FCA Redraws the Boundaries of Crypto Custody

The UK's Financial Conduct Authority (FCA) has published its Cryptoasset Perimeter Guidance, effectively broadening the definition of custody and pulling platforms, software providers, and validators into the regulated perimeter. The move forces virtually every crypto service provider to transition from anti-money laundering (AML) registrations to formal approval under the Financial Services and Markets Act (FSMA).

The 24-Hour Rule: Becoming a Custodian Without Knowing It

One of the most consequential provisions is the so-called 24-hour rule. Any firm holding client assets for longer than a day during trade settlement will be classified as a regulated custodian, requiring a full safeguarding license. Businesses that consider themselves mere intermediaries or apps could unknowingly trigger this classification.

Validators and node operators face similar exposure. The regulator made clear that the moment they offer "added value" features—user dashboards, yield products, or reward-compounding tools—they forfeit their pure-tech exemption and must seek formal approval for arranging staking.

'Shadow Custody' Officially Defined for the First Time

Perhaps the most novel concept in the guidance is shadow custody. The FCA stated that if a service provider can theoretically override a client's authority—even if it pledges never to exercise that power—it qualifies as a custodian. Crucially, operating through smart contracts or on a public blockchain does not place an arrangement outside the regulatory perimeter.

"The fact that an arrangement involves smart contracts, public blockchains or some elements of decentralisation does not determine the perimeter position," the document noted.

Stablecoin Issuers: UK Establishment and Full Lifecycle Mandatory

For stablecoin issuers, the guidance is equally unambiguous. Issuance is legal only if the issuer is established in the United Kingdom and manages the entire lifecycle—from initial offering through redemption and reserve maintenance. Offshore issuers or those delegating parts of the lifecycle to third parties will not meet the standard.

Historical Context: UK Crypto Regulation Evolves

The UK has required AML registration for crypto firms since 2018, but that framework focused on operator-level risk, not client asset protection. The collapse of FTX in 2022 catalyzed a global regulatory pivot toward stronger custody safeguards. The UK Treasury accelerated efforts to incorporate cryptoassets into FSMA, and the FCA issued a series of discussion papers and consultations through 2024 to shape the rules now being finalized.

With the EU's Markets in Crypto-Assets (MiCA) regulation fully in force since 2024, the UK is under pressure to establish a credible and competitive post-Brexit framework of its own.

Transition Timeline: Five-Month Window Starting September 30

All firms must migrate from the current AML registration system to the new FSMA approval regime. The FCA has set a five-month application window running from September 30, 2026 to February 28, 2027. Firms that apply within this window may continue operating under "savings provisions" while the regulator deliberates. Those that miss the deadline face fines, suspension, and potential permanent closure.

The FCA will accept industry feedback on the proposals until June 3, 2026, publish final rules in policy statements during summer, and release the final perimeter guidance in September.

Outlook [Expert Analysis]

While the guidance adopts a principles-based framing, its substance is notably prescriptive. The 24-hour rule and shadow custody concept are likely to sweep DeFi protocols and wallet software providers into the regulatory net, well beyond traditional exchanges.

Legal observers caution that the undefined scope of "added value" services could impose disproportionate compliance costs on smaller developers. For large custodians and institutional exchanges, however, a clearer regulatory framework is likely to serve as a growth catalyst rather than a deterrent.

The February 2027 deadline could accelerate market consolidation. Firms lacking compliance infrastructure may exit or be absorbed by larger players, reshaping the structure of the UK crypto market in ways that favor incumbents with regulatory capacity.