-custodians and group services.

A suggested review should examine:

• Actual control retained by each party.
• Required authorisations.
• Access to records.
• Security and recovery.
• Subcontractors.
• Incident reporting.
• Service continuity.
• Data and asset portability.
• Exit assistance.

Test provider failure against the custody architecture.

Ask whether the applicant could recover customer records, maintain necessary access and coordinate an orderly response. Where it depends on cooperation from another party, document the basis for that cooperation.

11. Prepare for Incidents Without Overstating Protection

Useful scenarios include:

• A compromised credential.
• Loss of a signing participant.
• Incorrect withdrawal.
• Reconciliation shortfall.
• Provider outage.
• Loss of customer records.
• Recovery failure.

For each scenario, define the decision-maker, investigation process, communications and remedial actions.

Customer descriptions should reflect the actual protection available. Avoid suggesting that authorisation, insurance or a security technology guarantees recovery or prevents every loss.

12. Assemble the Custody Application Evidence

A focused pack may include:

Check consistency across legal documents, architecture diagrams and application answers.

A claim that the applicant cannot transfer assets should be reconciled with every signing, recovery and administrative capability described elsewhere.

How CRYPTOVERSE Can Support Your Custody Application

CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.

We can help assess safeguarding permissions, review wallet control and MPC arrangements, prepare customer and governance documentation, and organise supporting application evidence.

Our approach connects the legal analysis with the technical architecture and operational responsibilities.

Contact CRYPTOVERSE to discuss FCA authorisation support for your crypto custody or wallet business.

FAQs