FCA Crypto Governance Requirements: Directors, Senior Managers, Compliance and the MLRO

FCA cryptoasset authorisation requires a governance framework that explains who runs the applicant, who controls its risks and how important decisions are challenged, approved and recorded.

An organisation chart is a starting point. The application should also show whether the named individuals have the competence, authority, capacity and information needed to perform their responsibilities.

For founders and boards, the central question is:

Can we demonstrate that our management structure will operate effectively for the business and permissions we are proposing?

This article explains how to prepare governance arrangements covering directors, senior managers, compliance and the Money Laundering Reporting Officer.

1. Distinguish Current MLR Governance From FSMA Requirements

A cryptoasset business preparing for the expanded regime should distinguish its current obligations from the requirements supporting its proposed FSMA authorisation.

The FCA’s published standards explain that the expanded framework applies from 25 October 2027. They identify appropriate people, financial resources and systems as part of the threshold conditions, alongside suitability and effective supervision. The FCA also states that FSMA fitness and propriety requirements are broader than those under the Money Laundering Regulations. FCA

A practical governance assessment should identify:

• Existing registrations and permissions.
• Proposed cryptoasset permissions.
• The applicant’s legal form and group structure.
• Applicable senior management functions.
• Required individual applications.
• Relevant responsibility, certification and conduct arrangements.
• Changes needed before the proposed services commence.

This avoids assuming that an existing AML governance structure covers every aspect of the expanded regime.

2. Understand How SM&CR Applies

In PS26/13, Chapter 7, the FCA confirms its approach to applying the Senior Managers and Certification Regime (SM&CR) to authorised cryptoasset firms.

Relevant provisions include SUP 10C for senior management functions, SYSC 24 for prescribed responsibilities, SYSC 27 for certification and COCON for conduct rules. The FCA also announced a modification-by-consent approach concerning certification while wider reforms develop. Applicants should check the current arrangements and any modification applicable to them. fca.org.uk

Do not assume that every job title corresponds to a senior management function. Equally, avoid overlooking an individual who exercises significant authority because their title appears informal.

Start with what each person actually does, then assess the applicable regulatory treatment.

3. Design a Board That Can Make and Challenge Decisions

For application preparation, define the board’s responsibilities and the decisions reserved to it.

A useful starting point includes oversight of:

• Business strategy and proposed services.
• Regulatory permissions and limitations.
• Financial resources and funding.
• Risk appetite.
• Significant outsourcing.
• Customer asset arrangements.
• Compliance and financial crime.
• Major incidents and remediation.
• Senior appointments and succession.

The composition should reflect the applicant’s activities and complexity. Assess the applicable rules before adopting assumptions about director numbers, independence or committee requirements.

For practical readiness, ask whether directors can explain the business, challenge management and obtain reliable information without depending entirely on the founders.

What should board evidence demonstrate?

Useful evidence may include terms of reference, reserved matters, meeting records, reporting packs and action logs.

Minutes should capture significant questions, decisions, reasons and follow-up responsibilities. Recording that a policy was “approved” provides limited insight if no review or challenge is evident.

4. Allocate Responsibilities Clearly

A responsibility framework should answer four questions:

1. Who is accountable?
2. Who performs the work?
3. Who reviews or challenges it?
4. Who receives an escalation?

The following is an illustrative allocation exercise, rather than a prescribed staffing model.

Where regulatory Statements of Responsibilities are required, ensure they match the individual’s actual remit. Assess separately whether a formal Management Responsibilities Map is required for the firm’s classification.

Even where a particular formal document is not required, a clear internal allocation can help identify gaps and overlaps.

5. Give Compliance the Authority to Challenge

A compliance function needs a defined remit, suitable resources and access to decision-makers.

For internal design, establish:

• Which obligations it monitors.
• What information it can access.
• How it reports findings.
• Who approves remediation.
• How unresolved concerns reach the board.
• How its effectiveness is reviewed.

Consider how compliance participates in product launches, marketing changes, provider appointments and customer journey design.

A practical test is to introduce a disagreement: commercial management wants to launch a service, while compliance identifies an unresolved issue. The governance framework should explain who decides, what evidence is required and how the disagreement is recorded.

6. Appoint an MLRO Who Understands the Business

The MLRO should understand the applicant’s financial crime exposure and how its controls operate.

The FCA’s MLR registration guidance expects the MLRO to be heavily involved in preparing the application and intended to remain in the role following registration. It addresses competence, capacity, conflicts and oversight, including scrutiny of arrangements where the MLRO is overseas. FCA

For practical preparation, the MLRO should be able to explain:

• The business-wide financial crime assessment.
• Customer risk assessment and due diligence.
• Monitoring and investigation procedures.
• Screening and analytics tools.
• Internal suspicious activity reporting.
• Escalation and decision records.
• Training.
• Control testing and identified weaknesses.

An appointment letter and CV should be supported by evidence that the individual understands the applicant’s products, customers, transaction flows and relevant UK framework.

7. Distinguish Compliance Oversight From the MLRO Function

Compliance oversight and money laundering reporting responsibilities have connected but distinct purposes.

Where applicable, assess SMF16 (Compliance Oversight) and SMF17 (Money Laundering Reporting) separately.

PS26/13 explains that the FCA generally expects mind and management in the UK and particularly considers location for SMF16 and SMF17, expecting holders to work from the firm’s principal UK place of business. Overseas SMF appointments may be considered in appropriate circumstances. This should not be confused with the separate MLR guidance on overseas MLROs. fca.org.uk

If proposing one individual for several responsibilities, document:

• Their competence across each remit.
• Available time.
• Conflicts and safeguards.
• Supporting staff.
• Reporting arrangements.
• Cover and succession.

The analysis should support the proposed combination rather than simply list the roles.

8. Assess Competence and Fitness and Propriety

The FCA identifies honesty, integrity and reputation, financial soundness, and competence and capability as relevant dimensions of individual fitness and propriety. FCA

A practical assessment should examine more than qualifications.

For each important role, consider:

• Relevant responsibilities previously performed.
• Understanding of the proposed business.
• Knowledge gaps.
• Training needs.
• Capacity and other commitments.
• Relevant disclosures.
• Evidence supporting the assessment.

A highly experienced finance executive may still need training on the applicant’s crypto activities. A technically skilled founder may need support understanding regulatory governance and individual responsibilities.

Record the assessment and how material gaps will be addressed.

9. Resolve Conflicts and Role Combinations

Smaller applicants may propose individuals holding several roles. Review each combination on its facts and against applicable requirements.

Useful questions include:

• Is the individual reviewing their own decisions?
• Does remuneration discourage escalation?
• Can the person challenge commercial management?
• Is independent review available?
• Is the workload realistic?
• What happens during absence or an incident?

For example, combining a revenue-generating responsibility with control oversight may create tensions that need careful examination.

Document the conflict, the proposed safeguard and the residual concern. A generic conflicts policy should be supported by an assessment of actual roles and incentives.

10. Demonstrate Control Within a Global Group

For an international applicant, map the relationship between local governance and group decision-making.

Identify who controls:

• Budgets and recruitment.
• Product changes.
• Customer acceptance.
• System access.
• Provider contracts.
• Incident response.
• Regulatory communications.
• Remediation spending.

Then assess whether the applicant’s management can obtain the information and action necessary to discharge its responsibilities.

Shared group services can support the business. The application should explain the service, contractual arrangements, local oversight and escalation route.

Where authority remains overseas, describe it accurately and assess whether the proposed structure satisfies the applicable requirements.

11. Build Management Information That Supports Action

A useful reporting pack should help directors identify problems and make decisions.

Suggested subjects include:

Define the data owner, reporting frequency and escalation triggers.

For application readiness, test a sample pack. Can management identify the issue, understand its significance and decide what action is required?

12. Prepare a Governance Evidence Pack

A practical application pack may include:

• Corporate and organisational charts.
• Board and committee terms of reference.
• Reserved matters and delegated authorities.
• Relevant individual applications.
• Statements of Responsibilities where required.
• A responsibilities map where applicable.
• Role descriptions and appointment terms.
• Fitness and propriety assessments.
• Conflicts assessments.
• Compliance monitoring plans.
• Financial crime governance documents.
• Management reporting templates.
• Training, cover and succession plans.
• Board approvals and remediation records.

Check these documents against one another.

A proposed reporting line in an application form should match the organisation chart, role description and actual employment or service arrangement.

How CRYPTOVERSE Can Support Your Governance Preparation

CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.

We can help assess governance requirements, map responsibilities, review compliance and MLRO arrangements, prepare supporting documents and brief management for regulatory discussions.

The objective is a governance framework that accurately reflects the applicant’s business and gives responsible individuals clear authority, information and escalation routes.

Contact CRYPTOVERSE to discuss governance readiness for your FCA cryptoasset authorisation application.

FAQs