CASS 17 Crypto Custody: MPC Shards, Backup Keys and Control
Quick answer. Not automatically: Article 9N control comes from a full key, or enough shards to sign or compel signing, and a lone shard usually lacks it. In the FCA's example, a full backup key holder safeguards; CASS 17.3.12R can lift only its trusteeship.
Video transcript
Does holding an MPC shard or a backup key make you a crypto custodian under CASS 17? Not automatically. It turns on who can actually move client assets.
Control under Article 9N comes from a full key, or enough shards to sign or compel signing. A lone shard usually lacks it.
The FCA's PS26/11 works through nine split-key set-ups, naming who has control and which parts of CASS 17 apply.
A shard directed by A leaves only A in scope. A full key held for A makes both co-trustees. Client co-signing did not remove A, and a full backup key brings its holder in.
The new backup provider exception lifts only the duty to hold assets on trust. The provider is still safeguarding, with the CASS 17.2 and 17.4 rules applying.
It needs four conditions: the client can transact alone, the role is recovery only, any client firm confirms it is trustee, and the provider arranges no safeguarding.
Document who can change a quorum too. In Guardian's OneSig on Canton review, one admin could change signers and threshold with no quorum signature.
Assess each entity for signing, recovery and configuration changes. Check shares against threshold, recall rights, overrides, client recovery routes and key history.
This is technical analysis, not legal advice. Read the full guide, or talk to Guardian to map who can really move client assets.
Why Key Splitting Raises the Question
MPC and multisig spread signing power across firms. CASS 17 asks a narrower question: which of those firms can actually move client cryptoassets? UK Legislation
The FCA published the rules in PS26/11 on June 30, 2026. Made as FCA 2026/42, CASS 17 applies from October 25, 2027. Financial Conduct Authority
PS26/11's Diagram 1 works through nine split-key set-ups. For each, it names who has control and which parts of CASS 17 they meet.
Our CASS 17 overview covers the duties themselves. This guide classifies each entity in a split-key design.
It explains the technical side of PS26/11 and the FCA's perimeter guidance.
Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.
Article 9N Control in Plain Terms
Article 9N makes safeguarding cryptoassets on behalf of another person a regulated activity. Arranging for someone else to safeguard is a separate activity. UK Legislation
Article 9N also covers relevant specified investment cryptoassets, but their custodians apply CASS 6, not CASS 17, for now. Financial Conduct Authority
A firm safeguards when it has control through any means that would let it transfer the benefit of the asset to another person, including itself.
Control can come from holding the means of access, or only part of it. A private key is the plainest example.
The FCA's final perimeter guidance, PERG 18 in PS26/18 of September 16, 2026, separates the power to transfer from a mere veto.
A holder below the signing threshold can still have control if it can require the other holders to cooperate.
A contractual promise not to use an available technical override does not remove control. So a client that can transact alone does not, by that fact, take the provider out of scope.
The FCA's Nine Custody Scenarios
Diagram 1 assumes firm A carries on Article 9N activity in the UK. B and C are other firms; the client may hold keys too. Financial Conduct Authority
Where the diagram names a party without qualification, that party applies all of CASS 17. Where it marks a shard holder N/A, CASS 17 does not apply to that holder in that example.
Scenario 7 matters for wallet-as-a-service. In the FCA's example, client co-signing did not take A out of scope.
The FCA ties A's control to its arrangement with B, which holds a recovery shard for when the client cannot reach its own.
The diagram does not state a signing threshold for scenario 7. Reading it as A plus B signing without the client is our inference, not FCA text.
| Set-up | In scope | CASS 17 parts |
|---|---|---|
| 1. Client holds all keys | Nobody | None |
| 2. A holds the key | A | A: all |
| 3. A and B hold shards; A directs B | A | A: all. B: none |
| 4. B holds a full key for A | A and B, as co-trustees | Both: all |
| 5. A directs shards held by B and C | A | A: all. B and C: none |
| 6. A and B sign; C holds a backup shard | A | A: all. B and C: none |
| 7. A and client sign; B holds a recovery shard | A | A: all. B: none |
| 8. A holds the key; B holds a backup key | A and B | A: all. B: 17.1, 17.2 and 17.4 |
| 9. Client acts alone; A runs a distributed backup | A | A: 17.2 and 17.4 |
Full Key or Enough Shards
The deciding fact is transfer capability. A party with a full key, or enough usable shards to execute a transaction, has control. UK Legislation, Financial Conduct Authority
An isolated shard that cannot reach the threshold does not automatically give control. Simmons & Simmons reads PS26/11 the same qualified way. Simmons & Simmons
The threshold test is case-specific. Count the shards a firm can call on, not only the ones it holds.
Under CASS 17.4.3G(4), the CASS 17.4 key rules still apply to a firm that created all the shards from a full key, or keeps a binding right to recall them.
Do not assume every distributed key generation participant once held a complete key. Establish how your protocol actually created the shares.
Technical and infrastructure providers get no dedicated safeguarding exclusion. Article 9R(2) can apply to a provider that does not hold itself out as offering a cryptoasset-related service.
PERG 18's examples are safety-deposit boxes and generic data storage holding private keys. They do not describe a shard arrangement specifically.
Backup Key Providers and CASS 17.3.12
CASS 17.3.12R is a new exception for backup providers. It lifts the duty to hold assets on trust, not the safeguarding activity itself. Financial Conduct Authority
CASS 17.1.2G(4) still treats a provider relying on it as safeguarding, with CASS 17.2 and 17.4 applying. Backup material needs the same life-cycle protection as any signing key.
Our reading: trust relief is not permission relief. PERG 18 requires Part 4A permission for regulated activity carried on in the UK, absent an exclusion or exemption.
In Diagram 1, a backup or recovery shard held within A's arrangements (scenarios 6 and 7) leaves CASS 17 to A alone.
A full backup key (8), or a backup A runs for an independent client (9), brings the backup holder into CASS 17.
The trust exception applies only when all of these hold:
- The firm has good reason to believe the client can transact independently of it.
- It is appointed solely to recover means of access that is lost, inoperable, inaccessible or irrecoverable.
- A client firm safeguarding the same asset confirms it does so as trustee under CASS 17.3.3R; confirming authorization is not enough.
- The backup provider does not arrange safeguarding for anyone.
Group Holders and Co-Trustees
Scenario 4 shows the outcome when another firm holds a full key for A: co-trusteeship. Financial Conduct Authority
Article 9O can exclude a connected company, but only on conditions. An authorized group custodian must operate the arrangements. UK Legislation
That custodian must also accept responsibility to the customer no less onerous than if it safeguarded the assets itself.
Without both, a group key holder is assessed like any other party. Arranging safeguarding, under Article 9N(1)(b), is a separate question.
Self-Assessment for Your Custody Model
Records must explain how each means of access gives control, without containing the secret itself (CASS 17.4.8R). Our CASS 17.4 key management checklist lists the record fields. Financial Conduct Authority
For the perimeter answer, document who can change a quorum, not only who satisfies it today.
Guardian's OneSig on Canton review shows why. Finding M-02 (Medium, acknowledged) let one admin change signers, threshold and seed with no quorum signature. Guardian
The report rates it High if single-operator and Info if threshold-hosted. It illustrates the mechanism; it is not a view on Article 9N.
Answer the questions below for each legal entity. Do it separately for ordinary signing, disaster recovery and configuration changes.
A quorum count alone will not settle it. Hand counsel the evidence and any open legal questions.
| Question | Evidence to hold | Flag if |
|---|---|---|
| Shares held against threshold | Share map per entity and wallet | Holds enough to sign |
| Shares it can recall | Contracts and recall clauses | Binding recall or convening right |
| Cooperation it can require | Service terms and co-signing duties | Others must co-sign on request |
| Technical overrides | Admin roles and policy engine settings | Override exists, even if promised unused |
| Quorum change rights | Who can change signers and threshold | Can change the quorum alone |
| Client-only route | Recovery kit and a dated client recovery | No client route: blocks the 17.3.12R trust exception; a veto is not control |
| Key history | Generation and resharding records | Firm once held the full key |
| Group link | Article 9O responsibility terms | No authorized group custodian accepting responsibility |
| Backup role | Appointment terms | Role goes beyond recovery after loss: trust exception unavailable |
Frequently Asked Questions
Is there a safeguarding exclusion for MPC, HSM or wallet vendors?
Proposed Article 9Z2A, in HM Treasury's draft amending regulations, would exclude technical services that merely give access to third-party services or a decentralized protocol from arranging deals, not from safeguarding. As of November 11, 2026, the instrument remains a draft needing approval by both Houses. Financial Conduct Authority, UK Legislation, UK Parliament
Does Diagram 1 decide whether my firm needs authorization?
No. The diagram's own note says firms B and C may or may not need authorization, depending on the threshold conditions. A CASS 17 outcome of none is not a permission answer. Territorial scope, exclusions and your actual contracts, instructions and recovery powers are assessed separately. Financial Conduct Authority, UK Legislation
Will more FCA perimeter guidance change this analysis?
CP26/36, open until November 18, 2026, includes draft exclusions for temporary settlement safeguarding, temporary UK qualifying stablecoin holding for payments, UK qualifying stablecoin backing assets and proprietary trading. None targets shard or backup key holders. Final guidance: spring 2027 per the paper, January 2027 per the web page. Financial Conduct Authority
Related reading
- CASS 17 Rules: FCA Safeguarding for Client Cryptoassets
- FCA Crypto Safeguarding: CASS 17.4 Key Management Checklist
- Multisig vs MPC Wallets: Security Tradeoffs for Institutions
- Hong Kong Virtual Asset Custodian Licence: Who Needs One
Sources
- Financial Conduct Authority: PS26/11: Regulated Cryptoasset Activities
- UK Legislation: Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026
- Financial Conduct Authority: PS26/18: Cryptoasset Perimeter Guidance
- Financial Conduct Authority: Overview of our cryptoassets regime policy statements
- Financial Conduct Authority: CP26/36: Cryptoasset Perimeter Guidance
- UK Legislation: Draft Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026
- UK Parliament: Procedure Schema: Cryptoassets (Miscellaneous Amendments) Regulations 2026
- Simmons & Simmons: PS26/11: Crypto Regime, Regulated Cryptoasset Activities
- Guardian: OneSig on Canton: M-02, Admin bypasses the OneSig quorum
- Guardian: OpSec Audit for Digital Asset Teams
- Financial Conduct Authority: CP26/36: Cryptoasset perimeter guidance
- Financial Conduct Authority: PS26/18: Cryptoasset perimeter guidance
- Financial Conduct Authority: Cryptoassets (Safeguarding) Instrument 2026 (FCA 2026/42)
- UK Legislation: Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026, Part 2
- HM Treasury: Draft statutory instrument amending the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026: Policy Note
Map Who Can Really Move Client Assets
Guardian's OpSec audit reviews how key shares are distributed, signing thresholds, privileged roles and recovery procedures. It gives counsel the control facts; the legal reading stays with them.