FCA Crypto Authorisation Gateway: Security Checklist
Quick answer. Applicants complete the FCA's IT self-assessment, which can call for an IT controls form and an operational resilience questionnaire. Custody applicants add means of access and reconciliation policies. The window closes February 28, 2027.
Video transcript
The FCA's crypto authorisation gateway closes at one minute to midnight on February 28, 2027. Its own forms set out the security evidence you need.
It opened September 30, 2026. Apply inside the window and you can keep operating until a decision. New rules are expected from October 25, 2027.
Technology sits in the IT self-assessment. Your answers decide what you return: a senior manager self-certification, a detailed IT controls form, or an operational resilience questionnaire.
Across ten control domains, the pentest question is direct. Our reading: for a crypto firm, that estate includes wallets, signing services, nodes and the APIs that move funds.
Custody applicants need a means of access policy. Protect keys across their life cycle, resolve incidents promptly, and record each key without storing it.
For resilience, map each important business service to find single points of failure. Testing must go beyond validating documented plans.
Submit final documents, not drafts. Missing minimum information means rejection without assessment. Incomplete applications can take up to twelve months, complete ones usually six.
Guardian's Regulatory Readiness Assessment writes the security and custody sections. The Operational Resilience Assessment runs scenarios like key compromise. Technical Evidence maps each artifact to its provision.
Read the full checklist, or talk to Guardian about building your application from evidence. Guardian is not a law firm, so confirm the legal reading with counsel.
The FCA's crypto authorisation gateway opened on September 30, 2026. It closes at 11:59pm on February 28, 2027.
To be authorized, a firm must show it meets the Threshold Conditions, including "the right people, financial resources and systems".
This checklist follows the FCA's own forms.
This article explains the technical and security side of the FCA's authorization application for cryptoasset firms. It is not legal advice; confirm how it applies to you with counsel.
Gateway Timeline
| Date | What happens |
|---|---|
| February 20, 2026 | FCA direction sets the application period (regulation 52) |
| June 30, 2026 | Final rules and guidance: PS26/9 to PS26/13, FG26/5 to FG26/7 |
| September 17, 2026 | Latest application form preview |
| September 30, 2026, 9:00am | Gateway opens; applications go through Connect |
| February 28, 2027, 11:59pm | Application period closes |
| October 25, 2027 | New cryptoasset rules expected to take effect |
Apply inside the window and a saving provision lets you keep providing services until your application is finally determined. You must tell the FCA when you start and stop relying on it.
Apply later and the FCA "will not expedite" its assessment. Not authorized by October 25, 2027? You may only perform pre-existing contracts, with no new UK contracts.
The FCA expects to decide window applications before the start date.
As at October 31, 2026, it reported 92 pre-application meeting requests, 2 variation of permission applications and no new authorization applications.
Our UK crypto deadlines post has the full calendar.
What the FCA Asks on Security
The FCA's information document (September 17, 2026) previews the form. Crypto sections depend on the activities you apply for.
Technology sits in one question: "IT self-assessment and IT controls". It starts with a workbook of screening questions, including whether you carry on regulated crypto activities.
Your answers decide which forms you return.
- Self-certification: a senior manager, such as the CIO, CRO or CEO, confirms your systems and controls align with FCA rules.
- Detailed IT controls form: control-by-control answers and evidence, which the FCA assesses against its rules.
- Operational resilience questionnaire: the workbook asks if you are in scope of the FCA's operational resilience policy, PS21/3.
The IT controls form
The form groups its questions into ten domains, each naming the evidence it wants.
| Domain | Evidence the form names |
|---|---|
| Governance | Roles chart, board packs, independent assurance reports |
| Risk management | Risk framework, IT and cyber risk report |
| Service mapping | Service design and asset management procedures |
| Continuity and testing | Continuity plan, IT continuity test results, impact analysis |
| Change management | Change policy, change testing, audit trail |
| Incident management | Incident procedures, communications plan, post-incident reviews |
| Third parties | Supplier policy, supplier categories, delivery reports |
| Identity and access | Least-privilege policy, access reviews |
| Threats and vulnerabilities | Vulnerability policy, latest pentest report, pentest policy |
| Physical environment | Security MI and KRIs, physical access procedures |
The pentest question is direct: "Do you carry out penetration testing of your IT estate at regular intervals?"
Our reading: for a crypto firm, that estate includes wallets, signing services, nodes and the APIs that move funds.
Custody and Key Evidence
Firms applying to safeguard client cryptoassets, or to arrange it, answer four more questions.
- a records and reconciliation policy for client cryptoassets;
- proof of the safeguarding trust;
- proof of any third-party custodian arrangements;
- a means of access policy, showing "robust security and organisational arrangements".
That last one maps to CASS 17.4, published in PS26/11 on June 30, 2026. Means of access is anything a person needs to move a cryptoasset, such as a key or its shards.
What CASS 17.4 requires
- Life cycle: keys protected from creation to destruction against loss, fraud and irrecoverability (17.4.4R).
- Incidents: key incidents promptly identified and resolved (17.4.5R, 17.4.6R).
- Records: each key's location, security, users, how it gives control, and any destruction (17.4.8R).
- No secrets: the record must not contain the key itself (17.4.8R(2)).
- Documents: a policy and procedures in "clear and non-technical terms", reviewed yearly (17.4.11R).
The FCA's guidance asks firms to consider single points of failure, dependency risk and backup and recovery systems (17.4.7G).
Our CASS 17 guide covers trusts and daily reconciliation.
Operational Resilience Mapping
The FCA's operational resilience questionnaire has seven parts. Important business services and impact tolerances are, in its words, "the key elements of our expectations".
| Part | What it asks |
|---|---|
| 1. Important business services | Method, governance and the list itself |
| 2. Impact tolerances | Where disruption becomes intolerable harm, and how it is measured |
| 3. Mapping | People, processes, technology, facilities, information and third parties |
| 4. Testing | Severe but plausible scenarios, a schedule, lessons learned |
| 5. Governance | Accountable executive, board oversight, management information |
| 6. Third parties and change | Due diligence, contracts, change assessment |
| 7. Incidents and communications | Escalation, and how affected consumers are told |
Three asks stand out for applicants.
- Use mapping to find concentration risk and single points of failure (3.2).
- Show testing goes "beyond validating documented plans" (4.2).
- Give a test schedule through initial operation, by sequence rather than fixed dates (4.3).
Not live yet? Explain the planned approach, the accountable owner, a target date and the evidence that will show it works.
The senior manager responsible for operational resilience signs an attestation. It says a board-approved self-assessment will document compliance.
What FG26/6 adds for crypto
FG26/6, final guidance from June 30, 2026, shows how these rules apply to crypto firms. Its scenarios include smart contract failure and validator outages.
Scans and pentests "should be carried out and proven to identify and address risks". Key tools such as MPC and HSMs "should be used in a way that avoids centralising risks".
Firms should notify the FCA when they intend to rely on third parties for critical functions, such as MPC and HSM providers, node operators and signing infrastructure (SYSC 8.1.12G).
Our FG26/6 checklist maps each expectation to evidence.
Application Checklist
- Run the IT self-assessment and note every form it returns.
- Answer the IT controls form with dated evidence, not policy alone.
- Attach a current pentest report and your pentest policy.
- Name important business services per activity, with impact tolerances.
- Map each service to its keys, nodes, chains, custodians and cloud.
- Plan scenario tests for key compromise and smart contract failure.
- Draft the means of access policy and a record for each key or shard.
- Document reconciliations, the trust and any third-party custodian.
- List critical providers for SYSC 8 notification.
- Line up the resilience attestation and board-approved self-assessment.
- Submit final documents, not drafts, with every required form.
The FCA rejects a submission without assessing it if it lacks the minimum information. A complete application is usually assessed within 6 months; an incomplete one can take up to 12.
How Guardian Helps
Guardian's Regulatory Readiness Assessment writes the ICT, security, custody and continuity sections of an authorization file from the system as built.
The Operational Resilience Assessment maps services, tolerances and dependencies, onchain included, and runs scenarios such as key compromise.
Technical Evidence maps each artifact to the provisions it answers, such as CASS 17.4, as a pack or a trust center page.
Guardian's pentests cover infrastructure, web apps, APIs, browser extensions, SDKs and offchain automation. Guardian is not a law firm; your counsel owns the legal reading.
Frequently Asked Questions
When does the FCA crypto authorisation gateway close?
At 11:59pm on February 28, 2027. The application period opened at 9:00am on September 30, 2026, under an FCA direction made under regulation 52 of SI 2026/102. The FCA can extend it by amending the direction.
What happens if a firm applies after February 28, 2027?
The FCA will not expedite its assessment. A firm not authorized by October 25, 2027 enters the transitional provision: it may perform pre-existing contracts but enter no new UK contracts.
Does the FCA application require a penetration test?
Not as a standalone requirement. Where the detailed IT controls form applies, it asks whether you pentest your IT estate at regular intervals, and lists your latest pentest report and pentest policy as evidence.
Do firms already authorized by the FCA use the gateway?
Yes, through a variation of permission. The FCA publishes a cryptoasset form for these applications, and says its information document covers the crypto-specific information it will ask for.
Sources
- FCA: A new regime for cryptoasset regulation (last updated November 2, 2026)
- FCA: Cryptoassets: How the gateway will operate (last updated November 3, 2026)
- FCA: Direction on the relevant application period for a relevant cryptoasset permission, under regulation 52 (February 20, 2026)
- FCA: Information about the authorisation application form for cryptoasset firms (version dated September 17, 2026)
- FCA: IT Assessment Questionnaire (IT self-assessment workbook, accessed November 6, 2026)
- FCA: Detailed IT Controls Form (accessed November 6, 2026)
- FCA: Operational Resilience Information Request (accessed November 6, 2026)
- FCA: Overview of our cryptoassets regime policy statements (June 30, 2026)
- FCA: Cryptoassets: Our standards (last updated June 30, 2026)
- FCA: PS26/11 Regulated cryptoasset activities, with CASS 17 (June 2026)
- FCA: FG26/6 Guidance on Cryptoasset Operational Resilience (June 30, 2026)
- FCA: How to apply for authorisation or registration (last updated March 3, 2026)
- Guardian: Regulatory & Compliance Assessments
- Guardian: Penetration Testing
Build your FCA application from evidence
Guardian writes the security, custody and resilience sections from the system as built, and tests what they describe.