FCA Crypto Safeguarding: CASS 17.4 Key Management Checklist

Video transcript

From October 2027, CASS 17.4 requires the keys and shards that move client cryptoassets to be protected for their whole life cycle.

Means of access is a key, part of one, or anything else needed to transfer a cryptoasset. Even a backup shard can count. The rules cover generating, storing, controlling, sharding and destroying it.

For each key generation, keep the approved script, attendees and witnesses, the device and its seals, the entropy source, and a signed log.

A proposed daily review of the means of access record was dropped. Instead, update it promptly whenever signers, devices, keys or thresholds change.

FCA guidance lists MPC, multisignature, HSMs, cold and warm segregation and cryptographic audit logs as emerging practices, used without centralising risk.

Avoid two opposite failures: too few staff or devices, and too many. Each quorum should be reachable at three in the morning, but not by colluding insiders.

The FCA does not prescribe a recovery test. Run one anyway: recover from backup alone, time it against your impact tolerance, and record the result.

Key incidents must be identified and resolved promptly. CASS 17.4 sets no FCA notice for them, but a client shortfall must be corrected within 24 hours.

Guardian audits key ceremonies and signer setups, and performs timed key recoveries. Read the full checklist, or talk to Guardian at guardian.security.

CASS 17 is the FCA's new safeguarding chapter for client cryptoassets, published in final form in PS26/11 on June 30, 2026. It comes into force on October 25, 2027.

Section 17.4 covers the means of access: the keys, shards and other secrets that move client assets. The FCA says these rules go beyond what CASS has traditionally covered.

The rules are technology-agnostic. The FCA will review whether to set minimum supervisory expectations as the market develops.

For dates, see our UK crypto deadlines post. For resilience testing, see our FG26/6 checklist.

This article explains the technical and security side of CASS 17.4 in the FCA's PS26/11. It is not legal advice; confirm how it applies to you with counsel.

What Counts as Means of Access

Means of access is a private key, part of one, or any other means a person would need possession or knowledge of to transfer the benefit of a cryptoasset.

The FCA says this could include hot wallets, cold wallets and hardware security modules (HSMs). The rules reach five activities (17.4.2R):

• generating or creating it
• storing it, in any form or medium
• exercising any form of control over it
• subjecting it to any process, such as sharding
• destroying it

They apply to firms safeguarding client cryptoassets. They also apply to backup providers that use the new trust exception in CASS 17.3.12R.

Shards, MPC and backup keys

Guidance in 17.4.3G works through sharding. Assuming the holder is a firm:

• Holding one shard alone may be unlikely to give control.
• A firm that created all the shards had control, so the rules apply.
• A firm that can still require shards back, or require help convening enough to sign, is covered.
• A recipient holding enough shards to have control is covered too.

PS26/11's Diagram 1 sets out nine custody models. In two, a firm holding only a backup key or backup shard applies CASS 17.4 without holding assets on trust.

Staking keys

For staking keys, it depends on whether they can transfer the benefit of a cryptoasset on behalf of another. The FCA does not expect that for validation-only keys; withdrawal keys may qualify.

Generation and Storage

CASS 17.4.4R is the core rule. A firm must have “robust security and organisational arrangements” protecting the means of access throughout its entire life cycle.

CASS 17.4.7G gives seven examples a firm should consider, as relevant.

1. international and industry standard practices
2. hacking and fraud risks, including from its own staff
3. a culture of detecting and acting on suspicious activity, with whistleblowing
4. single points of failure and dependency risk
5. back-up and recovery systems
6. checks that keys stay accessible and operable, without undue security risk
7. random, non-deterministic methods, to minimize the risk of irreproducible data

Ceremony evidence

Keep this evidence for each key generation.

• the approved script, and any deviations from it
• attendees, roles and witnesses, with identity checks
• the device or HSM, its firmware and its tamper seals
• the entropy source, for 17.4.7G(7)
• derived public keys and addresses, checked against the record
• a recording or signed log of the ceremony

Hot, warm and cold

FG26/6 lists MPC, multisignature, HSMs, cold and warm wallet segregation and cryptographic audit logs among its emerging practices, used in a way that “avoids centralising risks”.

For each tier, record the threshold, who holds each share, where devices sit and how funds move between tiers.

The Means of Access Record

For each means of access a firm controls, CASS 17.4.8R requires a record of:

• its location, digital or physical, with the virtual address where relevant
• a summary of its security measures, naming any other persons involved
• each natural person who, to the firm's knowledge, can use it
• how it gives the firm control, alone or with other means
• whether it has been destroyed, and if so when and why

The record must not contain the means of access itself. Names can be left out if naming would weaken security, as long as other records identify the person.

For shards, the record should explain how control works, such as the reconstruction or signing threshold and how the firm meets it (17.4.3G(5)).

Update triggers

A proposed daily review of each record was dropped from the final rules.

Instead, a firm must update records promptly, as often as needed to stay accurate (17.4.9R). Treat these as triggers:

• a signer, shard holder or administrator joins, leaves or changes role
• a device, HSM or backup location changes
• a key is created, resharded, rotated or destroyed
• a threshold or signing policy changes

Keep each record for 5 years after its creation or latest change (17.4.10R).

CASS 17.4.11R also requires a means of access policy document and a procedures document in clear, non-technical terms. Review both at least yearly; keep each version for 5 years after it is superseded.

Backup, Recovery and Dependency Risk

The FCA does not prescribe a recovery test, though respondents asked for more emphasis on testing.

FG26/6's example custodian tests restoring access from off-site recovery systems. Recover from backup material alone, time it against your impact tolerance and record the result.

Guidance asks for checks that keys remain operable without adding undue security risk (17.4.7G(6)). Prefer checks that never expose a secret, such as a quorum signing a test message.

Two opposite failures

Guidance names both (17.4.7G(4)):

• Single point of failure: too few staff or devices hold the means of access.
• Dependency risk: too many staff or devices, or too much reliance on others.

Show why each quorum can be reached at 3 AM, yet not by a few colluding insiders.

When a Key Is Compromised

A firm must promptly identify, and promptly resolve, any incident of inoperability, inaccessibility, loss, fraud or irrecoverability (17.4.5R and 17.4.6R).

CASS 17.4 sets no FCA notice for key incidents, so link the runbook to the duties that do.

• Shortfall: correct client holdings on trust within 24 hours (17.5.13R).
• Unresolved shortfall: tell affected clients and the FCA in writing immediately (17.5.15R).
• Records: tell the FCA without delay if they are materially out of date or inaccurate (17.5.16R).
• Clients: after unauthorized wallet access, FG26/6 says firms must promptly notify them.

Operational incident reporting under PS26/2 applies to all firms with a Part 4A permission from March 18, 2027.

Evidence Checklist

What Guardian Does

Guardian's OpSec audit covers custody and key ceremony: where keys live, who holds each share, what a quorum needs in practice, and what happens when someone leaves or loses a device.

Guardian's regulatory readiness assessment reviews key generation and storage, signing thresholds and recovery against the custody rules your license carries.

Guardian's technical evidence maps signer inventories and key ceremony and recovery records to CASS 17.4.8R. Its resilience assessment performs and times key recoveries.

Frequently Asked Questions

Did the FCA drop the daily means of access review?

Yes. The FCA had proposed a review of each record every business day, and PS26/11 dropped it. Firms must instead update the record promptly, as often as needed to keep it accurate (CASS 17.4.9R).

Are staking validator keys a means of access?

Generally not. The FCA does not expect keys used solely for blockchain validation to transfer the benefit of a cryptoasset. Withdrawal keys may qualify, depending on the business model.

Will a CASS audit check these controls?

The FCA intends that cryptoasset firms subject to CASS will need an audit checking their CASS compliance. It will revisit audit requirements in a later consultation and finalize them there, so they are not yet final.

Sources

• FCA: PS26/11 Crypto Regime, Regulated Cryptoasset Activities, including the Cryptoassets (Safeguarding) Instrument 2026 (PDF, June 2026)
• FCA: FG26/6 Guidance on Cryptoasset Operational Resilience (PDF, June 30, 2026)
• FCA: Overview of our cryptoassets regime policy statements (June 30, 2026)
• FCA: PS26/2 Operational incident and third party reporting (March 18, 2026)