In a previous Article on PS 26/13 (Application of FCA Handbook for Regulated Cryptoasset Activities) describing the application of the FCA’s Handbook to authorised Crypto Asset Service Providers (“CASP”), we noted that the FCA is extending its existing operational resilience framework under SYSC 15A in full to authorised CASPs. The article also noted that the FCA had published non-Handbook guidance FG 26/6 (Guidance on Cryptoasset Operational Resilience) to help firms apply it in practice. This article takes a look at the FCA’s guidance with the objective of helping CASPs to develop and implement a practical operational resilience programme.
Published on 30 June 2026, FG 26/6 provides guidance to supplement the rules in SYSC 15A (which already applies to FSMA-authorised firms). The guidance is aimed at assisting cryptoasset firms to apply operational resilience requirements to their business models, using five fictional example firms: a stablecoin issuer, a trading platform, a staking provider, a custodian, and an intermediary arranging deals. If your cryptoasset firm aligns with any of these business models there you will have a worked example to benchmark your arrangements against.
Risk environment within the cryptoasset market
Operational resilience is fundamental to the integrity and stability of financial services and has a particular relevance to firms operating cryptoasset services; the FCA’s guidance is explicit that certain operational risks occur more often, or more severely, in cryptoasset markets than in traditional finance. For example, vulnerabilities in smart contract code, private key security failures (that can lead to irreversible theft), validator misconduct or outages that trigger slashing penalties, and service disruptions that leave clients unable to access or move their assets (often at the exact moment of peak market volatility), when the financial cost of being locked out is at its highest. The guidance provides a helpful table in section 2 outlining some key risk areas – these will be relevant to both your operational resilience work and the development of your enterprise-wide risk management framework. The strategies, processes and systems that firms have in place to comply with SYSC 15A (Operational resilience) obligations must be comprehensive and proportionate to the nature, scale and complexity of the firm’s activities.
The four areas of an operational resilience framework
The guidance provided by the FCA in FG 26/6 should be read in conjunction with the FCA’s Policy Statement PS 21/3 (“Building operational resilience”) which was published in 2021 to support firms strengthening their operational resilience arrangements. PS 21/3 provides some very helpful detail on building an operational resilience framework that will be fit for purpose in the context of your specific firm.
The approach expected by the FCA for firms, including cryptoasset firms, when developing their operational resilience framework involves the following four areas:
1. Identify the important business services. This means naming the specific services provided by your firm (or another person on behalf of your firm) which, if disrupted, could cause intolerable levels of harm to clients or threaten the soundness, stability or resilience of the UK financial system. Assessments of what constitutes an important business service (“IBS”) must be kept up to date.
The FCA highlights that where a cryptoasset firm performs multiple activities, for example a cryptoasset principal dealer that also offers custody and staking services, the delivery of these different activities is likely to be underpinned by multiple important business services which should be clearly identified.
2. Set impact tolerances. For each important business service, firms must clearly define the maximum level of disruption that is acceptable before harm becomes intolerable or a risk to the UK financial system is posed. Firms must ensure that they can maintain each IBS within the prescribed impact tolerances under severe but plausible operational disruption scenarios.
When a firm uses a third-party provider in the delivery of an IBS, they should work effectively with the third-party to set impact tolerances. The firm should ensure the provider remains within those tolerances and monitors its performance against those tolerances on an ongoing basis.
Impact tolerances should be set per single disruption event, rather than as an aggregate across simultaneous failures which cryptoasset firms may be particularly susceptible to given that crypto markets run 24/7 and can experience significant volatility. Firms must monitor their impact tolerances on an ongoing basis and, where these are breached, ensure that appropriate business continuity and contingency plans are in place to manage and mitigate harm.
3. Mapping dependencies. Identify and document the people, processes, technology, facilities and information necessary to deliver each IBS. Mapping must be sufficiently detailed to support effective impact tolerance testing and help firms understand their vulnerabilities and remedy these as appropriate. Where a firm relies on third-party providers it must be able to identify and understand any vulnerabilities in those arrangements, whether they lie directly with the third party or further along the service chain. If firms are unable to obtain sufficient information from the third party to satisfy themselves that they can operate within tolerance, then they should review and where necessary change their arrangements.
Where there is a lack of direct contractual agreements, such as some permissionless DLTs, firms must strengthen their internal controls and monitoring to identify and address vulnerabilities beyond traditional oversight. Where infrastructure is beyond a firm’s control, the FCA’s expectation is that the firm has appropriate remedies in place such as contingency plans in the event of a disruption.
This stage should therefore result in the firm having mapped the vulnerabilities under their contractual control, the vulnerabilities arising from external network risks, and the mitigations in place for each.
4. Scenario planning and testing. SYSC 15A.5 requires firms to develop a scenario testing plan and perform testing to assess their ability to remain within the impact tolerances set for each IBS.
Cryptoasset firms must develop a detailed testing plan that sets out how they will gain assurance of their ability to remain within the impact tolerances set for each of their IBS. A number of factors are set out in SYSC 15A.5.2[G] for firms to consider. The plan must be regularly updated. Scenarios should include a diverse range of adverse circumstances varying in nature, severity and duration, relevant to cryptoasset business models. Scenarios could include data corruption or loss, critical third-party outages and technology failures. Compounded disruptions should also be considered.
Scenario tests must be performed in accordance with SYSC 15A.5.3[R] to assess their operational resilience under severe but plausible disruption scenarios. Testing may also necessitate working with third-party suppliers, in which case the cryptoasset firm should ensure that the third-party’s testing methodologies are valid, effective and aligned with its own operational resilience requirements.
Following each test, and where actual operational disruption occurs, firms must conduct a lessons learned exercise in line with SYSC 15A.5.8[R] and maintain a written record of this in line with SYSC 15A.6.1[R]. This should identify any weaknesses exposed during testing or disruption and inform actions a firm must take to improve the firm’s ability to effectively respond to and recover from future disruptions.
Outsourcing expectations for cryptoasset firms
In accordance with the requirements of SYSC 8, cryptoasset firms will need to consider the nature, scale and complexity of their outsourcing arrangements in their operational resilience work.
This operational resilience guidance reaffirms that the use of permissionless Distributed Ledger Technology (“DLT”) will not be treated as outsourcing under SYSC 8, given that there is no direct contractual relationship between cryptoasset firms and DLT providers. We also discussed this point in a previous article on the application of the FCA’s Handbook.
The FCA, however, still expect cryptoasset firms to evaluate their internal operational controls for the use of permissionless DLTs, following the requirements of SYSC 15A and the guidance set out in FG 26/6.
Communications as part of an operational resilience framework
Timely, transparent and technically informed external and internal communication, that has been considered in advance of a potential disruption event, is essential to maintaining trust and ensuring clients are adequately informed and supported. Without an effective communication strategy it is unlikely that a cryptoasset firm will be able to successfully manage operational disruption and thereby minimise harm to its clients and stakeholders. The FCA’s guidance provides some examples of disruptions that would require effective communication.
Separately, cryptoasset firms may need to report an operational incident and should refer to the FCA’s Finalised Guidance on Operational incident reporting (FG 26/3). Cryptoasset firms must notify the FCA, in line with SYSC 15A.2.11[G], of any failure to meet an impact tolerance.
What should cryptoasset firms be doing now?
If your firm is preparing for authorisation as a CASP, this Finalised Guidance (FG26/6) from the FCA is helpful reading and should be used to inform the development of your operational resilience framework. The key stages of development are explained above as well as certain references to additional FCA reading which should also be considered. The FCA will expect you to have a well thought out and clearly articulated operational resilience framework. You will need to describe your approach to operational resilience in your application materials and ensure that you are prepared to respond to detailed questions raised by the FCA during their assessment of your application.
Conceptually, operational resilience can be quite difficult and in reality requires actual involvement to determine the best approach and realise the operational value that can be obtained from a robust operational resilience program.
Contact
Helmut Bauer
Senior consultant
