The FCA’s Crypto Regime Puts Intent on the Record: What MARC Means for Trading Firms

A crypto trading platform can usually show a regulator every order and every fill, timestamped to the millisecond. What it often can’t produce is the Telegram chat between a trader and a token issuer the night before a listing. Under the UK’s new cryptoasset regime, that gap is no longer an operational blind spot. It is evidence of potential market abuse risk and should be monitored as such.

On June 30, 2026, the FCA published final rules for its cryptoasset regime, five policy statements that bring digital asset trading platforms, dealers, custodians, staking providers, and stablecoin issuers under full FCA authorization from October 25, 2027. Most of the conversations I have with crypto firms across EMEA and APAC start with capital and custody. They should also include surfacing and policing market abuse, because that’s where the distance between how these firms operate today and what the FCA will expect is widest.

What the FCA Finalized, and What It Hasn’t

These final rules are not yet in force. The market abuse piece sits in PS26/9, which creates the Market Abuse Regime for Cryptoassets (MARC) in a new CRYPTO 4 sourcebook. MARC adapts the UK Market Abuse Regulation (UK MAR) to include crypto, thus prohibiting insider dealing, unlawful disclosure of inside information, and market manipulation. Trading platforms and intermediaries will need systems to detect and report suspicious activity, along with insider lists and controls on personal account dealing.

MARC is also a first version. The FCA has acknowledged that the structure of crypto markets means MARC can’t yet deliver the same outcomes UK MAR does. I’d treat that as a starting point. Supervisory expectations rarely stay where they begin.

The ledger records what moved. It can’t tell you why.

The final rules also set an important size threshold. Platforms with £10 million or more in average annual revenue across their group carry extra obligations, including cross-platform information sharing and on-chain monitoring, though the FCA narrowed the on-chain monitoring requirement from what it consulted on.

Dates That Matter

• September 30, 2026: the FCA’s application window opened.
• February 28, 2027: the application window closes.
• October 25, 2027: the full regime, including MARC, applies.

Most firms have circled October 2027, but the date I’d plan around is the February one. During an application firms explain to the FCA how its systems and controls work, and a surveillance program that exists only as a distant project plan is hard to describe convincingly.

Intent Doesn’t Live on the Blockchain

Crypto firms are used to the ledger being their best defense. Every transfer is public and traceable, and much of the sector’s compliance thinking has been built on that.

Market abuse cases don’t work that way. Insider dealing turns on what someone knew and when they knew it. Manipulation turns on what a trader meant to do. The blockchain can show that a wallet bought a token an hour before a listing was announced. It can’t show that someone at the firm mentioned the listing in a group chat the day before. The ledger records what moved. It can’t tell you why.

That evidence lives in communications, and crypto firms communicate in places traditional finance has spent years learning to control: Telegram, Discord, WhatsApp, Signal, and direct messages on X. Much of it happens on personal devices, and a good share involves project teams and market makers outside the firm.

A record you can’t find quickly is a record you don’t have.

The FCA’s consultation proposed that platforms and intermediaries monitor orders, transactions, and communications for signs of abuse. Set the letter of the rule aside and the practical point still holds. Any firm investigating a suspicious trade will need the conversation behind it, and a program that only watches the order book will find the pattern and miss the reason.

Capture and Record Keeping Is Where Crypto Firms Are Least Ready

Once authorized, crypto firms will be subject to the FCA’s general systems and controls rules in the same way as other authorized firms. Whether the specific recording requirements in SYSC 10A reach crypto activities is something each firm should confirm for its own business. Either way, MARC creates a practical need for records a firm can produce on request.

Capture is the first challenge. When a supervisor asks about a specific trade, the firm must pull the messages and order data around that event and show how they connect, alongside the insider list for that token. Insider lists alone require the identity of each person with access, the reason they had it, and the timeline. At many crypto firms, that information is spread across spreadsheets and individual inboxes. A record you can’t find quickly is a record you don’t have.

Four Places to Start Before February

1. If you haven’t yet, map every channel your population uses. Include personal devices and the community channels where staff talk to project teams or market makers. Then decide which channels are permitted and how each one will be captured.
2. Connect communications to trade data. Pick a past trade and try to rebuild it, messages included. How long that takes will show you where the gaps are.
3. Check your insider list and personal account dealing controls against MARC. Whether you’re starting fresh or adapting what you already run, insider list management is a big job at scale. Leave time to close the gaps before you apply.
4. Name the accountable senior manager. The Senior Managers and Certification Regime (SM&CR) applies, and the FCA has said it expects senior managers to work from the firm’s principal place of business in the UK. Someone needs to own market abuse controls, and the FCA will want to know who.

Where Shield Fits

Once you can capture channels and have insider lists in place, you will need a platform that can process and analyze the data. That’s Shield.

Shield Archive captures and retains communications from more than 100 data sources, including email, chat, voice, and collaboration platforms, in one centralized archive. Shield Surveillance uses multi-layered AI to flag market abuse risk across those communications. Neither replaces a firm’s own judgment or its responsibility to the FCA. What they do is make the evidence findable when the question comes.

Trust Has to Be Evidenced

Trust is the currency of the financial system, and crypto firms have pushed hard for the regulation that comes with earning it. The FCA’s regime gives them that. It also asks them to prove, with records, that their markets are clean. The firms that plan around February 28 and start with their communications will have the easier conversation.

If you’re preparing an FCA application and want to pressure-test how your communications surveillance will hold up, get in touch with our team.