Do Cryptoasset Businesses Have to Follow Money Laundering Rules? FCA Registration and the Travel Rule
Yes. Cryptoasset exchange providers and custodian wallet providers are “relevant persons” under the Money Laundering Regulations 2017, so they must register with the Financial Conduct Authority (FCA) for anti-money laundering supervision before they operate in the UK. Doing so without registration is a criminal offence. Once registered, they must carry out the same core duties as other regulated firms, including risk assessment, customer due diligence and reporting suspicion, and follow crypto-specific rules such as the travel rule for transfers.
On this page
- 1Do cryptoasset businesses have to follow money laundering rules in the UK?
- 2Which businesses count as cryptoasset businesses?
- 3Must a cryptoasset business register with the FCA, and what happens if it does not?
- 4How does FCA registration work, and what does the fit and proper test look at?
- 5Which anti-money laundering duties apply to a cryptoasset business?
- 6What is the travel rule for cryptoasset transfers?
- 7What are the typical money laundering red flags in cryptoasset activity?
- 8How do source of funds checks work when the money started as cryptoassets?
- 9What should staff in a non-crypto business do when a customer offers to pay in cryptoassets?
- 10How do sanctions rules apply to cryptoassets?
- 11What is changing with the new FCA cryptoasset regime?
- 12What are the penalties and personal liability for breaking the rules?
- 13What checklist should a small firm use?
- 14What training helps staff understand cryptoasset money laundering risk?
- 15Frequently asked questions
- Registration. Cryptoasset exchange providers and custodian wallet providers must register with the FCA for money laundering supervision before operating in the UK, and acting without registration is a criminal offence.
- Same core duties. They need a risk assessment, policies, customer due diligence, monitoring, an MLRO, suspicious activity reporting and staff training, as other regulated firms do.
- Travel rule. Names and an account number or transaction identifier travel with every transfer between providers, with more sender details depending on the chain and the value of the transfer.
- What is coming. The FCA authorisation regime for cryptoassets is planned to start on 25 October 2027, and registration under the Regulations will not convert automatically.
This guide is for compliance staff in cryptoasset firms, and for anyone in another business whose customers want to pay in cryptoassets. It covers the UK and was checked against legislation.gov.uk, the FCA, HM Treasury, HMRC and OFSI on 1 November 2026. Examples are invented, and it does not recommend or discuss buying cryptoassets. For the basics, see what anti-money laundering is. General information, not legal or financial advice.
Do cryptoasset businesses have to follow money laundering rules in the UK?
Yes. Regulation 8(2) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the Regulations) lists the businesses they apply to. Since 10 January 2020 it has included cryptoasset exchange providers (paragraph (j)) and custodian wallet providers (paragraph (k)), alongside banks, accountants, estate agents and lawyers, under SI 2019/1511. The FCA says it has supervised these firms for money laundering purposes since that date, and that registration is not a recommendation or endorsement of the business.
The risk is the reason. The National Risk Assessment of Money Laundering and Terrorist Financing 2025, published by HM Treasury on 17 July 2025, assesses the risk of money laundering through cryptoassets as high (paragraph 5.82), citing rising criminal use and the speed with which money moves. It says unregistered exchanges, and exchanges registered in places with limited oversight, are the greatest threat (paragraph 5.85).
Which businesses count as cryptoasset businesses?
Regulation 14A defines the two activities. A cryptoasset exchange provider, by way of business, exchanges (or arranges the exchange of) cryptoassets for money or for other cryptoassets, or operates a machine that does so automatically, including where it acts as creator or issuer of the cryptoassets. A custodian wallet provider safeguards, or safeguards and administers, cryptoassets or the private keys to them for customers. A “cryptoasset” is a cryptographically secured digital representation of value or contractual rights, using distributed ledger technology.
The FCA’s page on who needs to register (updated 8 October 2026) applies a three-part test: is the service within regulation 14A, is it carried on by way of business, and is it carried on in the UK?
| Type of business | What it does | Basis |
|---|---|---|
| Exchange provider | Swaps cryptoassets for money or for other cryptoassets, or arranges such exchanges | Regulation 14A(1)(a) and (b) |
| Cryptoasset ATM operator | Runs a machine that exchanges cryptoassets for money or the reverse. The FCA lists crypto ATMs as in scope, and a UK machine counts as UK business | Regulation 14A(1)(c); FCA |
| Issuer or creator | Creates or issues cryptoassets and exchanges them for money or other cryptoassets, for example in an initial coin offering | Regulation 14A(1); FCA |
| Custodian wallet provider | Holds cryptoassets, or the private keys to them, for customers | Regulation 14A(2) |
| Peer-to-peer service | The FCA places peer-to-peer exchange services within the exchange provider category | FCA |
| Payment, e-money or other authorised firm | Must also register if it provides in-scope cryptoasset services. Existing authorisation or registration for other services does not cover them | FCA |
| Firm making its own cryptoasset promotions | Generally needs to register to communicate its own promotions to UK consumers, unless an authorised person approves them or an exemption applies | FCA |
| Overseas platform with UK customers only | Not automatically carrying on business in the UK. A UK office, agent or ATM changes the answer, and the FCA decides case by case | FCA |
The FCA recommends independent advice for anyone unsure whether they must register. A business that merely accepts cryptoassets as payment for its own goods is not obviously doing any listed activity; we return to that below.
Must a cryptoasset business register with the FCA, and what happens if it does not?
Yes. Regulation 56(1) says a person must not act as a cryptoasset exchange provider or custodian wallet provider unless on the FCA’s register (paragraphs (f) and (g)), subject to transitional rules for firms already operating in 2020 (regulation 56A). The FCA states that registration is a legal requirement.
Acting without registration is an offence. Regulation 86 makes contravening a relevant requirement a crime, Schedule 6 lists regulation 56(1), and the maximum on conviction on indictment is two years in prison, a fine, or both. Under regulation 92 an officer of a company is personally guilty where the offence was committed with their consent or connivance or is attributable to their neglect. Regulation 86(3) gives a defence of taking all reasonable steps and exercising all due diligence.
This has been enforced. In a press release of 28 February 2025, the FCA reported that Olumide Osunkoya was sentenced to four years at Southwark Crown Court after pleading guilty to five charges, including operating crypto ATMs without registration, forgery and possessing criminal property. The FCA called it the UK’s first criminal sentencing for unregistered crypto activity.
How does FCA registration work, and what does the fit and proper test look at?
The FCA’s guidance on how to apply (updated 20 July 2026) and on what it expects to see (updated 30 June 2026) sets out the process:
- Check you are in scope using the three-part test. A pre-application meeting is optional and free, requested through the FCA’s Connect system.
- Appoint a money laundering reporting officer (MLRO) under regulation 21(3). The FCA expects them to be heavily involved and to stay in post.
- Prepare a complete application. The FCA does not review drafts. The business-wide risk assessment is central, alongside full policies and a business plan.
- Give details of the people involved, such as directors, partners, the MLRO and beneficial owners, and be ready for fit and proper interviews.
- Pay the fee and submit through Connect. Annual fees follow.
- Wait for the decision. The FCA has three months from when it has all the information it needs. It can approve, reject an incomplete application, accept a withdrawal or refuse. A refusal starts with a Warning Notice and can end at the Upper Tribunal.
The fit and proper test is in regulation 58A. The FCA must refuse registration unless the applicant, and any officer, manager or beneficial owner, is fit and proper. A conviction for a Schedule 3 offence is automatically disqualifying. Otherwise the FCA considers any consistent failure to comply with the Regulations, the risk that the business may be used for money laundering or terrorist financing, and whether those people have adequate skills and experience and have acted, and may be expected to act, with probity.
As at 1 October 2026 the FCA had received 427 applications since January 2020. Of 393 determined, 68 (17%) were registered, 265 (67%) withdrawn, 46 (12%) rejected and 14 (4%) refused; appeals are excluded.
Registration brings continuing duties, according to the FCA’s AML and counter-terrorist financing page (updated 12 February 2026): an annual REP-CRIM return within 60 business days of the accounting reference date, a warning to customers under regulation 60A if the service is outside the Ombudsman and compensation scheme, and FCA approval before anyone acquires control of the firm, which the FCA calls a criminal offence if skipped.
Which anti-money laundering duties apply to a cryptoasset business?
The core duties are the same as for other regulated firms, so we link rather than repeat them: the business-wide risk assessment, customer due diligence, the MLRO’s role, suspicious activity reports and AML training requirements. The table shows only the crypto angle.
| Duty | Regulation | Crypto angle |
|---|---|---|
| Business-wide risk assessment | 18, 18A | Must reflect the firm’s own products, customers, countries and delivery channels. The FCA calls it key to its registration assessment |
| Policies, controls and procedures | 19 | The FCA expects a full framework, including sanctions, transaction monitoring and the travel rule |
| Customer due diligence and ongoing monitoring | 27, 28 | Ongoing monitoring (regulation 28(11)) covers transactions throughout the relationship, including the source of funds where necessary |
| Enhanced due diligence | 33; 34A from 1 February 2027 | The new regulation 34A adds steps for correspondent relationships with similar providers in third countries and bars shell-bank relationships |
| Nominated officer and internal controls | 21 | An individual must be appointed as nominated officer; the FCA expects the MLRO to be involved from application |
| Training | 24 | Relevant employees must be made aware of the law and regularly trained to recognise suspicious activity, with a written record |
| Records | 40 | Includes the information received under the travel rule (regulations 64C and 64G) |
| Customer disclosure | 60A | Tell customers if the service is outside the Ombudsman and compensation scheme |
| Travel rule | 64A to 64H | Information must accompany transfers; see the next section |
What is the travel rule for cryptoasset transfers?
The travel rule means information about who sends and who receives a cryptoasset must travel with the transfer, as it does for bank payments. It is Part 7A of the Regulations (regulations 64A to 64H), in force since 1 September 2023 under SI 2022/860, and covers domestic and cross-border transfers (National Risk Assessment, paragraph 2.17). It applies between “cryptoasset businesses” (exchange providers and custodian wallet providers) and to transfers to or from an “unhosted wallet”, which is software or hardware that lets a person store and transfer a cryptoasset on their own behalf.
What must accompany a transfer (regulation 64C):
- Always, with no minimum value: the names of the originator and beneficiary; for a firm, its registered name or else its trading name; and the account number, or else a unique transaction identifier.
- Further originator details: for an individual, a customer identification number, address, identity document number, or date and place of birth; for a firm, a customer identification number or the address of its registered office or principal place of business. Where every business in the chain operates in the UK, they follow within three working days if the beneficiary’s business asks. Otherwise they must accompany the transfer if it, with any linked transfer, equals or exceeds £800.
- Verification: the originator’s business must verify the originator information independently and must not send the transfer before it fully complies.
The £800 figure replaced 1,000 euros on 30 June 2026 under SI 2026/621 (regulations 32 and 33 of that instrument).
On receipt (regulations 64D to 64F), the beneficiary’s business must check, before making the cryptoasset available, that it has the required information and that the beneficiary details match its due diligence records. If not, it must ask for the missing information and consider delaying the transfer, or returning the cryptoasset if the problem is not resolved within a reasonable time. It weighs its risk assessment and factors such as the value of the transfer. Intermediaries must check before passing a transfer on and pass the information along. Both must report repeated failures by another business to the FCA.
For unhosted wallets, a firm may ask its customer for missing information, having regard to its risk assessment, and if it asks and does not receive it, the firm must not make the cryptoasset available to the beneficiary (regulation 64G). Regulation 64H requires a full and prompt response to written requests from law enforcement.
An invented example: a UK exchange receives a transfer worth £2,000 from a platform abroad. Because the value is above £800 and a business outside the UK is involved, further sender details should have come with it. If the sender’s name is missing, the exchange asks for it and decides, using its risk assessment, whether to hold or return the transfer.
What are the typical money laundering red flags in cryptoasset activity?
A red flag is a reason to ask questions, not proof of wrongdoing. This list draws on the Financial Action Task Force (FATF) report Virtual Assets: Red Flag Indicators of Money Laundering and Terrorist Financing (14 September 2020), based on more than 100 case studies, and on the National Risk Assessment 2025. FATF says a transaction with several indicators and no logical business explanation calls for further monitoring and examination, and that no list is exhaustive.
- Rapid onward movement. Immediate transfers to several other providers, including abroad (FATF).
- Unusual patterns. Irregular or uncommon patterns, such as a large first deposit from a new user (FATF).
- Anonymity tools. Technology that increases anonymity (FATF). The National Risk Assessment says privacy wallets are now used more often than mixers (paragraph 3.63).
- Geography and platforms. Links to high-risk jurisdictions (FATF), or use of exchanges in less regulated places or run solely for criminal purposes (National Risk Assessment, paragraph 3.62).
- Customer profile. Customers who look like money mules or scam victims (FATF). The National Risk Assessment describes networks using many third-party accounts to move relatively small amounts, typically under £10,000 at a time (paragraph 5.84).
- Weak travel rule information. Repeated failures by another provider to send the required information, which regulations 64D(5) and 64E(5) require firms to report to the FCA.
- Our own addition, not from those sources: a customer who cannot or will not explain where the funds came from.
How do source of funds checks work when the money started as cryptoassets?
Source of funds asks where the money for this transaction came from; source of wealth asks how the customer built up their wealth. Our guide to source of funds versus source of wealth sets out evidence by scenario, including proceeds of selling cryptoassets: exchange statements showing the sale and the withdrawal to a bank account in the customer’s name, and evidence of how the cryptoassets were first acquired. HMRC’s guidance on source of wealth lists crypto wallets among useful documents. If you cannot satisfy yourself, escalate to your MLRO.
What should staff in a non-crypto business do when a customer offers to pay in cryptoassets?
Most businesses that meet cryptoassets are not cryptoasset businesses. On our reading of regulation 14A, a shop, estate agency or law firm that simply accepts payment for its own goods or services is not exchanging cryptoassets for others or holding them for customers. That changes if it starts converting cryptoassets for customers, arranging exchanges or holding cryptoassets or keys for them. Apply the FCA’s test and take advice first. Existing duties do not go away:
- Your own AML duties still apply. A relevant person, such as an estate agent, law firm or accountancy practice, owes its duties under the Regulations on the underlying transaction whatever the payment method. For high value dealers the trigger is a payment “in cash”, which regulation 3 defines as notes, coins or travellers’ cheques, so ask HMRC how it treats cryptoassets.
- Supervisors treat it as higher risk. HMRC’s risk assessment for estate agent businesses (manual updated 13 October 2026) lists a customer who pays in cash, uses foreign currencies or uses cryptocurrencies among the indications of higher risk. See our guides for estate agents, accountants and financial advisers.
- The criminal law applies to everyone. Under section 340(9) of the Proceeds of Crime Act 2002, property includes intangible property, so cryptoassets can be criminal property. The money laundering offences apply to everyone, and the regulated sector must report suspicion. See our SAR guide, and never tip off the customer.
A practical sequence for staff:
- Do not agree on the spot. Check your firm’s policy and ask your manager or MLRO. Many firms decline cryptoasset payments altogether.
- Identify who would actually pay, and apply customer due diligence to anyone paying on the customer’s behalf.
- Ask how the cryptoassets were obtained and keep the evidence, as for any source of funds.
- Ask which provider would move the funds, and check whether a UK provider appears on the FCA’s Financial Services Register.
- Record what you asked, what you were told and who approved it.
- If something does not add up, report internally to the MLRO and carry on as normal with the customer, without hinting at it.
How do sanctions rules apply to cryptoassets?
UK financial sanctions cover cryptoassets. The Office of Financial Sanctions Implementation (OFSI) says in its general guidance (updated 12 May 2026) that the statutory definitions of funds and economic resources are wide and cryptoassets are considered covered. It also lists cryptoasset exchange providers and custodian wallet providers among relevant firms for sanctions reporting. See OFSI’s threat assessment for the sector (21 July 2025) and the joint statement by OFSI, the FCA and the Bank of England (11 March 2022). This guide does not cover sanctions law in detail, so take advice on specific cases.
What is changing with the new FCA cryptoasset regime?
A second, wider regime is arriving. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102), made on 4 February 2026, bring regulated cryptoasset activities such as custody, trading platforms, dealing, arranging and staking into FCA authorisation. The table shows what is in force and what is planned, as shown by official sources on 1 November 2026.
| Item | Status | Date | Source |
|---|---|---|---|
| Money laundering registration with the FCA | In force | Since 10 January 2020 | Regulations 8, 14A, 56 |
| Travel rule (Part 7A) | In force | 1 September 2023; £800 figure from 30 June 2026 | SI 2022/860; SI 2026/621 |
| FCA financial promotions regime for cryptoassets | In force | Since 8 October 2023 | FCA |
| Preparatory provisions of SI 2026/102 (rules, guidance, applications) | In force | 25 February 2026 | SI 2026/102, regulation 1(3) |
| FCA final rules and guidance | Published | 30 June 2026 | FCA |
| FCA application window for authorisation | Open; closes 28 February 2027 unless extended | Opened 30 September 2026 | FCA |
| Enhanced due diligence for correspondent relationships (regulation 34A) | Planned | 1 February 2027 | SI 2026/621, regulation 1(4) |
| Main FSMA cryptoasset regime | Planned | 25 October 2027 | SI 2026/102, regulation 1(2); FCA |
The FCA says there will be no automatic conversion from registration under the Regulations to FSMA authorisation, and a firm that does not apply before the new regime starts must run off its UK cryptoasset business before then.
The money laundering rules continue alongside. Authorised firms acting as exchange providers or custodian wallet providers must tell the FCA before they begin or within 28 days (regulation 56B), and the register under regulation 54(1A) will cover those that are not authorised.
What are the penalties and personal liability for breaking the rules?
Regulation 86 makes contravening a relevant requirement an offence, with up to two years in prison on conviction on indictment. Schedule 6 lists the travel rule duties (regulations 64C to 64H), the customer disclosure duty (regulation 60A) and the registration requirement (regulation 56). A person convicted under regulation 86 is not also liable to a civil sanction under Chapter 2 of Part 9 (regulation 86(4)). Regulation 92 reaches officers whose consent, connivance or neglect lies behind a company’s offence.
Individuals also face the Proceeds of Crime Act 2002 offences, including failure to disclose and tipping off. Our guides to the MLRO’s role and suspicious activity reports cover them. We found no separate crypto-specific criminal offence beyond registration, changes of control and the relevant requirements above.
What checklist should a small firm use?
These are our suggestions, not a legal form. Adapt them to your supervisor’s guidance.
- Decide whether any service you offer falls within regulation 14A, record your reasoning, and if it does, do not start until you are registered.
- Appoint an MLRO and a deputy, and write a business-wide risk assessment covering your own products, customers, countries and delivery channels.
- Document your due diligence, monitoring, sanctions and reporting procedures.
- Build a travel rule process: what you send, what you check on receipt, what you do when information is missing and how you log repeated failures.
- Train relevant staff, keep records, and diary 1 February 2027, 28 February 2027 and 25 October 2027.
- If you are not a cryptoasset business, write a short rule on whether you accept cryptoasset payments, who approves them and how staff escalate.
What training helps staff understand cryptoasset money laundering risk?
Awareness training helps everyone in a firm recognise and escalate suspicion. Three Nexis CPD courses fit together here:
Together they cost £18 rather than £27 under the pay-for-2-get-3 offer, and employers training 5 or more staff pay £6 a course place on the team plan. These are awareness-level CPD courses, not regulated qualifications. They do not replace your firm’s own procedures, the MLRO’s responsibilities or specialist training, and they do not make anyone a cryptoasset compliance specialist. If you take one, start with Anti Money Laundering (AML) Awareness: 20 questions, 80% to pass, and an instant certificate.
Anti Money Laundering (AML) Awareness
100% online, at your own pace. Pass the assessment and your verifiable certificate is emailed instantly.
Frequently asked questions
Do cryptoasset businesses have to follow money laundering rules?
Yes. Cryptoasset exchange providers and custodian wallet providers are covered by the Money Laundering Regulations 2017. They must register with the FCA, carry out the same core duties as other regulated firms, and follow the travel rule.
Does every cryptoasset business need to register with the FCA?
Every firm that provides exchange or custody services in the UK by way of business does. An overseas firm whose only UK link is having UK customers is not automatically carrying on business in the UK, but the FCA decides case by case.
What is the travel rule for cryptoasset transfers?
Information about the sender and recipient must accompany a transfer between cryptoasset businesses. Names and an account number or transaction identifier always travel with it. More sender details follow on request or travel with it, depending on the value.
Does a shop or estate agent that accepts cryptoassets have to register with the FCA?
Not merely by accepting payment for its own goods or services, on our reading. If it starts exchanging cryptoassets for others or holding them for customers it may be in scope. Its existing AML duties still apply, so ask its supervisor or take advice.
What happens if a firm operates without FCA registration?
It commits a criminal offence, with up to two years in prison on conviction on indictment. In February 2025 the FCA reported a four-year sentence for a man who ran unregistered crypto ATMs, among other offences.
Does awareness training replace our procedures or a cryptoasset compliance specialist?
No. Awareness CPD is not a regulated qualification. It helps staff recognise and report concerns, but it does not replace your firm’s own procedures, the MLRO’s responsibilities or specialist training.
General information, not legal or financial advice. This guide reflects the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as amended by SI 2019/1511, SI 2022/860, SI 2026/102 and SI 2026/621, the Proceeds of Crime Act 2002, FCA, HMRC and OFSI guidance, the National Risk Assessment 2025 and the FATF red flag indicators report, as checked on 1 November 2026. FCA regime dates are those shown on official pages that day and may change. The examples are illustrations, not findings about any real business. Always check current law and your supervisor’s guidance, and take advice on specific cases. Nexis CPD courses are CPD-accredited awareness training, not regulated qualifications, and they do not replace your firm’s own procedures, the MLRO’s responsibilities or specialist training.