What are digital assets? The UK guide to cryptoassets

"Digital asset" is marketing. "Cryptoasset" is law.

No UK statute defines "digital asset". Firms apply it to bitcoin, to dollar stablecoins, to tokenised money-market funds, to in-game items, to airline points and to cartoon JPEGs — often in the same brochure. The FCA has said as much in its draft perimeter guidance (CP26/13, 15 April 2026): terminology in the cryptoasset sector is used inconsistently, and substance rather than label determines treatment.

The term that carries legal weight is cryptoasset. Section 417 of the Financial Services and Markets Act 2000 defines it as:

Two things in that wording matter more than they look:

• "value or contractual rights." The definition is not limited to coins. A token representing a legal claim is inside it.
• "which may include distributed ledger technology." A blockchain is not required. The definition is deliberately technology-neutral, so a firm cannot escape it by saying its ledger is not really a blockchain.

HMRC uses a narrower gate. CRYPTO10100 (page last updated 28 November 2025) describes cryptoassets as digital representations of value that rely "on a cryptographically secured distributed ledger or similar technology to validate and secure transactions". Where the FSMA definition covers value or contractual rights and treats distributed ledger technology as optional, HMRC's requires the ledger. That is a real, if narrow, divergence — and it is the first sign that the UK does not have one crypto rulebook, it has several that were written at different times for different purposes.

So when a firm says "digital assets", the useful reply is: which of these do you mean, and under which regime?

The risk, before anything else

This page is an explainer, not a recommendation, and the risk framing belongs at the top rather than in a footnote.

• A cryptocurrency is a claim on nobody. There is no issuer who owes you anything, no earnings, no coupon and no redemption right. The only source of a return is what the next buyer will pay. That mechanism runs in both directions with equal force, and there is no market close, no circuit breaker and no settlement window to interrupt it — the FCA describes the market as highly interconnected, global and operating 24/7.
• There is no FSCS protection here, and there is not going to be. In PS26/13 (30 June 2026) the FCA confirmed it does not plan to extend Financial Services Compensation Scheme cover to the new regulated cryptoasset activities. The Financial Ombudsman Service will be extended. Those are different things: the Ombudsman can direct a solvent firm to put something right; it cannot compensate you when the firm has failed.
• Wrappers around cryptoassets can fall much further than the cryptoassets themselves. A listed company whose principal asset is a pile of coins, or any structure that borrows to hold them, stacks three extra risks on top of the coin's own volatility: leverage, dilution when new shares are issued to buy more, and a market price that can trade well above the value of the underlying holdings and then stop doing so. When the coin falls, those effects compound rather than cushion — see digital asset treasury companies explained, and the risks in them are set out in the risks, with the arithmetic. Exchange traded notes carry the issuer's credit risk as well as the coin's price risk, and the UK wrapper rules for them changed on 6 April 2026 — see crypto in an ISA or SIPP. The FCA still bans the marketing of crypto derivatives such as CFDs and futures to UK retail clients.
• The harm is measured, not hypothetical. FCA consumer survey data (fieldwork August 2025, published July 2026) found 10% of UK cryptoasset consumers have lost money to fraud and a further 17% were targeted without loss. The most frequent approaches were social media scams (43%) and Ponzi schemes offering unrealistic returns (39%). Around 40% of buyers relied on friends, family or social media when deciding.
• Assets marketed as "stable" have gone to zero. Terra's UST was sold as a dollar stablecoin. The SEC put the collapse at roughly $37bn of value destroyed in about a week in May 2022. The mechanism is set out in full below.

None of that means cryptoassets are a fraud. It means the category contains instruments with no issuer, instruments with an issuer who might fail, and instruments with no backing at all, all sold under one word — and the protections most people assume exist do not.

Why is no token ever "FCA approved"?

This is the single most important idea on the page, and it explains most of the misleading claims you will meet.

The UK regulates activities, not tokens. The FCA's draft perimeter guidance puts it flatly: the regulatory perimeter is set by Parliament in legislation, and it determines which activities require authorisation. Whether an activity is regulated depends on what a person does in substance and the role they perform in the arrangements — contractual documents are evidence, but labels are not determinative.

The consequence is absolute. A firm can be authorised. A token cannot. There is no register of approved tokens, no FCA seal for a coin, and nothing in the 2026 framework that creates one. When a promoter says a token is "FCA approved", "FCA regulated" or "fully compliant", they are describing something that does not exist.

Regulation 40 of SI 2026/102 adds nine new regulated activities to the Regulated Activities Order (the FCA groups them as seven for perimeter-guidance purposes):

• Issuing qualifying stablecoin in the United Kingdom.
• Safeguarding qualifying cryptoassets and relevant specified investment cryptoassets, and arranging for another person to safeguard them.
• Operating a qualifying cryptoasset trading platform.
• Dealing in qualifying cryptoassets as principal, and dealing as agent.
• Arranging (bringing about) deals in qualifying cryptoassets, and making arrangements with a view to transactions in them.
• Qualifying cryptoasset staking.

Notice what is not on that list: owning cryptoassets, holding them yourself, and transferring your own cryptoassets are not regulated activities. The regime is aimed at the people who handle other people's money and coins.

So what does a token's status actually tell you? Only which of a firm's activities need a licence. Bitcoin being a "qualifying cryptoasset" makes running a UK trading platform in it a regulated activity from 25 October 2027. It says nothing whatsoever about whether bitcoin is safe, endorsed, backed or suitable.

One further trap: the UK has three cryptoasset perimeters and they are deliberately not identical. The Regulated Activities Order, the Financial Promotion Order and the Money Laundering Regulations each draw the line in a slightly different place. NFTs and closed-loop tokens sit inside the anti-money-laundering perimeter while falling outside the "qualifying cryptoasset" definition, and the Financial Promotion Order's version of the definition differs slightly on what counts as transferable. "In scope" is never a complete answer on its own — in scope of what?

Two official taxonomies that do not agree

The UK now has two official ways of sorting cryptoassets into categories. They were written for different purposes, at different times, by different bodies, and they do not map onto each other.

The FCA and statutory taxonomy (three buckets)

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102), made and published on 4 February 2026, inserts new categories into the Regulated Activities Order:

• Qualifying cryptoasset (article 88F). A section 417 cryptoasset that is also fungible, transferable, and not solely a record of value or contractual rights. Expressly excluded: anything already a specified investment; electronic money; currency of the UK or any other territory, including a central bank digital currency; anything that cannot be transferred or sold except by redeeming it with the issuer; and closed-loop tokens that only buy goods or services from the issuer or within a limited network of providers with direct commercial agreements with the issuer. The exclusion is about closed loops, not about the technology — a loyalty points scheme on a blockchain is still a loyalty points scheme.
• Qualifying stablecoin (article 88G). A subset: a qualifying cryptoasset that seeks or purports to maintain a stable value by reference to a single fiat currency and involves holding backing assets for that purpose. Because backing assets are part of the definition, coins that hold their value by algorithmic means with no backing assets are excluded by construction. It need not be issued in the UK, and multi-currency pegs were not included in the final Regulations.
• Specified investment cryptoasset. The modern replacement for "security token": a cryptoasset whose legal and economic substance means it falls within one of the specified investment categories in the Regulated Activities Order — shares, debt instruments, units, derivatives, deposits — rather than being characterised by its label or technology.

This replaced an earlier FCA taxonomy that many older articles still repeat. PS19/22 (July 2019) used security tokens, e-money tokens and unregulated tokens (comprising exchange and utility tokens). The FCA now says that "security token" has been given new terminology in the Cryptoassets Regulations, and calls them specified investment cryptoassets. If a page still uses the 2019 vocabulary as though it were current, that tells you when it was written.

HMRC's taxonomy (four descriptive categories)

HMRC's Cryptoassets Manual at CRYPTO10100 — last updated 28 November 2025, before SI 2026/102 was made and before the FCA's June 2026 rules — still lists exchange tokens, utility tokens, security tokens and stablecoins. There is no HMRC concept of a "qualifying cryptoasset" or a "specified investment cryptoasset" at all.

And here is the part that makes HMRC's list far less important than it looks: HMRC's governing principle is that the tax treatment of all types of tokens depends on the nature and use of the token, not the definition of the token. The FCA's categories are load-bearing — they determine which activities need authorisation. HMRC's are illustrative — on their own they determine nothing.

The practical upshot: one token can be an FCA qualifying cryptoasset and an HMRC exchange token simultaneously. Neither label carries over to the other system, and neither says anything about quality. HMRC also does not consider cryptoassets to be currency or money, which is why swapping one token for another is a taxable disposal rather than a currency conversion — the mechanics of that are in our guide to crypto capital gains tax in the UK for 2026/27.

How do cryptocurrencies actually work?

Start with the plainest category. HMRC calls them exchange tokens: intended to be used as a means of payment, with bitcoin the primary example. The FCA's older phrasing captures the defining feature better — they are not issued or backed by any central authority.

Where new units come from. Nobody sells them to you at issue. They are created as rewards for validating the ledger. The FCA recorded bitcoin's block reward at 3.125 BTC, equivalent to roughly £140,000 as at 29 June 2026 (the FCA's own conversion date). Under proof of work, the right to add a new entry goes to the first person to solve a randomly generated complex cryptographic puzzle. Under proof of stake, a participant locks tokens in the protocol for a set period, validators are selected by the size of that stake, and dishonest validation triggers "slashing" — part of the stake is destroyed.

What a staking yield is and is not. The FCA cites indicative annual rewards of roughly 1.5%–4% for Ethereum, 3%–6% for Solana and 2%–5% for Cardano (July 2026). These are protocol rewards paid in the same volatile token. A 4% yield on an asset that can halve is not a 4% return in any meaningful sense, the stake is typically locked for a period, and slashing can reduce it. Staking is also a taxable event in the UK before you have sold anything.

How it fails. There is no issuer, no cash flow and no redemption right, so there is no floor of the kind a bond's par value or a company's assets provide. Price is set entirely by the balance of buyers and sellers, and the same reflexive dynamic that drives prices up — rising price attracts attention, attention attracts buyers, buyers raise the price — runs identically in reverse. Any explanation of the upside flywheel that omits the reverse gear is incomplete.

The scaling constraint is structural, not temporary. The FCA records the bitcoin blockchain processing an average of 3–7 transactions per second, against 1,700–6,000 for the Visa and Mastercard networks, and attributes the gap to the distribution of consensus itself: transactions must be validated by multiple participants, which requires substantial storage and communication between validators. In other words, the decentralisation is the bottleneck. Layer-2 systems such as the Lightning Network are the industry's response; they relocate where trust and settlement sit rather than removing the underlying constraint.

What does "backed" actually mean for a stablecoin?

"Backed" is doing an enormous amount of work in stablecoin marketing, and it covers at least three completely different machines with three completely different failure modes.

1. Fiat-backed: the issuer holds reserves

You give the issuer dollars, it issues tokens, it holds reserves, and it redeems the tokens for dollars. The issuer keeps the interest earned on those reserves — that is the business model, not a side effect.

Take the figures from a real filing. Circle Internet Group (NYSE: CRCL) reported, in its Q2 2026 results released on 5 August 2026, USDC in circulation of $73.3bn as at 30 June 2026 (19% growth year on year), average circulation of $76.5bn, reserve income of $667.7m for the quarter, and total revenue and reserve income of $701.3m. Reserves are held substantially in the Circle Reserve Fund, an SEC-registered government money market fund managed by BlackRock. Dollars, because the source is a US filing — we do not convert silently.

Those are hard facts from the issuer's own disclosure, and so is this: Circle's risk factors acknowledge that stablecoins may face periods of uncertainty, loss of trust or systemic shocks resulting in rapid redemption requests, and that in extreme scenarios reserves could be insufficient to meet all redemption requests. That is the issuer describing a run, in its own words.

Attestation is not audit. Tether's Q2 2026 figures come from a BDO attestation as at 30 June 2026, published 31 July 2026: total assets $187.75bn, total liabilities $183.64bn, excess reserves $4.11bn, USDT in circulation approximately $183.62bn, and net operating profit of $1.5bn for the quarter. Note the excess reserve buffer roughly halved in a quarter, from $8.23bn at Q1 2026 to $4.11bn. Reported reserve composition — approximately $115bn of Treasury exposure, around $18.8bn of gold (about 146.2 tonnes) and 98,932 BTC — comes from secondary reporting of the same attestation rather than the document itself, so treat those line items as less firm than the headline balances. Tether engaged KPMG in March 2026 for its first comprehensive financial statement audit; that audit remained incomplete as at 26 August 2026.

The distinction matters and the sector's language obscures it. An attestation is a point-in-time snapshot of asserted balances on one date. A full financial statement audit tests internal controls and the financial reporting process across a period. They are not interchangeable, and "audited reserves" used loosely to mean the former is misleading. Composition matters too: gold and bitcoin held inside a reserve pool are volatile assets standing behind a claim that is supposed to be worth exactly one dollar at all times. The UK's own rules would not permit them as core backing assets.

2. Crypto-collateralised: overcollateralisation absorbs the fall

Users lock volatile cryptoassets into a vault at more than 100% of the value of the coins minted against them. The surplus is what absorbs price falls; if the collateral drops through a liquidation threshold, the position is auctioned. MakerDAO rebranded to Sky in August 2024 and launched USDS alongside DAI, upgradeable at a fixed 1:1 rate and sharing the same collateral pool. Combined supply was reported at roughly $13.4bn as at 11 April 2026 (USDS around $8.7bn, DAI around $4.66bn) — from secondary aggregator reporting, not a primary on-chain query or a governance document, so treat the figures as indicative.

The failure mode is different from a fiat-backed coin's. There is no reserve account to run on; the risk is a fast, correlated fall in collateral value where liquidation auctions clear into a thin market and the buffer is exhausted faster than positions can be unwound.

3. Algorithmic: no backing at all, and the worked failure

Terra's UST held its peg through a mint-and-burn arbitrage with a second token, LUNA: $1 of LUNA was always exchangeable for 1 UST and vice versa, regardless of market prices. In a rising market that looks like a self-correcting machine.

Here is the reverse gear. When large holders withdrew from the Anchor Protocol in early May 2022 and UST slipped below $1, holders redeeming UST forced the protocol to mint enormous quantities of LUNA. That hyperinflated LUNA's supply and collapsed its price — destroying the very asset that was supposed to be supporting UST. Reported prices went from roughly $87 for LUNA and about $1 for UST on 5 May 2022 to under $0.00005 and around $0.2 respectively by 13 May 2022 (price figures from secondary and academic sources).

The regulatory record is primary. A Manhattan jury found Terraform Labs and Do Kwon liable for civil fraud including misrepresenting UST's stability, and on 12–13 June 2024 they agreed to pay over $4.5bn: Terraform $3,586,875,883 in disgorgement, $466,952,423 in prejudgment interest and a $420,000,000 civil penalty; Kwon $110,000,000, $14,320,196 and $80,000,000 respectively. The SEC's release put the collapse at roughly $37bn of value wiped out. The FCA has now written this design out of "qualifying stablecoin" status entirely.

What the UK will require — from 25 October 2027

PS26/10 (30 June 2026) sets the rules for UK-issued qualifying stablecoins. None of it is in force yet.

• 1:1 backing on a statutory trust. Backing assets sit under CASS 16 safeguarding and outside the issuer's own estate, with reconciliation records covering the valuation and location of assets given the continuous minting and burning.
• Redemption at par by T+1. The issuer must place a payment order to an account in the holder's name by the end of the next business day. The final rules changed the trigger so the clock starts when the issuer receives the coin in its wallet, not on a redemption request — meaning anti-money-laundering checks happen before the clock starts.
• A composition rule calibrated to actual runs. Core backing assets are short-term deposits and short-term government debt. An on-demand deposit requirement fixes 5% of the pool in on-demand deposits. Issuers using expanded backing assets — longer-dated government debt, public-debt constant-NAV money market funds, repos — must also meet a core backing asset requirement equal to the higher of 5% of the pool or the highest daily redemption percentage over the past 180 redemption days. The two cannot be double-counted, and the combined requirement is recalculated every redemption day. A 5% excess in the pool is permitted. Read the mechanism honestly: this is a liquidity buffer sized to how badly that specific coin has actually been redeemed. It is run resistance, not a solvency guarantee.
• No interest to holders. UK issuers may not pass interest or yield arising from the backing pool to tokenholders, directly or through a third party. Where such a feature sits alongside a right of redemption, the FCA says the arrangement may constitute a collective investment scheme or an alternative investment fund. Third parties may still pay rewards from their own resources.
• Systemic coins get a stricter regime. HM Treasury designates a systemic stablecoin under the Banking Act 2009, where deficiencies or disruption would be likely to threaten the stability of, or confidence in, the UK financial system. The FCA's summary of the Bank of England's June 2026 rules describes a maximum of 70% UK sovereign debt with under six months to maturity, a minimum of 30% central bank deposits, capital requirements, a temporary per-coin issuance guardrail of £40bn, and redemption within T+0. The Bank's Code of Practice consultation closes on 22 September 2026. Bank of England pages could not be retrieved directly for this page, so those figures rest on the FCA's description of them in PS26/10.

Until October 2027, a stablecoin you can buy today is governed by whatever its issuer chose, in whatever jurisdiction it chose. And even afterwards: a stablecoin is a claim on a private company against a reserve pool. It is not a bank deposit, and no FSCS cover stands behind it.

Utility tokens, security tokens and the substance test

Utility tokens give the holder access to a product or service rather than rights of the kind attached to an investment. HMRC's version: they provide access to particular goods or services on a platform, issued by a business that commits to accepting them as payment.

Under the new perimeter, a utility token may benefit from the limited-network exclusion in article 88F(4)(d)(ii)(bb) — but only depending on the model. The FCA is explicit that some tokens combine characteristics, with some utility and some economic return, and that characterisation depends on substance rather than the labels used to describe it.

Worth saying plainly, because the sector will not: calling something a "utility token" has been the standard route promoters use to argue their way out of securities regulation. The FCA's answer is that hybrids are assessed on substance. A description in a whitepaper is a marketing choice, not a legal conclusion. And the token's own failure mode is easy to miss — its value depends on demand for the issuer's service, but unlike a share it typically carries no dividend, no vote and no residual claim on the company's assets. If the service is not used, the token is a claim on nothing.

Security tokens / specified investment cryptoassets are the opposite case: they provide rights or interests in a business, such as ownership, repayment of a specific sum of money, or entitlement to a share in future profits. The statutory test is substance against the specified investment categories — shares, debt instruments, units, derivatives, deposits. Article 89 of the Regulated Activities Order means a right to or interest in a specified investment is itself a specified investment, so a tokenised debt security is caught whether the underlying bond exists off-chain or is issued natively on a blockchain.

Liquid staking tokens and wrapped tokens occupy an awkward middle. They could be described as recording rights in another cryptoasset, which would suggest the "mere record" exclusion applies. The FCA's draft view is that they are unlikely to be excluded, because they tend to be widely traded and often function as a liquid investment in their own right. The functional test it applies is useful in general: is the thing used and traded as an object of exchange in markets; do participants rely on it as the authoritative basis for taking commercial risk; and is transferring control of it, in practice, the mechanism by which value moves? A cryptoasset with no observable price or pricing mechanism, and no expectation among holders that it can be used to generate value, looks much more like a record.

NFTs and the fungibility test

NFTs are not excluded from the new perimeter by name. Whether one is a qualifying cryptoasset turns on fungibility as a question of fact, not on how the thing is labelled or marketed — the FCA says so directly in the draft guidance.

The test it sets out: a cryptoasset whose units are ordinarily treated by market participants as equivalent, freely replaceable and interchangeable will ordinarily be fungible. Units treated as unique because they carry unit-specific attributes market participants treat as relevant — collectible or unique artistic characteristics, for example — are less likely to be fungible. The practical consequence is that a mass-minted series whose items trade interchangeably could be caught, while a genuinely unique artwork token would not, regardless of what either is called.

Two further points a beginner needs:

• Out of one perimeter does not mean out of all of them. The Money Laundering Regulations definition is expected to capture NFTs and limited-network tokens even though they sit outside the "qualifying cryptoasset" definition.
• The token and the thing are not the same. An NFT is a ledger entry pointing at something. Whether it carries copyright, a licence, or nothing at all depends entirely on the terms of that specific mint. Very often the answer is nothing at all, and the image itself lives on a server someone else pays for.

The failure mechanism is the starkest in this whole category: an NFT's price rests entirely on collector demand for one specific item, in a market with no market maker and nobody under any obligation to bid. Secondary sources report monthly NFT sales falling from over $1bn at the 2021–22 peak to roughly $300m a month in early 2026, and that the large majority of collections show no meaningful trading activity. Treat the direction of travel as well established and the specific figures as indicative only: none come from a regulator or an audited source, methodologies differ — particularly on excluding wash trading — and the FCA's July 2026 market description does not attempt to size the NFT market at all. For the tax treatment, see our NFT tax guide.

Tokenised assets, CBDCs and tokenised deposits

Tokenised real-world assets

Here the token is a wrapper, and the only question that matters is what the wrapper carries. The FCA notes that specified investment cryptoassets may be non-digitally native — backed by or representing traditional finance specified investments — or digitally native, and gives a tokenised debt security as its example.

The mechanism warning follows directly: tokenising a bond does not remove the issuer's credit risk. It adds a second question on top of it — does the token confer enforceable legal rights against the underlying, or is it a database entry pointing at an asset that somebody else is holding? Answer that before anything else about the technology.

Scale, dated: the FCA estimated roughly $36bn of real-world assets issued on publicly available distributed ledgers globally as at May 2026, including tokens representing portfolios of home equity loans, gold and US government debt. That is around 1.3% of the roughly $2.7trn cryptoasset market and a rounding error against traditional securities markets. The category is real and growing, and currently very small relative to the promotional attention it attracts.

UK fund tokenisation already has its own live framework. FCA PS26/7 was published with rules in force on 30 April 2026, covering how authorised fund managers can use distributed ledger technology inside the existing framework and introducing an optional Direct to Fund dealing model available to traditional and tokenised structures alike. The significance for a reader: tokenised authorised funds are regulated as funds, under the existing regime — not under the new cryptoasset regime. Again, the wrapper does not determine the rulebook.

Central bank digital currencies

A UK CBDC does not exist, and no decision to build one has been taken. Two separate facts are worth keeping straight. On the perimeter, article 88F expressly excludes currency of the UK or any other territory, including a central bank digital currency, from being a qualifying cryptoasset — sovereign money is not a cryptoasset. On status, the Bank of England and HM Treasury remain in a multi-year design phase ending in 2026, supported by the Digital Pound Lab, with the blueprint, assessment and decision on next steps expected later in 2026 and a decision on whether to proceed to a build phase expected in late 2026. A launch would require further consultation, primary legislation and Parliamentary approval. Bank of England pages could not be retrieved directly for this page, so the status detail comes from secondary summaries of its March 2026 progress update.

Tokenised deposits

A fourth kind of digital money, and the one most often left out of the picture. A tokenised deposit is a commercial bank deposit represented on a ledger: it remains a bank deposit, keeping the bank's prudential regulation and, for eligible deposits, FSCS protection. Bank of England commentary has warned that privately issued stablecoins could threaten financial stability by diverting deposits out of the banking system, and a Monetary Policy Committee member has publicly argued tokenised deposits will supplant stablecoins. The underlying concern is the "singleness" of money — that £1 is £1 regardless of which institution issued it. This paragraph rests on secondary reporting of Bank speeches; the primary texts were not verifiable for this page.

The UK regime: what is in force, what is not

A great deal of coverage describes the UK's cryptoasset regime in the present tense. Most of it does not apply yet. Here is the state of play as at 26 August 2026.

Read the table as one sentence: for the next fourteen months, what most people call "UK crypto regulation" is anti-money-laundering registration plus rules about how firms are allowed to advertise. Conduct protection, custody rules and Ombudsman access arrive on 25 October 2027 — and even then, without FSCS.

How a transfer settles, and who controls your coins

Distributed ledger technology, in HMRC's description, is a digital system that records details of transactions in multiple places at the same time, without a single data store or central administration, maintaining an unchangeable record. The keys work as follows: the private key is a randomly generated string used to authorise a transaction involving tokens held at a public address; the public key is mathematically generated from the private key; and the private key cannot realistically be derived from the public key.

So a transfer settles like this. You sign an instruction with your private key. It is broadcast. Validators reach consensus under the protocol's rules. The entry becomes part of an effectively immutable ledger.

The consumer consequence is the part that gets skipped: a settled on-chain transfer has no chargeback, no recall and no central administrator to appeal to. The protections you rely on elsewhere — a bank recalling a payment, a card scheme chargeback, a section 75 claim — have no equivalent here. Send to the wrong address and the money is gone.

Wallets store keys, not coins. HMRC describes a cryptoasset wallet as a user interface where the private key is stored. Cold storage means offline: hardware wallets holding key details on a device such as a USB drive, or paper wallets where key information is printed or written down. Hot storage means internet-connected: custodial online wallets offered by exchanges, where the platform holds and controls both keys, and non-custodial wallets managed locally on your own computer or phone. A wallet is a keyring, not a purse. The coins never leave the ledger.

"Not your keys, not your coins" is literally a control test

In PS26/11 (30 June 2026), the FCA's draft CASS 17 application table turns on exactly one question: who can move the asset.

• You hold the cryptoasset and the private key. You have control, and no firm has any means that would enable it to bring about a transfer of the benefit of the cryptoasset. CASS 17 does not apply — because no firm is involved.
• A firm safeguards the cryptoasset and private key for you. The firm has control. CASS 17 applies.
• Multi-party computation splits private keys across multiple computer systems so that no single party can unilaterally transfer the asset; key-shard disaster recovery models work similarly.

In plain English: if a third party can move your coins without you, what you hold is a contractual claim on that party, not the asset. If they fail, you are a creditor in their insolvency. If you hold the key, you hold the asset — and nobody on earth can help you if you lose it.

CASS 17, when it starts, will require client cryptoassets to be segregated under a non-statutory trust — deliberately weaker than the statutory trust protecting stablecoin backing assets under CASS 16. The final rules require assets to be separately identifiable from any other assets (wording chosen to allow omnibus wallets), record-keeping and reconciliation, private key management and security controls, rules for appointing third-party custodians, and a duty to top up shortfalls from the firm's own resources or notify the FCA if not topped up by the next reconciliation. The settlement float limit was set at 2%. The FCA took a technology-agnostic approach to key management and is not applying CASS 17 to the custody of relevant specified investment cryptoassets at this stage. None of it applies before 25 October 2027.

What UK holders actually do

The FCA's July 2026 market description (survey fieldwork August 2025) gives the empirical shape of the trade-off:

• 72% of UK consumers store their cryptoassets on the trading platform they bought them from — that is, they take exchange counterparty risk by default. Custody fees range from 0.05% to 1% of net asset value.
• 9% of UK cryptoasset holders have forgotten a private key and lost access to their wallet. The FCA notes that if an owner forgets or loses their keys or password, the assets become irrecoverable.

That is roughly one in eleven UK cryptoasset holders — and since at most about 28% self-custody at all, closer to one in three of those who do hold their own keys. There is no option in this category without a failure mode; there is only a choice about which one you are exposed to.

What protection exists, and what does not

From 25 October 2027, most of the FCA Handbook will apply to authorised cryptoasset firms: the Consumer Duty (disapplied to trading between participants of a trading platform), Conduct of Business rules, complaints handling and access to the Financial Ombudsman Service, SYSC, the Senior Managers and Certification Regime, ESG rules and operational resilience requirements.

But the FCA has confirmed it does not plan to extend FSCS cover to the new regulated cryptoasset activities. Of the 21 respondents to the consultation, 86% supported that position; respondents also warned that consumers could be confused by extending the Ombudsman's compulsory jurisdiction without FSCS cover and overestimate the protection they have. The FCA's mitigation is standardised risk-warning wording. State it plainly: from October 2027 a UK crypto firm can be FCA-authorised while your coins carry no compensation-scheme backstop if that firm fails. A bank deposit is FSCS-protected. A stablecoin held with an authorised issuer is not.

Lost keys, and what HMRC does about them

The tax system says the same thing as the custody rule, in its own language. HMRC's position at CRYPTO22400 is that misplacing a private key does not count as a disposal for Capital Gains Tax purposes — the key and the tokens continue to exist on the distributed ledger even though the owner cannot reach them. Where there is realistically no prospect of recovering the key, you may make a negligible value claim; if HMRC accepts it, you are treated as having disposed of and immediately reacquired the inaccessible tokens, which crystallises the loss. The ledger does not care that you cannot reach your asset, and neither does the definition of a disposal.

One related point that catches people out: for tax purposes, exchange tokens are located where their beneficial owner is resident. Moving coins to an offshore exchange or a foreign wallet does not make them non-UK situs — the location follows the person, not the server. If you need to work through the numbers on a disposal, our crypto tax calculator covers the pooling mechanics.

How big is the market, really?

Every figure below carries a date and a source, because in this sector an undated number is worthless. Where a figure is an estimate, or comes from a commercial aggregator rather than a regulator, it says so.

• Global cryptoasset market: around $2.7trn as at June 2026 — the FCA's own figure, in its July 2026 market description, with most of it made up of bitcoin, then ethereum, then components including stablecoins.
• Live aggregator figures disagree with each other. Third-party readings retrieved for August 2026 ranged from roughly $2.18trn to $2.64trn, with bitcoin dominance quoted between 57.25% and 59.5% at different dates in the month. The spread reflects different inclusion methodologies — which tokens count, how locked or burned supply is treated — as well as genuine price movement. Treat any single live "total crypto market cap" number as illustrative, not factual.
• Global stablecoins: approximately $316bn as at 30 June 2026 (FCA), with Tether and USDC together representing 82% of it, both referencing the US dollar. Two implications: the market is overwhelmingly dollar-denominated, and it is extremely concentrated in two issuers.
• Stablecoins are mostly a trading chip, not a payment instrument. The FCA notes they are currently used primarily for trading within the cryptoasset sector — a way to move into something less volatile without off-ramping into fiat. Annual stablecoin payment volume was estimated at $390bn in 2025 (the FCA describes it as an estimate), against limited merchant acceptance, while Circle alone reported $14.8trn of on-chain USDC transaction volume in Q2 2026. The gap between those two numbers is the answer to how much on-chain activity is commerce.
• Tokenised real-world assets: an estimated $36bn globally as at May 2026 (FCA estimate).
• UK ownership: 8% of UK adults, about 4.5 million people, as at August 2025 (FCA), more than double the 2020 level. The average estimated portfolio is £2,250, but the distribution is skewed: most people own less than £1,000, while around 16% hold more than £5,000. Average holdings have risen more slowly than prices, which the FCA reads as consumers selling a portion as prices rise. Owners skew male (68%), young (58% under 34, 92% under 54) and risk-tolerant (63% say they are willing to take risks when investing, against 24% of the wider UK population).
• A contested figure to avoid. A widely circulated claim that 12% of UK adults own crypto conflicts with the FCA's own 8%. It appears to come from an earlier survey wave, a different base such as "ever owned" rather than "currently own", or non-FCA data. Use 8% and 4.5 million, with the August 2025 date attached.
• Costs, dated. The FCA calculated that buying £2,250 of cryptoassets cost £7 on average through a direct intermediary and £16 through an indirect one (July 2026), with custody separately costing 0.05%–1%.
• Ancillary services. As at August 2025, 22% of UK cryptoasset consumers had engaged with staking, 9% with lending and 2% with borrowing — though an earlier passage in the same FCA document cites 7% for lending or borrowing combined, so treat the split with caution. Platforms have advertised up to 20% APY to lenders, funded by deploying lender funds at a higher rate and capturing the net interest margin. That is the same maturity and credit transformation a bank performs, without the bank's capital rules, deposit insurance or lender of last resort. Both staking and lending become regulated activities from 25 October 2027.
• Illicit flows: three numbers that measure three different things. The National Crime Agency estimates UK cryptoasset money laundering of between $1.4bn and $5.1bn in 2025. Chainalysis, a commercial vendor rather than an official statistician, indicates $154bn of funds sent to illicit addresses globally in 2025, the majority sanctions-evasion related. The FATF estimated approximately $51m of illicit on-chain activity linked to fraud and scams in 2024. They are not comparable and must never be quoted as though they were.

Questions to ask before you put money in

Not a recommendation to buy anything, and not a substitute for regulated advice. This is a set of questions the material above should let you answer.

1. Which thing is this, in the statutory sense? A qualifying cryptoasset, a qualifying stablecoin, a specified investment cryptoasset, or outside the perimeter altogether? The answer changes which rulebook applies to the firm — it says nothing about whether the token is any good.
2. Is the firm authorised, registered, or neither — and for what? Registration under the Money Laundering Regulations is AML supervision only. Full FSMA authorisation for cryptoasset activities cannot yet be true of anyone. Check the FCA's own registers rather than the firm's claim about itself.
3. Has anyone told you the token is FCA approved or regulated? That is not a thing that exists in UK law. Treat it as a reason to stop, not a reassurance.
4. Who can move your coins? If the firm can move them without you, you hold a claim on the firm, not the asset. Ask what happens in an insolvency, and remember there is no FSCS cover for this.
5. If it is a stablecoin: backed by what, held where, evidenced how, and as at what date? Attestation or full audit? Is redemption at par a legal right or an operational promise, and can the issuer suspend it? Are volatile assets sitting inside the reserve?
6. If there is a yield, where does the money come from? Rewards paid in the same token are dilution. Interest funded by lending your coins out makes you an unsecured lender to whoever borrowed them. UK-issued stablecoins will be banned from paying interest from the backing pool at all — which tells you what the regulator thinks of the alternative.
7. What is the failure mode, and who has already lived it? Every design here has one — a run, a liquidation cascade, a death spiral, a lost key, a failed platform. If you cannot describe how this loses money, you do not understand it well enough yet.
8. Are you being hurried? Social media approaches (43%) and Ponzi structures offering unrealistic returns (39%) are the most frequently reported UK crypto scams. Urgency is the common ingredient.
9. What are the tax consequences, transaction by transaction? Crypto-to-crypto swaps are disposals, HMRC does not treat cryptoassets as money, and it does not treat buying and selling them as gambling — whether something is betting or gambling is a question of fact assessed case by case, not a blanket exemption. If you trade actively, whether HMRC would see you as an investor or as trading changes everything: see crypto trader vs investor. Since 1 January 2026 exchanges have had to collect your name, address, countries of tax residence and tax identification number under the Cryptoasset Reporting Framework, so the old assumption that holdings are invisible to HMRC no longer holds.
10. Could you lose all of it and be fine? For an asset with no issuer, no earnings and no redemption right, that is the only position-sizing question that means anything.

Sources and methodology

Everything above was checked against primary UK sources on 26 August 2026. The distinction between kinds of claim is deliberate, and worth carrying into anything else you read on this subject.

• Law. FSMA 2000 s.417; SI 2026/102 (commencement at regulation 1, new activities at regulation 40); SI 2026/248 on ISA eligibility.
• Regulator rules, final. FCA PS26/9 to PS26/13 (30 June 2026) — including PS26/10 on stablecoin issuance, PS26/11 on regulated activities and custody, and PS26/13 on Handbook application and the FSCS decision — plus PS26/7 on fund tokenisation.
• Regulator guidance, still draft. CP26/13 and the draft PERG 19 chapter. The FCA states that PERG is guidance, represents its views and does not bind the courts, and that the chapter cannot be exhaustive. Where this page quotes definitions from it, they are the regulator's stated view on draft guidance; the statutory text governs.
• Market and consumer data. FCA Description of the UK Cryptoasset Market (July 2026) and Cryptoassets Consumer Research 2025 (fieldwork 5 August – 2 September 2025, 3,406 interviews, published 16 December 2025).
• Tax. HMRC Cryptoassets Manual, principally CRYPTO10100, CRYPTO10200, CRYPTO10300, CRYPTO10350, CRYPTO10375, CRYPTO10410, CRYPTO10450, CRYPTO22100, CRYPTO22400 and CRYPTO22600. Those pages were last updated on 28 November 2025 and have not been rewritten for the 2026 framework.
• Company figures. Circle Internet Group Q2 2026 results (5 August 2026) and Tether's BDO attestation as at 30 June 2026 (published 31 July 2026). Circle's detailed reserve composition table sits in its Form 10-Q, which could not be retrieved for this page. Tether's individual reserve line items come from secondary reporting of the attestation. The SEC's 2024 release on Terraform and Kwon is primary; the May 2022 price path is secondary.
• Known gaps, stated openly. Bank of England pages returned errors on direct retrieval, so the £40bn issuance guardrail, the 70%/30% backing split and T+0 redemption rest on the FCA's description of the Bank's rules in PS26/10, and the digital pound status detail is secondary. We could not confirm that HM Treasury's draft amending SI has been made. NFT market sizing has no regulator source at all. Sky/USDS supply figures are aggregator data.

Prices, market capitalisations and holdings in this sector move weekly. Every figure here is dated for that reason; if you are reading it long after 26 August 2026, check the underlying source rather than the number. Our methodology page sets out how we verify and correct.

This page is educational. It is not financial advice, not a recommendation to buy, hold or sell any cryptoasset, and not an endorsement of any company or token named in it. Companies are named only where a dated public filing illustrates a mechanism. We take no affiliate revenue and carry no sponsored content.

Related crypto guides

• NFT tax in the UK: buying, selling and royalties
• Crypto staking tax: income vs CGT classification
• DeFi tax: yield farming, lending and LP tokens
• HMRC crypto nudge letters and how to respond
• The crypto investor money guide
• When HMRC reclassifies crypto activity as trading
• Investment scam checklist
• Complete UK Capital Gains Tax guide