When the FCA set out to assess how firms were responding to the crypto financial promotions regime, it wasn’t looking for edge cases or obscure technical failures. What it found were the same problems, at firm after firm, across the same five areas. None of them are surprising. Most of them stem not from ignorance of the rules but from a gap between what a firm’s compliance policy says and what actually happens when a customer interacts with a promotion.
That distinction matters. It means that having a compliant framework on paper is not the same as being compliant in practice — and the FCA is now experienced enough to tell the difference.
1.Risk Warnings That Are Present But Not Prominent
The FCA’s mandated risk warning — the fixed wording that must appear in every qualifying promotion, set out in full in last week’s piece — is not a checkbox. The requirement is not just that it appears. It must be prominent, meaning a consumer must actually see it and register its significance before they engage with the promotional content.
What the FCA found is that many firms had the warning in place but had not satisfied the prominence requirement. It was there, but greyed out. Or displayed in a smaller font than the surrounding copy. Or positioned after the main call to action, where attention had already been captured. Or absent entirely from certain formats — mobile displays, video, social media posts — where the full desktop version had been reviewed but the adapted formats had not.
Prominence is not a design preference. It is a regulatory requirement. If a consumer has to look for the risk warning, it is not prominent enough.
2.Cooling-Off Periods That Exist on Paper but Not in Practice
The regime requires a 24-hour cooling-off period for first-time investors. Before a consumer who has not previously invested through the firm can receive a direct offer financial promotion, they must be given that period. The purpose is to interrupt the decision-making journey and ensure the investment is considered rather than impulsive.
The FCA found that the cooling-off requirement was widely acknowledged in compliance documentation but frequently not built into the customer journey as a functioning system. In practice, this meant that first-time investors could proceed without the pause being enforced. The policy said one thing; the platform did another.
This is one of the clearest illustrations of the accountability gap the FCA is focused on. A firm that can produce a cooling-off policy but cannot demonstrate that the policy is operational is not compliant — and the FCA will not treat the documentation as a substitute for the practice.
3.Appropriateness Assessments in Form but Not in Substance
Appropriateness assessments are required before a consumer can proceed with a crypto investment. The assessment must establish that the consumer understands the risk and nature of what they are investing in. Where the assessment indicates they do not, they should not be allowed to proceed — or should only do so with explicit acknowledgment of the risk they are taking on.
What the FCA found was that many firms had assessments in place that were not doing the job they are designed to do. Questions were framed in ways that made correct answers obvious. Consumers who answered incorrectly were prompted to try again until they passed. Retry limits were absent or unenforced. The result was that virtually everyone completed the assessment successfully — which is precisely the outcome the requirement was designed to prevent.
An appropriateness assessment that routes everyone through is not an appropriateness assessment. It is a compliance box-ticking exercise, and the FCA treats it as such
4.Incentive Structures That Were Never Removed
The prohibition on investment-linked incentives is absolute. Referral bonuses, sign-up rewards, cashback offers tied to investment activity — all of it is prohibited. There is no compliant version of an incentive structure that rewards a consumer for investing.
This was a significant change for many firms. Before October 2023, incentive-based marketing was standard practice in the crypto sector. When the regime came into force, those structures needed to be removed entirely.
The FCA found that many had not been. Some firms had removed the most visible incentives but left others in place — tiered rewards, loyalty schemes, referral programmes — that still fell within the prohibition. Others had removed the UK-facing versions but had not extended the change to affiliate channels or partner platforms where the promotion was still reaching UK consumers.
The prohibition is not limited to promotions you create directly. If an incentive is offered anywhere in the chain that leads a UK consumer to invest, it is captured
5.Affiliate and Partner Channels Operating Without Oversight
The fifth area is also the most significant for senior management, and the one where the accountability gap is widest. The FCA found that many firms had no meaningful oversight of what their affiliate, influencer and third-party partner channels were publishing — meaning non-compliant promotions were reaching UK consumers without the firm’s knowledge or review. The principle is straightforward: firms are responsible for every promotion that reaches UK consumers on their behalf, whether they created it or not. The full implications of this — what oversight actually requires in practice, where firms are most exposed, and what a functioning monitoring framework looks like — will be covered in a dedicated piece later in this series.
Using These Findings as a Diagnostic
The value of the FCA’s published findings is not just that they describe what went wrong elsewhere. They are a diagnostic tool. Each of the five areas maps to something that can be tested in your own operations — not by asking whether your policy addresses it, but by asking whether your systems actually deliver on what your policy says.
That distinction is what the FCA is examining. The findings above are where the gap between policy and practice has already been found. If your own review of those areas produces any uncertainty, that is where to start.
Final Thought
The FCA’s findings are public and specific. Firms that have read them and tested their own frameworks against each area are in a stronger position than those that have not. The five areas above cover four of the five findings in detail — affiliate and partner channel oversight, the fifth, is covered separately given the depth of what it requires in practice.
The right question at this stage is not whether your compliance framework exists. It is whether, for each of these five areas, your systems would hold up if the FCA asked you to demonstrate them.
| We help crypto firms assess and strengthen their financial promotions framework quickly and practically.
Email: info@lhiconsult.com | Phone: +44 203 319 5147 | Web: lhiconsult.com |
This article is for general information purposes only and does not constitute legal or regulatory advice. LHI Consulting is a trading style of LHI Holdings Ltd, registered in England and Wales, No. 11496647.
FAQs
Where did the FCA publish its findings from reviewing firms’ promotions?
The FCA has published its supervisory findings through a combination of portfolio letters, published guidance, and enforcement announcements. Its feedback on the crypto financial promotions regime reflects reviews conducted across registered and authorised firms since the regime came into force in October 2023.
Our risk warning appears in every promotion. Is that enough?
Not necessarily. The requirement is for the warning to be prominent — not merely present. The FCA’s findings identified cases where the warning was visible but did not meet the prominence standard because of its positioning, size, contrast or omission from certain formats. Every channel and format your promotions appear in needs to be assessed against the prominence requirement, not just the primary desktop version.
How do we make our appropriateness assessment compliant?
A compliant appropriateness assessment must be capable of actually restricting consumers who do not demonstrate sufficient understanding of the risks involved. If your assessment allows unlimited retries, prompts correct answers, or produces a near-universal pass rate, it is unlikely to satisfy the FCA’s standard. The assessment should be reviewed against the FCA’s published guidance and tested against realistic consumer scenarios.
We removed our referral programme when the regime came into force. Are we covered?
You need to check whether the removal was applied consistently across all channels — including affiliates, partner platforms, and any third-party integrations. The FCA found cases where the prohibition had been applied to a firm’s own promotions but had not extended to partner channels still reaching UK consumers. If any channel in your distribution chain offers an investment-linked incentive to UK consumers, the prohibition applies.
How do we use these five findings to review our own framework?
Treat each finding as a test, not a description. For risk warning prominence: pull your last five promotions across every format and channel and assess whether the warning meets the prominence standard in each. For cooling-off: walk through your first-time investor journey end to end and confirm the 24-hour period is enforced by the system, not just referenced in policy. For appropriateness: look at your assessment completion data — if the pass rate is near-universal, the assessment may not be functioning as intended. For incentives: audit every active promotion and partner channel for anything that could constitute an investment-linked reward. For affiliate oversight: that question requires its own treatment and will be covered in a dedicated piece later in this series.