PS26/18: The FCA’s New Perimeter Guidance for Crypto Safeguarding, Explained

Published 2 October 2026

On 16 September 2026, two weeks before its cryptoasset authorisation gateway opened, the FCA published PS26/18, its policy statement on Perimeter Guidance (PERG) for the new UK cryptoasset regime. The timing was not an accident. Firms needed to know, before they could even start an application, whether what they do actually falls inside the regulatory perimeter at all, and specifically whether what they do with customer assets counts as the new standalone regulated activity of safeguarding cryptoassets. PS26/18 is the FCA’s answer.

For firms already thinking about CASS 15 safeguarding for payments and e-money, or the CASS 17 custody regime for crypto that we covered in an earlier post, this is a companion piece: it does not change the substantive safeguarding rules, but it does determine who is caught by them in the first place, and from when.

What PS26/18 actually is

PS26/18 is the FCA’s feedback statement and final guidance following its consultation on amendments to PERG, the chapter of the Handbook that interprets the boundaries of regulated activity. The FCA received 78 responses; roughly 60% supported the draft guidance as consulted, with most of the remainder asking for sharper clarity on technical service providers, decentralised and multi-party custody models, and territorial reach. The FCA has made targeted clarifications in response, without altering the substance of the perimeter itself.

That last point matters more than it sounds. The FCA is explicit that PERG is interpretation only: it “cannot be used to expand, narrow or otherwise alter the scope of the perimeter established in legislation.” If your activity is genuinely borderline, PS26/18 helps you read the statute correctly; it does not give the FCA room to sweep you in, or let you argue your way out, beyond what Parliament’s instrument actually says.

The control test for safeguarding

The core of PS26/18, for our purposes, is how the FCA approaches “safeguarding cryptoassets” as a standalone regulated activity. The test is control-based: a firm is safeguarding if it has the requisite degree of control over cryptoassets held for customers, regardless of the technical architecture used to achieve that control. A few specific clarifications are worth knowing before you map your own operating model against it:

• Multi-party and distributed custody, including key-sharding arrangements where no single party holds a complete key, are not automatically outside scope. Each participant’s role is assessed against the control standard on its own facts.
• There is no blanket exclusion for technical service providers. A sub-custodian, key-management vendor or wallet infrastructure provider that meets the control threshold is itself conducting a regulated activity, independently of its client’s regulatory status.
• “Arranging safeguarding” is a distinct activity from safeguarding itself. A firm that intermediates, for example by introducing a customer to a custodian without ever controlling the assets, can be caught by the arranging limb even though it never does the safeguarding itself.
• A narrow, practical carve-out exists for assets held only transiently for settlement purposes, generally where the holding period is no more than 24 hours.

Territorial scope and the “by way of business” test

PS26/18 also confirms that the perimeter reaches overseas firms providing cryptoasset services to UK consumers; being based outside the UK is not, by itself, a basis for exclusion. And the FCA has clarified that the “by way of business” threshold requires a firm to actually be carrying on that specific regulated activity as a business, not merely to be adjacent to it: providing technical infrastructure alone, without more, does not tip a firm into regulated territory. Managing or advising on qualifying cryptoassets remain outside the new regulated activities created by this regime, which is worth flagging to clients who assume every crypto-adjacent function is now caught.

Why this matters for your authorisation decision

The FCA’s cryptoasset authorisation gateway opened on 30 September 2026 and runs to 28 February 2027, ahead of the regime commencing on 25 October 2027. Firms already registered under the Money Laundering Regulations do not convert automatically; payment and e-money institutions adding cryptoasset activities need new permissions; and firms already authorised under FSMA for other business will typically need a variation of permission. Missing the application window has consequences under the regime’s transitional provisions, so the scope question PS26/18 answers, do you safeguard, do you merely arrange safeguarding, or are you outside the perimeter altogether, is not academic. It decides whether you need to be in that queue at all, and if so, under which limb of the new regime.

For smaller firms in particular, this is the moment to revisit your custody and operating model with a cold eye, rather than relying on how the activity has always been described internally. A firm that has quietly drifted from “arranging” into genuine control over customer keys, for instance through an infrastructure upgrade nobody flagged as a regulatory event, may now find itself needing full safeguarding permissions it did not previously think it required.

What’s next

The FCA has signalled that it will consult further on targeted guidance updates in October 2026, so PS26/18 is unlikely to be the last word on perimeter scope before the regime beds in. We will cover the next consultation here when it lands.

If you’re a payment, e-money or crypto firm working through where your activities sit against the new perimeter, or preparing a CASS 15 or CASS 17 authorisation application, get in touch for a review.