Technology Project & Program Management

Technology Systems &  Controls (FCA Cryptoasset Regime)

The Financial Conduct Authority’s new cryptoasset regime is designed to reinforce consumer protection, market integrity, and confidence across the sector. Although the rules come into force in October 2027, firms cannot afford to wait. The countdown has already begun: the window to apply opens 30 September 2026, at which point firms may submit applications for authorisation or a variation of permission.

Once the regime is active, any firm carrying out in‑scope cryptoasset activities must hold FCA authorisation to continue serving UK customers. Those without the required permissions will need to cease those activities. Operating without authorisation may result in regulatory action.

Prepare for Authorisation — With a Focus on Systems & Controls

Now is the time to assess whether your activities fall within scope and what permissions you will need. A critical part of this preparation is determining whether your organisation can meet the FCA’s expectations in key areas, including:

• Governance arrangements

• Technology Systems and Controls

The FCA places significant weight on the robustness of a firm’s systems, controls, and critical business infrastructure. This includes demonstrating that your technology environment is:

• Resilient enough to support the nature, scale, and risks of your cryptoasset activities

• Secure, with appropriate safeguards against operational, cyber, and financial crime risks

• Monitored, with clear audit trails, incident response processes, and change‑management discipline

• Governed, with defined accountability, oversight, and documented control frameworks

• Adaptable, ensuring systems can evolve as your operations or risk profile changes

Preparing a strong application takes time. Firms that begin early are far more likely to identify gaps, remediate weaknesses, and evidence compliance effectively.

This applies equally to firms already operating under the MLR. They must consider how the new rules affect them, whether additional permissions are required, and how they will meet the FCA’s heightened expectations for systems and controls.

How HG Webs Supports Your Systems & Controls Obligations

At HG Webs, I help organisations meet their regulatory commitments under the Systems and Controls element of the FCA’s cryptoasset regime.

I do this through a four‑point readiness assessment, designed to produce the information and evidence required to complete the FCA SYSC 15A submission. This assessment identifies gaps, strengthens operational resilience, and ensures your technology environment aligns with FCA expectations.

I also provide periodic reviews of existing systems and controls to demonstrate ongoing compliance and capture any operational changes since your last review. This ensures your control framework remains current, defensible, and audit‑ready.