Crypto Compliance for UK Businesses: What the FCA Actually Requires

If your business accepts crypto payments, runs a wallet service, operates an exchange, or even just provides crypto investment advice — there’s a good chance you need to be registered with the FCA under UK anti-money laundering law. Not recommended. Not best practice. Required by law. Operating without that registration is a criminal offence carrying up to two years in prison and an unlimited fine. Yet when I looked into the numbers, hundreds of UK firms have been operating in legal grey territory, and many still don’t fully understand what’s actually required of them.

Who Needs to Register With the FCA

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 — the MLR 2017 — require all UK cryptoasset businesses to register with the FCA before operating. The definition of “cryptoasset business” is broader than most people expect. It covers crypto exchanges, custodian wallet providers, peer-to-peer platforms, token issuers involved in exchange activity, and crypto ATM operators.

The FCA maintains a Cryptoasset Register. Any business carrying on cryptoasset activity as defined in the MLR 2017 must appear on it. This is separate from the broader FCA authorisation regime. Registration under the MLR is specifically about anti-money laundering and counter-terrorism financing compliance — it doesn’t grant permission to conduct regulated financial activities under FSMA 2000, which requires a separate authorisation.

As of early 2026, the FCA had approved around 50 firms for full registration and had seen over 250 firms either withdraw their applications or have them rejected — including several high-profile names. The rejection rate tells you something about how seriously the FCA is taking this process.

What the Money Laundering Regulations Actually Require

MLR 2017 compliance isn’t a one-time tick-box. It requires ongoing systems and controls. The core obligation is customer due diligence (CDD) — verifying the identity of customers before establishing a business relationship or conducting transactions above certain thresholds. For most crypto businesses, that means ID verification at onboarding and ongoing monitoring of customer activity.

Enhanced due diligence (EDD) kicks in for higher-risk customers — politically exposed persons (PEPs), customers from high-risk countries on FATF’s list, or anyone whose transaction patterns look unusual. EDD requires more evidence of source of funds, more frequent review, and senior management sign-off in some cases. Getting this calibration wrong — applying standard CDD where EDD is needed — is one of the most common findings in FCA supervisory visits.

Suspicious Activity Reports (SARs) must be filed with the National Crime Agency whenever a business has knowledge or suspicion that a customer is involved in money laundering or terrorist financing. Over 900,000 SARs were filed with the NCA in the 2022-23 reporting year across all sectors. Crypto firms that fail to file SARs when they should face serious regulatory and criminal exposure.

The Travel Rule: Crypto’s Biggest New Compliance Burden

The Travel Rule came into force in the UK on 1 January 2024. It’s arguably the single most operationally demanding requirement that’s hit crypto businesses in years. Under the rule, Virtual Asset Service Providers (VASPs) must collect and pass on information about the originator and beneficiary of crypto transfers — similar to the information requirements that already apply to wire transfers.

For transfers of £1,000 or more, the sending VASP must obtain and transmit the name, account number, and address of the sender, and the name and account number of the recipient. The receiving VASP must screen this information and can reject transactions where it’s missing or incomplete. The practical problem is that not all global VASPs are Travel Rule compliant — particularly smaller exchanges and DeFi protocols — creating friction in cross-border transfers.

UK businesses caught sending transfers without the required information face enforcement action. The FCA has been clear that it expects Travel Rule compliance to be embedded in onboarding flows and transaction processing systems, not handled as a manual afterthought. Third-party Travel Rule solutions — from providers like Notabene, Sumsub, and Sygna — have emerged to automate compliance, but implementation takes time and budget.

Crypto Financial Promotions — A Separate Obligation Since October 2023

Many UK crypto businesses were caught off guard by the financial promotions regime that came into force in October 2023. Under rules introduced through FSMA 2000 (Financial Promotion) Order 2005 as amended, all crypto financial promotions to UK consumers must be either approved by an FCA-authorised person, made by an FCA-registered cryptoasset business, or exempt under one of a narrow set of categories.

The FCA’s guidance is strict. Promotions must be clear, fair, and not misleading. They must include risk warnings — specific ones, not generic disclaimers buried in footers. The required risk warning since October 2023 is: “Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong.” This must be prominent and legible, not hidden.

Coinbase, Bybit, and several other major exchanges temporarily withdrew from the UK market rather than immediately comply with the new promotions rules. Binance was banned from approving its own financial promotions in the UK. The FCA issued over 100 alerts about illegal crypto promotions in the first three months after the rules took effect.