CFA Institute and CFA UK welcome the opportunity to respond to Part II of the CP25/25. This response addresses Chapters 1–5 of the consultation and builds on our previous submission on Chapters 6–7.
Overview
We appreciate the FCA’s decisive approach to bringing qualifying cryptoasset activities within the perimeter as ‘’designated investment business’’ under the Financial Services and Markets Act (FSMA), enabling coherent application of high level standards – Principles for Businesses (PRIN), the Systems and Controls (SYSC) requirements, and the Senior Managers and Certification Regime (SM&CR) – on a “same risk, same regulatory outcome” basis.
Set out below our key positions:
- Support extending SUP (except SUP 16) and the core SYSC chapters to crypto firms, with proportional implementation that recognises automated systems, on chain record keeping, and vertically integrated models.
- Set the “enhanced” SM&CR threshold for crypto custodians toward £5–10bn AuC and supplement it with a multi factor, risk based lens.
- Adapt SYSC 15A incident reporting for 24/7 markets with clear materiality thresholds, single notification mechanics, confidentiality safeguards, and post incident learning.
- Agree that use of permissionless DLT should not be treated as outsourcing.
- Support aligning the financial crime framework for crypto with that applied to other FSMA authorised firms.
- Recognise emerging quantum risk within operational resilience expectations.
- Apply the ESG Sourcebook proportionately with a firm focus on anti greenwashing.
Throughout, we emphasise phased roll out, international coherence, and close coordination across UK authorities to strengthen investor and market safeguards while preserving market dynamism.