The rule.
COBS 4.12A.27R:
“A firm must not communicate or approve a direct offer financial promotion for a qualifying cryptoasset to a retail client who is a restricted investor or who has not been categorised, unless: (1) at least 24 hours have elapsed since the personalised risk warning was given to the client; and (2) the client has not previously invested in qualifying cryptoassets with the firm.”
The clock starts when the personalised risk warning is delivered. For 24 hours, the consumer cannot deposit, buy, or commit funds.
What it requires.
Identify first-time investors. Determine during onboarding whether the consumer is a first-time investor with the firm — account-level, KYC-linked.
Deliver and timestamp the personalised risk warning. The clock starts at delivery; the timestamp must be auditable.
Block transaction completion for 24 hours. The funnel must actually prevent purchase, deposit, or commit. A dismissible “please wait” message is non-compliant.
Re-trigger the warning on the second visit. On return after 24 hours, refresh the warning before unlocking the transaction.
Common violations.
Onboarding step 8: “You’re ready to invest! Buy your first BTC now.”
Same session, no gate. One of the most common FCA findings on UK-facing exchanges.
Funnel: KYC → deposit GBP → wait 24h → trade.
Depositing funds to buy a cryptoasset is part of the “commitment” the rule prevents — deposits are restricted too.
Personalised warning delivered at sign-up; clock starts there rather than when the consumer engages with the warning.
Examiners want evidence the consumer read and acknowledged the warning before the clock starts. A passive display in a rushed flow is not enough.
How to comply.
A persistent “first purchase” flag — set at account creation, cleared after the first transaction — drives every downstream gate.
The warning screen requires an active click. That click starts the clock and goes in the audit trail.
Lock every upstream step too: GBP deposit, card linking, recurring-buy setup.
After the 24 hours, re-show the warning and require active acknowledgement before unlocking.
Related rules.
-
The first layer. Cooling-off is the second.
-
What the cooling-off clock starts from.
-
The fourth pillar: no referral bonuses, no “trade $X get $Y.”