FCA Finalises Guidance on the Prudential Overall Risk Assessment for Cryptoasset Firms

The Financial Conduct Authority (FCA) has published two sets of finalised non-Handbook guidance on COREPRU 7 (FG26/9) and CRYPTOPRU 7 (FG26/10), together with feedback statements responding to consultations GC26/4 and GC26/5, on the overall risk assessment requirements under the new prudential framework for regulated cryptoasset firms. 

Background

The FCA describes the overall risk assessment as the principal mechanism by which a firm sets the own funds and liquid assets it needs to comply with the overall financial adequacy rule. Through such mechanism, the firm assesses its own funds threshold requirement and liquid assets threshold requirement. FG26/9 and FG26/10 accompany Chapter 7 of the new Core Prudential sourcebook (COREPRU) and the Prudential sourcebook for CRYPTOPRU firms (CRYPTOPRU), respectively. 

FG26/9: COREPRU 7

FG26/9 describes an integrated process that runs from understanding a firm’s business model, through stating its risk appetite and setting financial resource thresholds, to planning for wind-down without causing material harm. The main elements are:

• Business model and risk appetite: the assessment must cover all of the firm’s activities, whether regulated or unregulated, and must be embedded in strategic decision-making. FG26/9 also describes setting the risk appetite within a wider framework of early warning indicators and triggers for contingency, recovery and wind-down action as the best practice approach. 
• Ongoing resources and stress testing: own funds and liquid assets should be assessed separately and on a forward-looking basis. A business plan typically covering three years should be stress tested, and reverse stress testing should be used to check whether the wind-down plan is workable. 
• Wind-down planning: the trigger for wind-down must occur while enough capital and liquid resources remain, assuming stressed conditions. Where wind-down needs exceed ongoing needs, the threshold requirement should cover the higher amount and enhanced early warning indicators should be introduced. 
• Documentation and supervisory review and evaluation process (SREP): the assessment must be reviewed at least every 12 months and after any material change. It must be kept for at least three years. It is subject to the FCA’s SREP, after which the FCA may require additional own funds or liquid assets, among other measures. 

FG26/10: CRYPTOPRU 7

FG26/10 applies the above expectations to cryptoasset activities and should be read alongside FG26/9. The main elements are:

• Risk identification: this covers market, leverage, credit, liquidity, operational, combined and concentration risks, including exposure to prefunded trading venues. It also covers uncertainty from the sector’s limited track record, such as the willingness of banks to provide services. 
• Stress testing: stresses should be severe but plausible and may go beyond historical experience. Examples include loss of private keys, a loss of confidence in a qualifying stablecoin, and combined market and cyber events. 
• Recovery actions and contingency funding: firms should identify credible recovery actions linked to internal triggers. They should also maintain a contingency funding plan, recognising that most liquidity outflows can occur within the first one to two days of a stress event. 
• Wind-down planning: firms should take account of risks such as unbonding periods and withdrawal delays (for custodians and custodial staking firms), on-chain transfer costs and tested procedures for handing over cryptographic keys.
• Liquid assets: firms should prepare a stressed 90-day cashflow forecast and a 12-month funding profile. Client assets and encumbered assets should be excluded from liquid asset resources. 
• Governance and group risk: the governing body of in-scope firms must review and approve the assessment and its key assumptions. Group risks, such as fragmented stablecoin reserves and centralised custody arrangements, must be evaluated. 

Timeline and Next Steps

Both sets of guidance come into force on 25 October 2027. 

FG26/9 and FG26/10 can be found here and here respectively.