Outsourcing in an FCA Crypto Application: What the Applicant Must Retain Control Over

By CRYPTOVERSE Legal Consultancy

Crypto companies often rely on external providers for technology, screening, transaction monitoring, wallet infrastructure and operational support. International groups may also share staff, systems and services across several entities.

These arrangements can support an FCA cryptoasset authorisation application. The applicant must still explain how it oversees the services, manages the risks and maintains access to the information and expertise needed to fulfil its obligations.

The practical question is:

If a provider fails, makes an error or withholds information, can the applicant understand the problem and take effective action?

This article explains how to prepare outsourcing arrangements and supporting evidence for an FCA crypto application.

1. Identify Which Arrangements Are Outsourcing

Start with the function performed, rather than the supplier’s description.

The FCA explains that outsourcing generally involves a provider performing a process, service or activity that the firm would otherwise carry out itself. Some purchases fall outside that definition, although wider governance, risk management and systems-and-controls expectations can still apply. FCA

For practical preparation, create an inventory covering:

• External service providers.
• Intra-group services.
• Technology and infrastructure dependencies.
• Providers supporting customer assets.
• Financial crime services.
• Operational and customer support.
• Significant subcontractors.

Record what each provider does, which applicant services depend on it and whether the arrangement constitutes outsourcing.

A contract’s label should not determine the assessment. “Software subscription”, “consultancy” and “group support” can describe materially different arrangements.

2. Establish the Applicable Requirements

The outsourcing assessment should identify the provisions applicable to the particular applicant and function.

PS26/13, Chapter 6, explains the FCA’s application of SYSC to cryptoasset firms, including their treatment as “other firms” unless they are otherwise common platform firms. Firms conducting multiple regulated activities need to consider the requirements applicable to those activities. fca.org.uk

This distinction matters because SYSC 8 contains provisions with different application as rules or guidance. For example, SYSC 8.1.1AG addresses how other firms should take account of the general outsourcing rule. SYSC 8.1.6R addresses retained responsibility where applicable, while SYSC 8.1.8R sets out detailed conditions for common platform firms. SYSC 8.1 General outsourcing requirements

Assess the relevant version and commencement date of the provisions. Avoid presenting every SYSC 8 provision as an identical mandatory rule for every crypto applicant.

3. Assess the Significance of Each Dependency

A practical assessment should consider what happens if the service becomes unavailable or performs incorrectly.

Ask whether failure could affect:

• Regulatory compliance.
• Customer access to assets.
• Transaction processing.
• Financial crime controls.
• Data security.
• Financial reporting.
• Business continuity.
• The firm’s ability to explain its operations to the FCA.

Record the classification and supporting rationale.

For example, a provider supporting withdrawal authorisation may create different risks from a supplier of an internal administrative tool. The assessment should reflect the actual role of each service.

Consider combined dependencies too. Several apparently separate providers may rely on the same cloud infrastructure or subcontractor.

4. Retain People Who Can Oversee the Service

An applicant needs enough internal understanding to evaluate the outsourced work and respond to problems.

For each important arrangement, identify:

• A responsible business owner.
• Relevant technical or operational expertise.
• Compliance and risk oversight.
• Escalation authority.
• Cover during absence.

A useful test is whether the responsible person can explain the service without relying entirely on the supplier’s presentation.

For transaction monitoring, for example, management should understand how alerts reach the firm, who investigates them and how defects are escalated. For wallet infrastructure, it should understand access, signing authority and recovery arrangements.

The applicant does not need to reproduce every provider capability internally. It should have a credible basis for supervising the service and making decisions about it.

5. Perform Due Diligence Before Appointment

A suggested provider review should examine:

Keep the conclusions and unresolved issues.

A certificate, audit report or regulatory registration can support the review. Explain its scope, date and relevance to the particular service.

6. Make the Contract Support the Operating Model

The contract should be reviewed against the applicant’s service requirements and applicable obligations.

Relevant issues may include:

• Defined services and responsibilities.
• Performance standards.
• Incident notification.
• Access to records and information.
• Audit and regulatory cooperation.
• Confidentiality and security.
• Subcontracting.
• Change control.
• Continuity arrangements.
• Termination and transition assistance.
• Data return and deletion.

These are contract review topics; the precise required provisions depend on the applicable framework.

Check whether contractual rights are usable in practice. A right to obtain information has limited value if the provider cannot produce it in a suitable format or within the time needed.

If standard supplier terms leave a material gap, record the issue and assess whether it can be resolved before relying on the arrangement.

7. Document Intra-Group Services Properly

Shared group services should have a clear scope and allocation of responsibilities.

The FCA’s MLR registration guidance specifically asks applicants to explain outsourcing within and outside the group, including relevant service arrangements. This is MLR application guidance and should be distinguished from the assessment of an applicant’s FSMA requirements. FCA

For practical preparation, identify:

• The entity providing the service.
• Personnel and systems involved.
• Costs and capacity allocated to the applicant.
• Local oversight.
• Access to records.
• Escalation routes.
• Continuity and termination arrangements.

Avoid assuming that group ownership guarantees cooperation or sufficient capacity.

Where the parent controls budgets, technology or staffing, explain how the applicant obtains the resources and decisions necessary to manage its obligations.

8. Examine Customer Asset Arrangements Separately

Where a provider supports custody or withdrawals, map the actual allocation of control.

Identify:

• Who holds keys or key shares.
• Who can initiate and approve transfers.
• Who can change permissions.
• Who manages recovery.
• Which entity contracts with the customer.
• What happens on provider failure.
• How records and assets can be accessed.

A technology outsourcing assessment should be coordinated with the legal analysis of safeguarding activities and applicable customer asset requirements.

Do not infer the regulatory position from labels such as “MPC”, “non-custodial” or “wallet-as-a-service”. Those descriptions need supporting facts.

9. Monitor Performance After Appointment

A practical oversight process should specify what the applicant reviews and how it responds.

Set review frequency according to significance and risk.

Record issues, actions, owners and completion evidence. Where deficiencies persist, management should understand the available contractual and operational responses.

10. Prepare for Disruption and Exit

The FCA’s outsourcing guidance connects third-party oversight with understanding operational dependencies and managing disruption throughout the arrangement’s lifecycle. FCA

For internal planning, test scenarios such as:

• A provider outage.
• Loss of access to records.
• A security incident.
• Provider insolvency.
• Abrupt termination.
• Failure of a shared subcontractor.

An exit plan should identify realistic options, costs, decision-makers and transition times.

“Move to another provider” needs supporting detail. Consider data portability, integration work, staff capacity, contractual restrictions and the effect on customers during transition.

If an alternative cannot be activated immediately, explain the interim response.

11. Prepare an Outsourcing Evidence Pack

A focused application pack may include:

• The provider and dependency inventory.
• Outsourcing classifications.
• Risk assessments.
• Due diligence records.
• Contracts and service schedules.
• Responsibility allocations.
• Monitoring arrangements.
• Incident and escalation procedures.
• Continuity and exit plans.
• Testing and remediation evidence.

Check consistency with the business plan, transaction flows, financial forecasts and policies.

State the implementation status accurately. A provider under evaluation should not appear elsewhere in the application as an established, tested arrangement.

How CRYPTOVERSE Can Support Your Outsourcing Assessment

CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.

We can help classify arrangements, assess applicable requirements, review contracts, map responsibilities and prepare outsourcing evidence for the application.

Our approach connects provider arrangements with the applicant’s permissions, customer services and governance.

Contact CRYPTOVERSE to discuss outsourcing and third-party readiness for your FCA cryptoasset authorisation application.

FAQs