FG26/10: Non-Handbook Guidance on CRYPTOPRU 7: Overall risk assessment for CRYPTOPRU firms
AI Analysis
The FCA published FG26/10 on 30 September 2026, providing non-Handbook guidance for cryptoasset firms completing the overall risk assessment required by CRYPTOPRU 7. The guidance is effective from 25 October 2027 and materially expands practical expectations around severe-but-plausible stress testing, own-funds and liquidity assessments, recovery planning, contingency funding and orderly wind-down, including crypto-specific scenarios such as private-key loss, stablecoin de-pegging, exchange failure and withdrawal surges.
Key dates
- 2026-06-30
- The FCA opened consultation on the proposed CRYPTOPRU 7 guidance.
- 2026-07-30
- Consultation on the proposed guidance closed.
- 2026-09-30
- The FCA finalised and published FG26/10.
- 2027-10-25 Deadline
- FG26/10 comes into force alongside the FCA's new UK cryptoasset regime.
Suggested considerations
- Firms should map their current CRYPTOPRU 7 overall risk assessment against FG26/10, documenting any gaps in risk identification, stress testing, financial-resource calculations, recovery planning and wind-down analysis.
- Compliance and prudential teams may wish to confirm that the own-funds requirement is calculated as the highest of the permanent minimum requirement, fixed overheads requirement and K-factor requirement, and that the own-funds threshold requirement is not below that amount.
- Firms should consider developing severe-but-plausible scenarios that combine cryptoasset price declines, customer withdrawal surges, counterparty or exchange failure, cyber incidents, private-key compromise, reduced market liquidity, stablecoin de-pegging and infrastructure outages.
- Firms should assess whether collateral, committed facilities, group support, banking arrangements, custody structures and other mitigants are legally, operationally and practically available under stress, rather than relying solely on their accounting treatment.
- Firms should prepare or refresh a stressed 90-day cash-flow forecast covering peak and cumulative liquidity needs, including margin calls, settlement failures, client drawdowns, pre-funding requirements and delayed or unavailable funding.
- Firms should assess their funding profile over the following 12 months, including renewal and rollover risk, withdrawal of facilities, reduced group funding and increased funding costs.
- Firms should establish a contingency funding plan with quantitative internal triggers above regulatory thresholds, credible actions within management control, implementation timelines, impediments and communication arrangements.
- Firms should distinguish recovery actions that management can execute directly from actions dependent on shareholders, banks, counterparties, group entities or buyers, and should consider whether limited recovery capacity requires earlier wind-down triggers.
What changed
FG26/10 does not create a new standalone binding rule or prescribe a single methodology; it explains how firms should evidence compliance with the binding requirements in CRYPTOPRU 7 and should be applied proportionately to the firm's nature, scale and complexity. Firms should begin with their business model, strategy and risk appetite, identify market, leverage, credit, liquidity, operational and concentration risks, assess interactions between those risks, and evaluate whether mitigants remain effective under stress. The guidance expects severe-but-plausible, forward-looking stress testing covering firm-specific, market-wide and combined events, including cyberattacks, private-key theft or loss, trading-venue or exchange failure, stablecoin de-pegging, redemption surges, withdrawal of ba
Compliance impact
The guidance is non-binding and illustrative, but it provides a detailed indication of the FCA's supervisory expectations for demonstrating adequate financial resources under CRYPTOPRU 7. Weak documentation, unrealistic stress scenarios, reliance on unavailable liquidity or poorly evidenced recovery and wind-down capacity could make it difficult for a firm or its governing body to demonstrate comp
Who is affected
Related regulations
References
AI-generated analysis. May contain errors or omissions — verify with the original FCA source before acting. Full disclaimer.
What the FCA said
We've published guidance to help cryptoasset firms complete the overall risk assessment required under CRYPTOPRU 7. ... Read FG26/10 (PDF)Why we are issuing this guidanceWe've published guidance to help cryptoasset firms complete the overall risk assessment required under our Prudential sourcebook for CRYPTOPRU firms…
Extract from FCA . Read the full notice at the source for the authoritative text.