On 30 September 2026, the Financial Conduct Authority (FCA) published two pieces of Finalised Guidance setting out its expectations for firms completing the Overall Risk Assessment (ORA) under the new prudential framework:
- FG26/9: Non-Handbook Guidance on COREPRU 7: Overall risk assessment; and
- FG26/10:Non-Handbook Guidance on CRYPTOPRU 7: Overall risk assessment for CRYPTOPRU firms.
Both pieces of guidance will come into force on 25 October 2027, alongside the relevant prudential framework. FG26/10 is specifically directed at firms subject to CRYPTOPRU, including cryptoasset custodians, custodial staking firms and stablecoin issuers, while FG26/9 establishes the broader approach to completing an ORA under COREPRU.
How the framework fits together
COREPRU 7 establishes the cross-sector obligation to complete an ORA. CRYPTOPRU 7 supplements that process for CRYPTOPRU firms by specifying cryptoasset-related matters that should be captured in risk identification, stress testing, recovery actions and wind-down planning. FG26/9 explains the integrated COREPRU methodology; FG26/10 applies it to cryptoasset business models. The guidance is illustrative and non-exhaustive, so firms remain responsible for selecting and evidencing a methodology appropriate to their activities.
Dual‑regulated MIFIDPRU and CRYPTOPRU firms complete an ICARA, not an ORA, with crypto‑specific risks integrated into the ICARA Process.
Key technical requirements
- The ORA must be proportionate to the nature, scale and complexity of the business and focus on risks capable of causing material harm to clients or markets.
- The Own Funds Threshold Requirement (OFTR) should be the higher of the firm’s own assessment and the applicable regulatory minimum. The Liquid Assets Threshold Requirement (LATR) cannot fall below the applicable minimum comprising the basic liquid assets requirement and any sector-specific liquidity requirement.
- The assessment should distinguish resources needed for ongoing operations from resources needed to execute an orderly wind-down, while avoiding double counting unless the same resource is genuinely available in both circumstances.
- Financial projections should be sufficiently granular to identify the timing of cash outflows, collateral or margin calls, asset haircuts, trapped liquidity and the point at which management action or wind-down must begin.
- Material changes, including new products, rapid growth, acquisitions, outsourcing changes, new token or protocol exposures, or entry into new markets—should trigger an out-of-cycle review rather than wait for the annual cycle.
What is the Overall Risk Assessment?
The ORA is intended to provide an integrated assessment of a firm’s business model, material risks, risk appetite and financial resources, including the resources required both to continue operating and to wind down without causing material harm.
Under the FCA’s framework, the ORA is the principal mechanism through which a firm assesses its OFTR and LATR. The assessment should not be treated as a standalone regulatory exercise. The FCA expects it to be proportionate, forward-looking and embedded within business planning and strategic decision-making.
For CRYPTOPRU firms, the FCA explains that the assessment should start with an understanding of the firm’s business model and strategy, including how it generates returns, the vulnerabilities that could affect its ability to operate, and the potential impact of planned developments such as new products, business lines, growth or other material operational changes.
A particular focus on crypto-specific risks
FG26/10 builds on the general principles in FG26/9 and considers risks particularly relevant to cryptoasset business models. These include, among others, market, leverage, credit, liquidity, operational and concentration risks, as well as the interaction between different risks during periods of stress.
Examples highlighted by the FCA include concentration in tokens, protocols and counterparties; failure of exchanges or trading partners; cyber-attacks and theft of private keys; loss of access to critical cold-storage arrangements; stablecoin-related stresses; slashing events; errors in blockchain transactions; and the availability of banking services.
The guidance therefore reinforces the importance of ensuring that risk identification reflects the firm’s actual cryptoasset activities, dependencies and operating model, rather than relying solely on generic risk categories.
Selected examples of technical risk assessment
- Custodian concentration: a firm that relies on one wallet technology provider and one cloud region could map the common dependency across custody, withdrawals and reconciliation; quantify the assets and clients affected; test the time needed to invoke alternative arrangements; and assess whether additional liquidity is needed while services are restored.
- Stablecoin issuer liquidity: a firm could model simultaneous redemption requests, declining market value or delayed realisation of backing assets, loss of a banking partner and increased settlement costs. The analysis should apply realistic liquidation haircuts and timing assumptions rather than assume immediate conversion at accounting value.
- Staking and validator risk: a custodial staking firm could assess slashing, validator downtime, unbonding periods, protocol concentration and the contractual allocation of losses. The scenario should capture both direct financial loss and liquidity pressure where customer withdrawals arise before assets can be unstaked.
Risk appetite and financial resources
The FCA expects firms to establish a clear risk appetite based on the risks capable of causing material harm. This should translate into appropriate limits, tolerances, early warning indicators and management triggers.
Firms should first consider whether risks can be adequately controlled or mitigated. Where mitigants are insufficient or unreliable, additional own funds or liquid assets may be necessary. Where a residual risk remains outside the firm’s risk appetite even after mitigation, the FCA indicates that the firm should consider whether the activity giving rise to that risk should continue.
Accordingly, the ORA links risk management directly with the determination of the firm’s financial resource requirements rather than treating capital, liquidity and risk management as separate exercises.
Stress testing and reverse stress testing
Stress testing forms a central part of the new framework. Firms should consider both firm-specific and market-wide stresses, individually and in combination, and scenarios should be forward-looking, severe but plausible and relevant to the firm’s business model.
For cryptoasset firms, the FCA provides examples including:
- significant falls in cryptoasset prices combined with customer withdrawals;
- loss of confidence in a qualifying stablecoin;
- withdrawal of liquidity across trading venues;
- cyber-attacks affecting firm-held assets or access to systems; and
- failures of significant counterparties, exchanges or trading venues.
Firms should also conduct reverse stress testing to identify circumstances in which their business model would cease to be viable. The results should inform recovery planning, wind-down planning and the point at which management intervention becomes necessary.
Technical approach to scenario design
A defensible stress-testing methodology should document the scenario narrative, transmission channels, time horizon, assumptions, data sources, management actions and impacts on profit and loss, own funds, cash flows and liquid assets. Firms should model both idiosyncratic and market-wide events, including combined scenarios where dependencies make risks mutually reinforcing.
For example, a custodian might test a sharp market fall occurring alongside a cyber incident that suspends withdrawals, loss of a key banking provider and failure of a significant counterparty. The model should reflect withdrawal behaviour, incident-response expenditure, legal or remediation costs, delayed receivables, haircuts on assets that may need to be monetised and the implementation time of recovery actions.
Reverse stress testing should work back from defined points of non-viability—for example, breach of a resource threshold, inability to return or safeguard client assets, or loss of a critical service beyond tolerance—to identify the combination of events and assumptions that would cause failure. The resulting proximity to failure should inform early-warning indicators and wind-down triggers.
Recovery and contingency planning
FG26/10 provides additional detail on the FCA’s expectations around recovery actions. Firms should identify credible actions that could be taken where financial resources deteriorate, considering both the time required to implement them and their effectiveness under stressed conditions.
The FCA also states that firms should have a Contingency Funding Plan (CFP). Depending on the firm’s nature, scale and complexity, this should identify credible liquidity actions, internal action triggers, stressed cash-flow considerations and appropriate governance and communication arrangements.
Wind-down planning
The ORA and the firm’s wind-down plan should be closely connected.
Firms should assess the own funds and liquid assets required to exit the market without causing material harm, taking into account the operational, financial and liquidity requirements of a wind-down. The wind-down trigger should occur while sufficient resources remain to execute the plan.
For cryptoasset firms, this may include costs associated with matters such as distributing custody assets or unwinding stablecoin backing assets.
Governance, documentation and FCA supervision
The overall risk assessment should be a living risk management framework, rather than an annual compliance exercise.
Under COREPRU, firms must review and document their ORA at least once every 12 months and following any material change to the business or operating model. The ORA documentation must be retained for at least three years from the date of approval.
The FCA may review firms’ ORAs through its Supervisory Review and Evaluation Process (SREP), considering areas including the firm’s business model, risks, governance, financial resilience, risk appetite and wind-down arrangements. The FCA indicates that supervisory findings may lead to measures including additional own funds or liquidity requirements, changes to governance, improvement plans, restrictions on activities or additional regulatory reporting.
Governance and evidence expected in practice
- Ownership: named first-line owners for each material risk and a clearly accountable governing body for approval of the ORA, thresholds and triggers.
- Challenge: documented review by risk, finance, treasury, operations and compliance, with assumptions reconciled to the business plan and wind-down plan.
- Monitoring: management information showing actual resources against OFTR, LATR, risk appetite limits, early-warning indicators and wind-down triggers, including forecast headroom.
- Data lineage: traceable links from source systems and exposure inventories to stress-test inputs, calculations, adjustments and board reporting.
- Actionability: recovery actions with owners, decision points, implementation times, dependencies, operational constraints and quantified benefits under stress.
The FCA’s supervisory review may therefore focus not only on the final resource numbers, but also on whether the underlying governance, data, assumptions, challenge and management actions demonstrate a coherent process.
What should cryptoasset firms be considering now?
Although the guidance does not take effect until 25 October 2027, firms preparing to operate under the new UK cryptoasset prudential regime should consider the ORA as a core component of their prudential framework rather than a document to be developed in isolation.
In practical terms, preparations should focus on aligning the firm’s:
- business model and forward-looking financial projections;
- risk assessment and risk appetite framework;
- capital and liquidity assessments;
- stress and reverse stress testing;
- recovery actions and contingency funding arrangements; and
- wind-down planning.
This reflects the FCA’s overarching expectation that these elements operate as a coherent and connected framework, with the level of sophistication proportionate to the nature, scale and complexity of the firm’s activities.
Suggested preparation priorities
- Complete a CRYPTOPRU applicability and gap assessment against COREPRU 7, CRYPTOPRU 7, FG26/9 and FG26/10.
- Map the legal entities, regulated activities, products, tokens, protocols, counterparties, banking partners, validators, wallet arrangements, outsourcing providers and critical services within scope.
- Define a material-harm taxonomy and connect each material risk to controls, risk appetite, stress scenarios, financial impacts and wind-down actions.
- Build an integrated financial model covering base case, severe-but-plausible stress, recovery and wind-down, with explicit OFTR and LATR calculations and headroom monitoring.
- Set quantitative and qualitative early-warning indicators, escalation thresholds and wind-down triggers that leave enough time and resources to act.
- Establish an annual ORA cycle, out-of-cycle triggers, board approval, document retention and a clear audit trail of challenge and decisions.
How Complyport can assist
Complyport’s Risk Management & Prudential team can support firms preparing for the new prudential framework, including the development and review of the Overall Risk Assessment, risk appetite and risk management frameworks, capital and liquidity assessments, stress and reverse stress testing, recovery and contingency planning, and wind-down planning.
Discover how Complyport can support your compliance needs. Visit https://complyport.tech/ to learn more about our RegTech solutions.
