You must have passed Gate 1 and hold a Sandbox Approval Notice (SAN) before applying for Gate 2. Your SAN must list your permitted FMI activities. You may not undertake any live activity until Gate 2 approval is granted.
What the Bank Is Assessing
The Bank's Gate 2 review is calibrated to the realities of a new firm using relatively untested technology. The Bank does not expect DSD-level maturity from day one — it expects a minimum level of preparedness to operate safely and wind down in an orderly way.
The Bank focuses on three primary systemic risks:
Your Document Package
Main narrative application. 9 sections covering your firm, technology, governance, operations, risk, and wind-down plan.
RequiredPDF Submission50 structured questions across 6 NIST-aligned domains. Ratings A–D with mandatory written rationale.
Requireddsscquest.xlsxArticle-by-article compliance statement against the DSS Rules Instrument 2024. 76 articles, each requiring a compliance status and explanation.
Requiredselfattestationtemplate.xlsxFit & proper declarations for all individuals and entities with significant influence or 10%+ ownership. Corporate form applies to your entity type.
Requireddss-corporate-controller-form.docxThe Application Process
-
Confirm Gate 1 status
Verify your SAN is active and lists the FMI activities you intend to conduct. Your SAN will specify: notary service, central maintenance, and settlement service (at minimum). -
Complete the Gate 2 Questionnaire
Work through all 9 sections in this guide. This is the core narrative document describing your firm's readiness. Allow 4–6 weeks for thorough completion. -
Complete the CQUEST
Rate each of 50 cyber questions A–D and write a rationale for each. If gaps exist vs. A, document your improvement plan before go-live. -
Complete the Self-Attestation Template
Work through 76 articles of the DSS Rules Instrument. For each, state Compliant / Partially Compliant / Non-Compliant and explain how you meet (or plan to meet) each article. -
Submit Controller Forms
Complete a corporate controller form for the entity and individual forms for each person who holds 10%+ or exercises significant influence. -
Engage with the Bank before submission
The Bank strongly encourages pre-submission engagement. Contact your supervisory contact to discuss gaps, questions, and expected timelines. -
Submit and await review
The Bank will assess your submission and may request follow-up information. If approved, your SAN is updated and you may begin live activity within your assigned asset limits.
The DSS application window is expected to close around March 2027. The DSS itself runs until December 2028 (extendable). Apply early enough to allow for review rounds and any required remediation before go-live.
What the Bank is looking for
A clear, accurate picture of your legal entity, its registration, ownership structure, and the specific FMI activities you intend to carry on in the DSS. Ensure this is consistent with your SAN.
For every individual or corporate entity identified in questions
1.3 and 1.4 as a controller, a separate controller form must be
submitted. For your corporate entity type, use
dss-corporate-controller-form.docx for corporate
controllers and
dss-individual-controller-form.docx for individuals.
What the Bank is looking for
The Bank wants to understand your technology stack, how DLT is used to perform FMI functions, what instruments you will support, and what your go-live timeline looks like. The DSS exists specifically to accommodate new technology — be precise and candid about how yours works.
- How DLT enables notary, maintenance, and/or settlement functions
- What asset types and instrument classes you plan to support
- Whether you are a standalone DSD or hybrid entity (DSD + trading venue)
- Realistic go-live timeline and initial operating scope
What the Bank is looking for
Robust governance is a hard requirement. The Bank needs to be satisfied that senior management are of good repute, the firm has appropriate policies, there is a sound risk management culture, and there is no unresolved conflicts of interest. Article 26 obligations are non-negotiable.
What the Bank is looking for
This section is at the heart of what a DSD does. The Bank needs confidence that you have thought through the integrity of every security issue, that assets are properly segregated, that settlement is final and timely, and that DVP is enforced. These obligations are not modifiable at Gate 2.
What the Bank is looking for
All securities-vs-cash transactions must settle on a DVP basis (Article 39.7). For GBP settlements, the Bank strongly prefers settlement through accounts at the Bank of England itself where practical. If you settle through commercial bank accounts or your own accounts, Articles 54–60 apply. This is one of the most commercially sensitive areas — be very precise about your cash leg arrangements.
What the Bank is looking for
A comprehensive risk management framework covering legal, business, operational, and other risks — including fraud and negligence. For a Gate 2 DSD, the Bank calibrates its expectations to your stage of development, but expects a credible and documented framework to be in place before go-live.
The Bank states explicitly that it will carefully review entrants' wind-down plans. This section must demonstrate that in the event of failure or cessation, participants' assets can be returned, obligations discharged, and systemic disruption avoided. A vague or aspirational wind-down plan will not pass.
What the Bank is looking for
Adequate financial resources to cover business risk and fund wind-down. Capital must be held in liquid, low-risk instruments. The Bank expects to see a documented capital policy and evidence that current resources meet requirements.
You have now worked through all 9 sections of the Gate 2 Questionnaire. Before submission, review all responses for consistency, then proceed to the CQUEST, Self-Attestation, and Controller Forms.
Open dsscquest.xlsx and work in the
Assessment tab. For each question: select a
response (A–D) in the Response column, then write your rationale
in the Rationale column. If you reference information provided in
the Gate 2 Questionnaire, signpost it rather than duplicating.
The 6 Domains
Rating Guide
| Rating | What It Means | Expectation |
|---|---|---|
| A | Highest maturity — documented, independently verified, continuously operating | Ideal — aim for this across most questions |
| B | Good maturity — documented and operating, minor gaps in assurance or frequency | Acceptable in most areas at Gate 2 |
| C | Partial — some controls in place but ad-hoc or not independently confirmed | Needs improvement plan documented in rationale |
| D | Not in place | Must have a credible, time-bound action plan before go-live |
The Bank values candour. Selecting inflated ratings without supporting rationale will be identified during review and will undermine confidence in your application. If you are at C or D on any question, own it and describe a credible improvement plan. Planned improvements before go-live are acceptable — gaps at go-live are not.
Critical Questions for Cyber Contagion (Bank Priority)
These questions are directly tied to the Bank's primary concern of cyber contagion. Aim for A or B and ensure rationale is detailed:
| Q# | Topic | Why Critical |
|---|---|---|
| Q1 | Cyber strategy approved at board level | Governance foundation |
| Q15 | IAM / MFA standard | Phishing attack prevention |
| Q16 | Remote access strong authentication | Network intrusion prevention |
| Q22 | Supply chain security | Third-party contagion risk |
| Q31 | Network monitoring | Detection of attacks |
| Q36 | Detection integrated with incident response | Response speed |
| Q38 | Incident response planning | Containment of contagion |
| Q41 | Regulatory communications in response plan | Obligation to notify the Bank |
| Q47 | Data backups — encrypted, offline | Asset data integrity |
For each article, complete two columns: Compliance Status (Compliant / Partially compliant, with actions required / Not compliant, with actions required) and Explanation of Compliance. Every article requires an explanation — do not leave any blank.
Article Groups & Complexity
| Articles | Topic | Complexity | Notes |
|---|---|---|---|
| 5.3 | Emergency notification | LOW | Confirm you will notify the Bank of any emergency promptly |
| 6.1 | SAN breach reporting | LOW | Confirm process for reporting SAN breaches immediately |
| 19.1–19.6 | Extension & outsourcing of activities | MED | If not outsourcing core services at go-live, most will be N/A |
| 26.1–26.7 | Governance — general provisions | HIGH | Core — cross-reference Section 3 of Gate 2 Q |
| 27.1 / 27.5 | Senior management | MED | Cross-reference controller forms |
| 29.1–29.2 | Record keeping (5 years) | LOW | Cross-reference Section 9 of Gate 2 Q |
| 30.1–30.3 | Outsourcing | HIGH | Cross-reference Section 6 of Gate 2 Q; detailed only if outsourcing |
| 32.1 | Conduct of business / goals | LOW | Cross-reference Section 3 Q3.5 |
| 33.1 | Participation criteria | LOW | Cross-reference Section 9 |
| 36.1 | DSD services — general | MED | Rules and procedures for SSS operation |
| 37.1–37.3 | Integrity of the issue | HIGH | Daily reconciliation, no overdrafts — cross-reference S4 |
| 38.1–38.7 | Asset protection & segregation | HIGH | Core — cross-reference Section 4 |
| 39.1–39.7 | Settlement finality + DVP | HIGH | Core — cross-reference Sections 4 & 5 |
| 40.1–40.3 | Cash settlement | HIGH | Core — cross-reference Section 5 |
| 41.1 | Default rules | MED | Cross-reference Section 4 Q4.4 |
| 42.1–47.2 | Prudential + risk framework | HIGH | Cross-reference Sections 6, 7, 8 |
| 48.1–48.10A | DSD links | MED | Only relevant if you plan DSD-to-DSD links; N/A otherwise |
| 54–60 | Banking-type ancillary services | HIGH | Only applies if settling through own accounts or acting as credit institution |
The Bank explicitly allows cross-referencing. Where your Gate 2 Questionnaire already addresses an article, write in the Explanation column: "See Gate 2 Questionnaire, Section [X], Question [Y]" and add any additional detail specific to the legal article. This saves time and keeps your submission consistent.
Who Must Submit a Controller Form?
-
Any corporate entity holding 10%+ of shares or
voting rights in the applicant →
dss-corporate-controller-form.docx -
Any individual holding 10%+ of shares or voting
rights →
dss-individual-controller-form.docx -
Any individual who exercises
significant influence over the management of the
applicant (regardless of ownership) →
dss-individual-controller-form.docx -
Any partnership with a controlling stake →
dss-partnership-controller-form.docx
Controller forms ask about criminal convictions, regulatory sanctions, civil proceedings, and financial history. These declarations are made directly to the Bank of England. Incomplete or inaccurate declarations are a serious regulatory matter. When in doubt, disclose and explain.
Corporate Controller Form — Key Sections
For your corporate entity, the form typically requires:
- Full legal name, registration details, and registered address of the controlling entity
- Description of the nature and extent of control or influence held
- Details of the controlling entity's own ownership structure (UBOs)
- Any regulatory authorisations or recognitions held by the controlling entity
- Declarations on legal proceedings, financial soundness, and fitness
- Signature of an authorised signatory of the controlling entity
Individual Controller Form — Key Sections
- Personal details, address history (last 5 years), nationality
- Employment history (last 10 years)
- Regulatory approvals held (SMF/CF functions at other firms)
- Criminal record declarations
- Civil proceedings, regulatory sanctions, disciplinary history
- Financial soundness (bankruptcy, IVAs, etc.)
- Conflicts of interest
The dss-controller-form-privacy-notice.pdf in the
project documents sets out how the Bank processes personal data in
controller forms. Each individual submitting a form should be
provided with this privacy notice before completing their form.
The Bank strongly encourages pre-submission engagement. Contact your supervisory point of contact to discuss your application, flag any areas of uncertainty, and agree a submission date. Do not submit cold without prior engagement.
Document Checklist
📋 Gate 2 Questionnaire
- ☐ Section 1 — Firm details, SAN confirmation, ownership structure complete
- ☐ Section 2 — Business model, DLT architecture, instrument eligibility addressed
- ☐ Section 3 — Governance structure, senior management fit & proper, conflicts policy
- ☐ Section 4 — Settlement finality rules, asset segregation, DVP mechanism, default rules
- ☐ Section 5 — Cash settlement arrangements, DVP enforcement, participant disclosures
- ☐ Section 6 — Risk management framework covering legal, business, operational risk
- ☐ Section 7 — Wind-down plan with triggers, process, timeline, and financial resources
- ☐ Section 8 — Capital position calculated and documented, investment policy in place
- ☐ Section 9 — Participation criteria, record keeping arrangements confirmed
🔐 CQUEST (dsscquest.xlsx)
- ☐ All 50 questions answered with A/B/C/D rating in Response column
- ☐ Rationale written for every question (not just those with C or D)
- ☐ Any C/D ratings have a credible improvement plan with timeline
- ☐ Questions overlapping with Gate 2 Questionnaire are cross-referenced
- ☐ Cyber contagion priority questions (Q1, 15, 16, 22, 31, 36, 38, 41, 47) reviewed by CISO / technical lead
📜 Self-Attestation (selfattestationtemplate.xlsx)
- ☐ All 76 articles have a Compliance Status selected
- ☐ All 76 articles have a written Explanation (no blanks)
- ☐ Partially compliant / non-compliant articles have action plans
- ☐ High-complexity articles (37, 38, 39, 40, 42–47) reviewed by legal counsel
- ☐ Article 54–60 section: completed if settling through own/commercial bank accounts; N/A flagged if not applicable
- ☐ Article 48 section: completed if DSD links planned; N/A flagged if not applicable
- ☐ Explanations cross-reference Gate 2 Questionnaire sections consistently
👤 Controller Forms
- ☐ Corporate controller form completed for all corporate controllers (10%+)
- ☐ Individual controller form completed for all individual controllers (10%+)
- ☐ Individual controller form completed for all persons exercising significant influence
- ☐ Privacy notice provided to all individuals submitting forms
- ☐ All forms signed by appropriate authorised signatories
Consistency Checks
- ☐ Firm legal name is identical across all documents and matches Companies House
- ☐ FMI activities described in Gate 2 Q match those in your SAN exactly
- ☐ Ownership/controllers in Gate 2 Q Section 1 match controller forms submitted
- ☐ Cash settlement approach is consistent across Gate 2 Q Section 5 and Self-Attestation Arts 40, 54–60
- ☐ Wind-down financial resources in Section 7 are consistent with capital position in Section 8
- ☐ Outsourcing arrangements in Section 6 are consistent with Self-Attestation Arts 19 and 30
Once all items above are checked, compile your full package and submit via the Bank of England's designated submission route. After submission, remain available for follow-up questions — the Bank typically responds with clarification requests before making a final determination. Keep a timestamped record of your submission.