Twenty four questions against the standards the FCA will actually assess you on. Answer honestly rather than optimistically: a score you like is worth nothing. Under the existing cryptoasset registration regime the FCA approved 6% of the applications it determined in one recent twelve month period, and the FSMA bar is higher, not lower.
Published feedback on cryptoasset applications it rejected. These are not our opinions about what good looks like. They are the regulator's stated reasons for saying no, and every one of them is a document problem rather than a business problem.
Applicants failed to identify and assess money laundering, terrorist financing and proliferation financing risk properly, and did not explain the methodology behind the assessment they did produce. A risk register is not a risk assessment.
Firms conflated the two. Inherent risk is what the business is exposed to before controls. A gap in your controls is a control failure, and presenting it as an inherent risk tells the FCA you do not understand your own framework.
Business plans lacked adequate explanation of the cryptoasset activities themselves, the risks attached to them, and how those risks are mitigated by specific corresponding controls. The chain from activity to risk to control has to be visible on the page.
The FCA has said plainly it will not approve an application where the AML framework is underdeveloped or the governance structure is weak, with particular attention to how procedures work day to day rather than how they read in a policy.
The same feedback describes what good looks like: full outsourcing detail including intragroup and overseas, product and service descriptions with token vetting policies, a clear customer risk scoring methodology, enhanced due diligence triggers, transaction monitoring proportionate to the complexity of the business, compliance staff who can actually investigate on chain, and suspicious activity reporting with a defined escalation path.
Dated backwards from 28 February 2027. The dates that matter are not the FCA's, they are the internal ones these imply.
Accurate as at 11 September 2026. The permanent minimum requirement figures are taken from the final policy statement. The fixed overhead figure this page calculates is indicative: the binding calculation is in COREPRU 4.3.5R and uses audited figures with specified deductions. This assessment is a planning aid, not regulatory or legal advice, and it does not create a client relationship. Perimeter Advisory is not a law firm.