FCA CP25/25: Raising the Bar for UK Crypto Regulation

Last week, Portofino Technologies took part in the FCA’s roundtable on CP25/25: Application of the FCA Handbook for Regulated Cryptoasset Activities. The session, which reviewed Chapters 1–5 of the consultation, focused on how the FCA plans to bring cryptoasset firms under the same regulatory framework as traditional financial institutions. Topics ranged from governance and resilience to the Senior Managers & Certification Regime (SMCR), financial crime, and ESG — all part of the FCA’s broader Crypto Roadmap to build trust and stability in the sector.

‍

A Defining Step for the UK’s Digital Asset Market

Until now, most UK crypto firms have operated under the Money Laundering Regulations (MLRs) — a regime limited to AML obligations. CP25/25 represents a step change: it proposes that certain cryptoasset activities be treated as designated investment business, bringing them within scope of the Financial Services and Markets Act (FSMA).

This means crypto firms will now face the same regulatory expectations as banks, brokers, and asset managers. For institutions considering exposure to digital assets, this alignment is crucial — it provides the legal certainty and governance standards required to engage confidently with the sector.

It also highlights the challenge of balancing strong regulation with keeping the UK attractive for crypto businesses.

‍

Key Areas of the Consultation

1. High-Level Standards & Supervision

Crypto firms would become subject to the FCA’s Principles for Businesses, including the Consumer Duty and Threshold Conditions and the Senior Managers & Certification Regime (SMCR).

What it means: Firms will need to strengthen their internal governance, accountability lines, and reporting frameworks to match institutional standards.

2. Governance, Systems & Controls

CP25/25 expects crypto firms to implement robust risk management, oversight, and conflict-of-interest frameworks, supported by independent control functions. Firms must also establish whistleblowing channels and operational oversight.

What it means: Compliance will shift from box-ticking to active risk management, embedding governance into daily operations.

3. Operational Resilience

Firms will be required to comply with SYSC 4, 7, and 8 of the FCA Handbook, ensuring they can maintain important business services during disruptions. This includes mapping critical processes, defining impact tolerances, and testing continuity plans.

What it means: Resilience becomes a differentiator. Institutions will expect custodians, market makers, and exchanges to demonstrate robust business continuity and IT controls.

4. Financial Crime

Crypto firms will come under the same financial crime, AML, and fraud prevention standards as FSMA-authorised entities. This covers detection, reporting, and prevention of money laundering, terrorist financing, and fraud.

What it means: Stronger controls will reduce counterparty risk and support the institutionalisation of crypto markets.

‍

Balancing Oversight and Competitiveness

The FCA faces a familiar dilemma: how to regulate effectively without driving innovation offshore.
CP25/25 aims to strike that balance — setting a compliance baseline to protect consumers and markets, while ensuring the UK remains a credible and attractive jurisdiction for global firms.

In doing so, the UK aligns itself with leading frameworks such as the EU’s MiCA and Singapore’s MAS regimes, establishing clear regulatory pathways that encourage long-term institutional participation.

‍

What It Means for Crypto Firms

• Compliance investment will rise – firms will need dedicated compliance, risk, and operational resilience teams.
• Senior accountability becomes central – under SMCR, executives will be personally responsible for conduct and oversight.
• Resilience is strategic – demonstrating reliability and business continuity will strengthen institutional trust.
• Integrity drives adoption – alignment with financial crime and governance rules will enhance reputational credibility.

‍

Portofino Technologies’ Perspective

At Portofino, we view CP25/25 as a pivotal moment in the institutionalisation of crypto markets. The FCA’s initiative creates a framework that promotes trust, transparency, and resilience — the same principles that underpin healthy liquidity and market efficiency.

As market participants, we support efforts that raise standards across the industry. Reliable regulation doesn’t hinder innovation — it enables sustainable growth by building the confidence institutions need to operate at scale.

Our regulated frameworks — including Portofino’s Treasury Management offering — help institutions operate within evolving compliance standards while maintaining flexibility and liquidity across digital assets.

‍

✅ Bottom Line:
CP25/25 sets the stage for a more mature, transparent, and resilient crypto market in the UK. Firms that invest early in compliance and operational excellence will not only meet FCA standards but also position themselves as trusted partners for institutional capital.

‍
👉 To learn more about the UK’s regulatory roadmap, read our recent interview with Dilan Bastin on the FCA’s DP25/1 discussion paper.