The Crypto CFO: Prudential Requirements, Reserve Management and the FSMA Regime

Under the incoming FSMA cryptoasset regime, the finance function becomes a regulatory function. Capital requirements, liquidity standards, financial projections for the authorisation application, reserve backing for stablecoin issuers and prudential reporting all land on the CFO’s desk. This guide covers what the new regime asks of crypto finance leadership, how it changes the CFO profile the sector needs, and how firms should hire against the 30 September 2026 application gateway.

The finance function inside a UK cryptoasset business has historically been shaped by commercial demands: fundraising, treasury in volatile assets, revenue models unfamiliar to generalist accountants, and financial reporting frameworks that have not caught up with the asset class. Regulation touched the CFO lightly — the registration regime under the Money Laundering Regulations imposed no minimum capital requirement and no prudential reporting, and while the FCA has always expected adequate financial resources, the discipline was nothing like the quantified regimes that govern banks, investment firms or payment institutions.

The FSMA regime ends that separation. When applications for cryptoasset authorisation open on 30 September 2026 — with the regime expected to start on 25 October 2027 — firms will be assessed against threshold conditions that include appropriate financial resources, supported by projections and a capital plan; and the FCA has finalised a dedicated prudential regime for cryptoasset firms covering capital, liquidity and risk management. The CFO becomes an application-critical role, and after authorisation, the owner of an ongoing prudential obligation. This guide — a companion to our sector pages on cryptocurrency and blockchain CFO recruitment and finance leadership in fintech and crypto — covers the regulatory dimension in depth.

What the prudential regime proposes

The FCA published its final prudential regime for cryptoasset firms on 30 June 2026 (PS26/12), sitting in two new sourcebooks — COREPRU and CRYPTOPRU. The framework follows the pattern set by the Investment Firms Prudential Regime (MIFIDPRU): own-funds requirements calibrated to the firm’s activities, liquidity requirements, an overall risk assessment discipline (the subject of further FCA guidance consultations, GC26/4 and GC26/5), and regulatory reporting. For investment firms there are explicit interactions between CRYPTOPRU and MIFIDPRU. For crypto CFOs, four building blocks deserve attention.

Capital requirements

Authorised cryptoasset firms should expect a defined own-funds requirement — a floor based on the firm’s activities and scale, likely combining a permanent minimum, an overheads-based component, and activity-based add-ons in the IFPR style. The CFO owns the calculation, the monitoring, and the headroom management: raising and holding qualifying capital, forecasting the requirement through growth, and evidencing compliance to the FCA. For firms whose balance sheets carry digital assets, the interaction between asset volatility and the capital position is a modelling problem the payments sector never had — a genuinely new discipline.

Liquidity

Liquid-resources requirements protect the firm’s ability to wind down or meet stress without harming customers. In crypto businesses the liquidity question has extra texture: what counts as liquid when part of the treasury is on-chain, how quickly digital assets convert to fiat under stress, and how banking-partner concentration risk affects access to cash. The CFO’s liquidity framework must answer these in FCA-legible terms.

Wind-down planning

A credible wind-down plan — how the firm would exit the market in an orderly way, returning client assets and meeting obligations — is a standard FCA expectation across authorisation gateways and a near-certain feature of the crypto regime. Costing the wind-down, and holding resources against it, is finance work.

Prudential reporting

Authorised firms report through RegData on a defined cycle. Building the reporting capability — data, controls, sign-off — is part of the post-authorisation build the CFO leads, and the application itself must show the firm is ready for it.

The authorisation application: what finance owns

Within the FSMA application — covered end to end in our cryptoasset FSMA authorisation guide — the finance workstream is one of the three pillars alongside compliance and governance. The FCA’s existing cryptoasset registration guidance already requires realistic financial information prepared in line with its expectations; the authorisation gateway deepens this into a full adequate-resources case. The CFO’s deliverables typically comprise: three-year financial projections with scenario analysis; the capital plan, including the funding strategy for the own-funds requirement; the liquidity framework; the wind-down plan and its costing; fee and revenue analysis mapped to the regulated activities; and the financial sections of the regulatory business plan.

Case officers test these numbers. Projections that assume hockey-stick growth without funding to match, capital plans that depend on undocumented shareholder support, or wind-down costings that ignore the operational reality of returning on-chain client assets all generate the rounds of requisitions that stretch determination timelines. The applications that move fastest are the ones whose finance sections were built by someone who has been through an FCA gateway before — which is the heart of the hiring argument this guide ends with.

The stablecoin issuer’s finance function: reserves as a regulatory activity

For qualifying stablecoin issuers the finance role expands again, because the product itself is a balance-sheet promise. The FCA’s final rules require issuers to ensure regulated stablecoins maintain their value, with backing assets held on statutory trust under CASS 16 and clear disclosure of how they are managed; the joint FCA and Bank of England regime adds reserve-composition requirements for systemic issuers at scale, and the FCA set the stablecoin-issuance capital coefficient (K-SII) at 1%. The finance function that satisfies this runs reserve management as a daily operation: one-to-one reconciliation between tokens in circulation and backing assets, management of the reserve portfolio within permitted asset classes, redemption liquidity management under normal and stressed conditions, independent attestation arrangements, and public disclosure. The nearest existing disciplines are e-money safeguarding and money market fund management — which is why issuer CFO searches concentrate on candidates from payments, e-money and bank treasury backgrounds. Our stablecoin issuer compliance guide covers the wider regime.

The accounting and tax layer: still unsolved, still the CFO’s problem

The regulatory build lands on top of a financial reporting environment that remains genuinely difficult. Neither UK GAAP nor IFRS contains a dedicated digital asset standard: cryptocurrency holdings are typically treated as intangible assets under IAS 38 or, for broker-traders, inventory under IAS 2, and the policy choice has material consequences for balance sheet presentation and audit. The ICAEW’s cryptoasset guidance provides the practitioner framework. On tax, HMRC’s Cryptoassets Manual treats crypto as property rather than currency, with Corporation Tax, CGT, Income Tax and VAT consequences varying by transaction type — trading, staking, lending, token issuance — and a compliance burden that scales with volume. Audit adds a third front: valuing illiquid tokens, evidencing existence and control of on-chain assets, and satisfying auditors whose firms are still building digital asset capability. An authorised firm’s numbers face FCA scrutiny as well as audit scrutiny, so the tolerance for unresolved accounting judgments narrows under the new regime.

The candidate profile: what the market now demands

The regime redraws the crypto CFO specification. The profile that raised the last funding round — commercial, fundraising-led, technology-fluent — remains necessary but stops being sufficient. The additions are specific.

FCA gateway experience. Candidates who have prepared or supported an authorisation application — payments, e-money, consumer credit, investment management — carry the pattern recognition that keeps a crypto application out of the requisition cycle. This is the single most predictive credential in our placement experience.

Prudential literacy. Working knowledge of an own-funds and liquidity regime (IFPR is the closest template), capital planning, and regulatory reporting. Candidates from MIFIDPRU investment firms, payment institutions and e-money businesses transfer well.

Digital asset treasury competence. Custody arrangements, on-chain controls, exchange counterparty risk, and the valuation and reconciliation of volatile assets — the part traditional-finance candidates must evidence rather than assume.

Regulated-firm instincts. Comfort operating under personal scrutiny (senior finance roles may fall within certification, and finance directors at regulated firms live close to the SMF perimeter), board reporting discipline, and the habit of documentation the FCA expects.

Most of our crypto CFO placements draw from three pools: finance leaders from FCA-authorised payments and e-money firms adding digital asset capability; CFOs from existing registered crypto businesses stepping up into the authorisation build; and financial services finance leaders (banking treasury, investment firms) making a deliberate sector move. ICAEW-qualified candidates dominate the shortlists — the audit-grounded training maps well onto the attestation and control demands of the regime.

Engagement models against the gateway timetable

The gateway creates a defined project with a defined deadline, and the market has settled into a recognisable pattern: interim or fractional finance leadership through the application, converting to permanent after the grant. FCA authorisation submissions have long fitted interim engagement — the submission workload is intense for nine to fifteen months and then normalises — and our interim CFO for tech and crypto practice has placed against exactly this shape since 2018, including FCA authorisation submissions and crypto registration support. Fractional models suit pre-revenue firms and sandbox-stage issuers: prudential competence for two or three days a week ahead of launch volume, on the same logic as the fractional MLRO. Permanent appointments from the outset make sense where the firm is already at scale — an established exchange or a funded issuer — and wants the application owner to be the long-term finance leader. Hiring timelines mirror the compliance functions: three to six months from brief to start for senior candidates, which measured against a 30 September 2026 submission target puts unstarted searches on the critical path today.

The first hundred days: a CFO’s authorisation runway

For a finance leader joining a cryptoasset firm ahead of the gateway, the opening hundred days set the submission date. The sequence that works, drawn from our placements into FCA application processes:

Days 1–30: establish the baseline. A finance health check with regulatory eyes — quality of the historical numbers, the audit position, the accounting policy choices for digital assets, banking relationships and their fragility, and the true cash runway through an application period that will consume professional fees before it produces permissions. Alongside it, a first-cut own-funds estimate against the COREPRU and CRYPTOPRU framework: the number that tells the board whether a funding round belongs in the authorisation plan.

Days 31–70: build the regulatory finance stack. The three-year projection model with scenarios the FCA will find credible; the capital plan, including the instrument and timing of any raise the requirement forces; the liquidity framework, with the on-chain/fiat conversion analysis; and the wind-down plan costing — the deliverable first-time applicants most consistently underestimate. Where the treasury holds volatile tokens, this window also produces the treasury policy revision the capital treatment demands.

Days 71–100: converge with the application. The financial sections of the regulatory business plan drafted in the CFO’s own voice; internal challenge session with the SMF16 so the compliance and finance narratives reconcile (case officers cross-read them); board approval of the numbers as filed; and the reporting build begun — RegData readiness evidenced in the application rather than promised for later.

The pattern to notice: almost none of this is conventional month-end finance, which is why the incumbent bookkeeping function, however competent, rarely produces it unaided.

Building the finance team beneath the CFO

The regime also reshapes the layer below. An authorised cryptoasset firm’s finance function typically needs four capabilities the pre-regulation business ran without. A financial controller with regulated-firm month-end discipline, owning the audit relationship and the control environment the FCA now has an interest in. A regulatory reporting capability — at smaller firms a shared responsibility with the controller, at scaled firms a dedicated hire — running the RegData cycle and the capital and liquidity monitoring between reporting dates. A treasury operations function for issuers and firms with meaningful on-chain assets: daily reconciliation, reserve administration and settlement, sitting at the join of finance and operations. And FP&A with prudential fluency, so that growth plans are costed in capital-requirement terms before the board approves them rather than after the FCA queries them. Our sister page on finance leadership in fintech and crypto covers the wider team build; the sequencing point here is simple — the controller hire belongs before authorisation, because the application’s financial credibility rests on the control environment, and the rest scale with volume after the grant.

Fundraising under a prudential regime

One consequence of the new framework deserves its own treatment, because it changes the CFO’s most visible job: raising money. For venture-backed cryptoasset firms, the prudential regime turns fundraising from a growth exercise into a regulatory one, in four specific ways.

The raise becomes part of the application. The adequate-resources threshold condition is assessed on evidenced capital, not term sheets. A firm whose capital plan depends on a future round must show the FCA committed funding or credible alternatives — and case officers discount optimism. The practical pattern we see: firms closing a round before submission specifically to make the capital chapter unarguable, with the CFO sequencing the raise against the gateway rather than the product roadmap.

Instrument choice starts to matter. Own-funds regimes care about loss-absorbency: ordinary equity qualifies cleanly, while convertible notes, venture debt and SAFEs need careful analysis against the final rules before they are counted. A cap table built for the next priced round is not automatically a capital stack built for a regulatory requirement, and reconciling the two is CFO work that surprises founders.

Investor diligence inverts. Sophisticated investors in regulated fintech price authorisation as milestone and risk simultaneously — and their diligence now asks prudential questions: the size of the requirement, the runway consumed by the application, the capital consequences of the token treasury, the wind-down cost. A CFO who answers fluently moves the valuation conversation; one who cannot invites a discount. Increasingly we also see the reverse diligence: investors assessing whether the finance leadership itself is gateway-credible before committing to an authorisation-stage round.

Shareholder support gets documented. Where capital plans lean on parent or investor support, the FCA expects it evidenced — committed facilities and documented undertakings rather than comfort letters. Negotiating those instruments with a venture investor unused to regulatory capital commitments is a distinctive piece of crypto-CFO craft, and one more reason gateway-experienced candidates command the premium they do.

The first hundred days: a CFO joining ahead of the gateway

For finance leaders taking these roles — and for the boards hiring them — the opening quarter has a recognisable best-practice shape when the destination is a FSMA submission.

Weeks one to four: establish the true position. A clean cut of the balance sheet including the digital asset treasury (custody arrangements, valuation policy, reconciliation state); the cash runway against the authorisation project cost; the state of the audit relationship; and an honest read of whether the accounting policies for token holdings will survive FCA and auditor scrutiny. Most incoming crypto CFOs find at least one unresolved valuation or control issue in this pass — better found in week two than in the requisition cycle.

Weeks five to eight: build the prudential skeleton. First-draft own-funds calculation under the COREPRU and CRYPTOPRU framework, liquidity mapping across fiat and on-chain resources, and the initial wind-down costing. With the rules now final, these drafts can be built to the actual requirements rather than moving targets — and the data plumbing they force (daily positions, counterparty exposures, conversion assumptions) takes months to establish, so it cannot wait until the application is drafted.

Weeks nine to fourteen: produce the application pack. Three-year projections with downside scenarios, the capital plan with funding evidence, the financial sections of the regulatory business plan, and the fee-and-revenue mapping to regulated activities — drafted with the SMF16 so the narrative and the numbers tell one story. By day one hundred the finance workstream should be submission-ready in structure, awaiting only final calibration.

Building the finance team beneath the CFO

The CFO cannot run an authorised firm’s finance function alone, and the build beneath them follows the regime’s demands. The first hire is almost always a financial controller with regulated-firm reporting experience — the person who owns the daily reconciliation discipline, the audit file and, at issuers, the reserve operations cycle. A treasury or reserve manager follows where the business model warrants it, particularly for stablecoin issuers where reserve management is a daily regulated activity. Regulatory reporting capability — RegData returns, prudential calculations on cycle — is next, either as a dedicated hire at scale or folded into the controller role earlier on. The pattern mirrors what payments and e-money firms built through their own authorisation waves, and the candidate pools overlap: safeguarding-experienced controllers transfer directly into reserve operations, and IFPR-literate analysts transfer into the prudential seat. Our fintech and crypto finance leadership practice covers this build-out tier alongside the CFO appointment itself.

Frequently asked questions

Do crypto firms currently have a minimum capital requirement?

Registered-only firms face no regulatory minimum, though the FCA expects adequate financial resources in all cases. Defined own-funds and liquidity requirements arrive with FSMA authorisation under the final prudential regime (COREPRU and CRYPTOPRU, PS26/12, 30 June 2026). With the rules now made, prudent firms are modelling their own-funds position — permanent minimum requirement, fixed overheads requirement and K-factor requirement — against the final framework rather than waiting until they draft the application.

Will our CFO need FCA approval?

Not automatically. The CFO function (SMF2) is a required approval in banks and larger investment firms; whether and where it applies under the crypto regime depends on the final rules and the firm’s scale. Regardless of SMF status, the CFO’s work is assessed throughout the application, and senior finance staff may fall within the Certification Regime. Firms should watch the FCA’s final SMCR application to the sector.

Can our existing head of finance grow into this?

Sometimes — with support. A strong head of finance without gateway experience paired with an interim CFO who has run an FCA submission is a pattern that works well: the application gets experienced ownership and the incumbent gets a development path, often stepping up to the permanent CFO seat a year or two after the grant with the prudential machinery already running. What rarely works is asking a first-time finance lead to learn prudential regulation on the application itself: the requisition cycle exposes inexperience quickly, and the delay costs more than the interim would have. Boards weighing this should ask one question of their incumbent — have you built a capital plan a regulator has tested? — and structure the engagement honestly around the answer.

How does the prudential regime interact with our token treasury?

Expect conservative treatment: digital asset holdings will attract haircuts or deductions in capital calculations, and liquidity frameworks will discount assets that cannot reliably convert to fiat under stress. Firms holding working treasury in volatile tokens should model the capital consequences early — it changes treasury policy for some business models.

What does a crypto CFO cost?

London benchmarks in our current placement work: permanent CFOs at authorisation-stage crypto firms typically £150,000–£250,000 plus meaningful equity; scaled exchanges and issuers above that range; interim day rates at a premium to non-regulated tech equivalents, reflecting the gateway skillset. Equity participation is near-universal at venture-backed firms, and SMF-adjacent accountability increasingly features in package negotiations. Two market dynamics are worth pricing in: the gateway compresses demand into a narrow window, so candidates with FCA submission experience are fielding competing approaches and moving quickly when they move at all; and fractional engagements — two or three days a week at a defined day rate — often cost a pre-launch firm less over the application period than an underqualified permanent hire whose application spends an extra six months in requisitions. The expensive CFO is rarely the one on the higher package; it is the one whose numbers stall the determination.

Related guides and services

• Cryptoasset Compliance Recruitment
• Cryptoasset FSMA Authorisation: The Complete Guide
• Stablecoin Issuer Compliance: The UK Regime
• Cryptocurrency & Blockchain CFO Recruitment
• Interim CFO for Tech & Crypto Startups
• Finance Leadership in Fintech & Crypto

External resources

• FCA — Cryptoassets
• FCA — Registration under the MLRs ahead of the new FSMA regime
• ICAEW — Blockchain and cryptoasset guidance
• HMRC — Cryptoassets Manual
• FCA — Cryptoassets regime policy statements (PS26/9–PS26/13, 30 June 2026)
• Financial Services and Markets Act 2023

Hiring finance leadership for the gateway? Call FD Capital on 020 3287 9501 or email recruitment@fdcapital.co.uk — interim, fractional and permanent crypto CFOs, shortlists typically within 3–7 working days.