Registering as a cryptoasset business: the ten most common gaps
Drawing on our authorisation work with UK cryptoasset exchange and custodian wallet providers, we identify the ten weaknesses that most frequently trigger further information requests or applicant withdrawal. Recurring themes include an under-developed firm-wide risk assessment, monitoring coverage that fails to reflect on-chain typologies such as mixer usage and peel chains, weak evidence for the source of wealth of high-net-worth customers, and governance structures that place the MLRO too far from the executive.
The pattern the FCA sees
Withdrawal rates for cryptoasset applications remain materially higher than for other regulated populations. The reasons are consistent across applicants and, more importantly, are addressable before submission.
The ten gaps
1. Firm-wide risk assessment written to a template rather than to the business.
2. Monitoring coverage that ignores on-chain typologies (mixers, peel chains, chain-hopping).
3. Source-of-wealth evidence for HNW customers that relies on self-declaration.
4. MLRO reporting line that does not reach the board directly.
5. Travel-rule solution scoped only for domestic transfers.
6. Sanctions screening that does not resolve wallet addresses to designated persons.
7. Customer risk model without cryptoasset-specific factors.
8. Weak record retention for on-chain evidence.
9. Training that does not cover cryptoasset-specific typologies.
10. No mechanism to review and re-baseline monitoring rules.