If you run a crypto business in the UK, you know the feeling. You have a great product, users are signing up, and then reality hits: the Financial Conduct Authority (FCA) wants to see your paperwork, or worse, they reject your application because your risk assessment didn't tick their specific boxes. It’s not just about having good intentions anymore; it’s about proving you can stop dirty money from flowing through your platform.
The landscape changed dramatically on January 10, 2020, when cryptoasset businesses were officially brought under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, commonly known as MLR 2017. Since then, the rules have tightened, costs have risen, and the bar for entry has skyrocketed. If you’re trying to figure out if you’re compliant-or if you’re thinking about launching here-you need to understand exactly what the regulators expect. Spoiler alert: it’s more than just collecting ID photos.
Who Needs to Register with the FCA?
First things first: do you actually fall under these rules? The short answer is yes, if you touch customer funds or facilitate exchanges. The MLR 2017 targets two main types of entities: cryptoasset exchange providers and custodian wallet providers. If you swap one crypto for another, or one crypto for fiat currency, you’re an exchange provider. If you hold private keys for customers, you’re a custodian.
But here’s where it gets tricky. The definition of "business" is broad. If you’re a decentralized finance (DeFi) protocol that still holds some centralization over user assets, you might be caught. The FCA doesn’t care if you call yourself a DAO; if you look like a duck and quack like a duck in terms of custody and exchange, you need to register. Failure to register before starting operations is a criminal offense, punishable by up to two years in prison or a fine. Yes, prison. That’s not a typo.
The Registration Gauntlet: Why Most Fail
You might think registering is a simple form-filling exercise. Think again. Data from the FCA shows that between 2020 and 2023, a staggering 87.3% of crypto firms failed their initial registration requirements. Why? It usually comes down to three things:
- Inadequate Risk Assessments: Regulators want to see that you’ve thought about how money could move through your system illicitly. Generic templates don’t cut it.
- Poor Senior Management Oversight: Your directors need to prove they understand AML. They can’t just hire a consultant and walk away.
- Weak Transaction Monitoring: If your software flags every transaction as suspicious (false positives) or misses obvious red flags, you’re failing.
The average firm spends around £287,500 just setting up their initial compliance infrastructure. And the process takes time-on average, 9.2 months. Some founders report spending over £500k in consultancy fees after 14 months of back-and-forth with the regulator. It’s expensive, slow, and stressful. But once you’re in, the clarity of expectations can actually help you expand internationally, as investors trust FCA-regulated firms more.
Customer Due Diligence (CDD): Beyond the Basics
So, what does compliance actually look like day-to-day? At its core, it’s Customer Due Diligence. You must identify who your customer is and verify their identity using at least two independent sources. For individuals, this usually means a government-issued photo ID and proof of address. For companies, it’s more complex-you need to dig into the corporate structure until you find the real humans behind the scenes, known as beneficial owners.
This isn’t a one-time check. You have to monitor ongoing relationships. If a customer suddenly starts moving millions overnight, your systems should flag it. This is where technology comes in. Manual checks don’t scale. Successful firms integrate blockchain analytics tools with traditional KYC (Know Your Customer) systems. One Reddit user noted that integrating these tools cost them £185k in customization alone, but it was necessary to reduce false positives, which averaged 28.7% compared to 12.3% in traditional banking.
The Travel Rule: Tracking the Money Trail
In 2022, the UK implemented the Travel Rule. This rule requires crypto businesses to collect and share specific information for transactions exceeding £1,000. You need to know who sent the money (the originator) and who is receiving it (the beneficiary). Their names, addresses, and account numbers must travel with the transaction.
This sounds simple, but it’s a technical nightmare. Not all blockchains support metadata easily. Plus, you need to ensure the counterparty (the other exchange or wallet provider) is also compliant. If you send funds to a non-compliant entity, you’re risking your own license. The draft amendment regulations published in April 2025 propose even stricter counterparty due diligence (CPDD), aligning with global FATF standards. This means you might need to verify counterparties even if they aren’t your direct customers.
Upcoming Changes: The Move to FSMA
The current regime is transitional. The UK government is phasing out the standalone MLR registration in favor of a comprehensive licensing framework under the Financial Services and Markets Act (FSMA). Full implementation is expected by Q1 2026. This shift aims to create regulatory coherence, treating crypto more like traditional financial services.
| Feature | Current MLR Regime | Upcoming FSMA Regime (2026) |
|---|---|---|
| Regulator | FCA (AML supervision only) | FCA (Full prudential & conduct regulation) |
| Registration Threshold | Standard CDD | Stricter capital & governance requirements |
| Change in Control | 25% ownership change | 10% ownership change |
| Counterparty Checks | Basic verification | Mandatory CPDD aligned with FATF |
| Dual Registration | Required for some hybrid models | Eliminated for FSMA-authorised firms |
One major change is the lowering of the threshold for notifying changes in control. Currently, you notify the FCA if someone acquires 25% of shares. Under the new rules, this drops to 10%. This reflects the UK’s precautionary approach to ownership transparency, aiming to prevent bad actors from slipping in unnoticed.
Sanctions and High-Risk Jurisdictions
Don’t underestimate sanctions screening. The Office of Financial Sanctions Implementation (OFSI) reported that 23.7% of crypto transactions analyzed between 2022 and 2025 involved high-risk jurisdictions. You must screen against 12+ sanctions lists in real-time. If you miss a sanctioned individual, the fines can be massive.
Furthermore, Politically Exposed Persons (PEPs)-individuals with prominent public functions-require Enhanced Due Diligence (EDD). Norton Rose Fulbright found that crypto firms had to apply 37.8% more EDD than traditional finance firms, largely because identifying PEPs in the pseudonymous world of crypto is harder. You need robust data sources to link wallet addresses to real-world identities.
Practical Tips for Survival
If you’re navigating this maze, here is what works:
- Hire Specialists Early: Don’t try to DIY your AML policy. 78.3% of successful applicants hired external consultants. Use them to build your risk assessment, then train your internal team to maintain it.
- Invest in Tech: Manual monitoring fails. Use automated transaction monitoring tools that integrate with blockchain analytics. Expect integration costs to be high upfront but lower long-term operational friction.
- Train Your Staff: Compliance isn’t just for the compliance officer. Every employee needs to spot red flags. The requirement is 35 hours of annual training per staff member.
- Document Everything: Keep records for five years. If the FCA asks, you need to show your work instantly.
The market is consolidating. As of June 2025, there were 147 registered crypto firms, down from 184 in early 2024. Many smaller players couldn’t afford the compliance burden. Analysts predict the number will drop further to 85-95 fully compliant firms by 2027. This means the UK is becoming a premium, selective jurisdiction. If you survive, you gain credibility. If you don’t, you’re out.
Do I need to register if I only accept Bitcoin payments?
Yes, likely. If you provide a service that involves exchanging crypto for goods or services, or facilitating transfers, you may fall under the definition of a cryptoasset exchange provider. The key factor is whether you are acting as a business providing services to others involving cryptoassets. Even small merchants accepting crypto often need to consider their obligations, especially if they convert crypto to fiat immediately.
How much does FCA registration cost?
The direct application fee is relatively low, but the total cost is high. Firms spend an average of £287,500 on initial setup, including legal advice, compliance software, and staffing. Ongoing annual costs average £142,300. These figures vary significantly based on the complexity of your business model and the volume of transactions.
What happens if I operate without registration?
Operating without registration is a criminal offense. Penalties include unlimited fines and up to two years in imprisonment. Additionally, banks may refuse to open accounts for unregistered crypto businesses, making it difficult to handle fiat currencies. The FCA actively publishes warnings against unauthorized firms.
Is DeFi covered by UK AML rules?
It depends on the level of centralization. Fully decentralized protocols with no intermediary holding funds are generally outside the scope. However, if a DeFi platform has a centralized front-end, custodial elements, or development teams controlling smart contracts, the FCA may deem it a regulated activity. The lines are blurry, and legal advice is crucial.
When do the new FSMA rules take effect?
The full implementation of the FSMA-based licensing regime is expected by Q1 2026. Draft amendments were published in April 2025, with feedback periods closing in late 2025. Businesses should prepare for stricter capital requirements and governance standards well before this date.