Cryptoassets: AML / CTF regime - Registering with the FCA

You must register with us if you want to provide cryptoasset services that come within the scope of the money laundering regulations. Find out if this applies to you and how to register.

We are the anti-money laundering and counter-terrorist financing (AML/CTF) supervisor of UK cryptoasset businesses under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017[1](MLRs).

This information will also be of interest to cryptoasset businesses that may need to seek registration with the FCA under the MLRs to allow them to communicate financial promotions in the UK as a result of extension of the UK’s financial promotions regime to include qualifying cryptoassets[2].

Find out more about the AML/CTF regime[3].

Who needs to register

Check our flowchart to understand if you need to apply for registration.

View our flowchart[4]

If you want to provide certain cryptoasset services by way of business and you intend to act in the course of business carried on in the United Kingdom, then you must register with us before you begin.

The requirement to be registered is set out in Regulation 8[5] and Regulation 9[6] of the MLRs. Regulation 14A[7] also defines the cryptoasset services that come within scope of the MLRs.

Businesses already registered or authorised with the FCA for other services (such as e-money institutions, payment institutions and firms authorised under FSMA) will also have to register with us under the MLRs if they intend to provide relevant cryptoasset services.

Our assessment on whether an activity is being carried on by way of business in the UK will be made on a case-by-case basis.

Here are some of the things we take into account.

Is the activity carried on by way of business?

Commercial element: we will consider matters to assess whether the individual or organisation advertises, acts or holds itself out in such a way that suggests that they are providing services by way of business related to cryptoasset services.
Commercial benefit: we will consider matters to assess whether the individual or organisation receives direct or indirect benefit from this service.
Relevance to other business: it is possible that cryptoasset services form only part of the overall business activities. We will consider matters to assess the significance of the cryptoasset asset service in relation to other services.
Regularity/frequency: we will also consider matters to assess whether the frequency of carrying on a cryptoasset service suggests that it is being carried on as a business.

Is the activity carried on in the UK?

Every case will need to be assessed on its own merits, with reference to the nature and business model that is being undertaken. When deciding if the business is being carried on in the UK, we will consider a variety of factors including:

Where the business has a UK office or its head office in the UK this may indicate that the service is being carried on in the UK (Regulation 9[6]). If the office is not a registered office or head office, we will need to consider the type of service that is carried on by that office (offices) and whether we consider the presence of that UK office means that it is carrying on business in the UK. The presence of a UK automated teller machine (ATM) will be considered business carried on in the UK, and so the operator will require registration.
Where the business has no UK office or other activity in the UK, beyond simply having a client in the UK, we are likely to consider that the business is not carrying on UK business. For example, if a cryptoasset exchange provider is registered in a jurisdiction other than the UK and has no offices or agents in the UK but nevertheless permits UK customers to open trading accounts and permits them to buy/sell/hold cryptoassets, we would not automatically consider that as business being carried on in the UK.

Complying with the UK’s financial promotions regime

From 8 October 2023, cryptoasset business that wish to market to UK customers (i.e. communicate their own cryptoasset financial promotions) will need to be registered with the FCA under the MLRs unless their financial promotions are approved by an authorised person or otherwise rely on an exemption in the Financial Promotion Order.

Cryptoasset businesses seeking registration in order to market to UK customers should consider how they will meet the requirements set out in Regulation 8[5] and Regulation 9[8] of the MLRs.

If you are unsure whether you need to register, you should seek independent legal/compliance advice.

How to apply for registration

You should submit your application using our Connect system[7].

Before you apply you should read:

the guide to the information we need below
our feedback on good and poor quality applications[8]

Once submitted we will review your application and are likely to ask for more information. Keep in mind the extra time it could take you to gather this.

At the point, and only at the point, that we have all the information we need, we have 3 months to come to a decision on your application.

Start your application by registering for Connect[9]

You can see a summary of the number of applications we have received[10] and their outcome.

Pre-application meetings

You can request a pre-application meeting if you seek registration under the MLRs.

The benefits include:

Further insights into the requirements of the rules and expectations of the FCA when an application is made. It will be expected that the relevant FCA pages have been reviewed.
A clearer understanding of the application process.
An opportunity to introduce and explain your firm’s business model.

Please note that we do not provide advice to firms and pre-application meetings do not guarantee a successful application.

To request a pre-application meeting, you should provide the following information in advance:

Name of firm and address (and Companies House number).
Your expectations from a pre-application meeting.
Link to your website (if applicable).
If available, a slide deck introducing your business model, products, customer types and any points that you wish to draw our attention to.
The cryptoasset activity(ies) you will be applying for.
Names and position of perspective attendees to the pre-application meeting.

Requests for pre-application meeting can be submitted to [email protected].

Registration fee

You will need to pay a fee to register with the FCA. Cryptoasset registration falls into Category 6 of our pricing categories.

You can find the charge for each category in our Handbook[11]. For more information please see pricing categories for application fees[12].

You will also need to pay a periodic or annual fee while your firm is registered with the FCA. For more information see our Handbook[13].

We have defined income as the gross inflow from economic benefits (that is: cash, receivables and other assets) recognised in the registered UK entity’s accounts during the reporting year in relation to the provision of the cryptoasset services specified in the MLRs.

Tips on applying

Prepare

Review the cryptoasset registration forms on our Connect system before starting your application so you know what information and documents we require.

Complete your application fully

Make sure you answer every question fully and provide all the information requested. Omissions may result in your submission being rejected. If we do ask for further information, you should provide it promptly.

A continued failure to provide the information we request may lead to your application being refused.

Provide up-to-date information

The information and documents you supply should be up-to-date (as on the date of submission), specific (do not reuse older documents if they are not fit for purpose), have been reviewed thoroughly (final versions) and signed off (via appropriate governance) before submission.

We will not review and comment on draft documents as part of our assessment.

Do not withhold information

Make sure you fully disclose any information. We take non-disclosure of information that could impact our assessment very seriously, especially where there is an apparent attempt to mislead.

The success of your application could be affected. If in doubt, it is better to disclose information rather than withhold it.

Review the cryptoasset registration forms on our Connect system before starting your application so you know what information and documents we require.

A continued failure to provide the information we request may lead to your application being refused.

We will not review and comment on draft documents as part of our assessment.

Make sure you fully disclose any information. We take non-disclosure of information that could impact our assessment very seriously, especially where there is an apparent attempt to mislead.

The success of your application could be affected. If in doubt, it is better to disclose information rather than withhold it.

We will reject poor quality submissions that do not meet the criteria above without conducting an assessment.

Guide to the information we need

You will need to include a range of information about how your business is organised and operates.

We highlight the information we expect below. Please note this is not an exhaustive list.

The information about your business should be up-to-date and we will need information on the applicant business and all key individuals who hold a relevant function to assess whether or not you are fit and proper (as set out in Regulation 58A[14]).

More on fit and proper assessments[15] can be found in the next section.

Information we expect you to include

Programme of operations: the specific cryptoasset services for your business. The activities you are applying for should be selected within the application form with additional explanation of how they will be used within the Regulatory Business Plan.

Regulatory Business Plan: your business objectives, customers, employees, governance, plans and projections. It should give enough detail to show that the proposal has been thought through and that the adequacy of financial and non-financial resources has been considered. It should also include details on the volume and value of transactions, number and type of customers, pricing, the main lines of income and expenses and any additional products or services that your business plans to offer in the future.

Structural organisation chart: a description of how your business is organised (including a corporate structure chart, any close links and group entities). You must include a description of any relevant outsourcing arrangements. We may ask for a copy of the outsourcing contract.

Jurisdictions: a list of any jurisdictions your business or group currently operate in. Include any group entities in the ‘structural organisation’ section detailed above. If governed by a regulator in those jurisdictions please state who, and for what services.

IT systems: details of the key IT systems you will use to run your business, including details of IT security policies and procedures.

Company details: we would expect to see up-to-date information about your business, and individuals within it. We will compare this information against Companies House. We would also expect to see no outstanding charges. If there are outstanding charges, please provide an explanation as to why.

Individuals, beneficial owners and close links: directors and any other persons who are, or will be, responsible for the management of the business, must satisfy us they have a good reputation, and have the appropriate knowledge and experience. We would expect to see, as part of an organisation chart, details of the roles and responsibilities of key individuals.

A business must appoint a person to be responsible for compliance with the MLRs, to monitor and manage compliance with policies, procedures and controls relating to the MLRs and to act as the nominated officer under the Proceeds of Crime Act 2002.

These functions can be carried out by the same person, but we expect them to have the knowledge, experience and training, level of authority, independence, and sufficient access to resources and information to enable them to carry out that function. For businesses already authorised or registered by us for other services, the relevant officer can be the same person as for those other services, subject to the person having appropriate knowledge, experience, capacity to perform the role and probity for the cryptoasset business.

You will still need to provide details of the relevant officer on the application form when registering for cryptoasset service. We expect to see Money Laundering Reporting Individual forms for all directors, executives and officers and beneficial owner forms for shareholders.

Governance arrangements and internal control mechanisms: details of senior management responsibility, oversight, organisational structure, budget forecasts and financials for the first 3 financial years and business continuity arrangements.

There should be a clear description of the type of management information the senior management of the business will have at their disposal in order to effectively manage the business. This could include, but not limited to, the reporting of suspicious activity, AML breaches and reporting, conflicts of interest, training records and risk management.

There should also be a description of the internal controls to identify, assess and manage the money laundering, terrorist financing and proliferation financing risks relevant to the business.

Anti-Money Laundering/Counter Terrorist Finance (AML/CTF) framework: a description of their AML/CTF framework, including policies, procedures and training material designed to comply with the MLRs.

Business-wide risk assessment: this should evidence an assessment of the inherent risks the business faces with the impact and likelihood of these risks assessed. An explanation of the control framework (design-only for non-trading firms). How risks are evaluated and what the residual risks are should be documented. The methodology of how the risk assessment was constructed should also be evidenced.

Customer risk assessment: a holistic assessment of the risk presented by a customer. At a minimum it should include the factors noted in the MLRs such as jurisdiction risk.

The customer risk assessment should provide a risk rating outcome that drives the level of due diligence, customer due diligence / enhanced due diligence) the business must collect, as per the applicant’s policies and procedures. A detailed methodology should lie behind the risk assessment.

Financial promotions: details of your financial promotions policy including details of the systems, controls and processes in place to ensure that financial promotions comply with our rules and are fair, clear and not misleading. You should also provide copies of any promotions (adverts, etc) you have issued or have plans to issue in the future. For more information please see approving financial promotions[16] and PS23/6[17].

Travel Rule: policies and procedures to describe how you will meet the requirements of Regulations 64 A-H of the MLRs to receive and transmit details of the beneficiary and originator when conducting cryptoasset transfers. This should be supported by a detailed flow of funds diagram which includes the flow of Travel Rule data as well as details of any technology solutions that you will use to support their implementation. For more information, please see the FCA sets out expectations for UK cryptoasset businesses complying with the Travel Rule[18].

All cryptoasset public keys/wallet addresses: all of the cryptoasset addresses controlled by your business and used in the activity of the business for each cryptoasset that your business deals with.

Customer on-boarding process: details of screening tools/processes for sanctions, politically exposed persons and adverse media.

Flow of funds and customer journey diagram: this diagram should also include any dependencies on linked group entities or other third-parties.

Ongoing monitoring and transaction monitoring procedures: this should include processes for detecting and escalating suspicious activity.

Record-keeping and recording procedures: this should include making the FCA aware of changes in individuals attached to the applicant or updates to any policies and procedures that have previously been submitted as part of the application.

What we need to make a fit and proper assessment

To become registered, cryptoasset businesses regulated by us under the MLRs and any person who is an officer, manager and beneficial owner in the business, will be subject to the fit and proper requirements under Regulation 58A[18] of the MLRs.

Any officer, manager and beneficial owner must pass the fit and proper test before the business can be registered.

This can include:

the sole proprietor of the business
a partner in the business
a director of the business
the Board member or Nominated Officer responsible for compliance with the Regulations
the Nominated Officer for reporting suspicious activity reports to the National Crime Agency
a beneficial owner as defined in Regulation 5[19] and Regulation 6[20] of the MLRs
other person performing a role of similar influence or responsibility

An applicant must disclose to us any issues as to why it may not be fit and proper.

When disclosing any matter under this requirement you may also, if appropriate, make representations explaining why the person should now be treated as fit and proper.

The FCA carries out checks on applications for fit and proper status and treats non-disclosure very seriously. The success of your application could be affected if we find that you have withheld information deliberately or provided false or incomplete facts.

Giving us false or misleading information may be a criminal offence. We suggest that if, after reading this information, you remain uncertain about disclosing convictions then you should seek legal advice.

We will use the information you provide, amongst other things, to determine whether the business and the relevant persons are fit and proper to carry on the regulated activity. Before doing so we will carry out checks on the information you provide to make sure it is correct.

A business must ensure any person who has not been approved by the FCA does not act as a manager, officer or beneficial owner. Any material information which is determined to be false or misleading may lead to refusal of the application.

We will consider:

convictions. An applicant or an officer, manager or beneficial owner that has an unspent conviction as listed in Schedule 3 of the MLRs[21] will automatically fail the fit and proper test
failure by an individual to pay a penalty under Part 9[22] or a charge under Part 11[23] of the MLRs, or charge imposed by the authority under Regulation 35(1) or 42(1) of the Money Laundering Regulations 2007
reasonable grounds that suggest an individual will fail to comply with the MLRs, Part 3[24] of the Terrorism Act 2000 and Part 7[25] and Part 8[26] of the Proceeds of Crime Act 2002
any failure to comply with the MLRs
the risk of the business being used for money laundering or terrorist financing or proliferation financing
an applicant and any individual’s honesty and integrity, skills and experience, financial soundness within the context of the regulations and the expectation to act with probity. For example, this may include any matters that cast doubt on the honesty and integrity of the individual, such as disciplinary proceedings or dismissal, competence or capability or financial soundness

Information you should also consider

This information will be useful when putting together your application. We would expect to see evidence of how you have taken into account this information, as appropriate to the nature of your application.

What to consider

Cryptoasset AML / CTF regime: feedback on good and poor quality applications[14]
Joint Money Laundering Steering Group (JMLSG) guidance[27] on the prevention of money laundering and terrorist financing and in particular, part II, chapter 22 (sectoral guidance for cryptoasset exchange providers and custodian wallet providers)
FCA Financial Crime guide for firms[28]
FCA Guidance (FG17/6) on the treatment for Politically Exposed Persons (PEPs)[29]
FATF Guidance on a risk-based approach[30]
FATF VASP Guidance[31]
Anti money laundering supervision: detailed information[32]
Guidance on Cryptoassets Feedback and Final Guidance to CP 19/3[33]
PS19/22: Guidance on Cryptoassets[34]
PS23/6: Financial promotion rules for cryptoassets[35]

Contact us

For any queries regarding the regime, please email [email protected].

31/01/2024 : Information added Pre-application meetings

18/08/2023 : Information added Travel Rule

31/07/2023 : Editorial amendment Typo corrected

06/06/2023 : Link added Link to registration statistics.

28/03/2023 : Editorial amendment reference to Money Laundering Regulations 2007 added

22/03/2023 : Editorial amendment Updates to page as part of website refresh

First published: 22/03/2023 Last updated: 01/07/2024 See all updates

Cryptoassets: AML / CTF regime - Registering with the FCA

On this page

Who needs to register

How to apply for registration

Pre-application meetings

Registration fee

Tips on applying

Guide to the information we need

What we need to make a fit and proper assessment

Information you should also consider

Contact us

On this page

Cryptoassets: AML / CTF regime [3]