What crypto firms can learn from IFPR and ICARA

Crypto firms often think about prudential requirements as capital numbers. That is understandable, but too narrow.

The FCA’s prudential expectations are rarely just about holding a minimum amount of capital. They are about whether the firm understands the risks it creates, has adequate financial and non-financial resources, and can continue or wind down without causing avoidable harm.

Against this backdrop, comparing IFPR and ICARA is particularly useful. The crypto prudential regime is different, but the supervisory philosophy is familiar.

ICARA is a useful mental model

Within financial services, MiFID investment firms are familiar with the ICARA process. The point is not simply to calculate a requirement. It is to identify harms, assess risks, test capital and liquidity, consider stress events and plan for wind-down.

Crypto firms should expect a similar mindset. Their overall risk assessment should not be a compliance document completed once a year and filed away. It should be a structured assessment of the firm’s business model, risks, resources and resilience.

The most important question is not, “What is the minimum number?” It is, “What resources do we need to run the business safely and wind it down if necessary?”

Crypto risks are not all balance-sheet risks

Crypto firms may face risks that do not look like traditional market or credit exposures. These include wallet compromise, cyber incidents, loss of banking rails, market risk, stablecoin depeg events, token liquidity collapse, validator failure, smart contract issues, market abuse exposure, sanctions events, blockchain congestion, third-party custody failure, group dependency and sudden customer withdrawal activity.

A good prudential assessment should connect those risks to capital, liquidity, operational capacity and wind-down planning. It should not treat them as separate compliance topics.

For example, a cyber incident may result in legal costs, customer redress, asset recovery costs, technology rebuild costs, revenue loss, and liquidity stress. A loss of a banking partner may affect redemption, fiat settlement, customer support and business continuity. A third-party custodian failure may create customer asset return issues and operational costs.

Liquidity matters

Crypto prudential requirements extend beyond capital. Liquidity is often a more immediate concern.

A firm may be solvent on paper but unable to meet obligations as they fall due if customer withdrawals increase, banking services are disrupted, transaction volumes fall, collateral values change or counterparties require additional margin. Liquidity planning should therefore be realistic and should not rely too heavily on uncommitted group support.

The FCA has long been sceptical of prudential plans that rely on untested assumptions. Crypto firms should expect similar scrutiny.

Wind-down planning is not optional thinking

Wind-down planning should be built into the prudential workstream from the start. The plan should identify triggers, governance decisions, funding, customer asset return, communications, key staff, third-party dependencies, technology continuity and legal constraints.

The wind-down plan should be credible under stress. It should not assume perfect market conditions, cooperative counterparties, unlimited group funding, or uninterrupted access to technology.

Firms should ask whether they could still execute the plan if:

  • transaction volumes collapse;
  • a key bank terminates services;
  • a wallet provider fails;
  • a regulator imposes restrictions;
  • customers request mass withdrawals;
  • a group entity becomes insolvent; and/or
  • a cyber event restricts access to systems.

Board ownership is essential

A prudential assessment is not a finance department exercise. The governing body should own it. The board should understand the methodology, assumptions, stress scenarios, key risks, management actions and wind-down triggers, and ensure appropriate prudential standards are maintained across the business.

It should also receive MI that allows it to monitor emerging prudential risk. That may include capital, liquidity, customer asset metrics, transaction volumes, concentration risk, operational incidents, complaints, financial crime alerts, key third-party performance and market stress indicators.

Practical insight

Crypto firms should start building a framework to meet crypto prudential requirements before submitting the application. At a minimum, firms should prepare:

  • risk and harm assessment;
  • capital methodology;
  • liquidity assessment;
  • stress testing framework;
  • wind-down plan;
  • board MI pack;
  • group dependency analysis;
  • third-party dependency analysis;
  • recovery actions;
  • governance approval process.

That work will improve the authorisation application and make the business more resilient.

How C&G can help with crypto prudential requirements

C&G has practical experience with IFPR, ICARA, prudential governance, stress testing and wind-down planning. That experience is highly relevant to crypto firms because the FCA’s prudential expectations are rooted in familiar supervisory concepts. Crypto firms do not need generic capital commentary. They need a practical, evidence-based prudential framework.

**Download our complimentary C&G Guide to FCA Cryptoasset Authorisation and Regulation** for further insight into prudential readiness and overall risk assessment.