Cryptoasset businesses

Regulation 56 contains the prohibition on acting in the specified businesses without required registration. Regulation 57 sets out the application and information framework; it is not, by itself, the complete registration duty. The authority assesses the application and relevant fitness and propriety under the statutory framework.

Applicants need evidence showing how their business model, governance and controls address financial-crime risks. Material changes or inaccuracies in submitted registration information must be notified under the applicable provisions; registration is not the end of supervisory obligations.

Part 7A sets requirements for information accompanying covered cryptoasset transfers, including obligations of originator, beneficiary and intermediary businesses. The UK Travel Rule took effect on 1 September 2023. Required information and verification depend on the transfer circumstances and applicable provisions; it is not a blanket exemption for small transfers.

Businesses must have risk-based procedures for missing or incomplete information and decisions to execute, reject or suspend relevant transfers. Transfers involving overseas counterparties and unhosted wallets need assessment under the actual rules and FCA expectations, not an assumption that every wallet must belong to a regulated institution.

Blockchain analytics may support risk assessment, monitoring and sanctions investigations, but a vendor risk score does not replace CDD, source-of-funds analysis or a reasoned decision. Check attribution quality and the context of indirect exposure.

The financial-promotions regime is separate from AML registration and includes restrictions on communicating qualifying cryptoasset promotions to UK consumers. A business must identify a lawful communication route and comply with the applicable FCA rules. AML law does not create a general obligation to transfer cryptoassets or pay a wallet deposit to unlock funds.

Regulation 18 requires a relevant person to identify and assess its money-laundering and terrorist-financing risks. The assessment must consider customers, countries or geographical areas, products or services, transactions and delivery channels, as well as information made available by the supervisory authority. Its extent must be appropriate to the size and nature of the business.

Keep a written record and keep the assessment up to date unless the supervisor has determined that an individual documented assessment is unnecessary for the sector. Regulation 18A separately addresses proliferation-financing risk: the risk of breaches, non-implementation or evasion of financial sanctions connected with proliferation of weapons of mass destruction.

Regulation 19 requires proportionate policies, controls and procedures to manage identified risks. These cover risk management, internal controls, customer due diligence, reporting, record keeping and monitoring compliance. Senior management must approve them; they must be reviewed and updated. Regulation 20 addresses group-wide arrangements, including relevant overseas branches and subsidiaries.

Where appropriate to the size and nature of the business, Regulation 21 requires a board or senior-management officer responsible for compliance, screening of relevant employees and an independent audit function. A nominated officer receives internal suspicion reports where required. These roles are distinct; not every firm has an FCA-designated SMF17 role. Regulation 24 requires relevant staff, and relevant agents where applicable, to receive regular training, with written records of the measures taken.

Customer due diligence (CDD) is required when establishing a business relationship, when applicable occasional-transaction thresholds are met, when money laundering or terrorist financing is suspected, or when the adequacy or accuracy of earlier identification information is in doubt. Sector-specific triggers also apply; a threshold is not permission to ignore suspicion below that amount.

Regulation 28 requires identification and verification using reliable, independent sources, identification of beneficial owners with reasonable verification measures, and assessment of the purpose and intended nature of the relationship. Understand a corporate customer's ownership and control structure and check the authority of anyone acting on its behalf. Do not rely solely on a public register to establish beneficial ownership.

Regulation 30 generally requires verification before establishing the relationship or carrying out the transaction. Its limited exceptions have conditions and are not a general entitlement to defer checks. Regulation 30A contains separate duties to report qualifying material discrepancies in relevant beneficial-ownership registers; not every typographical difference is reportable.

Ongoing monitoring includes scrutiny of transactions for consistency with the firm's knowledge of the customer, business and risk profile, including the source of funds where necessary. Keep due-diligence information current. The law requires an effective risk-based outcome, not one particular software product or a universal annual review interval.

Where a firm cannot apply the required CDD, Regulation 31 generally requires it not to establish the relationship or execute the relevant transaction, to terminate an existing relationship and to consider a disclosure. Specific exceptions exist, including for certain legal work; apply the actual provision rather than automatically blocking every instruction.

Regulation 40 generally requires CDD evidence and transaction records to be retained for five years after a business relationship ends or an occasional transaction completes. Personal data must ordinarily be deleted afterwards, subject to the statutory exceptions. AML records do not remove data-protection obligations.

Enhanced due diligence (EDD) and enhanced ongoing monitoring apply to the higher-risk circumstances specified in Regulation 33. These include identified high risk and specified country-related circumstances. The amended transaction triggers include transactions that are unusually complex or unusually large given their nature, unusual patterns of transactions, or transactions without an apparent economic or legal purpose. Examine the background and purpose and record the findings.

Regulation 35 addresses politically exposed persons (PEPs), their family members and known close associates. Required measures include senior-management approval, adequate measures to establish source of wealth and source of funds, and enhanced monitoring. A PEP is not automatically suspected of crime.

For domestic PEPs and their family members or known close associates, the statutory starting point is lower risk than for non-domestic PEPs where no additional enhanced risk factors are present. The extent of EDD must reflect that distinction. Simplified due diligence under Regulation 37 is available only on a properly evidenced low-risk assessment, not when suspicion or another mandatory EDD trigger applies.

Sections 327–329 of the Proceeds of Crime Act 2002 create the principal money-laundering offences. Section 330 contains the regulated-sector failure-to-disclose offence, including where there are reasonable grounds for knowledge or suspicion, subject to its statutory conditions and exceptions. Reports are made through the nominated officer where appropriate and to the National Crime Agency (NCA).

A suspicious activity report (SAR) is not the same as a request for a defence against money laundering (DAML). Where a proposed act could engage a principal offence, assess whether a defence is needed before proceeding and observe the applicable statutory process. A DAML is not an NCA endorsement of the customer or a general clearance for future activity.

Section 333A addresses tipping off in the regulated sector and section 342 addresses prejudicing an investigation, each with specific elements and exceptions. Terrorist-financing offences and disclosure duties arise separately under the Terrorism Act 2000. Obtain appropriately qualified advice on privilege, exceptions and any proposed disclosure.

UK sanctions obligations are separate from the MLR customer-risk framework. Relevant regulations may prohibit dealing with frozen funds or economic resources, or making funds or economic resources available to or for the benefit of designated persons, including entities owned or controlled by them. The exact restrictions and exceptions depend on the applicable sanctions regime.

A name match needs investigation, and absence from a list does not settle ownership or control. Where applicable, freeze assets, do not proceed without a lawful exception or licence, and comply with the relevant reporting obligations to the Office of Financial Sanctions Implementation (OFSI). Overseas sanctions do not automatically have the same legal scope as UK sanctions.