meta_id 3281773

On June 30, 2026, the Financial Conduct Authority (FCA) published finalised guidance on operational resilience requirements for cryptoasset firms under its new regulatory regime. The guidance, titled FG26/6, applies the FCA's existing operational resilience framework to cryptoasset businesses, incorporating requirements under SYSC 4 (General Risk Management Requirements), SYSC 7 (Risk Control), SYSC 8 (Outsourcing), and SYSC 15A (Operational Resilience Requirements). The guidance addresses cryptoasset-specific operational and technological risks that present distinct challenges compared to traditional financial services. Key risks identified include vulnerabilities in smart contract code, private key security threats, validator misconduct, service disruptions affecting distributed ledger technology (DLT) infrastructure, and cyber threats. The FCA emphasises that firms must maintain robust cyber and technology controls, implement secure processes for safeguarding cryptographic keys and supporting infrastructure, and establish continuity and disruption planning tailored to cryptoasset activities. The guidance provides five illustrative example firms—a qualifying stablecoin issuer, cryptoasset trading platform, staking service provider, custody provider, and intermediary arranging deals—demonstrating how operational resilience requirements apply across different business models. For each firm type, the FCA illustrates how to identify important business services, set impact tolerances, map dependencies, and conduct scenario testing. The FCA clarifies that permissionless DLT usage should not be treated as outsourcing under SYSC 8, though firms remain fully responsible for maintaining operational resilience when relying on such infrastructure. Firms must notify the FCA when outsourcing critical or important functions, including custody infrastructure, validator services, and cloud hosting. The guidance also addresses effective communication strategies for managing disruptions, including those beyond the firm's control such as blockchain forks or cyberattacks.