The rule.
COBS 4.12A.22R and 4.12A.24R:
“Before communicating a direct offer financial promotion for a qualifying cryptoasset to a retail client, a firm must give the client a personalised risk warning, including the client’s name. The personalised risk warning must contain the prescribed wording in COBS 4.12A.25R and must be given separately from any other financial promotion.”
“A firm must assess whether a qualifying cryptoasset is appropriate for the retail client, taking into account the client’s knowledge and experience in the investment field relevant to that cryptoasset.”
Warning + assessment + 24-hour cooling-off: the three-step gate for every UK first-time investor flow.
What it requires.
Use the consumer’s name. “Personalised” is literal. A generic warning shown to all visitors fails.
Separate surface. Its own screen, not bundled with other onboarding content — a moment of reflection, not a scroll past.
Appropriateness questionnaire. Substantive knowledge-and-experience questions. “Do you understand crypto can lose value?” (yes/no) is not enough.
Negative-outcome path. A failing consumer is declined, or proceeds with a documented warning and enhanced friction. “Pass everyone” assessments fail FCA review.
Common violations.
Warning screen: “Investing in crypto is high-risk. Click to continue.” No name.
Not personalised. Fails 4.12A.22R. Common when one component serves both warnings.
Question 1: “I understand crypto can go down in value.” [Tick to confirm]
Question 2: “I have read the risks.” [Tick to confirm]
Self-attestation, not knowledge testing. The 2024 FCA Dear CEO letter explicitly criticises this pattern.
Appropriateness assessment data: 99.7% pass rate over 12 months.
An assessment everyone passes assesses nothing. A pass rate above ~85% triggers FCA scrutiny.
Onboarding screen: KYC fields + appropriateness questions + risk warning all on one page.
Bundling fails 4.12A.22R’s “given separately” requirement.
How to comply.
After KYC, render the warning with the consumer’s legal first name interpolated. Store view and click-acknowledge timestamps.
A question bank testing volatility, irreversibility, custodial risk, smart-contract risk, regulatory risk, capital loss — multiple-choice with distractors, not tickboxes.
Target a 10–20% first-attempt fail rate; failed consumers get a learning module and retry.
Its own page, one CTA: “I have read this,” active click required. No other content or nav distractions.
Log display timestamp, answers, and acknowledgement click — the record for a Section 165 information request.
Related rules.
-
The first layer.
-
The third layer. Clock starts at personalised-warning acknowledgement.
-
The fourth layer.