The FCA's Self-Custody Guidance Has One Real Target: Third-Party Risk Scores

I keep a folder of regulator PDFs. Most of them put me to sleep by page four. This one didn't.

The FCA published a nonbinding consultation on crypto guidance, and the headline everyone will grab is that unhosted-wallet due diligence now shows up as good practice. Read it twice and the wallet stuff is the appetizer. The main course is a regulator openly questioning black-box risk scores and rigid tracing demands.

That's a bigger deal than it sounds. The chart is the chart, and the structure of this paper tells you the UK is quietly backing away from the most aggressive form of surveillance-by-checklist.

What's Actually in the Paper

Start with the word nonbinding. No new rulebook. No statutory instrument. No fresh enforcement hook. The FCA is essentially saying, here's how we'd look at your business if we came knocking. That's it.

Except that's not how compliance works, and everyone in the room knows it. Firms treat guidance as law because the alternative is arguing with a supervisor after the fact. So a soft paper produces hard behavior.

Here's the mechanics. Unhosted-wallet due diligence means an exchange or broker wants to know who's on the other side of a transfer to a self-custody address. In practice that can mean proof of ownership, a signed message from the wallet, source-of-funds questions, or a screenshot of your hardware wallet balance. Not a ban. Not a register. Just friction.

And friction has a price. The UK has roughly fifty registered cryptoasset firms at last count, fewer than sixty by any measure. Each one now has to decide how much identity checking to layer onto transfers that go to addresses nobody controls but the customer. Every extra step costs money and pushes users toward platforms that ask fewer questions. That's not theory. That's how the last four years played out.

The more interesting part is the pushback on third-party scores. The paper questions risk ratings that arrive as a number with no explanation attached. Vendor flags an address, exchange freezes the account, customer has no appeal and no reasoning. The FCA is saying that isn't good enough. You need to know why the number is what it's.

Then there's tracing. Regulators have spent years writing rules that assume every hop is visible and every counterparty is identifiable. That assumption breaks the moment a transfer touches self-custody, Lightning, or any privacy-preserving tool. The consultation acknowledges the gap. That's rare.

The Bigger Picture

So why does any of this matter for price? Because jurisdiction is a competitive market now.

The EU has MiCA fully in force. The US has swung toward a friendlier posture on digital assets through 2025. The UK watched both and realized its registered-firm count isn't growing fast enough to matter. Historically speaking, capital goes where the paperwork is lightest. If London wants a slice of the next cycle, it needs a story that doesn't end with the words enhanced due diligence.

This paper is that story. It's a signal to self-custody wallet makers, hardware vendors, and on-ramps that the UK won't treat them as the enemy by default. That's a tailwind. Small, quiet, but a tailwind.

Now the losers. Surveillance vendors that sell opaque scores are on notice. If a regulator says you've to explain the number, the product has to change. Explainable risk is expensive risk. Some of those vendors will adapt. Some will find their UK pipeline thinning out.

And the registered firms stuck in the middle will eat the cost, because they always do. Compliance teams don't get to say the guidance is nonbinding. They get to say the guidance exists and the board wants a memo.

If BTC holds this level of regulatory tolerance in the UK, the read-through for the whole European crypto trade is mildly constructive. Mildly. Don't oversell it. The invalidation point sits at the first enforcement action brought against a firm for something this paper only calls good practice. If that happens, the whole interpretation falls apart.

My Honest Take

Two things stand out, and neither is the wallet language.

First, the criticism of unexplained third-party scores is the most substantive thing the FCA has said about crypto compliance in years. It's a direct shot at the model where a vendor hands you a number and you freeze a customer's life savings without a reason. That model deserved the shot.

Second, nonbinding guidance is a tell. Regulators don't publish soft papers on topics they plan to hammer. They publish them when they want to move without taking political heat. That's a real shift in posture, and the market should price it as such.

What do you actually do with this? Watch the consultation responses. Watch whether any of this becomes rules in 2026. Watch UK hardware wallet demand as a proxy for how users read the tea leaves. And watch the first enforcement case, because that's where the nonbinding veneer gets tested.

The structure mirrors the 2020 setup in one specific way. Back then, everyone assumed the regulators would eventually see reason. Some did. Some didn't. The ones that did got the flow.

One question worth sitting with: if the guidance is nonbinding, why does every UK compliance officer I know already have it open in a tab?

Because guidance is guidance until your lawyer says otherwise. And by then, the invoice is already written.