By CRYPTOVERSE Legal Consultancy
A small product change creates a different business
A crypto company receives FCA authorisation for its proposed UK services.
Several months later, its product team adds a feature allowing customers to earn rewards on assets held in their accounts.
The team describes it as an improvement to the existing service. Customers use the same application, and the company retains the same branding.
During legal review, however, the arrangement looks materially different.
Customer assets move to another provider. Withdrawal conditions change. The firm receives a share of the return, and customers acquire different contractual rights.
The original authorisation does not settle the regulatory treatment of the new arrangement.
For crypto businesses, ongoing compliance requires a process for assessing changes before they reach customers.
What happens after FCA cryptoasset authorisation?
Authorisation begins an ongoing obligation to operate within the firm’s permissions, meet applicable regulatory requirements and maintain the resources and controls needed for its business.
The FCA’s final PS26/13 applies relevant conduct, governance, customer protection and reporting frameworks to regulated cryptoasset activities. The precise obligations depend on the firm’s activities, classification, structure and applicable commencement provisions.
A firm should translate its application commitments into operational responsibilities.
Who monitors financial resources? Who reviews custody arrangements? Who checks proposed products? Who decides whether a change requires regulatory approval or notification?
Those questions should have workable answers before launch.
Understand the limits of your permission
“FCA-authorised” does not mean authorised to provide every crypto service.
The firm should maintain a clear record of:
- Its permitted regulated activities.
- Relevant investment and customer types.
- Limitations and requirements.
- The entity holding the permission.
- Any conditions affecting its operation.
The FCA expects a firm’s permission scope to accurately reflect its activities. Where a variation of permission is required, the firm cannot begin the requested activities before approval.
For practical implementation, connect the permission record with the actual product catalogue.
A service name may remain unchanged while its legal characteristics change. Assess what the firm does, what authority it exercises and what rights customers receive.
Turn application commitments into operating controls
An application may describe detailed arrangements for governance, financial crime prevention, customer support and asset protection.
After authorisation, management should establish that those arrangements operate as described.
Our recommended implementation review covers:
| Area | Practical evidence to maintain |
| Governance | Decisions, responsibilities, challenge and escalation |
| Financial resources | Current calculations, forecasts and funding evidence |
| Financial crime | Risk assessments, monitoring and operational reviews |
| Customer assets | Entitlement records, reconciliations and access controls |
| Customer outcomes | Product reviews, communications testing and support data |
| Outsourcing | Provider oversight, incidents and contingency arrangements |
| Reporting | Accurate returns, notifications and submission records |
The aim is a consistent operating model supported by evidence.
A policy approved during the application can become outdated when the firm changes systems, staff or providers.
Monitor financial resources as the business develops
Growth changes the firm’s resource needs.
For example, more customers may require additional support staff, stronger monitoring and greater custody capacity. New activities can affect prudential calculations.
The FCA notes that changes to permission scope may also change financial resource and reporting requirements.
For practical management, review actual performance against forecasts and investigate material differences for UK Crypto staking FCA Authorisation.
We recommend tracking:
- Revenue and expenditure.
- Available operating cash.
- Applicable capital and liquidity requirements.
- Funding commitments and conditions.
- Stress scenarios.
- Resources needed for an orderly exit.
A profitable month does not establish that every relevant resource requirement is satisfied.
Establish a regulatory review process for changes
A useful change process begins while a proposal is still being designed.
We recommend requiring a short assessment for changes involving products, customers, asset flows, authority over assets, ownership or essential infrastructure.
| Proposed change | Questions to resolve |
| New custody feature | Does the firm acquire additional control over customer assets? |
| Staking or yield feature | Which underlying activities and customer rights arise? |
| Principal execution | Is the firm trading against its own capital, and is this permitted? |
| Retail expansion | Do customer types, conduct obligations or permission limits change? |
| New provider | What happens to access, records, oversight and recovery arrangements? |
| Group restructuring | Which entity performs each activity after the change? |
| Funding round | Could ownership or control thresholds be crossed? |
Not every change requires a variation of permission. The assessment should determine whether approval, notification, internal governance or another action is needed.
Record the reasoning even where the conclusion is that no regulatory filing is required.
Distinguish approval from notification
These processes serve different purposes.
A required approval must be obtained before the relevant action proceeds. A notification must follow the applicable trigger and timing for Crypto proprietary trading authorisation.
SUP 15.3 contains general notification requirements for matters including significant events and relevant changes. Firms should assess the specific provisions alongside other applicable notification rules.
For practical preparation, maintain a matrix showing:
- The proposed action or event.
- Its regulatory treatment.
- Required timing.
- Decision-maker.
- Supporting documents.
- Submission channel.
- Evidence of completion.
Sending information to the FCA should not be assumed to constitute approval.
Likewise, an internal board decision cannot replace a required regulatory permission.
Review ownership changes before completion
An investment transaction can affect control through direct holdings, upstream ownership, voting arrangements or other rights.
The FCA’s change in control framework requires proposed acquisitions or increases in control of relevant UK-authorised firms to be assessed for prior approval. Thresholds and procedures depend on the firm and transaction.
For practical transaction planning, review the position before documents are finalised.
Do not limit the assessment to the percentage of shares being sold. Conversions, buybacks, shareholder agreements and changes above the immediate parent may also matter.
Build any required regulatory process into the completion conditions and timetable.
Keep outsourcing and group arrangements under review
An arrangement that worked at launch may become unsuitable.
A provider may change subcontractors, reduce service levels or introduce a new recovery process. A group team may take over responsibilities previously performed by the applicant.
We recommend reviewing material changes to:
- Decision-making authority.
- Access to systems and customer records.
- Incident reporting.
- Contractual rights and termination.
- Concentration and shared dependencies.
- Continuity and exit arrangements.
A UK firm should understand whether it retains the capability to supervise services delivered elsewhere.
Commercial convenience should be considered alongside the ability to fulfil regulatory responsibilities.
Maintain accurate customer communications
Changes to services may require changes to contracts, disclosures and customer journeys for overseas crypto UK FCA authorisation.
For practical review, check whether customers understand:
- Which entity provides the service.
- What the firm’s regulatory status covers.
- Their rights over assets.
- New fees or withdrawal conditions.
- Relevant risks and protection limits.
- How to obtain support or complain.
Update operational procedures and staff training alongside the customer-facing material.
A revised contract alone may leave the application interface or support team describing the old service.
Use monitoring to identify deterioration
A compliance calendar should include reviews as well as submissions.
We recommend combining routine checks with information about actual performance:
- Repeated withdrawal delays.
- Unresolved complaints.
- Financial crime review backlogs.
- Reconciliation differences.
- Security and access exceptions.
- Provider outages.
- Reporting corrections.
- Overdue remediation.
Management should examine causes and customer effects, rather than relying solely on the number of completed checks.
When a problem arises, assess immediate protection, regulatory notification and longer-term remediation separately.
Preserve evidence of decisions
A material change file should explain:
- What is changing and why.
- Which activities, entities and customers are affected.
- The regulatory assessment.
- Changes needed to resources and controls.
- Required approvals or notifications.
- Launch conditions.
- Post-launch review arrangements.
The file helps management verify that the approved design matches what was implemented.
It also provides a coherent explanation if the FCA later asks how the business evolved.
Returning to the opening scenario
The company pauses the rewards feature for assessment.
It maps the asset movements, contractual rights and provider responsibilities. It determines which permissions and other requirements are relevant, updates the operating model and completes any necessary regulatory process before launch.
The product team can now proceed against defined conditions, with customer communications and controls aligned to the final design.
How CRYPTOVERSE can support your ongoing compliance
CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.
We can support permission reviews, product assessments, variations, ownership changes and the development of ongoing governance and compliance arrangements.
Contact CRYPTOVERSE to assess whether your next business change fits your FCA permissions and operating obligations.
FAQs
1. Does authorisation cover future products automatically?
No. Assess each proposal against the firm’s permissions and applicable requirements.
2. Does every operational change need FCA approval?
No. Some require notification or internal review. The treatment depends on the facts and relevant rules.
3. Can we launch while a variation application is pending?
Where the activity requires the requested variation, the FCA states that it must not begin before approval.
4. Can ongoing compliance be supported externally?
Yes. External advisers and providers can assist, while the firm retains the responsibilities applicable to its business.
5. Do ownership changes require FCA approval after authorisation?
Possibly. A proposed acquisition of, or increase in, control of an FCA-authorised firm can require prior approval. Thresholds and procedures depend on the firm and the transaction.