The Financial Conduct Authority has finalised guidance to help firms subject to CRYPTOPRU prepare an overall risk assessment. FG26/10 connects business-model risks with stress testing, financial-resource planning, recovery actions and orderly wind-down. It comes into force on 25 October 2027, not on its publication date, and does not prescribe a single methodology.
What the FCA published
On 30 September 2026, the FCA published FG26/10, final non-Handbook guidance supporting CRYPTOPRU 7. The FCA says it is intended for cryptoasset firms regulated under CRYPTOPRU, including custodians, custodial-staking firms and stablecoin issuers, as well as the risk, compliance and prudential teams responsible for their overall risk assessments.
The guidance comes into force on 25 October 2027. Its publication did not make a new CRYPTOPRU duty effective on 30 September 2026. FG26/10 is illustrative and non-exhaustive: firms should read it with the applicable rules and other guidance and apply it proportionately to the nature, scale and complexity of their activities.
Start with the actual business model
The guidance says an overall risk assessment should begin with the firm's business model and strategy. That includes its main activities, business-plan assumptions, sources of return and vulnerabilities that could affect its ability to operate. The assessment should look forward as well as at the current position, because new products, business lines, growth plans and operating changes can alter risk and resource needs.
A prospective firm can use this as a consistency test. The activities and dependencies described in its authorisation material should connect to the risks, controls and financial-resource assumptions in its overall risk assessment. That does not mean every crypto, payment, e-money or technology firm falls within CRYPTOPRU; permissions and prudential classification must be established for the particular business model.
Connect material risks to credible mitigants
FG26/10 discusses market, credit, liquidity, operational and concentration risk, as well as combinations of risks. It also asks firms to consider whether contractual and non-contractual features affect the realisability or liquidity of assets. Reliance on a single asset, exchange, financial partner, service provider or custody arrangement can increase vulnerability.
The practical issue is whether proposed controls and mitigants would remain available under stress. Collateral, committed facilities and operational contingencies should not be treated as reliable without evidence. If mitigants are insufficient or unreliable, the guidance says a firm should consider holding additional financial resources; if residual risk remains outside appetite, it should consider whether to continue the activity.
Make risk appetite and stress testing operational
The FCA connects risk appetite to limits, tolerances, early-warning indicators and triggers for action. Monitoring should help management decide when to strengthen controls, take recovery action or consider wind-down. Risk metrics, escalation routes and decision rights therefore need to match the risks that could threaten viability or cause harm.
Stress testing is central to the assessment. Scenarios should be relevant to the business model, forward-looking, internally consistent, and severe but plausible. The guidance includes firm-specific, market-wide and combined stresses, such as cyber incidents, loss of access to critical services, counterparty or trading-venue failure, significant price declines and liquidity withdrawal. These are examples rather than a mandatory scenario library.
Reverse stress testing identifies the point at which the business model stops being viable. That conclusion should inform recovery planning and wind-down, including whether enough own funds and liquid assets would remain when a wind-down decision has to be made.
Link financial resources, recovery and wind-down
The overall risk assessment should not treat going-concern resources and wind-down planning as separate exercises. Risks, mitigants, stress results and recovery options shape the resources needed during normal operations and under pressure. Wind-down assumptions determine what may be required once recovery is no longer credible.
A useful internal review can map each material activity to the relevant permission and prudential classification, material risks, controls, risk-appetite metrics, stress scenarios, resource impacts, recovery actions and wind-down triggers. Figures and assumptions should reconcile across the authorisation application, overall risk assessment, financial-resource analysis, recovery framework and wind-down plan.
This kind of mapping can expose unsupported assumptions, unclear ownership and inconsistent evidence before documents are finalised. It is a preparation technique, not an FCA template or a guarantee that a firm will satisfy regulatory requirements.
Application and implementation timing
The FCA opened the crypto authorisation application period on 30 September 2026. It says firms intending to continue operating in the UK should apply by 28 February 2027, ahead of the new regime coming into force on 25 October 2027. Authorisation is not automatic.
Those dates make preparation relevant now, but firm-specific transition arrangements, application timing and prudential requirements depend on current official material and the firm's activities. Existing anti-money-laundering registration should not be described as authorisation under the new regime.
Status and limitations
FG26/10 was published on 30 September 2026 and comes into force on 25 October 2027. The earlier consultation ran from 30 June to 30 July 2026. The FCA's stated application cutoff for firms intending to continue operating is 28 February 2027, with the new regime due to begin on 25 October 2027.
Firm-specific permissions, prudential classification, transition route and resource calibration require review of the current rules and actual business model. This article does not compare FG26/10 line by line with earlier guidance and does not claim that it changed a particular requirement. It is general regulatory and operational commentary, not legal or financial advice.