UK AML Rules for Crypto: Compliance Guide & FCA Requirements

You want to launch a crypto business in the UK? Good luck getting past the Financial Conduct Authority (FCA). It’s not just a hurdle; it’s a gauntlet. Since January 2020, the UK has treated crypto assets like traditional financial instruments under its anti-money laundering laws. This means if you run an exchange or hold customer keys, you aren’t just a tech startup anymore-you’re a regulated entity with heavy obligations.

The reality is harsh. Between 2020 and 2023, nearly 87% of crypto firms failed their initial FCA registration attempts. Why? Because most founders underestimated the paperwork. They thought blockchain innovation exempted them from old-world banking rules. It didn’t. The Money Laundering Regulations 2017 apply fully. If you ignore this, you face fines, shutdowns, or worse-being blacklisted from banking partners who fear regulatory blowback.

Who Needs to Register?

Not every crypto company needs FCA approval, but most do. You fall under these rules if you operate as a cryptoasset exchange provider or a custodian wallet provider. Let’s break that down simply:

• Cryptoasset Exchange Providers: If you swap one crypto for another (like Bitcoin for Ethereum) or crypto for fiat currency (like GBP), you’re an exchange provider. This includes peer-to-peer platforms if you facilitate the trade.
• Custodian Wallet Providers: If you hold private keys on behalf of customers, you’re a custodian. Think of services like Coinbase Custody or Ledger Live if they manage your keys centrally.

If you’re purely developing software without holding funds or facilitating trades, you might escape registration. But be careful. The FCA looks at substance, not labels. If your app allows users to buy crypto directly via card and stores it, you’re likely in scope. Don’t guess here. Get legal advice before you start coding.

The Core Obligations: KYC and Monitoring

Once registered, your daily life changes. You must implement robust Customer Due Diligence (CDD) processes. This isn’t just asking for an email address. You need to verify identity using at least two independent sources. For example, a government-issued ID plus a utility bill or bank statement. If the risk is higher-say, a client from a high-risk jurisdiction-you trigger Enhanced Due Diligence (EDD).

EDD means digging deeper. You ask where the money came from. You check if the person is a Politically Exposed Person (PEP). According to recent industry data, crypto firms spend 37.8% more effort on PEP checks than traditional banks because crypto anonymity makes tracing harder. You also need ongoing monitoring. If a user suddenly moves £500,000 after months of small transactions, your system should flag it. Static KYC isn’t enough. You need dynamic surveillance.

The Travel Rule: Tracking Transfers

In 2022, the UK implemented the Travel Rule. This aligns with global Financial Action Task Force (FATF) standards. Here’s how it works: If a transfer exceeds £1,000, you must collect and share specific information about both the sender and the receiver. This includes names, account numbers, and addresses.

Why does this matter? It stops bad actors from bouncing money between unhosted wallets to hide its trail. Before this rule, sending crypto was often anonymous. Now, for significant amounts, it leaves a paper trail similar to wire transfers. Your compliance team needs tools to automate this. Doing it manually is impossible at scale. Many firms use blockchain analytics providers like Chainalysis or Elliptic to screen counterparties automatically. Without this tech stack, you’ll drown in manual checks.

Registration Reality Check: Costs and Timelines

Let’s talk money and time. These are the two things founders forget until it’s too late. On average, setting up compliance costs a new firm £287,500. That’s not a typo. Ongoing annual costs hover around £142,300 per firm. This covers staff, software, audits, and legal fees.

Time is equally brutal. The official processing time is three months, but reality differs. In 2024, the average wait was 9.2 months. Some firms reported 14 months of back-and-forth with the FCA. During this limbo, you can’t legally operate fully. You’re burning cash while waiting for a green light. Most successful applicants hire external consultants. About 78% of firms do this. It feels expensive, but trying to navigate FCA expectations alone often leads to rejection and restarts.

Upcoming Changes: The FSMA Transition

The current regime is transitional. By late 2025 and into 2026, the UK will shift to a comprehensive licensing framework under the Financial Services and Markets Act (FSMA). This replaces the simple registration system with full authorization.

What does this mean for you? Stricter rules. Draft amendments published in April 2025 propose lowering the threshold for notifying ownership changes from 25% to 10%. If someone buys 10% of your shares, you must tell the regulator immediately. This aims to catch hidden controllers who might use complex structures to evade scrutiny. Also, counterparty due diligence will become mandatory even if the other party isn’t your direct customer. This aligns with FATF Recommendation 15 on new technologies.

Experts warn this transition could shrink the market. Analysts predict a 35-40% reduction in regulated entities by 2027. Smaller firms may not survive the increased burden. Larger players with deep pockets will consolidate power. If you’re planning to enter the UK market now, build for FSMA standards, not just current MLR requirements. It saves you a painful migration later.

Common Pitfalls to Avoid

Most rejections happen for predictable reasons. The FCA’s threat assessment highlights three main failures:

1. Inadequate Risk Assessments: 62% of failures cited poor risk mapping. You can’t copy-paste a template. Your risk assessment must reflect your specific business model. Do you serve retail investors? Institutional clients? High-volume traders? Each carries different risks.
2. Poor Senior Management Oversight: Nearly half of rejected firms lacked proper governance. The FCA wants to see that directors understand AML duties. It’s not enough to hire a compliance officer and walk away. Board members need training and active involvement.
3. Weak Transaction Monitoring: 39% of firms had systems that generated too many false positives or missed real alerts. Your tools need tuning. Off-the-shelf solutions rarely work perfectly out of the box. Expect customization costs.

Another trap is advertising. The FCA tightened promotion rules in 2023. Over 60% of firms initially failed advertising standards. You must clearly state risks. Phrases like “secure” or “guaranteed returns” get flagged. Always include a prominent warning that crypto investments are high-risk and not protected by the Financial Services Compensation Scheme (FSCS).

International Context: How the UK Compares

Is the UK strict? Yes. Compared to Singapore, only 12.7% of UK applicants passed first try versus 38.4% in Singapore. The EU’s MiCA regulation offers a single license across member states, which some find more efficient. However, the UK’s centralized approach under the FCA provides clarity once you’re through. You don’t juggle multiple regulators like in the US, where FinCEN, SEC, and CFTC all have claims.

The UK’s 10% ownership change threshold is stricter than the EU’s 20%. This reflects a precautionary stance on transparency. While annoying for businesses, it builds trust. Investors know exactly who controls a platform. This credibility helps legitimate firms attract institutional capital, which remains hesitant in less regulated jurisdictions.