Section 21 FSMA, the Financial Promotion Order, and COBS 4.12A. In force since 8 October 2023. Hardened by February 2026 enforcement action against HTX. Applies to overseas firms communicating to UK consumers, not just UK-authorised firms.
It starts with one perimeter question — the Section 21 gateway — and then a four-part content rule set: a prescribed risk warning, a 24-hour cooling-off period for first-time investors, a personalised risk warning + appropriateness assessment, and an outright ban on incentives. The combination is stricter than MiCA and applies even to firms that have never set foot in the UK if their promotion reaches a UK consumer.
The perimeter every other rule sits behind: who may lawfully communicate a crypto promotion to UK consumers. Get it wrong and the content rules are moot — it is a criminal offence under FSMA s25.
The exact 100-word warning, in the prescribed wording, with prominence requirements. Post-HTX, this is the line FCA examiners start at.
A first-time investor cannot complete a cryptoasset purchase within 24 hours of receiving the direct-offer financial promotion. This is a funnel-design constraint, not a footer note.
Before a first-time investor can transact, the firm must show a personalised risk warning and run an appropriateness assessment. Not a checkbox; a sequenced flow with friction the FCA specifically wants in.
Refer-a-friend, sign-up bonus tokens, “trade $X get $Y” promotions are banned in the UK cryptoasset perimeter. This affects every growth team that imported a fintech playbook.
A shirt, a stadium board or an ambassador post can be a Section 21 financial promotion. After the FCA’s June 2026 letter to every UK football club, this sets out when a partnership crosses the perimeter and who carries the liability — club, firm, or agency.
Paste any UK-facing crypto marketing copy or URL. Verdict against the FCA regime in seconds.
A signed audit across MiCA, FCA, and GDPR. Five business days. From €4,950.
FCA-style audit trails are about to become machine-verifiable. The rules pages are the upstream input.