UK FCA clarifies rules for tokenized securities

The UK Financial Conduct Authority has finalized guidance explaining when tokenized securities—including certain tokenized debt securities and shares—fall within regulated cryptoasset activities. The guidance translates the statutory framework created by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 into practical perimeter guidance for firms.

The FCA published PS26/18: Cryptoasset perimeter guidance on September 16, 2026. It is guidance interpreting legislation, not a standalone rule that replaces the regulations. Most new requirements under the statutory regime are scheduled to take effect on October 25, 2027, while transitional applications can begin from September 30, 2026, according to the FCA and the legislation.

For issuers, custodians and digital-asset infrastructure providers, the practical question is no longer simply whether an instrument is recorded on a blockchain. It is whether the token’s legal and economic characteristics place it inside the regulated perimeter—and whether the firm’s activities require authorization.

What the FCA’s tokenized securities guidance clarifies

The FCA says that tokenized debt securities can constitute specified investment cryptoassets, depending on how the relevant instrument is structured. The guidance also explains when activities connected with those assets, including custody and related services, require authorization under the forthcoming regime. These conclusions are set out in PS26/18.

That distinction matters because “tokenized” describes a method of recording or transferring an asset; it does not, by itself, determine the asset’s regulatory classification. A token representing a financial instrument may therefore create obligations that differ from those applying to a token with no corresponding investment right.

The FCA’s document should be read alongside the binding statutory instrument. The 2026 Regulations establish the legal framework for new regulated cryptoasset activities and provide for full commencement on October 25, 2027. The guidance helps firms interpret the boundary, but the underlying legal obligations come from legislation and other applicable rules.

Why the perimeter matters for real-world asset tokenization

The clarification is significant for real-world asset tokenization because a project may involve several regulated or potentially regulated functions at once. An issuer may create a token linked to a debt instrument. A platform may arrange transactions or provide access. A service provider may safeguard private keys or control transfer permissions. Each function requires separate perimeter analysis.

For issuers, the immediate task is to document what the token legally represents, what rights holders receive, how ownership or entitlement is evidenced, and which parties perform distribution, transfer and custody functions. Product documentation should not rely on technical terminology alone. It should explain the underlying instrument and the operational role of every intermediary.

For investors, the guidance improves visibility into the questions that should be asked before participating in a tokenized offering: What is the underlying asset? Who is legally responsible for custody? Can the token be transferred, and under what restrictions? Which entity is authorized for the relevant activity? The FCA guidance does not amount to approval of any individual token, issuer or platform, and it does not remove investment or counterparty risk.

Infrastructure teams should map their architecture to regulated activities rather than treating compliance as an overlay added after launch. That means identifying who controls wallets, who can initiate transfers, how eligibility checks operate, and how records reconcile with the legal ownership register or contractual entitlement.

Operational priorities before the 2027 commencement date

Firms preparing for the regime can use the transition period to build an evidence trail. A useful first step is a product-and-activity inventory covering each token, underlying asset, customer group and service provided. The inventory should distinguish issuance from arranging, dealing, custody and technology provision.

The next step is a legal and technical control map. It should connect each regulatory conclusion to the token’s terms, smart-contract permissions, wallet model, transfer restrictions and recordkeeping process. Where a token represents debt or shares, teams should ensure that the on-chain record and the legally operative documentation cannot diverge without detection.

Authorization planning also needs to account for dependencies. A firm that relies on a third-party custodian, transfer agent or compliance provider should establish which entity performs the regulated function and how oversight will work. Transitional applications may be submitted from September 30, 2026, but firms should confirm their position against the applicable legislation and FCA materials rather than assume that an application is required—or sufficient—without further analysis.

This is where a structured tokenization platform workflow can be useful. In Fundshing’s context, the potential value is not a claim of regulatory approval; it is the ability to organize asset data, permissions, documentation and operational handoffs in a way that supports review by legal and compliance teams.

What this means for digital asset infrastructure

The FCA’s guidance reinforces a broader design principle for digital asset infrastructure: compliance requirements should be reflected in the asset lifecycle. Onboarding, suitability or eligibility checks, issuance, custody, transfers, corporate actions and reporting should be designed as connected workflows.

That approach is particularly relevant to RWA tokenization, where the token is only one component of a wider structure. Teams must coordinate legal agreements, investor records, valuation processes, servicing arrangements and blockchain operations. A technically efficient transfer is not necessarily an appropriate transfer if the recipient is ineligible or the transaction bypasses required controls.

The perimeter guidance may also increase the importance of clear accountability between technology vendors and regulated firms. Software can support controls, but it does not determine which legal entity bears responsibility. Firms should define approval rights, escalation paths, access management and audit evidence before production deployment.

Fundshing analysis: the practical effect of the FCA’s publication is likely to be less about changing the concept of tokenization and more about forcing sharper separation between asset design and service design. Two projects can use similar blockchain technology while falling into different regulatory positions because their rights, counterparties and operating models differ.

Practical takeaway for tokenized securities firms

Issuers and infrastructure providers should treat September 2026 onward as a preparation window: classify each token and activity, document the legal basis, test custody and transfer controls, and align any transition or authorization strategy with the FCA guidance and 2026 Regulations. This article is informational, not legal advice.

The key reader question is: Does your tokenization workflow identify the regulated activity at each stage, or only describe the technology?

Explore the Fundshing Tokenization Engine to discuss which workflow may fit your asset and operating model.

Sources

• PS26/18: Cryptoasset perimeter guidance - Financial Conduct Authority
• The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 - UK Government Legislation