The previous part, What AML/KYC controls does a crypto business need?, examined EU customer and transaction controls. This part addresses the checks before publishing UK retail promotions of qualifying cryptoassets, including communications from overseas. It focuses on self-directed investment: permission to communicate, advertising content, customer decisions and evidence of compliance. (Financial Services and Markets Act 2000, s. 21; FCA Handbook, COBS 4.12A.2R, 4.12A.15R.)
Summary
- Establish whether the asset and communication fall within the financial promotion restriction. An overseas business is caught where its communication can have an effect in the UK. (Financial Services and Markets Act 2000, s. 21(1), (3), (8); Financial Promotion Order 2005, Sch. 1, para. 26F.)
- Identify a lawful communication route before publication. FCA registration under the Money Laundering Regulations permits specified own promotions; it does not confer permission to approve another business’s advertising. (Financial Services and Markets Act 2000, s. 21(2)–(2A); Financial Promotion Order 2005, art. 73ZA.)
- Check the substance and presentation of every promotion. Claims must be fair, clear and not misleading; prescribed warnings and restrictions on incentives apply within their defined scope. (FCA Handbook, COBS 4.2.1R, 4.12A.4R, 4.12A.7R, 4.12A.10R–11R.)
- The first direct offer normally requires a 24-hour period after the customer requests it. The personalised warning and affirmative continuation must precede categorisation or appropriateness steps. Prior receipt from the same communicator creates specified exceptions. (FCA Handbook, COBS 4.12A.15R(2), 4.12A.18R–20R.)
- Investor categorisation and appropriateness perform different checks. Self-certification as sophisticated is unavailable for this crypto category; an order responding to the offer requires a positive appropriateness assessment. (FCA Handbook, COBS 4.12A.21R–22R, 4.12A.28R–33G.)
- Approval requires continuing supervision of the promotion and its customer process. Preserve the applicable advertising records and the separate five-year categorisation and assessment records. (FCA Handbook, COBS 4.10.2R–2AR, 4.11.1R, 4.11.5R–7R.)
- The wider cryptoasset regime comes fully into force on 25 October 2027. Its preparatory commencement does not replace the permission route for a campaign published now. (Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, reg. 1(2)–(3).)
Promotions and the UK audience
A firm checking UK crypto marketing compliance should begin with the asset, message and intended recipients. Section 21 prohibits a business communication inviting or inducing investment activity unless a statutory route permits it. The restriction covers causing another person to communicate. A paid post, referral message or website can therefore require review even where another person publishes it. Describing promotional content as education does not resolve whether its substance encourages investment. (Financial Services and Markets Act 2000, s. 21(1), (8), (13).)
The current definition of a qualifying cryptoasset requires fungibility and transferability, subject to express exclusions. Describing a cryptoasset as transferable can satisfy the transferability limb. Electronic money, fiat currency and assets already falling within specified controlled-investment categories are excluded from this particular definition. Their own legal treatment must be considered. A token’s commercial label cannot replace an assessment of its rights and transfer features. (Financial Promotion Order 2005, Sch. 1, para. 26F(1)–(4).)
An overseas communication falls within section 21 if it is capable of having an effect in the UK. The exemption for communications directed only outside the UK has specific conditions and indicators. Relevant matters include links from UK-directed communications and systems preventing UK recipients from entering the promoted activity. A disclaimer must be assessed with the actual distribution and access arrangements. It cannot establish the exemption merely by declaring an overseas audience. (Financial Services and Markets Act 2000, s. 21(3); Financial Promotion Order 2005, art. 12(1)–(4).)
Permission to communicate
There are four principal routes for communicating an in-scope crypto promotion. An authorised person can communicate it. An unauthorised person can communicate content approved by an authorised person entitled to give that approval. A qualifying registered person can use Article 73ZA. A communication can also satisfy another applicable Financial Promotion Order exemption. The reviewer should identify the actual legal person and route for each publisher. Group membership or an overseas licence does not itself satisfy these conditions. (Financial Services and Markets Act 2000, s. 21(2)–(2A), (5); Financial Promotion Order 2005, arts. 19, 49–50, 73ZA.)
Article 73ZA covers an eligible cryptoasset exchange provider or custodian wallet provider on the FCA’s relevant register, without FSMA authorisation. Its communication must relate only to qualifying cryptoassets. Another person can communicate on its behalf under this exemption only through a non-real-time communication whose content the registered person prepared. A contracted influencer’s independent script therefore needs its own lawful basis. The exemption is unavailable where the communication breaches an applicable FCA requirement or direction identified in Article 73ZA(2). (Financial Promotion Order 2005, art. 73ZA(1)–(3).)
Registration does not authorise the firm to approve promotions for another business. The reviewer must establish the approver’s relevant section 55NA permission, or the precise exemption or transitional provision permitting approval. Exemptions cover content prepared by the approver or an unauthorised member of its group. Another covers its appointed representative’s content concerning regulated business for which the approver has accepted responsibility. The check should establish any restrictions, the content approved, and the audience covered. (Financial Services and Markets Act 2000, ss. 21(2A), 55NA; Financial Services and Markets Act 2000 (Exemptions from Financial Promotion General Requirement) Regulations 2023, reg. 3; SI 2023/936, reg. 3; FCA Handbook, COBS 4.10.3G(8), 4.10.5R.)
Audience exemptions require particular care. The high-net-worth individual and self-certified sophisticated exemptions in Articles 48 and 50A do not cover qualifying cryptoassets. Article 50 can cover a certified sophisticated investor with an authorised-person certificate signed and dated no more than three years earlier. The recipient’s statement must be signed within the preceding 12 months. The communication must concern only the certified investment description, carry the prescribed indications and not invite investment activity with the certificate signer. These statutory exemptions are separate from the FCA’s investor categories for an otherwise lawful retail offer. Selecting a wealthy-customer category does not supply permission to publish an unrestricted campaign. (Financial Promotion Order 2005, arts. 48(1), (8), 50(1)–(4), 50A(3)(b), (8); FCA Handbook, COBS 4.12A.21R–22R.)
Claims about returns and regulatory status
Every claim in a promotion must satisfy the fair, clear and not misleading standard. Where retail marketing mentions potential benefits, the firm must give a fair and prominent indication of relevant risks. The information must suit the likely recipient’s understanding and must not obscure important qualifications. A review should therefore connect each yield, fee, liquidity or protection claim to evidence explaining its meaning and limits. (FCA Handbook, COBS 4.2.1R, 4.5.2R.)
The FCA’s crypto guidance explains its expectations for applying that standard; it does not replace the binding rules. For a yield claim, the review should establish how returns arise, whether they vary, and which risks affect access to assets. A stable-value claim needs support concerning the arrangement that maintains that value. Describing a token as stable does not establish that its price, redemption or issuer presents no risk. The disclosure must address the product actually promoted. (FCA Handbook, COBS 4.2.1R, 4.5.2R; FCA FG23/3, paras. 2.33, 2.48–2.52, 2.63–2.66.)
Past-performance advertising has additional conditions. Past results must not be its most prominent feature, and the stated period and source must accompany the prescribed performance warning. The rule requires appropriate information based on complete 12-month periods, normally covering five years or the shorter period for which the investment has been offered. Non-sterling figures must identify the currency and warn about currency fluctuations; gross figures require disclosure of charges’ effects. A selected price-rise chart must be checked against each applicable condition. (FCA Handbook, COBS 4.6.1R–2R.)
Claims about FCA status must match the firm’s actual position and the business supervised. A registered firm must not imply that registration constitutes FCA endorsement or supervision of activities outside that registration. The website should distinguish the firm’s status from the protection available for the investment. A valid registration number cannot substantiate an unsupported claim that customer assets are protected. (FCA Handbook, GEN 1.1.1R(3)–(4), 1.2.2AR(1), 4.5.1AR, 4.5.3R–4R.)
Retail promotions approved by another firm must include the relevant approver’s name and approval date. A digital format that cannot reasonably accommodate those details permits a linked page under specific conditions. The link must use the prescribed wording identifying the approver’s firm reference number. A reviewer should check the disclosure in the version consumers receive. (FCA Handbook, COBS 4.5.2R(1)–(1A), 4.5.2AR.)
The Consumer Duty also applies when an authorised firm communicates or approves promotions addressed to retail customers or likely to reach them, subject to its defined exclusions. The firm must support informed customer decisions and, where appropriate, test communications before release and monitor their effects. Identified deficiencies require investigation and correction. Registration under the Money Laundering Regulations alone does not impose that full duty; the extension for registered persons applies Principle 7. (FCA Handbook, PRIN 3.1.1BR, 3.2.6R(2), 2A.5.3R, 2A.5.10R.)
Risk warnings in each format
Qualifying cryptoassets fall within the FCA’s restricted mass market investment category. Its promotion rules exclude defined image advertising and excluded communications, but promotions under Article 73ZA remain covered. For an ordinary covered promotion, the reviewer must check the crypto warning in COBS 4.12A.11R(1)(d). Its opening is: “Don’t invest unless you’re prepared to lose all the money you invest.” The remaining wording addresses high risk and the absence of expected protection if something goes wrong. A generic capital-at-risk notice cannot replace the required text. (FCA Handbook, Glossary, “restricted mass market investment”; COBS 4.1.7EG, 4.12A.2R–4R, 4.12A.10R–11R.)
For digital promotions, the warning normally links through “Take 2 mins to learn more” to the prescribed risk summary. That summary must open in a pop-up or equivalent. The shorter warning is permitted where a third-party marketing provider’s character limit cannot accommodate the full warning. Separate exceptions address the link’s wording and media that cannot incorporate links. These conditions require a format-specific decision; a preference for shorter advertising is insufficient. (FCA Handbook, COBS 4.12A.11R(2)–(4); COBS 4 Annex 1R(8).)
Non-digital promotions require the full warning in a durable medium, or an appropriate form where the medium prevents that. The accompanying summary must be in a durable medium unless the necessary delivery information cannot be obtained. An amended risk summary requires a valid, recorded reason for each change and must satisfy the plain-English and reading-time conditions. (FCA Handbook, COBS 4.12A.11R(4), 4.12A.44R.)
Prominence requires review of the rendered advertisement. Written warnings must be legible, within their own border and use the indicated bold and underlining. On websites and apps, the warning must remain fixed and visible at the top, below other fixed content, including during scrolling. It must also appear on each linked page relating to the investment. Digital personalised warnings and summaries must remain fixed and visible in the middle of the screen as its main focus. Other design must not reduce their visibility or prominence. The FCA expects each social-media promotion to comply individually; a later risk page cannot cure an earlier misleading claim. (FCA Handbook, COBS 4.12A.36R, 4.12A.38R, 4.12A.40R, 4.12A.42R; FCA FG24/1, paras. 2.20–2.21, 2.43–2.46.)
Rewards and referral offers
The FCA prohibits monetary and non-monetary incentives in covered retail promotions of restricted mass market investments. That includes crypto offers designed to encourage investment through a reward separate from the investment’s features. Cash bonuses, gifts and referral arrangements need examination under that rule, including rewards offered to an existing customer for recruiting another investor. (FCA Handbook, COBS 4.12A.7R–9G.)
The prohibition has defined limits. An incentive solely to transfer an existing holding between providers can qualify for an exception if it does not encourage further investment. The exception for products or services supplied by the investment recipient or its group does not extend to qualifying cryptoassets. Guidance permits lower fees available to all retail clients where they are not linked to trading volume. The reviewer should examine the reward’s conditions, recipient and economic effect before classifying it. (FCA Handbook, COBS 4.12A.7R(2)–(4), 4.12A.9G–9AG.)
The first direct offer
The stricter customer process applies to a direct offer financial promotion. It contains an offer to enter a controlled agreement, or an invitation to make such an offer, and specifies how to respond or includes a response form. General advertising remains subject to its applicable content rules even where it stops before that point. The review should locate the first screen or communication that provides the direct offer and test access to it. (FCA Handbook, Glossary, “direct offer financial promotion”; COBS 4.12A.15R.)
For an ordinary first direct offer, the communicator must wait at least 24 hours after the retail client requests it. After the period expires, the client must receive equally prominent options to leave or continue and choose to continue. Starting a timer after the offer has already appeared does not satisfy that sequence. (FCA Handbook, COBS 4.12A.18R(1)–(2).)
The personalised warning requires the client’s full name and the prescribed wording. Digital delivery requires a pop-up or equivalent, a linked risk summary, and equally prominent options to leave or continue. The client’s affirmative continuation must occur before steps to categorise them or assess appropriateness. Those later checks can take place during the cooling-off period; the required decision to continue after that period must still occur. Product teams should test the actual order of screens and decisions. (FCA Handbook, COBS 4.12A.18R–20R, 4.12A.29G(2).)
The cooling-off and personalised-warning conditions need not be repeated where the client previously received a relevant direct offer from the same person. An existing account alone does not establish that exception. The rules also permit specified routes involving compliance with suitability rules or qualifying corporate-finance and venture-capital contacts. A self-directed retail process must satisfy its own conditions unless the alternative route’s requirements are met. (FCA Handbook, COBS 4.12A.15R(2), 4.12A.17R.)
Investor categorisation
Before communicating the direct offer, the communicator must take reasonable steps to establish the retail client’s category. For qualifying cryptoassets, the available categories are high net worth, certified sophisticated and restricted investor. The separate self-certified sophisticated route is unavailable for this investment category. The applicable statement must be completed and signed within the preceding 12 months, and its contents must establish the relevant criteria. (FCA Handbook, COBS 4.12A.21R–23E.)
The high-net-worth form uses income of at least £100,000 or net assets of at least £250,000 in the last financial year. Income excludes one-off pension withdrawals. The net-assets calculation excludes the primary home, pensions and any pension withdrawals, and rights under qualifying insurance contracts. For certified sophisticated categorisation, the form requires the client to have received an authorised-firm certificate within the last three years concerning the relevant investment type. The separate investor statement must also be current. (FCA Handbook, COBS 4 Annex 2R; COBS 4 Annex 3R; COBS 4.12A.22R.)
The restricted-investor form requires investment below 10% of net assets in the relevant high-risk investments over the previous 12 months, and an intention to remain below 10% over the next 12 months. The declaration aggregates the relevant investments across providers and applies the form’s net-assets exclusions. Guidance permits omitting investments made in response to offers for which the client was categorised as sophisticated. The firm must not influence the information supplied or encourage a replacement certificate after the client’s answers show that they do not qualify. (FCA Handbook, COBS 4.12A.25G–26R; COBS 4 Annex 5R.)
Appropriateness and failed assessments
Appropriateness examines the client’s knowledge and experience concerning the investment and its risks. It therefore requires information beyond customer identification. Where the provider knows or should know that an application or order responds to the direct offer, it may process that application or order only after a positive appropriateness assessment. A warning after an adverse result does not permit execution through this route. (FCA Handbook, COBS 10.2.1R–2R, 4.12A.28R, 4.12A.33G.)
The assessment must test understanding without assistance, information, guidance or feedback that might affect the substance of the client’s answers. After a question-based assessment fails, the client must not be told which particular answers caused that result. A later assessment must not reuse questions from any earlier assessment for that client and investment. Broad explanations of gaps in understanding remain possible under the guidance, but revealing answers and inviting repetition would defeat these requirements. (FCA Handbook, COBS 4.12A.30R–31R, 4.12A.35G(1)–(3).)
The retry rule applies where the first and second assessments both fail. After the second failed assessment, and every subsequent failure, the next assessment must wait at least 24 hours. That retry rule is separate from the cooling-off period for the first direct offer. A previous positive assessment by the same person can remove the need for another assessment for that specific investment type. The firm should still consider whether elapsed time makes reassessment appropriate in the client’s interests. (FCA Handbook, COBS 4.12A.15R(3), 4.12A.16G(2), 4.12A.32R.)
Approval and publication records
The people responsible for a promotion’s compliance need competence and expertise in the relevant investment or service. An external approver must confirm compliance before approval and take reasonable steps to monitor continuing compliance for as long as the promotion is communicated. It must also take reasonable steps to check the continuing direct-offer conditions and any assessment performed by another provider. The appointment should give the approver access to records of the customer process needed for those checks. (FCA Handbook, COBS 4.10.2R–2AR, 4.10.9AR, 4.11.6R.)
Where an unauthorised person issues the promotion and receives approval to communicate it, the approver must require written quarterly attestations concerning material changes. If the approver becomes aware that the promotion no longer complies, it must withdraw approval. It must notify known persons relying on that approval as soon as reasonably practicable. Approval cannot cover a personal visit, telephone conversation or other interactive dialogue. A livestream can be non-real time; the reviewer must examine whether the actual format involves interactive dialogue. (FCA Handbook, COBS 4.10.2R(1B)–(2), 4.10.4R; FCA FG24/1, para. 3.14.)
Approvers must apply the reporting rules within their scope. Under the rules effective from 1 October 2026, a crypto approval requires notification within seven days if it is a direct offer or falls within the relevant three-month period. That period starts with the first crypto approval after permission is granted or varied to include crypto promotion approvals. Amendments or withdrawals caused by a notifiable concern also require notification within seven days. These duties concern approvals requiring approver permission; they do not make a registered firm report every own promotion under this section. (FCA Handbook, SUP 16.31.1R–7R.)
The general record rule requires adequate records of covered promotions and the basis for the responsible individuals’ competence. It normally requires three years’ retention for these non-MiFID promotions. Interactive communications are excluded from that general requirement, while telemarketing scripts must be recorded. Categorisation evidence and the specified assessment records require five years. Grounds for using an alternative risk summary also require five years. The record schedule should distinguish these categories and retain the version actually communicated. (FCA Handbook, COBS 4.11.1R, 4.11.5R–8R.)
Failed checks and the 2027 commencement
A campaign without a lawful section 21 route must not be communicated. Contravening that restriction can constitute a criminal offence. One defence is belief on reasonable grounds that an authorised person prepared the content or approved it in accordance with section 21(2A). Another is taking all reasonable precautions and exercising all due diligence to avoid the offence. A controlled agreement entered into because of an unlawful communication can be unenforceable against the recipient, with recovery and compensation rights. Section 30 retains causation requirements and the court’s power to permit enforcement or retention where just and equitable. Recovery can also require the customer to return property received or its value. A breach of an FCA content rule does not automatically establish every element of those statutory consequences. (Financial Services and Markets Act 2000, ss. 21, 25(1)–(2), 30(1)–(7), (11)–(13).)
The wider cryptoasset regime comes fully into force on 25 October 2027. The earlier commencement of the 2026 Regulations serves specified preparatory and permission purposes. Article 73ZA’s future removal also has savings and transitional provisions. A campaign released before that change must use the route and conduct rules then applicable. The release decision should identify the lawful communicator, approved content where needed, the operation of applicable customer restrictions and any defect preventing publication. (Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, regs. 1(2)–(3), 42(4), 53–56; FCA Handbook, COBS 4.1.7CR, 4.12A.15R.)
