FCA to consult on safeguarding rules for tokenised investments

The Financial Conduct Authority's chief executive has committed the regulator to consulting on safeguarding rules for tokenised investment assets, framing the move as necessary to stop tokenisation from creating doubt about who owns what. Nikhil Rathi made the commitment in the FCA's published draft of a speech delivered to a TheCityUK dinner on 22 September 2026; the FCA published the draft the following day and said the version delivered on the night might differ. The regulator has already set a timetable: a joint roadmap with the Bank of England, due later in 2026, that will set target dates for wholesale tokenisation work more broadly, to be followed by a safeguarding consultation planned for the first half of 2027.

This matters to UK banks, custodians, exchanges, asset managers and infrastructure providers because the current rulebook was not built for assets that live on a distributed ledger. When the new safeguarding regime commences on 25 October 2027, firms seeking permission to safeguard relevant specified investment cryptoassets will initially be assessed against applicable CASS 6 requirements for traditional safe-custody assets, rules that the FCA itself says do not fully fit the technology. The safeguarding consultation and the forthcoming roadmap are meant to close that gap before tokenised markets move from pilot activity into permanent infrastructure.

Neither the consultation paper nor the roadmap had been published as of 24 September 2026. What follows is an account of the interim position, the practical questions the authorities have flagged, and the pieces of live market infrastructure that will test the answers before the rules are written.

What is actually in scope

The speech refers broadly to "relevant tokenised investment assets", but the formal category that will matter for custody rules is narrower: a relevant specified investment cryptoasset. This is a specified investment cryptoasset that is a security or a contractually based investment, and its classification depends on legal and economic substance rather than on the token's label or the ledger it sits on.

This is not a change to rules for cryptocurrencies traded as speculative assets, and it does not extend blanket cryptoasset custody protections to every token. It may cover tokenised shares, bonds, fund units and similar contractually based investments that meet that definition, though the FCA has not said which structures fall outside the category.

The interim rulebook

The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 create new regulated activities for safeguarding cryptoassets, including relevant specified investment cryptoassets, under article 9N of the Regulated Activities Order. That regime commences on 25 October 2027, after which safeguarding a relevant specified investment cryptoasset, or arranging for it to be safeguarded, will require FCA authorisation or an applicable exemption.

The FCA finalised a new cryptoasset safeguarding sourcebook, CASS 17, as part of its policy package published on 30 June 2026, but decided not to apply it to relevant specified investment cryptoassets at the outset. Firms seeking permission to custody these assets will instead be assessed against CASS 6, the FCA's existing rules for traditional safe-custody assets, for the time being.

The FCA has said plainly that CASS 6 does not fully address features specific to tokenised assets, including control exercised through private keys. Feedback also raised harder questions: whether digitally native and tokenised conventional securities should be treated alike, how mixed custody models and complex custody chains should be handled, how trust structures fit tokenised holdings, and how fungibility survives when the same security exists in more than one form. The FCA has not said whether its lasting framework will amend CASS 6, adapt CASS 17, or introduce a bespoke sourcebook; that is the question the first-half 2027 consultation is expected to answer.

Who owns it, and who answers for it

The FCA and Bank of England's joint Call for Input, published on 18 May 2026, sets out a working principle rather than a finished rule: a legally accountable person must maintain a clear record of ownership and ensure settlement is final, regardless of whether a blockchain or smart contract performs parts of the workflow underneath. Securities within the UK Central Securities Depositories Regulation perimeter should settle through a central securities depository, or, where settlement happens on-chain, through a digital securities depository. Using a blockchain does not remove a regulated firm's responsibility for registry, settlement, safekeeping or administration; those functions still need an identifiable, accountable entity behind them.

What is not yet settled is how that principle translates into practice. The Call for Input flagged, without resolving, how a custodian proves and segregates client ownership across omnibus wallets and sub-custody chains, and what happens to a client's tokens and private-key access if a custodian, depository or technology provider fails. An investor's ability to get assets back promptly and in full after a custodian's insolvency would depend on exactly those arrangements, so tokenised custody carries the same kind of counterparty and operational risk as any other, pending clearer rules.

The Property (Digital Assets etc) Act 2025, which received Royal Assent on 2 December 2025, gives some legal footing to this work by confirming, for England and Wales, that something is not barred from being personal property simply because it falls outside the traditional categories of things in possession or things in action. But the Act leaves courts to develop that category's boundaries and does not resolve which ledger entry prevails in a dispute, how competing claims rank, or how insolvency would treat any given tokenised security.

Settlement finality and the cash leg

A second practical question is when a tokenised trade becomes final and irreversible. The joint Call for Input says finality on regulated settlement platforms should have a point that is deterministic, auditable and legally enforceable; for some digital securities depositories and non-systemic activity, the responsible person may instead define finality contractually. This is not a uniform standard, and how the securities leg and cash leg connect when they sit on different ledgers is a question the Call for Input raised without answering. The Bank of England is separately targeting 2028 for a live synchronisation service linking transactions on external asset ledgers to sterling settlement in central-bank money through its Real-Time Gross Settlement service, with further design detail expected in early 2027.

Interoperability and the risk of fragmentation

The authorities' stated ambition is for tokenised and conventional market infrastructure to coexist and interoperate, rather than tokenisation creating a parallel, disconnected system. The Call for Input warns that a lack of technological, legal or economic compatibility can fragment liquidity: between different ledgers, between tokenised and non-tokenised versions of the same asset, and across borders. Of the 123 responses the FCA and Bank of England received to the Call for Input, reported in Feedback Statement FS26/1 on 14 September 2026, the FCA said most respondents saw post-trade activity, particularly the movement of collateral, as the main opportunity from tokenisation, though FS26/1 gave no numerical breakdown.

From sandbox to live market

The clearest sign this is no longer theoretical is the Digital Securities Sandbox, a joint FCA and Bank of England scheme that lets firms move through gated stages toward live issuance, trading and settlement of digital securities under temporarily modified rules and initial limits. Passing Gate 2 gives a firm permission to conduct real, live business rather than simulated testing.

As of 24 September 2026, the Bank of England's dashboard listed two firms at Gate 2: HSBC Bank plc, approved on 13 July 2026, and ClearToken CSD Limited, approved on 18 September 2026. Read this against an earlier Bank of England statement from May 2026 describing 16 firms as working on live issuance and settlement through the sandbox: that figure referred to the broader cohort engaging with the sandbox, not to firms that had reached the gate required to go live.

The DIGIT test

HM Treasury's Digital Gilt Instrument pilot is the most concrete test case for these questions. HM Treasury expects the first transaction on HSBC's Orion platform by the first quarter of 2027, and HSBC and London Stock Exchange Group have agreed a proposed bilateral link under which LSEG's platform would act as an investor digital securities depository alongside HSBC Orion as issuer depository, letting investors access and hold the instrument through either infrastructure. If it works as described, this would test interoperability, settlement and asset servicing across two platforms holding the same security, though it would not on its own prove that interoperability has been solved market-wide. The link remains proposed under a memorandum of understanding, and the sources reviewed do not establish that it is already operational.

Who is watching, and how the pieces fit together

The FCA is expected to lead the safeguarding consultation, while the Bank of England holds direct responsibility for the sandbox and the synchronisation work. The roadmap due later in 2026 may clarify how FCA conduct supervision, Bank of England market-infrastructure oversight and Prudential Regulation Authority prudential supervision divide responsibility, though the exact allocation was not available in the sources reviewed. The authorities have described a medium-term horizon of five to ten years for some capital-market segments, with conventional and tokenised structures potentially coexisting indefinitely.

Key dates

None of this amounts to a finished framework, and the sources reviewed do not establish what protection, if any, schemes such as the Financial Services Compensation Scheme or the Financial Ombudsman Service would offer for a given tokenised product or custody arrangement.

What to watch next

The joint roadmap, due later in 2026, should give firms target dates to plan against and may clarify how oversight is divided between the FCA, the Bank of England and the PRA. The FCA's safeguarding consultation, expected in the first half of 2027, will show whether the regulator intends to adapt CASS 6, extend CASS 17, or write new rules specific to tokenised investments. HM Treasury's first-quarter 2027 target for the first Digital Gilt Instrument transaction, and the Bank of England's 2028 target for its synchronisation service, are the two live milestones most likely to show whether the practical questions raised here have workable answers. Readers wanting the primary detail should follow publications directly from the FCA and the Bank of England rather than commercial summaries.