FCA Finalises CASS 17: A New Safeguarding Regime for Crypto Custodians

On 30 June 2026 the FCA published the core rulebook for the UK’s new cryptoasset regime — five policy statements (PS26/9 through PS26/13) covering everything from stablecoin issuance to market abuse. Buried in that package, but arguably the single most consequential piece for firms already living inside CASS, is the creation of CASS 17: a bespoke safeguarding chapter for custodians of client cryptoassets.

For firms that have spent the last few years watching CASS 6, CASS 7 and now CASS 15 (the payments and e-money safeguarding regime) evolve, CASS 17 will feel familiar in structure but distinct in detail. It is worth understanding now, well before the authorisation gateway opens, because the FCA has been explicit that it expects firms to be operationally ready before they apply — not scrambling to build controls after approval.

What CASS 17 actually does

Trust status. Client cryptoassets must be held on trust, separate from the firm’s own assets and outside the firm’s estate on insolvency. The FCA consulted on whether alternative protective structures might work as well as a trust; in the final rules it held its ground on trust as the default model, while noting it will “monitor” how this beds in. For custodians who had hoped for more flexibility, this is the one to note — legal title matters, and documentation needs to reflect it properly.

Segregation and record-keeping. Assets must be held separately per client and per asset class, with ownership rights, record-keeping and reconciliation obligations that echo CASS 6 but are written specifically for the mechanics of cryptoasset custody — including private key management, which has no real analogue in traditional custody rules. Firms will need to be able to demonstrate, asset by asset and client by client, exactly what is held and on whose behalf.

Client money treatment. Where cryptoasset safeguarding activity generates client money — for example, fiat proceeds awaiting reinvestment or withdrawal — that money falls under the existing CASS 7 regime, not CASS 17. Firms running mixed cryptoasset and fiat books will need both chapters operating side by side, with clear internal logic for which pot governs which asset. Stablecoin issuers, by contrast, are carved out of CASS 7 entirely, reflecting the separate backing-asset trust regime that applies to them under PS26/10.

Reconciliation and shortfalls. As with the CASS 15 supplementary regime that came into force for payment and e-money firms on 7 May 2026, the direction of travel is towards daily reconciliation and prompt escalation of shortfalls, rather than periodic, after-the-fact checking. Firms building CASS 17 controls would be well advised to look at how the FCA has been supervising the CASS 15 supplementary regime in practice, since the underlying supervisory philosophy — continuous, operational, evidenced — is clearly consistent across both regimes.

Key dates

The authorisation gateway for cryptoasset firms opens on 30 September 2026 and closes on 28 February 2027. Firms that apply within that window can generally continue operating while their application is assessed; firms that apply later cannot onboard new customers until they are approved. The wider UK Cryptoasset Regulations 2026 — and with them the full CASS 17 regime — are due to commence on 25 October 2027, giving firms a genuine but not generous runway to get safeguarding arrangements gateway-ready.

What this means in practice

If your firm safeguards, or arranges the safeguarding of, qualifying cryptoassets, the sensible starting point is a gap analysis against CASS 17 now, rather than waiting for the authorisation window to open. The FCA’s own commentary on the CASS 15 experience is instructive: firms that treated the rules as a documentation exercise rather than an operational rebuild have generally faced tougher supervisory conversations than those who built reconciliation, resolution planning and key management into their day-to-day treasury operations from the outset. CASS 17 is being built in that same spirit, and firms preparing for the 2026 gateway would do well to assume the same standard applies.

If you’d like a second opinion on how CASS 17 will map onto your existing safeguarding arrangements — or where CASS 7 and CASS 17 need to interact within your business — get in touch.