Search This Blog

Monday, 23 June 2025

EU Payment Services Reform: PSD3 & PSR Loom Larger

We are apparently nearing the next step in the evolution of EU payments law, with the publication of new versions of the proposed directive and accompanying regulation. The original proposals were published in June 2023, which I covered here

PSD3 will govern licensing and supervision of e-money and payment institutions, while the PSR will govern the operation of payment services (including those offered by banks). Of course, the directive will need to be implemented under the national laws of each member state, while the regulation will apply directly (though will likely require some local implementation).

Among the more revolutionary aspects are proposals for an anti-fraud framework. Regulated payment service providers (PSPs) will have to share fraud-related information and adopt a system to check IBANs against the corresponding bank account name before permitting transfers. 

The proposals also bring electronic communications service providers - internet service providers and messaging platforms - within scope for fraud prevention, specifically requiring them to "take all reasonable organizational and technical measures to detect and prevent fraud within their sphere of competence, in accordance with applicable Union and national law." 

ATMs will have to show all fees and exchange rates before each transaction. 

There are also proposals for more transparency on payment card scheme fees and rules that should help merchants compare acquiring services (as the UK's Payment Services Regulator was also seeking to achieve, before being subsumed into the FCA).

I will keep following developments until the new legislation is passed. It appears the legislation will take effect 24 months later.


Changes to UK Data Protection Regime

The UK's Data (Use and Access) Act 2025 (DUA) has been passed, though much of it is yet to take effect. There are some important tweaks to the UK's data protection laws (Data Protection Act 2018/UK GDPR and cookies regulation (PECR)). Firms will need to reconsider their privacy policies relating to research, (direct) marketing, cookies and AI in particular. There are now the same potential fines for cookie violations as for UK GDPR breaches - note that the Information Commissioner seems to care more about cookies and automatically scans for non-compliance. If you need legal advice on any of this, please let me know.

Friday, 20 June 2025

FCA Consults on Stablecoin & Custody Rules... Confusion Looms On E-money

The FCA has been preparing to regulate 'stablecoins' for a lot longer than other types of cryptoasset, and is currently consulting on the detailed rules for issuance/offer of qualifying stablecoins, the holding and management of the backing assets, and key information that issuers will need to disclose.plan to consult separately on proposals for managing cryptoasset firm failure, including qualifying stablecoin issuers. This (evolving) post is a summary for information purposes. If you would like legal advice on the potential issues and impact, please let me know.

Terminology

"Qualifying Stablecoin" is defined in a new section 88G of the FSMA (Regulated Activities) Order (RAO) as:

a 'qualifying cryptoasset' [see s88F RAO - this excludes a cryptoasset that is already a specified investment of some kind, e-money, a fiat currency, a central bank digital currency or used in a limited network (similar to the exclusion from e-money/payment services] that: 

(a) references a fiat currency; and 

(b) seeks or purports to maintain a stable value in relation to that referenced fiat currency by the issuer holding, or arranging for the holding of: 

(i) fiat currency; or 

(ii) fiat currency and other assets, 

irrespective of whether the holding of a fiat currency other than the one referred to in sub-paragraph (a) or other asset contributes to the maintenance of that stable value. 

However, this will not include a tokenised bank deposit (we'll discuss the concept of 'tokenised e-money' below].

"Issuing" a qualifying stablecoin in the UK involves the issuer only accepting (a) money; or (b) other qualifying stablecoins issued by FCA-authorised firms, in exchange for qualifying stablecoins they issue. Where issued in exchange for money, it follows that the stablecoin they might also qualify as e-money; and this is pretty much how the FCA is treating them, albeit as a distinct form. Unlike [other] e-money, qualifying stablecoins form a subset of qualifying cryptoassets; have a secondary market value [so does e-money, where it turns out too little cash is safeguarded], and the issuer can mint tokens before receipt of funds from token holders [like prepaid/smart cards?]. The FCA proposes to consult on guidance further clarifying the differences once legislation is passed.

"Creating" includes the technical design of a qualifying stablecoin on any form of DLT, including on private, public, permissioned or permissionless blockchains. Issuers must identify and manage the risks associated with 'creation' (the design and build of a qualifying stablecoin) before it is issued. This includes analysing the risks of the underlying DLT and making sure they can manage potential disruptions

"Minting" a qualifying stablecoin such that it first exists as an identifiable asset on the blockchain in a transferrable form - an issuer must always hold backing assets in amounts equivalent to the value of the stablecoins that have been minted (1:1 in a single fiat currency, regardless of how the backing assets might perform in the markets for those types of assets). The jury is out on whether multi-currency stablecoins will be permitted, as they introduce FX and liquidity risks and the fact that 'par' would be judged against a basket of currencies, yet redemption could only be in one, thereby crysalising losses/gains. 

"Burning" or permanently removing the stablecoin from circulation (on the blockchain). 

Backing Assets 

Only certain asset classes can be used to 'back' a stablecoin, including on demand deposits; and government treasury debt instruments that mature in one year or less. This is because the composition of the 'backing asset pool' must be able to meet requirements for redemption at all times and ensure that the qualifying stablecoin maintains stability.minimum ‘floor’, known as the on-demand deposit requirement (ODDR), for the proportion of backing assets that must be held in bank deposits that are available on-demand. The ODDR is set at 5% and will apply to all stablecoin issuers - both those who only use core backing assets and those who opt-up to use expanded backing assets (who would also need an appropriate backing asset risk management tools and comply with the backing assets composition ratio (BACR) that has a core requirement (CBAR) and an estimated 'daily redemption amount (DRA) for each of the up-coming 14 redemption days, by reference to the experience over the prior 180 redemption-day period, with increases in the CBAR for each redemption day where the actual DRA is at least 110% of the forecast DRA. The intention is that core backing assets should be sufficiently liquid to meet redemptions within the T+1 timeframe. Accordingly, in this context, short term deposits must be repayable on demand or have an immediate break clause attached to them. Issuers should ensure that they manage the portion of government debt instruments used to meet the BACR in a way that meets their redemption obligations.

However, with permission and additional controls, public debt of a longer residual maturity; assets, rights or money held as a counterparty to a repurchase agreements or reverse repurchase agreements; and some limited money market funds might qualify as backing assets.firms to determine their own compositions, based on factors including the redemption modelling they undertake on an ongoing basis. An appropriate backing asset composition will be driven in part by the maturity and liquidity of the underlying assets. This will be set against the requirement for firms to place a payment order for redeemed funds by the end of the business day following receipt of a valid redemption request

Statutory Trust Over Backing Assets

The FCA is still proposing a statutory trust over backing assets held by the issuer as trustee for the benefit of stablecoin holders as beneficiaries, so there would be a fiduciary duty between the issuer and stablecoin holders. This seems more consistent with a stablecoin being an investment instrument, rather than money-like, even though some rules are intended to redress this. It must also mean that the beneficiaries hold both a stablecoin and a beneficial interest in backing assets to the same value as that stablecoin - which surely adds up to two in economic/accounting terms?

The issuer must appoint an independent third party (not a group company), to safeguard the backing assets, which must be promptly segregated on receipt; and the third party must acknowledge in writing that safeguarded qualifying stablecoin backing assets are held on trust for the benefit of the stablecoin holders (rather than for the client issuer/trustee). This sounds like good news for the custody industry and expensive. 

If an issuer issues more than one qualifying stablecoin it must ensure that the backing assets for each stablecoin product are held separately and under separate trusts for the benefit of each separate group of stablecoin holders for each corresponding qualifying stablecoin pool.

The issuer retains the obligation to ensure that each set of backing assets are managed appropriately and the qualifying stablecoins are backed 1:1 with the backing assets at all times. 

There must be reconciliations of backing assets at least daily and to ensure shortfalls are topped up and excesses removed, or that qualifying stablecoins are minted or burned to ensure parity is maintained within 1 business day, failing which the issuer must alert the FCA the following business day (though the issuer won't be expected to publish or report the value daily, only monthly...).  This is said to be in order to address the risk that any redemptions while the stablecoin has de-pegged would exacerbate the shortfall (potentially resulting in a 'run' on the issuer); and that issuers (or other investors) could speculate by buying the stablecoins below par and waiting for the issuer to restore parity. The fact that the rules could leave a window of 4 trading days (including a weekend) seems to have escaped the FCA's attention...

The issuer must redeem its qualifying stablecoins to all qualifying stablecoin holders at par, with no minimum redemption amount of stablecoin per redemption request, to an account in the name of the holder by the end of the business day following receipt of the request. Any redemption fee must be 'commensurate' with the operational costs incurred for executing redemption (not costs and losses arising from the sale of assets in the backing asset pool); and must not exceed the value of the stablecoins being redeemed. So the par value is the value of one unit of the reference currency, multiplied by the number of stablecoins being redeemed, irrespective of the value of the backing assets - so the redemption value should not fluctuate in line with the performance of the underlying backing assets (as is the case with a fund).

Issuers can retain interest on backing assets, but cannot pass interest or dividends/benefits on the backing asset pool to qualifying stablecoin holders (directly or indirectly), further distinguishing qualifying stablecoins from funds or other investment products. 

The draft RAO distinguishes 'issuing a qualifying stablecoin' from the operation or management of a Collective Investment Scheme (CIS) or Alternative Investment Fund (AIF), of which Money Market Funds are a subset, but the FCA foresees the need to consult on the differences in due course... 

Stablecoins, E-money, Tokenised E-money and E-money Tokens

The FCA has always tried to adopt a technologically neutral and 'same risk, same regulatory outcome' approach to regulation. So crypto-tokens issued 1:1 in relation to the value of a single currency on receipt of funds and accepted as a means of payment by third parties have been treated as 'e-money tokens' and therefore e-money, such that the issuer would need to be authorised as an e-money institution under the E-money Regulations (EMRs). A reminder that e-money is defined as:

...electronically (including magnetically) stored monetary value as represented by a claim on the electronic money issuer which— 

(a) is issued on receipt of funds for the purpose of making payment transactions; 

(b) is accepted by a person other than the electronic money issuer; and 

(c) is not excluded by regulation 3 [limited network, low value telecoms billing for certain things];

This remains baked into the proposed changes to the RAO, since to be a 'qualifying stablecoin', a cryptoasset must also be a 'qualifying cryptoasset', which excludes e-money.

This is also reflected in the EU's Markets in Cryptoasset Regulations (MiCAR). In a recent opinion to delineate MiCAR and the Payment Services Directive (PSD2), the European Banking Authority has confirmed that a cryptoasset which aims to stabilise its value by referencing only one official currency is an "e-money token" (EMT); and Article 48(2) of MiCAR deems EMTs to be e-money, and therefore within the definition of ‘funds’ in Article 4(25) of PSD2. Article 70(4) of MiCAR then provides that cryptoasset service providers (CASPs) who provide PSD2 payment services related to their crypto-asset services, may either do it themselves or partner with a PSD2 firm, so long as either is authorised to provide the payment services. In addition, a custodial wallet that is held in the name of one or more clients and allows the client(s) to send and receive EMTs to and from third parties is a 'payment account' within the scope of PSD2. So, the following activities involving e-money tokens (EMTs) are also to be regarded as 'payment services' under PSD2: 

  • the transfer of cryptoassets as a payment service, where they entail EMTs and are carried out by the entities on behalf of their clients; 
  •  the custody and administration of EMTs.

However, the UK seems to have diverged from this now in relation to qualifying stablecoins that "seek or purport to maintain their value by reference to a single fiat currency" (which I'll call 'single currency stablecoins'). The FCA seeks to explain this on the basis that such single currency 'qualifying stablecoins' are somehow different from e-money because they "have a secondary market value... the issuer can mint tokens before receipt of funds from token holders...and [due to] their use case in cryptoasset trading." This fails to acknowledge that the criteria for stored value to qualify as e-money were ordained by regulation that does not really negate such characteristics: recently, the FCA itself revealed that, in their experience of e-money institution insolvencies, only about 20% of funds corresponding to e-money balances are safeguarded, implying that UK e-money may have decoupled from sterling (just as stablecoins can). In addition, in order to reflect the custom that customers' payment accounts are credited instantly with e-money they purchase online or over the counter, the trigger point for the "receipt of funds" by e-money institutions has been inferred by the FCA as occurring earlier than when the funds themselves actually arrive in the firm's actual bank account: the e-money issuer must merely have become 'entitled to' those funds. And e-money can be used in the course of cryptoasset trading, as the EBA has confirmed.

Yet the FCA has also said that: 

"we intend to regulate [qualifying stablecoins] as money-like instruments rather than as investment products. This means we would expect qualifying stablecoin issuers to offer all holders the right to redeem at par value, and the redemption value should not fluctuate in line with the performance of the underlying backing assets as is the case with a fund. We also propose to prohibit issuers from passing interest on the backing asset pool to qualifying stablecoin holders, further distinguishing qualifying stablecoins from funds or other investment products."

Note that while a qualifying cryptoasset need only "seek or purport to" maintain its value in a reference currency/asset in order to become a 'qualifying stablecoin', the FCA will then also require that the qualifying stablecoin maintain that value.

At any rate, there is now no mention at all of "e-money tokens" in the UK proposals for stablecoins or cryptoassets more widely. While a cryptoasset is not a 'qualifying cryptoasset' (and therefore could not be a qualifying stablecoin) if it is e-money (Art 88F(4), RAO), a new exclusion from the definition of "e-money" will also be added (via Reg 3ZA in the EMRs) to provide that the concept of “stored monetary value” is not to include: 

(a) qualifying stablecoin; 

(b) money or assets held as the backing assets or the stabilisation mechanism for a qualifying stablecoin; 

(c) a cryptoasset comprising or representing a claim for the repayment of a sum of money received by way of deposit, within the scope of article 5 (accepting deposits) [in other words, tokenised bank deposits - which reflects the carve-out of tokenised bank deposits from the definition of a 'qualifying stablecoin in Art 88G RAO].

So, could a cryptoasset ever be considered "e-money" in the UK? Well, by analogy with the definition of a tokenised bank deposit, perhaps a cryptoasset that itself comprises or represents "e-money" could also be considered e-money, so long as 'the stored monetary value' is not itself a 'qualifying stablecoin' (while recalling that a to be a qualifying stablecoin, a cryptoasset must also be a qualifying cryptoasset, which excludes e-money; and around the circle we go...). 

Of course, banks can issue e-money as distinct from 'accepting deposits'.

Not only is all this quite confusing, but having separate UK regulatory regimes for single-currency stablecoins and e-money also increases the jeopardy for getting the classification wrong at the outset (especially when opining on and operating under, say, the limited network exclusion) and addressing their uses and abuses in the market.

Are Pre-minted Tokens 'Qualifying Stablecoins'?

The FCA is concerned about the fact that issuers might "mint qualifying stablecoins" (the crypto-token that is not yet backed) before issuing them to the public and that if these tokens are not 'backed' from the time they are minted, there's a risk of unbacked qualifying stablecoins slipping into the market (as could a qualifying stablecoin that has been redeemed). I guess the simple answer to this risk is that neither a pre-minted (or redeemed) unbacked token is not yet (or any longer) a qualifying stablecoin, because it does not 'seek or purport to maintain' any value. 

Stablecoin Redemptions

The FCA proposes that a redemption must be for money (not other assets); and starts when a holder makes a formal request to redeem; and ends when "a payment order for the redeemed stablecoins has been submitted to the holder's desired [bank or payment] account." These rules will need to be tightened up. Of course, the payment order in this case would be submitted by the issuer to the safeguarding custodian to pay the fiat currency to the holder's account. The issuer does not submit a payment order directly to the holder's account. Equally, 'placing a payment order' begs the question of when the payment order is to be executed. It is possible to place a future-dated payment order...

There would also be exemptions, e.g. where redemption would breach a legal requirement (e.g. AML check, as the stablecoin has been transferred from the original recipient) or court order; or where a currency exchange is required (in which case the issuer should disclose the timing of when such requests can be executed, along with redemption fees that are 'commensurate' with the operational costs incurred (excluding costs/losses from selling backing assets).

Redemptions could be suspended "in exceptional circumstances" where necessary to protect the rights of holders or the integrity of the stablecoin: due to a failure in the underlying blockchain/infrastructure; insolvency of the issuer; or a sudden loss of confidence in the value of the stablecoin (a 'run'). The FCA wants "at least 5 working days' notice" of restarting redemptions, which means the suspension could last at least 6 working days.

Use of Third Parties

An issuer can use third parties to sell or redeem qualifying stablecoins and manage the backing asset pool, on its behalf. In each case, there are requirements to minimise the risk on the third party's failure. It must be clear when a third party is carrying out any issuance activity.

Communications/Disclosure

Issuers must publish the number of stablecoins issued and the backing asset composition at least once every three months (why not daily?); obtain independent verification annually of any statements they've made about the 1:1 ratio in the previous 12 months; along with e.g. technology used, third parties outsourced service providers and the redemption policy/process. 

Custody

Taking custody of a cryptoasset usually means taking control over it by holding or storing the means of accessing it (the private key) on behalf of the customer, but that doesn't mean it holds the customer's private key to the customer's own wallet. Instead, the custodian receives a transfer of the cryptoasset from the customer's wallet to its own wallet to which it has access with its own private key. 

Customers often leave the cryptoasset with the exchange they bought it on, which then also acts as a custodian. 

In a cryptoasset custody arrangement, the stablecoin holder may therefore have both legal and beneficial title, only beneficial title or just a right for the return of the stablecoin.  There is no registration of ownership in some kind of central register, as there is for traditional securities, for example, under Article 40 of the RAO. While there's a record of transactions on the blockchain, that is not a definitive record of ownership. There is some reliance, therefore, on the custodian's records and service terms that might defeat ownership interests or render customers only unsecured creditors of the custodian.

Therefore, custodians will have to segregate client assets from their own and ringfence them from other creditors' claims. This could be done in individual or omnibus wallets. Reconciliation must be done each business day; and the results held independently of other records (with notification to the FCA if this is not possible or there is a shortfall (in which case the client must also be notified). 

The custodian would also have to hold the cryptoassets in a (non-statutory) trust for the clients, as a bare trustee on receipt, recording the name of the client beneficiary in the firm's internal records that state the type of asset, quantity, the address where it is held, the nature of the client's claim to it and the identity of any third party that has capacity/control to effect a transfer. 

Whether such a trust persists in the event that the customer wants the cryptoassets put to a different use in some way (e.g. staking) remains to be consulted upon.

The CASS 7 rules will apply to any cash that is held for clients.

The FCA also wants to avoid the insolvency of crypto custodians altogether, by ensuring they wind-down in an orderly fashion:

Where necessary, we propose amendments to existing CASS provisions, to ensure we accommodate the unique characteristics of cryptoasset custody outlined above. We have considered feedback from DP23/4 and other publications. These include the IOSCO Policy Recommendations for Crypto, the Law Commission’s final report on digital assets and the Property (Digital Assets Etc.) Bill which clarifies that certain digital assets, such as crypto-tokens, can be recognised as property even if they do not fit into the two traditional categories of personal property in the law of England and Wales.

Other internal controls must also be maintained; and custodians will only be able to use third party service providers under strict conditions, including that the appointment must be "in the best interests of the client, and necessary for safeguarding, which firms must evidence in a written policy." 

Custodians may be held liable for negligence, breach of contract and breach of FCA rules. 

Specific disclosure requirements are being considered, but not Proof of Reserves (a cryptographically proved, independent audit process). Audit standards will also be consulted upon, along with regulatory reporting rules.


Monday, 16 June 2025

E-Money Tokens: The Difference Between MiCAR Payments & PSD2 Payments

I have a number of posts in the works on the UK's belated plans for cryptoasset regulation, but this one deals with the European Banking Authority's use of its 'no action' powers to minimise the overlap between the EU's second Payment Services Directive (PSD2) and the Markets in CryptoAssets Regulation (MiCAR), to minimise the burden of dual authorisation for firms. The distinctions summarised below should be applied in the exercise of national EEA payment authorities' supervision and enforcement policies until 2 March 2026, and selective supervision of certain aspects thereafter, while waiting for legislative clarity when PSD2 is replaced in 2-3 years' time. This post summarises the relevant distinctions for information purposes. If you need legal advice, please contact me via Crowley Millar.

EMT-based PSD2 Payments

Specifically, the European Banking Authority (EBA) has opined that the following activities involving e-money tokens (EMTs) should be regarded as 'payment services' under PSD2: 

  • the transfer of crypto assets as a payment service, where they entail EMTs and are carried out by the entities on behalf of their clients; 
  • the custody and administration of EMTs. 

In addition, a custodial wallet should be regarded as a payment account under the PSD2 where the wallet is held in the name of one or more clients and allows the client(s) to send and receive EMTs to and from third parties.

This is because Article 48(2) of MiCAR deems EMTs to be electronic money, so they come within the definition of ‘funds’ by virtue of Article 4(25) of PSD2. Article 70(4) of MiCAR then provides that CASPs who provide PSD2 payment services related to their crypto-asset services, may either do it themselves or partner with a PSD2 firm, provided that either is authorised to provide the respective payment services. But exactly which of the 8 payment PSD2 services applies is not quite clear.

Any firm undertaking these activities will need local authorisation under PSD2 from 1 March 2026, but even after that date, local regulators should not prioritise the supervision and enforcement of PSD2 provisions on safeguarding, disclosure of information on charges to consumers, the maximum execution time of payment transactions, unique identifiers (e.g. IBAN), or open banking (account information services and payment initiation services). Only the rules on strong customer authentication (two factor authentication) should apply (to custodial wallets and the initiation of EMT transfers), along with rules on fraud reporting and the cumulative calculation of 'own funds' (working capital) requirements.

EMT-based MiCAR Payments

Meanwhile, the EBA says that ‘exchange of crypto-assets for funds’ and ‘exchange of crypto-assets for other crypto-assets’ as defined in MiCAR should not be deemed PSD2 'payment services' by local authorities, nor where crypto-asset service providers (CASPs) intermediate the purchase of any crypto-assets with EMTs.

The EBA acknowledges that this advice "will result in a large number of EMT transactions not to be subject to the requirements of PSD2", but the aim is to minimise the burden of dual authorisation for CASPs.

This post summarises the relevant distinctions for information purposes. If you need legal advice, please contact me via Crowley Millar.


Saturday, 24 May 2025

Reform of UK Consumer Credit Law - Phase 1

Just a short post to confirm that the UK government is consulting on its proposed approach to the long overdue reform of the deeply confusing consumer credit regime. This will be done in several phases. And consultation on the first phase ends on 21 July.

Broadly, as with other areas of financial regulation, the government basically proposes to repeal the Consumer Credit Act 1974 and Regulations, bar a few provisions that I guess it could fold into, say, the Financial Services and Markets Act/Orders and FCA Rules.

Phase 1 will focus on removing 'information requirements' and the draconian sanctions or consequences for mistakes, in favour of FCA disclosure rules and supervision.

Phase 2 will look at supplier/creditor liability and unfairness provisions, the different types of credit/hire agreements and other key definitions. 

While the government is looking for feedback on the approach, frankly, the whole thing is going to be so hideously complex we may as well just get on with it as proposed. At some point, the new regime will have to factor in the multitude of court decisions, interpretation and unofficial guidance that has grown up over the decades: this will need to be captured in the FCA Handbook (a combination of rules and guidance, anyway); and/or the original language transplanted so as not to create fresh grounds for 'clarifying' litigation.

At any rate, it will be fascinating to see whether the outcome is just as complex as before, albeit everything is in the one set of legislation, orders and rules. That's my bet. It surely can't get much worse... can it?


Friday, 23 May 2025

UK Government Follows Through On BNPL Regulation

The 'new' UK government has followed through with earlier plans to regulate 'Buy Now Pay Later' (BNPL) short term installment credit that had stalled under the previous government. The regulated version will be called 'deferred payment credit' (DPC). The regulations won't bite until mid-2026, but it's good to finally have certainty as to what is regulated (if not the fine detail yet). And merchants, fintech service providers and credit reference agencies can use the 12 month window to figure out ways for consumers to keep track of both their regulated DPC and unregulated BNPL instalment credit. I've already summarised the latest proposals for Keystone here for information purposes, and have added a few thoughts below to consider. If you need advice on the plans, please let me know. 

Given that BNPL agreements directly with a merchant will remain unregulated, there remains an opportunity for third party finance providers (whether FCA-authorised or not) to work with merchants on unregulated BNPL. Structuring the overall offering to remain unregulated will take care, however.

The proliferation of DPC/BNPL arrangements should prove a boon to 'open banking' or 'account information service' providers who can offer consumers visibility of all their obligations, whether directly or via device manufacturers, DPC lenders or even merchants themselves.

There's also a growing credit reference/assessment challenge as more consumers take on more instalment credit, whether regulated or not.

The government is right, in my view, to keep a weather eye on the unregulated BNPL market to see if intervention is required, before acting. Third party lenders who complain about an uneven playing field between should also consider that regulating merchant BNPL could hurt smaller merchants in favour of larger merchants who already possibly have the resources to offer better instalment options, let alone bear the burden of being FCA authorised (not to mention the strain on the FCA itself in taking on every merchant that wishes to offer BNPL/DPC!).

 


Tuesday, 6 May 2025

FCA Discussion Paper On New Crypto Rules

Hard on the heels of the Treasury's proposed regulatory framework for cryptoasset activities in the UK, the Financial Conduct Authority published its own discussion paper on how it will supervise these activities within that framework. The FCA requested feedback by 13 June 2025. I will gradually add my thoughts on the discussion paper below, for information purposes. If you require legal advice on the plans and their impact, please let me know

The FCA's proposals are far reaching (including extra-territorial) and complex. Some areas are new, while others aspects attempt to include cryptoassets/activity into existing rulebooks. There are also some proposed restrictions on the type of customers that firms can deal with. 

The actual rules and guidance won't be available until mid-2025, when the FCA will publish a Consultation Paper on issuing a qualifying stablecoin, safeguarding qualifying cryptoassets and specified investment cryptoassets, along with the prudential framework (capital requirements) for qualifying stablecoins and safeguarding. There will be a further consultation on the wider 'conduct' standards, such as the Consumer Duty even later in 2025.

Operating a Qualifying Cryptoasset Trading Platform

This proposed new regulated activity is incredibly broad: 

[the operation of] ‘a system which brings together or facilitates the bringing together of multiple third-party buying and selling interests in qualifying cryptoassets in a way that results in a contract for the exchange of qualifying cryptoassets for any of: (a) money (including electronic money); or (b) other qualifying cryptoassets.

Any entity operating a trading platform for cryptoassets in the UK, or providing services to UK clients, will generally need to be authorised in the UK, except a firm operating an offshore trading platform for cryptoassets that is only serving professional investors in the UK.

One approach to authorisation for offshore firms would be to require both a 'branch' or local establishment for operating the platform and interfacing with overseas customers; and a UK subsidiary for client-facing functions (including for retail customers). Where an offshore firm is also regulated in its home jurisdiction, the FCA might be prepared to leave certain issues (e.g. capital requirements and systems/controls for trading operations) to the home regulator.

When dealing with retail customers, the FCA proposes that CATPs should:

  • Disclose and clarify their own and their clients’ respective responsibilities. 
  • Ensure that customers comply with the platform rules and relevant regulations (for example, not engaging in market manipulation). 
  • Monitor trading activity to identify infringements of rules. 
  • Set controls and limits for each type of customer profile. 
  • Be able to revoke access or participation rights, or to suspend a customer.

Algorithmic trading and automated trading software: the FCA points out these are "highly prevalent in cryptoasset markets, with popular bot providers reporting up to 1 million users", including retail investors, requiring limited, if any, human intervention. "Trading platforms also provide dedicated access capabilities for algorithmic trading or [high frequency trading] HFT." Whether or not these will need to be authorised or registered somehow, CATPs will have to ensure fair and non-discriminatory access to trading, ensure orderly markets and eliminate or manage/disclose conflicts of interests between providers of algorithmic or automated trading software and the CATP operator.

Market-makers: the FCA is aware of anti-competitive and collusive practices between crypto trading platforms and market makers, artificially inflating trading volumes, giving unfair advantages for affiliated market makers, and market manipulation. Therefore, CATPs may need to identify those operating market making strategies on the trading platform; have appropriate contracts in place; and disclose potential relationships. Contracts would govern the market making scheme and including obligations for market makers posting simultaneous two-way quotes for a specific liquidity pool.

Trading & execution: Crypto trading service providers have different matching and execution protocols. Some exchanges combine discretionary and non-discretionary systems, and some trade in principal capacity on and off platform with their clients in ways that aren't clear who the counterparty is. The FCA will require CATPs to operate on a non-discretionary basis, treating all orders identically, according to a consistent set of rules, rather than using their judgement as to whether, when and how much of any orders to match. Where investors participate directly, CATPs might not be required to "take all sufficient steps to obtain the best possible order execution results for clients" (best execution requirements), so it would be up to investors to consider where best to trade on the basis of prices, fees and costs. Investors using an intermediary may benefit form investor protection rules and the intermediary's obligation to act in the investor’s best interest, including seeking best execution, though commission or other compensation would be charged.

Matched Principal Trading: this is a form of trading where a person acts as a broker or central counterparty between the buyer and seller, making sure that the price and quantity is agreed on both sides before the trade is executed. The broker charges a fee rather than making a turn on the difference/spread between the buy and sell prices. The risks are that the CATP as broker trades against the clients on platform and/or takes on market risk (of counterparty default). which could create resiliency risks; conflicts of interest undermine the fair and non-discretionary operation of markets; and there may be other abusive or anti-competitive practices, such as wash trading and market manipulation. As a result, the FCA is not happy that "Exchanges often execute clients’ transactions back-to-back, by standing between the 2 trading counterparties" and want to explore some alternatives in light of the IOSCO Recommendations: neither the CATP operator nor any of its affiliates should never be allowed to trade in principal capacity on the CATP's own platform; and the CATP should not be allowed to do so even off platform, for trading activity not related to their CATP’s operation.

Issuing: the FCA may require legal or functional separation between the firm operating a CATP and the issuer of the cryptoassets admitted to trading on the CATP. Legal separation in particular could avoid credit and market risks exposures, capital risks, conflicts of interests and anti-competitive practices by the CATP against other issuers.

Market & Counterparty Credit Risks: the FCA wants CATPs to be "risk-neutral trading systems", without counterparty or credit risk to clients or products. CATPs could not act as a clearing house or directly manage or internalise risk exposures between counterparties on their platform; or provide credit lines or make credit arrangements with their clients.

Settlement: is the ‘irrevocable and unconditional transfer of an asset […], or the discharge of an obligation […] in accordance with the terms of the underlying contract’. The challenge with regulating settlement in cryptoasset markets is that CATPs don't control the underlying distributed ledger or 'blockchain' protocols (which the UK does not intend to regulate). CATPs often take on settlement responsibilities internally, creating risks for the CATP or its clients if a counterparty defaults in its own obligations. Generally, the FCA expects CATPs to have "satisfactory arrangements" for securing the timely and effective transfer of control over the cryptoassets traded on their platform, whether internally or by facilitating or arranging this through other service providers (including custodians).

Transparency & Reporting: the FCA has found that "cryptoasset market data is often unreliable and inconsistent", which undermines efficient pricing, creates unlevel playing fields, and creates "incentives in favour of minor, or illiquid, trading desks that do not offer the same level of transparency". In other words, this is how the pro's fleece the retail sheep. Therefore, the FCA wants to rely on CATPs to clean up and publish pre- and post-trade market data (presumably so a cryptoasset market data sector will grow up, just as other markets for financial data have evolved), including order and transaction data (while also retaining client identity information internally for 5 years).

Cryptoasset Intermediaries

These intermediary functions involve dealing as principal or agent; or arranging such deals in qualifying cryptoassets. Many CATPs undertake these functions as well as being an 'exchange'. Only 28% of users bought crypto through a distinct intermediary, paying higher charges and taking on a long list of risks (that also apply where the CATP is also acting as an intermediary, with additional conflicts of interest and opportunities for abuse). Chapter 3 of the Discussion Paper has more detail on the proposals to address these issues on a 'same risk, same regulatory outcome' basis as in traditional markets: 

  • Facilitate UK investors’ access to global crypto markets through authorised entities. 
  • Make sure UK markets remain internationally competitive, fair, orderly, transparent and liquid. 
  • Fair and transparent conditions for trades executed for, or on behalf of, a client; executed in a way that serves the best interest of clients. 
  • Intermediaries ensure that the price a customer pays for a product is transparent and reasonable compared to the overall benefits the customer gets from the product. 
  • Firms compete to provide best execution. 
  • Consumers protected from unfair or abusive practices. 
  • Intermediaries manage conflicts of interest effectively. 
  • Support growth of the UK intermediary market with clear and proportionate regulation.