FCA FG26/10: Crypto Firms Face New Risk Assessment Guidance

September 30, 2026 · Plaza Cripto

FCA FG26/10 sets out final guidance on the overall risk assessment framework that cryptoasset firms within the CRYPTOPRU regime will need to use to identify and manage financial and operational risks. Published by the Financial Conduct Authority (FCA) on September 30, 2026, the guidance covers risk identification, stress testing, recovery planning and wind-down preparation, with the objective of helping firms maintain adequate financial resources and reduce risks to consumers and markets.

FCA FG26/10 Introduces Final Risk Assessment Guidance

The publication of FCA FG26/10 represents another development in the UK’s evolving regulatory framework for cryptoasset businesses.

The final guidance explains how firms subject to the CRYPTOPRU regime should approach an overall risk assessment.

Rather than focusing on a single type of financial risk, the framework requires firms to consider a broader range of risks that could affect their ability to operate safely and meet regulatory obligations.

The guidance covers several key areas, including risk identification, stress testing, recovery measures and wind-down planning.

What Is FCA FG26/10?

FCA FG26/10 is the FCA’s final guidance concerning the overall risk assessment expected from firms within the scope of the CRYPTOPRU framework.

The guidance is designed to help firms assess whether they have sufficient financial resources and appropriate arrangements to manage risks arising from their business activities.

An overall risk assessment provides a structured way for a company to identify potential threats, evaluate their impact and determine how the business would respond under adverse circumstances.

For cryptoasset firms, this approach is particularly relevant because the sector can involve market volatility, technology dependencies, custody risks and operational challenges.

CRYPTOPRU and Cryptoasset Firms

The guidance applies to firms operating within the scope of the UK’s CRYPTOPRU regime.

The framework is relevant to different categories of cryptoasset businesses, including firms involved in custody, custodial staking and stablecoin issuance.

The FCA’s guidance provides these firms with a clearer framework for considering how their financial resources and risk-management arrangements would perform under different circumstances.

Companies therefore need to understand how the overall risk assessment fits into their wider regulatory responsibilities.

Cryptoasset Custodians Under the Guidance

Cryptoasset custodians are among the firms covered by the guidance.

Custodians can be responsible for holding or safeguarding cryptoassets on behalf of customers.

Because customers depend on these businesses to protect assets and maintain operational continuity, effective risk assessment can be particularly important.

Under the approach outlined in FCA FG26/10, firms should consider the risks associated with their operations and ensure that their financial and operational resources are appropriate for the risks they face.

Custodial Staking Firms Also Covered

The guidance also applies to custodial staking firms within the relevant regulatory scope.

Staking services can introduce additional operational and financial considerations, particularly when a provider holds or controls customer assets while facilitating staking activities.

A firm’s overall risk assessment should therefore consider the specific characteristics of its business model.

Stress testing and recovery planning can help firms examine how they would respond if adverse conditions affected their operations or financial resources.

Stablecoin Issuers and Risk Assessment

Stablecoin issuers are another category identified in relation to the guidance.

Stablecoin businesses can face risks associated with reserves, liquidity, redemption activity, market conditions and operational infrastructure.

The overall risk assessment framework gives firms a structured process for considering these risks and determining whether their available resources are sufficient.

The guidance does not eliminate the underlying risks associated with stablecoins. Instead, it establishes expectations around how firms should assess and manage the risks relevant to their activities.

Identifying Risks Before They Become Critical

A central element of FCA FG26/10 is risk identification.

Firms need to understand the risks that could affect their financial position, customers or ability to continue operating.

Risk identification can include consideration of market conditions, operational failures, liquidity pressures, technology disruptions and other events relevant to a firm’s business model.

The purpose is to ensure that potential weaknesses are identified before they develop into situations that could materially affect customers or market stability.

Risk Assessment Should Reflect the Business Model

A single risk assessment approach may not be appropriate for every cryptoasset business.

A custodian, custodial staking provider and stablecoin issuer can have different sources of financial and operational risk.

The guidance therefore places emphasis on assessing risks in the context of each firm’s activities, structure and exposure.

This allows firms to develop risk-management arrangements that are connected to the actual risks generated by their operations.

Stress Testing Under FCA FG26/10

Another important component of the guidance is stress testing.

Stress tests allow firms to consider how their financial resources and operations might perform under severe but plausible adverse scenarios.

For crypto businesses, scenarios could involve significant market movements, liquidity pressures, operational disruptions or other events relevant to the firm’s activities.

The purpose of stress testing is not to predict exactly what will happen.

Instead, it provides a framework for evaluating whether a business has sufficient resources and contingency arrangements to withstand difficult conditions.

Financial Resources and Resilience

The FCA’s guidance places significant attention on financial resources.

Firms need to assess whether they have sufficient resources to absorb potential losses and continue meeting their obligations under adverse conditions.

Financial resilience can be particularly important for businesses operating in markets where asset prices and liquidity conditions can change rapidly.

The overall risk assessment therefore provides a mechanism for connecting identified risks with the resources available to manage them.

Recovery Planning

FCA FG26/10 also addresses recovery planning.

A recovery plan sets out actions that a firm could take if its financial or operational position deteriorates but the business remains capable of continuing operations.

These measures can include actions designed to strengthen liquidity, reduce costs, preserve critical operations or otherwise stabilize the business.

The exact measures will depend on the firm’s structure, business model and risk profile.

Why Recovery Measures Matter

Recovery planning provides firms with a predefined framework for responding to financial or operational stress.

Instead of developing a response only after a crisis begins, firms can identify potential actions in advance.

This can help management understand what options may be available and what resources could be mobilized under different stress scenarios.

Wind-Down Planning for Crypto Firms

The guidance also requires firms to consider wind-down arrangements.

A wind-down plan addresses the possibility that a business can no longer continue operating and needs to exit its activities in an orderly manner.

For crypto businesses, an orderly wind-down can be particularly important where customers have assets or contractual relationships that need to be managed.

Planning in advance can help firms identify the resources, processes and actions required to protect customers and meet outstanding obligations during an exit.

Reducing Risks to Customers and Markets

One of the broader objectives behind the FCA’s framework is to reduce potential risks to consumers and markets.

A crypto firm’s financial difficulties can have consequences beyond the company itself, particularly when the business provides custody, staking or stablecoin-related services.

By requiring firms to assess risks, conduct stress tests and prepare recovery and wind-down measures, the framework seeks to improve preparedness for adverse scenarios.

The guidance therefore connects internal risk management with broader consumer and market protection.

FCA FG26/10 and Operational Resilience

Financial resilience is closely connected to operational resilience.

A company may have adequate financial resources but still face significant risks if critical systems, personnel, technology or third-party services fail.

Cryptoasset businesses can have substantial technology dependencies, making operational preparedness an important component of their broader risk assessment.

Firms should therefore consider how operational disruptions could affect their ability to continue providing services and meeting customer obligations.

Implications for Crypto Businesses

The publication of FCA FG26/10 provides crypto businesses with additional guidance for assessing their regulatory preparedness.

Companies within the CRYPTOPRU framework may need to review:

• their overall risk assessment methodology;
• financial resources and liquidity;
• stress-testing scenarios;
• recovery options;
• wind-down arrangements;
• customer protection measures; and
• operational dependencies.

The specific implementation will depend on the firm’s activities and regulatory obligations.

What Crypto Firms Should Review

For affected firms, the guidance creates several areas for internal review.

First, businesses should identify the material risks associated with their activities.

Second, firms should consider whether their stress-testing scenarios adequately reflect their risk profile.

Third, management should evaluate whether recovery actions are realistic and supported by sufficient resources.

Finally, companies should ensure that wind-down plans address the needs of customers and other relevant stakeholders.

A Broader Shift in UK Crypto Regulation

FCA FG26/10 forms part of a wider development in the UK’s crypto regulatory framework.

The UK is moving toward a more structured regulatory environment in which qualifying crypto businesses are expected to demonstrate stronger governance, financial resilience and customer protection arrangements.

The overall risk assessment guidance adds another layer to these requirements by focusing on how firms prepare for adverse financial and operational conditions.

Looking Ahead

The publication of FCA FG26/10 on September 30, 2026, provides final guidance for relevant cryptoasset firms operating under the CRYPTOPRU regime.

The framework covers risk identification, stress testing, recovery planning and wind-down preparation.

Cryptoasset custodians, custodial staking firms and stablecoin issuers within the relevant scope will need to consider how the guidance applies to their individual business models and risk profiles.

The broader objective is to encourage firms to maintain adequate financial resources and strengthen preparedness for situations that could affect customers or markets.

👉 Open Your Account: : https://forms.gle/QVri289ukKMFR6Qn

🔐 Buy OneKey and Get Up to 5 USDT Cashback: https://onekey.so/r/ERC

💳 Discover MyPal: https://h5.mypal.pro/pm/vhcn?code=27090432