FCA Proposes Tougher Crypto Checks Before 2027 Regime

FCA crypto checks focus on wallet screening

The draft consultation paper adds examples concerning onboarding, enhanced due diligence and blockchain analytics. Enhanced due diligence means closer investigation when a customer or transaction presents greater risk.

Its proposed poor-practice examples include using third-party tools without being able to explain their findings, and applying a fixed number of transaction “hops” without adjusting for risk. A hop is a transfer between addresses, rather than proof of wrongdoing.

Good-practice examples include calibrating monitoring tools to a firm’s risks and keeping decision records. The draft also discusses unhosted wallets and privacy-enhancing services as factors that can justify closer checks, rather than establishing a blanket ban on self-custody.

For customers, the potential consequence is more scrutiny of how funds reached an account. The proposal concerns how firms assess that evidence and document their decisions.

Some transfer requirements already apply. The FCA’s existing Travel Rule statement says UK crypto businesses have had to collect, verify and share transfer information since September 2023.

That statement also makes firms responsible when they use outside suppliers. For transfers arriving with incomplete information from jurisdictions without the Travel Rule, it calls for a risk-based assessment before making assets available to the recipient.

The distinction is practical: the consultation is not the first introduction of identity information into crypto transfers. It proposes further guidance against a background of existing obligations, including cross-border information gaps that firms already need to manage.

Financial Crime Guide proposals are not a new law

The guide’s introduction describes it as general guidance that is not binding. The FCA says departure from the guide does not automatically mean a firm has breached its rules.

Supervision instead focuses on compliance with applicable rules and legal obligations. Firms may meet those obligations through approaches other than the guide’s good-practice examples, but the regulator expects them to consider relevant guidance when maintaining their controls.

That leaves two separate questions for a crypto business: whether its arrangements satisfy the law, and how it can demonstrate that they do. Buying an analytics tool does not, by itself, answer either question.

The guide also says it is not a complete account of every applicable requirement. Where guidance and a legal obligation differ, the legal requirement takes precedence. CP26/38 therefore should not be read as replacing the existing anti-money-laundering framework.

The emphasis on operational readiness differs from the separate UK fraud review’s recommendations for judicial training. One concerns controls inside supervised businesses; the other addressed courts’ ability to handle complex fraud evidence.

UK crypto firms face three separate deadlines

The consultation’s December 24 deadline is for feedback, not an application for permission to operate. The FCA’s September gateway announcement says firms intending to continue in the UK should apply by February 28, 2027, ahead of the October 25 regime start.

Approval is not automatic. The regulator says applicants must demonstrate the required standards on customer protection, safeguarding, market integrity and financial resilience. It expects to determine applications submitted within the application period before commencement.

In its separate preparation guidance, the FCA tells businesses to assess the permissions they need, identify gaps and adopt a realistic implementation plan agreed at board level. That plan should identify responsibility, resources and delivery dates.

The same page warns that poor-quality or late applications can result in rejection, delays or refusal. Existing money-laundering registrations can help demonstrate controls, but firms must assess the additional requirements of the broader authorisation regime.

The immediate business issue is therefore evidence of readiness, including who owns compliance decisions and whether weaknesses can be fixed in time. Consultation responses and authorisation applications serve different purposes; completing one does not complete the other.

Alternative.me’s Fear and Greed Index stood at 51, or neutral, when checked October 24, compared with 50 the previous day. It measures market sentiment rather than regulatory compliance or the likelihood of authorisation.

The FCA has not given a final publication date for the revised guide on its consultation page. The next milestones are the December feedback deadline, the February application cutoff and publication of the final guidance, whose wording may change after consultation.