CASS 17 Rules: FCA Safeguarding for Client Cryptoassets

Video transcript

From October 25, 2027, UK firms controlling client cryptoassets must hold them on trust, reconcile daily, secure the keys and vet third-party custodians.

The test is control. A firm safeguards if it can bring about a transfer of client cryptoassets, whether or not it holds them.

The default is a trust. Targeted exceptions include lending, a settlement float of up to two percent, services that need it, and backup keys.

Each business day, calculate what clients are owed from internal records only, confirm what the trust holds from an external source, then reconcile.

Fix any shortfall within 24 hours, in the same asset class, not with money. Otherwise, tell affected clients and the FCA immediately.

CASS 17.4 protects keys, shards, wallets and hardware security modules. The FCA says these rules go beyond what CASS has traditionally covered.

Appointing a third-party custodian requires a regulated jurisdiction, due diligence, Consumer Duty compatibility for retail, a signed agreement and governing body approval.

The FCA intends a CASS audit but will finalize crypto requirements later. Meanwhile, keep trust records, reconciliations, means of access records and third-party files ready.

Guardian's regulatory readiness assessment covers segregation, key storage, signing thresholds and recovery. Our OpSec audit maps where keys live and who holds each share.

The FCA application window closes February 28, 2027. Read the full article, or talk to Guardian at guardian.security.

The FCA published its final cryptoasset safeguarding rules in PS26/11 on June 30, 2026, as a new chapter: CASS 17.

They apply from October 25, 2027, to custodians and to platforms, brokers, staking and borrowing firms that control client cryptoassets.

Firms applying in the FCA's window, which closes February 28, 2027, need these systems designed now. Our UK deadlines post has every date.

This article explains the technical and security side of CASS 17 in the FCA's PS26/11. It is not legal advice; confirm how it applies to you with counsel.

Who CASS 17 Covers

The test is control. A firm safeguards under Article 9N when it can bring about a transfer of the benefit of a client's cryptoassets, whether or not it holds them.

Control can come from holding the means of access, or part of it, or from appointing someone to hold it. Self-custody is out of scope.

PS26/11's Diagram 1 works through nine custody models, including MPC shards and backup keys.

CASS 17 also covers custodial staking, and collateral a borrowing firm receives from a retail client, even when that collateral is staked.

Why RSICs stay under CASS 6

CASS 17 does not yet apply to relevant specified investment cryptoassets (RSICs). Their custodians apply CASS 6 while the FCA gathers views on tokenization.

Trusts and Their Exceptions

The default is a trust. A firm must safeguard as trustee, under documented terms its client has agreed to (17.3.3R, 17.3.14R).

The FCA chose a trust because cryptoassets have no registrar or depository recording legal ownership.

The trust must keep client assets separately identifiable and not co-mingled. One address cannot sit in two trusts.

The terms must say how shortfalls are shared; the FCA generally expects pro rata.

Where its services need it, a firm may add an operational surplus of its own, such as gas tokens or a staking minimum. Clients' claims always rank first.

The exceptions

• Lending: while a lending service runs, never for borrowing collateral (17.3.4R).
• Settlement float: up to 2% per client and class, where the firm or its group runs a UK QCATP (17.3.5R).
• Necessary for a service: with a written record per distinct service (17.3.6R).
• Client instructions: a specific instruction to transfer, once carried out (17.3.8R).
• Client debt: a written right to take assets to settle it (17.3.10R).
• Backup keys: new, where the client keeps its own means of access (17.3.12R).

For staking, the FCA's guidance says to make that record for each staking protocol (17.3.7G).

Consent for the float and service exceptions must be written and explain the risks if the firm fails. Keep it for 5 years after the firm stops relying on it (17.3.11R).

Records and Reconciliations

Each trust needs a record of its addresses or devices, network, third parties, clients and asset classes (17.3.19R). Update it immediately when the trust changes.

Asset classes are chain-specific. A wrapped or liquid staking token is a different class from its underlying, and so is the same token on another chain (17.1.5G).

The daily check

1. Requirement: what each client is owed, per trust and class, from internal records only (17.5.6R).
2. Resource: what the trust holds, from an external source (17.5.7R).
3. Reconciliation: compare the two at the same point in time, and record it (17.5.10R).

All three run at least once each business day. Chain data can confirm the resource for your own wallets.

Where a third party holds assets, the firm should use its confirmation instead (17.5.8G). The two sources must stay independent.

Shortfalls and excesses

• Excess: remove it before the next reconciliation, unless it is a permitted surplus.
• Shortfall: fix it within 24 hours, in the same class. Money does not count.
• Unfixed shortfall: tell affected clients and the FCA in writing, immediately.
• Bad records or missed checks: tell the FCA without delay (17.5.16R).

Shortfalls count whatever the cause, including network congestion. Keep reconciliation records for 5 years; review procedures yearly.

Keys and Third Parties

Keys under CASS 17.4

CASS 17.4 protects the means of access: keys, shards, wallets and HSMs. The FCA says these rules go beyond what CASS has traditionally covered.

They apply to trustee firms and to backup providers. Our CASS 17.4 key management checklist covers them rule by rule.

Appointing a third-party custodian

A firm may appoint a third party to safeguard client cryptoassets only if (17.6.3R):

• its jurisdiction specifically regulates and supervises crypto safeguarding;
• due diligence concludes the appointment does not increase the risk of loss;
• it is compatible with the Consumer Duty, for retail business;
• a written agreement is signed before it starts; and
• the governing body, or a delegate including the CASS senior manager, approves it.

The agreement must keep client assets separate, recognize the trust, exclude set-off and require consent before sub-delegation (17.6.6R). Review appointments yearly.

A holder of one shard that cannot move assets alone is not a 17.6 third party. Backup providers under 17.3.12R may not appoint third parties.

Client Money, Audit and Reporting

Client money

Money follows CASS 7, the client money rules, as PS26/13 confirms:

• Money held in connection with safeguarding is client money, even via a third party.
• Cash pre-funded ahead of crypto delivery is client money until settlement.
• The professional client opt-out does not apply to qualifying cryptoasset activities.
• Staking rewards paid in crypto, not money, fall outside CASS 7.

Stablecoin issuers are the exception: money from issuance sits outside CASS 7 (see our PS26/10 post).

The CASS audit

The audit is not settled. Made rules in PS26/13 add CASS 17 to the auditor's client assets report under SUP 3.10.

But PS26/11 says the FCA will revisit audit requirements for all cryptoasset firms in a later consultation, and intends to finalize the client cryptoasset audit requirements there.

The FCA's intention is unchanged: an audit of each firm's CASS compliance.

Meanwhile, keep ready the records CASS 17 already requires: trust records, reconciliations, means of access records and third-party files.

Reporting and accountability

Safeguarding firms also file a monthly return to the FCA. A senior manager holds the CASS responsibility (PRz), which now covers cryptoassets.

A Gap List for Applicants

1. Map every wallet, shard and backup against the Article 9N control test.
2. Choose trusts per client or omnibus, per class, with an address map.
3. Draft trust terms covering shortfall allocation and distribution costs.
4. Update client agreements; build written consent flows with risk wording.
5. Write a trust exemption record for each distinct service and staking protocol.
6. Define asset classes per chain, using Digital Token Identifiers where possible.
7. Calculate requirements from the internal ledger, never from chain data.
8. Rehearse the 24-hour shortfall path and both notifications.
9. Build each third-party file: jurisdiction, due diligence, agreement, approvals.
10. Separate CASS 7 client money flows, including pre-funding.

What Guardian Does

Guardian's regulatory readiness assessment covers custody and safeguarding: segregation, key generation and storage, signing thresholds and recovery, assessed against the custody rules your license carries.

It writes an authorization file's custody and security sections from the system as built. Your counsel keeps the legal reading.

Guardian's OpSec audit maps where keys live, who holds each share and what a quorum needs in practice.

For institutions, Guardian advises on custody and signing models while they are still decisions.

Frequently Asked Questions

Does holding one key shard bring a firm into CASS 17?

Not by itself: a single shard that cannot move assets is unlikely to give control. But the CASS 17.4 key rules apply to a firm that created all the shards, can require their return, or holds enough to sign.

Can a UK exchange hold client crypto outside the trust for settlement?

Yes, within limits. A firm that runs, or whose group runs, a UK QCATP may hold up to 2% of each client's holding per class outside the trust, with the client's prior written consent.

Is a CASS audit required for crypto custodians?

The FCA intends one. Made rules in PS26/13 add CASS 17 to the auditor's client assets report, but PS26/11 says the FCA will revisit audit requirements in a later consultation and intends to finalize them there.

Sources

• FCA: PS26/11 Crypto Regime, Regulated Cryptoasset Activities, with the Cryptoassets (Safeguarding) Instrument 2026, FCA 2026/42 (PDF, June 2026)
• FCA: PS26/13 Crypto Regime, Application of FCA Handbook for Regulated Cryptoasset Activities, Chapters 5, 7 and 13 (PDF, June 2026)
• FCA: Overview of our cryptoassets regime policy statements (June 30, 2026)