If you run a cryptocurrency business in the United Kingdom, ignoring anti-money laundering (AML) rules isn't just risky-it's illegal. Since January 10, 2020, the Financial Conduct Authority (FCA) has strictly supervised cryptoasset firms under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.
The landscape is shifting fast. As we move through 2026, the transitional "dual regulatory regime" is ending. The comprehensive licensing framework under the Financial Services and Markets Act (FSMA) is now fully active. This means the days of simple registration are over; you now need full authorization to operate.
This guide breaks down exactly what these rules mean for your operations, from customer due diligence to the new counterparty checks that caught many firms off guard in late 2025.
Who Needs to Comply?
You might think only exchanges need to worry about AML. That’s a dangerous assumption. The regulations apply specifically to two main types of entities:
- Cryptoasset Exchange Providers: Platforms that match buyers and sellers of cryptocurrencies.
- Custodian Wallet Providers: Services that hold private keys on behalf of customers to secure their digital assets.
If you fall into either category, you must be authorized by the FCA. Unregistered businesses operating after the transition period face severe penalties, including criminal charges and unlimited fines. As of mid-2026, the FCA register shows approximately 147 fully compliant firms, down from earlier peaks because many failed to meet the stricter standards required for the new FSMA licenses.
Core Compliance Requirements
Compliance isn’t a one-time checkbox. It’s an ongoing operational layer. Here are the non-negotiable pillars of the current UK AML framework for crypto:
1. Customer Due Diligence (CDD)
You must identify and verify your customers before providing services. The rule of thumb? Use at least two independent sources. For individuals, this usually means a government-issued ID and proof of address. For corporate clients, you need to dig deeper into beneficial ownership. You cannot rely solely on self-declared information.
2. Enhanced Due Diligence (EDD)
High-risk scenarios trigger EDD. This includes dealing with Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, or complex transaction structures. In 2025, data showed that crypto firms had to perform 37.8% more enhanced due diligence steps than traditional finance firms due to the opaque nature of some blockchain transactions. You need senior management approval for these relationships.
3. Ongoing Monitoring
Verification doesn’t stop at onboarding. You must monitor transactions in real-time. If a customer suddenly starts moving millions in stablecoins after years of small trades, your system needs to flag it. Records of all CDD and monitoring activities must be kept for five years.
The Travel Rule: What You Need to Know
Implemented in 2022, the Travel Rule requires you to share specific data when transferring funds. If a transaction exceeds £1,000, you must collect and pass along the originator’s name, account number, and address to the beneficiary institution.
Why does this matter? Because anonymity is no longer a shield. If you fail to provide this data, receiving institutions can reject the transfer or freeze the funds. For cross-border transfers, ensure your counterparties are also compliant. The UK aligns with the FATF standard here, so if you’re working with global partners, this requirement is universal.
New 2026 Standards: Counterparty Due Diligence
This is where things got tighter. The draft amendments published in April 2025, now enforced under the FSMA regime, introduced Counterparty Due Diligence (CPDD). Previously, you only checked your direct customers. Now, you must verify the legitimacy of the entities you transact with, even if they aren’t your direct clients.
For example, if you send funds to another exchange, you must confirm that exchange is properly regulated. This aligns with FATF Recommendation 15 on New Technologies. Many firms initially struggled with this, as integrating blockchain analytics with traditional KYC systems cost an average of £185,000 in customization alone.
Change in Control: The 10% Threshold
Ownership transparency is critical. Under the old rules, you notified the FCA if someone bought 25% of your shares. That threshold has dropped to 10%. Any acquisition of 10% or more of voting rights or shares triggers a mandatory notification.
Professor Nicholas Ryder from the University of Bristol criticized this as an "unnecessary administrative burden," but the FCA views it as essential for preventing hidden ownership by illicit actors. Make sure your shareholder registry is updated in real-time to avoid accidental breaches.
| Requirement | Pre-2026 (MLR Focus) | 2026+ (FSMA Integrated) |
|---|---|---|
| Registration Type | AML Registration Only | Full FSMA Authorization |
| Change in Control Threshold | 25% Shareholding | 10% Shareholding/Voting Rights |
| Due Diligence Scope | Direct Customers Only | Customers + Counterparties (CPDD) |
| Regulatory Body | FCA (AML Supervision) | FCA (Prudential & Conduct) |
Costs and Implementation Reality
Let’s talk money. Compliance is expensive. According to industry surveys from 2025, the average initial setup cost for AML compliance was £287,500. Annual ongoing costs hover around £142,300 per firm. These figures include software licenses, staff training, and external consultancy fees.
Many founders underestimate the time factor. The FCA’s average processing time for applications remains around 9 months. During this period, you cannot legally operate. Most successful applicants spend 6-9 months preparing their documentation before even submitting. Hiring external compliance consultants is common-78.3% of firms did so in 2025-to navigate the complex requirements.
Penalties for Non-Compliance
The consequences of getting this wrong are severe. The FCA has shown zero tolerance for inadequate risk assessments. Common reasons for rejection or enforcement action include:
- Inadequate risk assessments (cited in 62.1% of failures).
- Lack of senior management oversight (48.7%).
- Poor transaction monitoring systems (39.4%).
Beyond fines, unregistered businesses face asset freezes and potential imprisonment for directors. The Office of Financial Sanctions Implementation (OFSI) noted in July 2025 that 23.7% of analyzed crypto transactions involved high-risk jurisdictions, highlighting the sector’s vulnerability and the regulator’s focus.
Next Steps for Your Business
If you are launching or expanding in the UK, start with a gap analysis. Compare your current processes against the FSMA requirements. Ensure your technology stack can handle real-time sanctions screening against at least 12 major lists. Train your staff-35 hours annually per compliance officer is the mandated minimum.
Don’t try to cut corners. The UK aims to be a "premium but selective" jurisdiction. While this drives some businesses away, it builds long-term trust with institutional investors who prioritize security and legality over speed.
Do I need FCA registration if I only offer cold storage wallets?
Yes. If you hold private keys on behalf of customers, you are classified as a Custodian Wallet Provider. This falls squarely under the AML regulations and requires full FCA authorization under the FSMA framework effective 2026.
What is the penalty for failing to report a change in control?
Failure to notify the FCA of a change in control exceeding the 10% threshold is a criminal offense. Penalties can include unlimited fines and up to seven years in prison for responsible individuals. The FCA may also revoke your license immediately.
How does the UK Travel Rule differ from the EU's MiCA?
While both follow FATF standards, the UK implements the Travel Rule via secondary legislation under MLRs and FSMA, whereas the EU integrates it into the broader Markets in Crypto-Assets (MiCA) regulation. The UK currently uses a £1,000 threshold, matching the global standard, but operates within a centralized FCA supervision model rather than the EU's distributed national competent authority approach.
Can I use automated KYC providers for compliance?
Yes, and most firms do. However, you remain legally responsible for the outcome. You must ensure your third-party provider meets UK data protection laws (GDPR) and AML standards. Relying solely on automation without human oversight for high-risk cases is a common reason for FCA rejection.
When does the FSMA regime fully replace the old registration system?
The transition was completed in early 2026. All existing registered firms were required to apply for full FSMA authorization. Operating under the old "registration-only" status is no longer valid for new businesses, and legacy firms must maintain their new licenses to continue operating legally.
I must say, the sheer complexity of these new regulations is quite staggering when one considers the rapid pace at which this industry has evolved. It seems that the Financial Conduct Authority is attempting to impose a level of bureaucratic rigor that might be better suited for traditional banking institutions rather than agile crypto startups. The requirement for full FSMA authorization instead of simple registration is a significant hurdle that will likely stifle innovation in the United Kingdom. One cannot help but feel a sense of melancholy for the small entrepreneurs who are now facing insurmountable barriers to entry due to these stringent compliance measures. The transition period ending in 2026 marks a definitive shift towards institutionalization, which may alienate the very community that built this space. I believe we should approach this with an open mind and seek a balance between necessary oversight and the freedom to innovate without excessive red tape.
It's just a lot of rules now. You have to check everyone. Costs are high. Many firms left because it was too hard. The FCA wants safety but it makes things slow for normal people trying to trade or start a business. Simple changes like lowering the share threshold to 10 percent add more work for owners. It is what it is though. If you want to stay in UK you need to follow them or get fined heavily.
This article completely misses the point of why these regulations exist in the first place! 😡 You think this is about stifling innovation? No, it is about stopping criminals from using your platform to launder money derived from human trafficking and drug sales. The fact that you are complaining about 'bureaucratic rigor' shows a profound lack of empathy for the victims of financial crime. The Travel Rule is not optional; it is a moral imperative. If you are running a custodian wallet provider and you are worried about the cost of KYC, maybe you should reconsider your business model. We need strict enforcement, not hand-wringing about administrative burdens. The FCA is doing exactly what they should be doing to protect the integrity of the financial system.
Boring stuff. Everyone hates paperwork. But hey, if you got money, hire someone else to do it. I don't care about AML. Just let me buy my coins. Why does government need to know everything? It's always about control. They want to watch every transaction. Typical. 🙄
The irony here is palpable, isn't it? 🤔 We created decentralized technologies specifically to escape the clutches of centralized oversight, only to willingly march back into the arms of the regulator with our hands tied behind our backs. The £185,000 customization cost for blockchain analytics integration is a testament to how absurdly expensive compliance has become. It is almost philosophical in its futility: we are building digital fortresses to keep out bad actors, while simultaneously handing the keys to the state under the guise of 'safety.' The 10% change in control threshold is merely a symptom of a larger disease-the fear of transparency by those who have something to hide. Let us hope the market adapts, or perhaps, as some argue, retreats entirely to jurisdictions that value liberty over bureaucracy. 📉🏛️
they are watching us all (((the deep state))) uses crypto to track your movements and thoughts. the travel rule is just a way to build a database of every citizen. dont trust the FCA. they work for globalists. the penalties are a trap to seize assets. wake up sheeple. the real crime is privacy. :)
Its just wrong how much power they have. If u dont comply u go to jail. That is tyranny. People should not have to register to hold their own money. The 10 percent rule is stupid. Who cares if someone buys shares? This is socialism creeping in. Bad for freedom. Good luck getting approved in 9 months. What a waste of time.
Okay guys lets look at the bright side!! 💪 Yes its hard but imagine being part of a legit secure system. No scams! No hacks! Just pure safe trading. If u can afford the 287k setup then u r golden. Go get that license and show the world ur serious. Dont give up on the dream. Compliance is just a hurdle jump over it and win! 🚀✨