#
Financial promotions regime in force since Oct 2023: authorisation/registration or approved-marketing required, standardised risk warnings, Restricted Mass Market Investment classification limiting who may respond. No FSCS/FOS protection for unauthorised or MLR-only firms. CASS 7 custody segregation (with adjustments) tied to the future regime; stablecoin issuers excluded from CASS 7. FCA enforcement demonstrated via the HTX action.
The protection gap on the other side of this regime is stark: consumers using cryptoasset or unauthorised cryptoasset firms cannot make a claim to the Financial Services Compensation Scheme if the firm fails, nor an eligible complaint to the Financial Ombudsman Service if the firm is unauthorised or only MLR-registered. This means the marketing-side protections are already live, while the safety-net protections that would matter if a firm actually failed remain absent for the large population of firms operating under MLR registration alone, pending the wider authorisation regime.
Looking toward the future regime, the FCA is proceeding with applying CASS 7 (with targeted adjustments) to client money and client assets arising from the safeguarding of client cryptoassets once the future regime takes effect, though firms issuing qualifying stablecoins will not be subject to CASS 7 given their separate reserve and redemption obligations under the stablecoin regime. The FCA has also demonstrated active enforcement of the existing financial promotions regime, having taken enforcement action, including legal proceedings, against the exchange HTX for illegally promoting cryptoasset services to UK consumers via websites and social media in breach of the financial promotions regime.
Outlook
The consumer protection module illustrates the UK's bifurcated timeline most clearly: marketing restrictions and risk-disclosure obligations have applied since October 2023 and are actively enforced, as the HTX action demonstrates, while custody segregation (CASS 7) and the broader safety-net implications of full authorisation remain tied to the October 2027 commencement of the wider regime. Continued FCA enforcement activity against unauthorised promotion should be expected in the interim, given the regulator's demonstrated willingness to pursue such cases under the existing regime.
Consumer Protection
The FCA's finalised guidance FG26/7 sets a baseline supervisory expectation, not yet a binding commenced rule, that firms requiring authorisation for Table 1 regulated cryptoasset activities operate from a UK legal entity. The guidance states that a UK branch alone is generally not expected to meet minimum standards for client-asset protection in the event of firm failure, signalling that the FCA will scrutinise corporate-structure choices made by overseas groups seeking UK market access ahead of the 2027 commencement of the wider regulated-activities regime. This is supervisory expectation rather than a binding instrument, and firms should read it as guidance shaping how authorisation applications made through the gateway open since 30 September 2026 will be assessed, rather than as a standalone enforceable requirement in its own right.
Outlook
Whether the FCA formalises this legal-entity expectation into a binding authorisation condition, rather than leaving it as guidance, is the item to watch as applications move through the gateway ahead of the 25 October 2027 commencement.
2 earlier distinct update(s)
Consumer Protection
SI 2026/102 amends section 418 of FSMA to close a previously significant extraterritorial gap in UK crypto consumer protection: overseas firms selling or arranging qualifying cryptoasset activities to UK consumers will require FCA authorisation, removing the route by which offshore platforms could serve UK retail customers without being subject to UK-specific conduct requirements. This change is enacted but not yet effective, entering force with the rest of the SI 2026/102 package on 25 October 2027. Until that date, the extraterritorial gap the amendment is designed to close remains open in practice, meaning UK consumers using overseas platforms are not yet covered by the enhanced protection the new perimeter will eventually provide. This is a consumer-facing dimension of the same licensing transition covered under crypto_licensing: the same instrument, same commencement date, but the specific harm it addresses is offshore firms reaching UK retail consumers without local authorisation.
Outlook
The practical consumer-protection benefit of the section 418 amendment will not materialise until 25 October 2027. Between now and then, UK consumers dealing with unauthorised overseas platforms remain outside the protection this amendment is designed to eventually provide.
Consumer Protection
The FCA has confirmed, as part of the finalised 30 June 2026 cryptoasset package, that established financial-services standards -- including the Consumer Duty -- now apply to firms operating within the cryptoasset regime. This is a principle-level confirmation from the primary regulator rather than a detailed rulebook mapping: the finalised package establishes that Consumer Duty obligations extend to cryptoasset firms, but the specific rule-by-rule detail of how that duty translates into cryptoasset-specific conduct requirements (disclosure standards, product-governance expectations, fair-value assessments as applied to cryptoasset products, and so on) was not independently retrieved or verified this cycle.
The framework underpinning this is the FCA's Consumer Duty (PRIN 2A), applied to cryptoasset firms via the finalised 30 June 2026 package, with the Financial Conduct Authority as supervisory authority. Because the detailed mapping is not yet independently confirmed, this module should be read as establishing that consumer-protection standards apply in principle, without yet specifying their full practical content for cryptoasset firms.
Outlook
The next development to watch for here is the detailed rule-by-rule mapping of Consumer Duty obligations as applied specifically to cryptoasset firms, which has not yet been independently retrieved. Until that detail surfaces, the practical compliance content of this module's headline finding remains only partially specified.
Sources and findings (7)
- T1 · FCAFirms wishing to promote cryptoassets in the UK — authorised or registered by the FCA, or have their marketing approved by an authorised firm; illegal promotion is a criminal offenceretrieved M5bindingin force
- T1 · FCACryptoasset promotions — clear, fair and not misleading, labelled with prominent standardised risk warnings, and must not inappropriately incentivise people to investretrieved M5bindingin force
- T1 · FCAFCA — 'Restricted Mass Market Investments', meaning consumers can only respond to cryptoasset financial promotions if classed as restricted, high-net-worth, or sophisticated investors, alongside appropriateness assessmentsretrieved M4bindingin force
- T1 · FCAConsumers using cryptoasset or unauthorised cryptoasset firms — a claim to the Financial Services Compensation Scheme if the firm fails, nor an eligible complaint to the Financial Ombudsman Service if unauthorised or MLR-only-registeredretrieved M4bindingin force
- T1 · FCAFCA — CASS 7 (with targeted adjustments) to client money and client assets arising from the safeguarding of client cryptoassets under the future regime; firms issuing qualifying stablecoins will not be subject to CASS 7retrieved M4bindingenacted not yet effectivenew
- T1 · FCAFCA — the exchange HTX, including legal proceedings, for illegally promoting cryptoasset services to UK consumers via websites and social media in breach of the financial promotions regimeretrieved M3non-bindingnew
- T1FCA Handbook CASS 17 — Future CASS 17 custody rules for cryptoassets are expected to apply from 25 October 2027 alongside the main regime commencement; detailed custody/segregation provisions not independently retrieved this cycle.retrieved M3bindingenacted not yet effective