FCA PS26/9: Crypto Market Abuse and Admissions Rules

By Owen ThurmPublished November 11, 202612 min read

Quick answer. From October 25, 2027, retail UK platforms must assess tokens against approved criteria and publish a disclosure document (QCDD) before admission. Every platform must run MARC surveillance, disruption and annual review controls; large platforms must also monitor relevant wallets onchain and share information.

Watch: FCA PS26/9: Crypto Market Abuse and Admissions Rules 1:52

Video transcript

The FCA's final PS26/9 rules make UK crypto platforms the gatekeepers.

The FCA published PS26/9 on June 30, 2026. The rules are final, but they commence on October 25, 2027.

Retail platforms assess each token against approved criteria, including smart contract risk. Before admission, they publish the QCDD disclosure document and upload it to the FCA repository, keeping records for five years.

Another exchange's admission does not replace yours. An unverifiable fact does not remove the test either. The QCDD must still be true and not misleading.

MARC bans insider dealing, unlawful disclosure and manipulation. Every platform, even wholesale-only, needs surveillance with order-book replay, price dislocation alerts, powers to disrupt trading and an annual audit.

FCA guidance says a team's pre-admission knowledge of a code vulnerability could be inside information. Not every bug is. Any disclosure delay must meet every rule condition and be recorded.

Large platforms average at least ten million pounds in annual revenue over three years. They must monitor relevant wallets onchain and share information when suspicion and necessity tests are met.

The FCA's CP26/32 proposed up to six months of admissions relief for tokens already trading. As of November 11, 2026 it is still a proposal, and MARC would not be deferred.

Read the full article for a build list to take to counsel. Guardian's compliance audits can check the contract facts your QCDD relies on. Admission decisions stay with your platform.

What PS26/9 Covers and When

The FCA published PS26/9 on June 30, 2026. It finalised the Admissions and Disclosures (A&D) rules in CRYPTO 3 and the Market Abuse Regime for Cryptoassets (MARC) in CRYPTO 4. Financial Conduct Authority

The rules are final but not yet in force. Instruments FCA 2026/37 and FCA 2026/38 commence on October 25, 2027.

SI 2026/102, made on February 4, 2026, sets that start date. The FCA application window runs from September 30, 2026 to February 28, 2027. The National Archives

Our UK crypto regulation deadlines guide maps what each date needs across the wider regime.

This article explains the technical and security side of the FCA's PS26/9. It is not legal advice; confirm how it applies to you with counsel.

Admission assessments and the qualifying cryptoasset disclosure document (QCDD) apply to retail UK qualifying cryptoasset trading platforms (QCATPs), those open to retail investors directly or through intermediaries. UK qualifying stablecoins and assets not available to retail investors have specified exceptions. A&O Shearman

Wholesale-only platforms still need MARC controls. Brokers and other intermediaries carry separate CRYPTO 4.8 duties, including notifying relevant UK QCATPs without unnecessary delay when the statutory suspicion test is met.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

Admissions and the QCDD

Under CRYPTO 3.2.1R, a retail platform may admit a token only when reasonably satisfied it is unlikely to harm retail investors. Financial Conduct Authority, Freshfields

Criteria must cover reputation, governance, technical resilience, smart contract and other technology risks, compensation capacity and whether information can be verified.

The governing body approves the criteria, which are applied consistently, reviewed and published. Commercial decision-makers stay separate from assessors. A&O Shearman

Own-motion and group admissions get no lighter treatment. The assessment is proportionate, not a guarantee of safety.

Flagging a fact as unverifiable does not remove the admission test. The QCDD must still be true and not misleading.

Before admission, the operator publishes the QCDD on its website and uploads it to the FCA-owned repository. The requester drafts it, or the operator does for own-motion admissions.

CRYPTO 3.3.10G expects coverage of protocol changes, vulnerabilities, audits, mitigations, ownership concentration and trading history. CRYPTO 3.3.11G points to checks against code, onchain data, supply and public records.

A supplement is needed for material new information or errors found after publication but before admission. The supplement rule stops at admission; after that, ask counsel whether a development is inside information that MARC requires to be disclosed.

Keep assessments, decisions and reasons for five years, or up to seven if the FCA asks.

Guardian analysis: code, deployed configuration, privileged roles and supply are verifiable. Signer identities, key storage and undisclosed plans need other evidence.

Guardian's Clanker I-04 finding warned that configurable transfer policies could allow buying while restricting selling. It is marked resolved, with documentation and user warnings recommended. Guardian

Test whether transfer restrictions, and who can change them, match the QCDD. Our smart contract admission checklist covers the per-token tests.

MARC: Insider Dealing and Manipulation

MARC prohibits insider dealing, unlawful disclosure of inside information and market manipulation involving relevant qualifying cryptoassets and related instruments. The National Archives, Simmons & Simmons

Relevant tokens include those admitted to, or seeking admission to, an authorised UK QCATP. Conduct outside the UK can still be caught.

Inside information is precise, not public, relates directly or indirectly to a relevant qualifying cryptoasset or to its issuer, offeror or platform operator, and would likely move its price significantly if made public. Financial Conduct Authority

CRYPTO 4.3.9G(4) says a team's pre-admission knowledge of a code vulnerability could qualify.

That does not make every bug inside information. Security triage should flag findings that may meet the tests.

Issuers, offerors and platform operators must disclose inside information directly concerning them as soon as possible.

Delay, for example during a fix, needs every CRYPTO 4.10.19R condition: legitimate interests, no likely misleading of the public and kept confidentiality. Record each delay decision. Freshfields

Controls Every Platform Needs

Every UK QCATP needs proportionate surveillance and disruption arrangements under CRYPTO 4.7. Financial Conduct Authority, A&O Shearman

Price dislocation alerts need a defensible reference. Guardian's Limit Break AMM Round 2 remediation finding L-05, a Low warning marked acknowledged, noted that swaps on zero-liquidity pools can leave misleading stored prices. Guardian

Check liquidity and freshness before treating an onchain quote as evidence of divergence.

Order and transaction analysis, including order-book replay.
Parameterised alerts, with software backed by human analysis.
Communications monitoring, information barriers and regular staff training.
Powers to intervene in and disrupt trading.
Detection of material, persistent price dislocations against public prices on markets material to price formation. Simmons & Simmons
A documented annual audit and internal review of these arrangements, or sooner after business, regulatory or abuse-risk changes.
Five-year retention of specified surveillance records.

Large Platforms: Wallets and Sharing

A large UK QCATP averages at least £10 million in annual revenue over the previous three years, calculated at 12-month intervals. Financial Conduct Authority, Freshfields, Simmons & Simmons

Revenue covers all activities, not just UK or platform business. The FCA estimated the threshold would capture about 95% of the market by revenue.

Large operators must monitor relevant wallets: those trading on the platform identified as abuse risks, plus wallets reasonably identifiable as controlled by the same people.

CRYPTO 4.7.23G lists blockchain analytics, wallet clustering and anomaly detection as example methods, not mandated tools.

Large operators share relevant, proportionate information with each other when suspicion and necessity conditions are met. Sharing must be timely, secure, lawful under data protection and documented.

Each sharing decision, including a decision not to share, is recorded and kept for five years (CRYPTO 4.9.16R). The FCA set no common sharing format. A&O Shearman

Treat analytics-based wallet links as leads, not proof of beneficial ownership. Our onchain monitoring guide for large platforms covers the build.

Changes and the Proposed Deferral

CP25/41 ran from December 16, 2025 to February 12, 2026. The final onchain duty targets relevant wallets, not continuous whole-chain surveillance. Financial Conduct Authority

The final rules removed the fungibility exception, set a token-identifier standard and strengthened withdrawal-right notifications. Freshfields

The broad legitimate-reasons exemption was dropped. CRYPTO 4.11.5R allows disclosed framework burning and conditional ad hoc burning; crypto-stabilisation is capped at 30 calendar days. A&O Shearman, Simmons & Simmons

Burn monitoring should reconcile supply rather than trust one event. Guardian's Universal L-09 finding, marked resolved, found a hook burn path that skipped the usual burn event. Guardian

Insider-list templates omit wallet addresses. Firms must still be able to require employee wallet details where data-protection law allows.

CP26/32, published September 4, 2026, proposed up to six months of A&D relief from authorisation for tokens trading before it. Feedback closed on October 12, 2026.

Relief would end for each token once its QCDD is published. Eligibility needs a window application, an asset list with identifiers, an implementation roadmap and notification on authorisation.

Newly admitted tokens are excluded and MARC is not deferred. Prescribed warnings would flag missing regulation 14 and 15 rights where no QCDD exists.

As of November 11, 2026, we found no final FCA instrument implementing these deferrals. Treat them as proposals.

A Build List for Counsel

Take this ownership and evidence map to your compliance lead and counsel. Keep proposed backbook relief in a separate, conditional workstream.

Classify scope: retail, wholesale-only or intermediary, plus large-platform revenue status rechecked every 12 months.
Approve and publish admission criteria, and separate commercial staff from assessors.
Name who drafts, verifies, publishes and uploads each QCDD, and who issues pre-admission supplements.
Verify contracts, privileged roles, transfer rules and supply against the QCDD before admission.
Route vulnerability reports to an owner who decides on inside information and records any disclosure delay.
Specify alerts, order-book replay, reference price feeds and intervention powers.
Build secure intake for intermediary suspicion notifications.
If large, scope relevant wallets and write sharing procedures with data-protection review.
Set the annual audit date and five-year retention, with admission records extendable to seven years on FCA request.

Frequently Asked Questions

Can a platform rely on another exchange having already listed the token?

No. The final rules say another platform's admission does not replace the admitting platform's own assessment. Each retail platform applies its own published criteria and keeps its own records. Financial Conduct Authority, Freshfields

Does CP26/32 propose relief for intermediaries too?

Yes, as proposals. Intermediaries would get related relief with prescribed warnings before orders. Separate execution-venue and execution-policy relief would last three months from commencement, to January 25, 2028, with a high-level execution policy expected from day one. Financial Conduct Authority, A&O Shearman

Must intermediaries still report suspected abuse to the FCA?

Principle 11 still applies. CRYPTO 4.8.35G says intermediaries should tell the FCA when they cannot adequately prevent, detect and disrupt suspected abuse themselves or by notifying a platform, and PS26/9 says the FCA also expects notice of serious or repeated abuse. Financial Conduct Authority, Simmons & Simmons

Sources

Check the Token Facts Your QCDD Relies On

Guardian's compliance audits include scoped smart contract audits, fix review and an indexed evidence pack for admission assessments. Admission decisions and surveillance stay with your platform and advisers.

Talk to Guardian Explore the service