Crypto prudential risk assessments need a board-owned evidence trail

At a Glance

The FCA's GC26/5 consultation closed on 30 July 2026. Its proposed non-Handbook guidance describes how an overall risk assessment would connect a CRYPTOPRU firm's business model, risks, financial resources and governance. Firms preparing for the FCA's planned September permissions gateway can use the published proposal as a readiness benchmark while monitoring the final guidance.

The FCA has published its crypto prudential sourcebook and separately consulted on non-Handbook guidance for the CRYPTOPRU 7 overall risk assessment. GC26/5 describes how the assessment could connect the business model, financial resources, stress testing, recovery options and governance. Because that guidance remained proposed at consultation close, the article keeps the final sourcebook and the consultation text distinct.

GC26/5 complements the FCA's final prudential sourcebook, but the non-Handbook guidance was still proposed when the consultation closed. The practical task is to distinguish the final Handbook requirements from the supporting guidance still under review, then build an evidence trail that can be updated when the FCA publishes its final position.

What is final and what remains under review

FCA’s integrated cryptoasset regime policy package

The FCA’s June 2026 policy statements deliver a comprehensive cryptoasset regulatory framework, including admissions and disclosures (A&D) and the Market Abuse Regime for Cryptoassets (MARC). These rules require cryptoasset trading platforms to conduct due diligence and publish qualifying cryptoasset disclosure documents (QCDDs) before admitting assets to trading. Firms should assess how these requirements interact with prudential risk assessments, ensuring that disclosures and governance align with financial resource planning and risk management.

Non-Handbook guidance consultation on CRYPTOPRU 7 overall risk assessment

GC26/5 describes the overall risk assessment as a continuous process reflecting the firm's business model, risk appetite and financial resources. It discusses severe but plausible stress testing and recovery actions linked to internal triggers. Firms can use those proposals to test whether ownership, challenge and evidence are ready, while marking every conclusion that depends on the FCA's final guidance.

Stress testing and recovery planning expectations

The proposed FCA guidance says stress testing should cover both market-wide and firm-specific severe but plausible events, including operational risks and potential redress liabilities. The proposed guidance discusses credible recovery actions with clear triggers and timelines, integrating these into contingency funding plans. Under the proposal, prudential risk assessments would need to be dynamic and actionable, with evidence of board oversight and management control over recovery strategies.

Who should use the proposed guidance

The FCA’s CRYPTOPRU 7 guidance consultation explicitly targets firms seeking authorisation and regulation for cryptoasset-related regulated activities under the Cryptoassets Regulations. This includes cryptoasset trading platforms, custodians, and other firms participating in regulated cryptoasset services. The guidance is also relevant to boards, CFOs, risk leads, and compliance officers responsible for prudential risk management and financial resilience within these firms.

Beyond firms directly regulated under CRYPTOPRU, the consultation is of interest to industry groups, professional advisers, and trade bodies representing crypto firms. While firms not currently regulated under CRYPTOPRU may monitor the guidance for future applicability, the FCA’s focus is on firms with prudential permissions that would need to demonstrate ongoing financial adequacy under the final regime and robust risk assessments linked to their business models and governance.

MEMA Assessment

The FCA’s consultation on non-Handbook guidance for CRYPTOPRU 7 places the board at the centre of prudential risk management for cryptoasset firms. Boards should ask how the overall risk assessment connects to the firm’s business model, financial resources, and stress testing results. They should seek evidence that management has identified severe but plausible stress scenarios and credible recovery actions, with clear triggers and timelines. The board’s role includes challenging assumptions and ensuring the firm’s financial resilience is demonstrably maintained under stress.

MEMA's view is that the assessment should operate as a governance record rather than a one-off application document. Useful board evidence includes model assumptions, stress results, contingency-funding options, recovery feasibility, management actions and a record of challenge. The board should be able to see which gaps block an application and which points remain contingent on final guidance.

Questions Firms Should Resolve

With the consultation closed, firms can use GC26/5 as a challenge tool rather than treating every passage as final guidance. The working paper should map business-model exposures to financial resources, stress results and credible recovery actions, while identifying assumptions that depend on the FCA's final guidance. The resulting register should show where evidence exists, where modelling is incomplete and which decisions need board challenge before an application.

MEMA recommends developing severe-but-plausible scenarios that cover relevant market-wide, firm-specific, operational and redress exposures, then testing whether recovery actions are credible, timely and within management control. Firms should show how the results feed into the overall risk assessment and how the board challenges the assumptions before relying on that assessment in a permissions application. The working papers should identify the model owner, data date, key limitations, financial-resource impact and trigger for reassessment. They should also record why a proposed recovery action remains feasible under the scenario in which it would be needed, rather than listing actions that disappear when market liquidity, operational capacity or counterparties are under the same stress.

Readiness decisions after the consultation

Source Evidence

Plain English Glossary

• PS - Policy Statement. FCA publication confirming final rules following consultation, typically with the new Handbook text and feedback summary.
• GC - Guidance Consultation. FCA publication consulting on proposed guidance (rather than rule changes) before finalising it.

Disclaimer

This article is for general information only and does not constitute legal or regulatory advice. Firms should assess the application of regulatory requirements by reference to their permissions, products, customers and operating model.

How MEMA Can Help

MEMA can help firms translate regulatory change into practical controls, policies, monitoring activity and board evidence. Book a free scoping call to discuss what this development means for your firm.

MEMA helps firms apply regulatory developments through its cryptoasset regulatory readiness support.

Further reading: permission-scope decisions before launch.