The recommended first product uses native ether, or ETH, for Ethereum validation. Customers retain control of withdrawal addresses and receive attributable protocol rewards, less disclosed charges. Custody and pooled products remain alternatives, with the additional conditions set out below.
Executive Summary
- Mauritius permissions follow the functions performed. Transferring assets points to Class O; safekeeping or administration points to Class R. A non-custodial description does not establish an exemption. (Virtual Asset and Initial Token Offering Services Act 2021, ss 2, 3, 7 and Second Schedule.)
- Qualifying cryptoasset staking has been excluded from the UK collective investment scheme definition since 31 January 2025. Pooling and sharing validation rewards do not, by themselves, defeat that exclusion. Broader investment arrangements require separate assessment. (Financial Services and Markets Act 2000 (Collective Investment Schemes) Order 2001, Schedule, para. 22; SI 2025/17, arts 1–2; FSMA 2000, s 235.)
- UK financial-promotion restrictions already apply to relevant communications from overseas. UK money-laundering registration has a separate activity and territorial test. Neither regime provides the future staking permission. (FSMA 2000, s 21; Money Laundering Regulations 2017, regs 8, 14A and 56; SI 2026/102, reg. 40(5).)
- The new UK staking and safeguarding activities take effect on 25 October 2027. The protected application period is 30 September 2026 to 28 February 2027. A timely qualifying application can preserve the previous rules for the relevant activity, subject to its status and the statutory two-year limit; filing is not permission to start otherwise unlawful business. (SI 2026/102, regs 1 and 52–56; FCA direction under reg. 52, 20 February 2026, para. 2.)
- Delegated custody requires its own permission and responsibility analysis. Mauritius requires an overseas custodian's equivalent licence and regulation, with the equivalence assessment notified to the FSC before deposit. (VAITOS Custody of Client Assets Rules 2022, rr 2, 5(4) and 10.)
- Customer terms should separate inherent protocol losses, provider fault, custody shortfalls and insolvency. They must preserve applicable consumer protections and identify who owes rewards and asset return. (VAITOS Act, s 17; Custody Rules, rr 20–21; Consumer Rights Act 2015, ss 49, 57 and 62.)
The platform's role and the three product structures
Under the non-custodial structure, the customer retains the withdrawal address and its means of control. For this whole-validator model, each customer must fund at least 32 ETH. The platform arranges validator participation and performs the agreed operational tasks. Customers receive the remaining ETH and attributable rewards at the agreed destination. Validator signing powers still create exposure to penalties and slashing. The platform must identify every power over signing, recovery, reward routing and exits before describing the service as non-custodial. Ethereum's withdrawal mechanism also permits an exit initiated from the withdrawal address, subject to protocol conditions and queues. (Ethereum, Delegated staking, “What is delegated staking?”, “The delegation spectrum” and “Trust model: what to evaluate”; Staking withdrawals, “Exiting staking entirely”.)
Under custody plus staking, the customer transfers control to a custodian. The contracts must establish whether the customer retains a proprietary interest in identified or pooled assets, or instead holds a contractual return claim. A title-transfer structure requires separate classification and cannot displace applicable Mauritius client-property protection. The platform might itself undertake custody and delegate performance, or merely arrange a direct customer-custodian relationship. Those arrangements have different duties and permission consequences. (VAITOS Act, s 17; Custody Rules, rr 5 and 10–11; Regulated Activities Order 2001, art. 9N, as inserted by SI 2026/102.)
A pooled product combines customer positions and allocates returns under common terms. The decisive questions concern the source of returns, management discretion and redemption rights. Shared native staking rewards differ from interest generated by lending or a platform's independent promise to pay a fixed amount. A transferable receipt adds another asset whose rights and transactions require classification.
Infrastructure supply is a separate route. A Mauritius operator can supply restricted technical functions to a customer-facing provider that retains the customer contract and relevant control. The existing analysis of validator infrastructure supplied to an Irish custodian addresses that division of work. The UK decision additionally concerns direct retail staking, promotion controls and future staking authorisation.
Mauritius permissions depend on transfers and administration
The Virtual Asset and Initial Token Offering Services Act 2021, or VAITOS Act, prohibits unlicensed VASP business in or from Mauritius. The statutory categories contain no standalone staking licence. The platform must map each actual function to the categories, including activities performed through its contractual powers. Incorporation alone provides no permission. (VAITOS Act, ss 2, 7–9 and Second Schedule.)
Class O covers transfers of virtual assets. Class R covers safekeeping or administration of virtual assets or instruments enabling control. Class M becomes relevant where the platform exchanges fiat and cryptoassets or one cryptoasset for another. Class I concerns financial services related to an issuer's offer or sale; its advisory label does not make it a general staking permission. Class S concerns a virtual asset exchange. (VAITOS Act, s 2 and Second Schedule.)
Customer-controlled withdrawals reduce the platform's powers but do not settle whether its other functions constitute administration or transfer. Record who submits deposits, directs validators, controls recovery and distributes rewards. Obtain the necessary licence before performing a covered function. Where the proposed limits support an outside-perimeter position, document that conclusion against the deployed architecture and resolve material classification uncertainty with the FSC before launch.
The technical-service exclusion is specific. Section 3(2)(e) covers listed ancillary services supplied to a VASP; the Third Schedule includes validation and node operation. A direct service to retail customers cannot assume it satisfies that recipient condition. A Mauritius infrastructure supplier should document the recipient's VASP status and keep its actual work within the exclusion.
Marketing also needs a Mauritius check. Section 34A, effective from 13 August 2026, prohibits unlicensed solicitation of investors in Mauritius and creates a presumption for publicly accessible communications and activities. A website labelled “UK customers only” does not establish compliance. An unlicensed business must resolve that restriction before publishing transactional promotions or opening access. (VAITOS Act, s 34A; Economic and Financial Measures (Miscellaneous Provisions) Act 2026, ss 56(c) and 61.)
Pooling requires a separate securities and fund analysis. Mauritius's CIS definition includes portfolio investment, risk diversification, NAV redemption and absence of participant day-to-day control. A single-asset validator pool is not automatically a CIS. If the product satisfies the applicable CIS or closed-end fund definition, FSC authorisation or recognition, as applicable, is required; manager and custodian permissions require separate examination. Securities-like receipt rights can also engage dealing, advice and offering rules. (Securities Act 2005, ss 2, 29–30, 67–70 and 97–100.)
Issuing a virtual token to the public in exchange for ETH can instead engage the VAITOS initial-token-offering registration requirements. The business must classify the receipt's actual rights before selecting either route. It should also check any Global Business Licence requirement against ownership and operations outside Mauritius. These entity requirements do not replace activity permissions. (VAITOS Act, ss 2–3 and 23–30; Financial Services Act 2007, s 71.)
UK obligations before and after October 2027
Current staking and investment-product rules
The current exclusion covers arrangements for using qualifying cryptoassets in blockchain validation. It does not require every customer to operate a separate validator. A pool confined to that activity can therefore benefit from the exclusion. Calling a treasury investment or lending product staking cannot establish that condition. (Collective Investment Schemes Order 2001, Schedule, para. 22.)
Where the arrangement extends beyond that exclusion, section 235 tests participation in profits or income from property, absence of day-to-day participant control, and pooling or management as a whole. A promise of fixed returns requires examination of its legal form and funding; it does not itself prove that every product is a CIS. An arrangement that raises capital under a defined investment policy also needs the separate alternative investment fund test. (FSMA 2000, s 235; Alternative Investment Fund Managers Regulations 2013, reg. 3.)
If the product is a CIS or security, existing regulated activities can apply now. An unregulated collective scheme has restrictive UK promotion routes, including the statutory restriction on promotion by authorised persons. A Mauritius fund authorisation does not establish a UK retail distribution route. Remove the affected features or establish the necessary operator, manager and distribution permissions before offering them. (FSMA 2000, ss 19, 21 and 238; Regulated Activities Order 2001, arts 25, 37, 51ZC–51ZE and 53.)
Current registration and marketing controls
UK money-laundering registration depends on providing an in-scope exchange or custodian-wallet service in the course of business carried on in the UK. Merely having UK customers does not automatically establish that territorial connection. A UK establishment, personnel or agent performing relevant functions can change the assessment. (Money Laundering Regulations 2017, regs 8, 9, 14A and 56; FCA, Cryptoassets: Who needs to register, “Is the activity carried on in the UK?”.)
The promotion test is wider territorially. Section 21 restricts business communications inviting or inducing controlled investment activity; an overseas communication can qualify if capable of having an effect in the UK. The platform must review its purchase flows, staking invitations, receipt-token offers, affiliates and advertising against that test. A bare technical-service communication is not automatically a financial promotion. (FSMA 2000, s 21(1), (3) and (8); Financial Promotion Order 2005, Schedule 1.)
For in-scope cryptoasset promotions, the lawful routes are communication by an authorised person, approval by a permitted authorised approver, the qualifying MLR-registered-business exemption, or another applicable statutory exemption. An overseas platform cannot borrow its custodian's registration to approve its own advertising. The arrangement must identify the communicator, approver and legal route. (FSMA 2000, ss 21 and 55NA; Financial Promotion Order 2005, art. 73ZA.)
Promotions subject to FCA rules need the prescribed risk warnings and fair, clear, non-misleading presentation. Applicable direct-offer journeys require customer categorisation, the cooling-off process and appropriateness assessment. Remove prohibited investment incentives and referral bonuses. The product's protocol rewards should be explained accurately, without presenting a variable rate as guaranteed. (COBS 4.2.1R, 4.12A and 10; FCA FG23/3, paras 2.63–2.66.)
The enacted regime and the customer-facing entity
From 25 October 2027, article 9Z6 of the Regulated Activities Order regulates arranging qualifying cryptoasset staking. Article 9N separately covers safeguarding and arranging safeguarding. A customer-facing non-custodial platform can require staking permission even where it cannot transfer customers' assets. Appointing a custodian can add arranging-safeguarding activity. (SI 2026/102, regs 1 and 40(5); RAO, arts 9N and 9Z6.)
The new territorial rule reaches overseas staking and safeguarding performed for UK consumers, unless performed at the direction of a person authorised for that same activity. A referral, branding agreement or vendor contract alone does not establish that exception. Other UK territorial connections must still be checked. (FSMA 2000, s 418(6E)–(6F), as inserted by SI 2026/102, reg. 41(6); PERG 18.3.3–18.3.4.)
For a direct retail service, budget for a UK legal entity and the corresponding FCA application. That reflects the FCA's stated authorisation expectation, with individual applications assessed on their merits. It is not an absolute statutory incorporation rule. A genuine service under an appropriately authorised principal's direction offers another structure, subject to that principal's actual permissions and responsibility. (FCA FG26/7, paras 7.3–7.6; FSMA 2000, future s 418(6E).)
The technical exclusion in article 9Z9 requires a technical service supporting another person's staking and no holding out of staking to the public. It cannot support the platform's own retail staking proposition. Liquid-staking receipt issuance and redemption also require separate dealing or arranging analysis; staking permission does not cover every associated transaction. (RAO, arts 9Z6–9Z9; PERG 18.10.6–18.10.7.)
Submit the relevant application within the protected period ending 28 February 2027. Continuation under regulation 53 depends on its conditions and the application's status. The saving applies to the relevant activity and lasts no longer than two years from full commencement. A late application or refusal can leave only restricted run-off of qualifying existing contracts, rather than permission for new business. The UK authorisation and transition guide explains that wider transition. (SI 2026/102, regs 52–56.)
Customer asset rights and loss allocation
For Mauritius custody, client assets must remain client property and outside the provider's creditors' claims. The custodian must hold sufficient amounts of each asset type to meet its obligations to clients. Delegation preserves its responsibility to clients and the FSC. An overseas subcustodian needs equivalent licensing and regulation, pre-deposit notification of the equivalence assessment, due diligence and continuing review. UK MLR registration alone does not establish those requirements. (VAITOS Act, s 17; Custody Rules, rr 2, 5(4) and 10–11.)
The UK's published rules for the October 2027 regime add express staking consent and specified customer information. They also establish a general requirement for safeguarding firms to act as trustees, subject to defined exceptions. The rules do not themselves create a statutory trust. A staking-related title-transfer exception requires necessity for the particular service and informed consent; it is not available merely because a provider prefers ownership. (CRYPTO 10.2–10.3; CASS 17.3.2G–17.3.3R, 17.3.6R–17.3.7G and 17.3.11R.)
From that date, a UK safeguarding firm that delegates custody must appoint a supervised custodian in a jurisdiction that specifically regulates cryptoasset safeguarding. Before appointment, it must complete due diligence and conclude that the arrangement will not increase client-asset loss risk. A written custody agreement, at least annual reviews and the applicable Consumer Duty and governance requirements also apply. (CASS 17.6.3R, 17.6.5R–17.6.6R and 17.6.9R.)
The customer agreement, custody agreement and validator contract should implement the following positions:
- Identify the customer's asset entitlement at deposit, during staking and on exit. For pooled holdings, define the allocation ledger and each customer's share. State who owes delivery of ETH and who owes payment of earned rewards.
- Credit rewards actually received or allocated under the protocol, using a stated calculation period and allocation method. Separate network charges, validator charges and platform fees. Explain compounding and any consent required for reinvestment.
- Separate slashing, ordinary downtime penalties and losses caused by protocol failure. Allocate inherent disclosed staking risks to the agreed entitlement, while preserving claims for negligent operation, unauthorised instructions and breach of custody duties. The network's penalty alone does not establish contractual fault.
- Distinguish the platform's time to act on a withdrawal instruction from protocol exit queues and subsequent transfer. Permit suspension only on specified grounds, with notices, status updates and an escalation process. Do not promise immediate withdrawal from locked stake.
- Preserve responsibility for delegated functions and state recourse against each custodian or validator. Require incident evidence, reconciliations, recovery access and termination assistance. Address insolvency under the law governing the actual asset-holding arrangement.
These are proposed contract positions. Applicable pre-service risk, fee, withdrawal and third-party custody disclosures must also meet the Client Disclosure Rules. (VAITOS Client Disclosure Rules 2022, rr 5 and 8–10.) Mauritius's statutory safeguarding and shortfall duties remain applicable where their conditions are met. The rules contain specific qualifications for third-party responsibility, timing differences and restrictions imposed by the custodian's insolvency proceedings; they do not supply a universal indemnity for every staking loss. (Custody Rules, rr 20–21.)
UK consumer terms must preserve applicable reasonable-care duties and statutory remedies. Liability exclusions and caps require review under sections 57 and 62; clear disclosure alone does not make an unfair term enforceable. Choosing Mauritius law cannot remove the Consumer Rights Act's unfair-terms protection where the contract has a close UK connection. The separate consumer choice-of-law rule also preserves mandatory home-law protections where its conditions apply. (Consumer Rights Act 2015, ss 49, 57, 62, 68 and 74; Rome I, art. 6.)
The recommended structure and launch conditions
Develop the non-custodial native ETH product first, with a UK entity taking the customer-facing role for the future regime. Restrict the initial service to identified validation arrangements, customer-controlled withdrawals and attributable variable rewards. Exclude lending, restaking, a transferable receipt and an independent fixed-return promise. This reduces the activities requiring classification and avoids funding withdrawal promises from assets committed to validation.
Customers requiring fractional pooled positions need a separately reviewed design and any required regulatory approval. If commercial requirements instead demand custody, select the custodian only after its permissions, asset segregation and insolvency treatment are established. Keep custody mandates and staking consent distinct. A Mauritius business that retains custody responsibilities must meet the FSC's delegation conditions; an arranging-only business must document the direct custodian obligation to the customer.
Before any launch, the platform's board should approve a function and permission map tied to the actual contracts and technical controls. Mauritius counsel must settle the applicable VASP, solicitation and entity requirements. The UK customer business must complete the current perimeter and promotion assessment, obtain any required MLR registration or existing financial-services permission, and establish the future FCA application route. The product team must remove unsupported yield and liquidity claims. Customer operations must demonstrate reward reconciliation, loss investigation and withdrawal handling.
A service launched before October 2027 can proceed only when those current-law conditions are satisfied. Continuation into the new regime requires effective permission or an applicable statutory transitional or exempt route. Run-off under regulation 56 cannot support new onboarding. If those conditions cannot be met, keep UK retail onboarding closed. A restricted infrastructure service can proceed only after its own recipient, function and holding-out conditions are established. (VAITOS Act, ss 3, 7 and 34A; FSMA 2000, ss 19 and 21; SI 2026/102, regs 1 and 52–56.)
Review the staking operating model
Ask Licentium to scope a review of the proposed service, asset-control map, customer terms and custody or validator agreements. The review should identify required permissions and document changes. Review the staking operating model.