Written for the analyst with a live decision, not the project team
Most crypto compliance content is written for the person managing the FSMA authorisation project. This is written for the person who has to make a real decision on a real customer before that project finishes. Those are different jobs, and the timeline that matters for one is not the timeline that matters for the other.
What counts as a cryptoasset, in terms that actually matter to you
Skip the blockchain explainer. For a working analyst, a cryptoasset is defined by what triggers a regulatory duty, not by how the technology functions underneath. Under the Money Laundering Regulations, a cryptoasset is a cryptographically secured digital representation of value or contractual rights, transferable and storable electronically. The definition is wide on purpose: exchange tokens, stablecoins, and a broad range of digital assets all sit inside it. The operative question is never really is this crypto, it is does dealing in this trigger a registration duty.
Owning crypto and dealing in crypto are two different questions
These get conflated constantly, and the conflation causes real onboarding mistakes. An individual holding cryptoassets personally, in their own wallet, for their own account, triggers no FCA registration duty at all. Ownership is unregulated.
The duty attaches to the business providing the service, not the person holding the asset. Exchange cryptoassets for money or other cryptoassets by way of business, or safeguard cryptoassets or the private keys controlling them on behalf of customers, and you are a cryptoasset exchange provider or custodian wallet provider under the Money Laundering Regulations. That duty has been in force since 10 January 2020. Nothing about that changes this year.
Two regimes are live at once right now, and that is the actual complication
| Regime | Status now | What it covers | Key date |
|---|---|---|---|
| MLR registration | In force, has been since 2020 | AML and counter terrorist financing supervision only | Ongoing |
| FSMA cryptoasset authorisation | Application gateway opens 30 September 2026 | Full financial services authorisation, stablecoin issuance, safeguarding, arranging deals, staking | Regime commences 25 October 2027 |
Registration under the MLRs does not convert into FSMA authorisation, and does not guarantee it. A firm correctly registered and supervised since 2020 still has to make a fresh case under the new regime. This is not a formality layered on top of what already exists, it is a separate gate.
The AML and sanctions obligations that sit underneath both regimes
A registered cryptoasset business carries the same core duties as any regulated firm: a business wide risk assessment, customer due diligence and enhanced due diligence where warranted, sanctions and PEP screening, ongoing transaction monitoring, staff training, and suspicious activity reporting, with an MLRO who genuinely understands cryptoassets, not a traditional finance background stretched thin to cover it.
The Travel Rule, the one obligation that is genuinely crypto specific
Customer initiates a cryptoasset transfer above the applicable threshold
The transfer enters the regulated pathway once it clears the threshold at which the information requirement applies.
Originator information is attached to the transfer before it leaves
Name and account identifier for the originator travel with the transfer itself, not separately after the fact.
Receiving cryptoasset business must confirm it can identify the beneficiary
The business on the receiving side has to be able to identify who is receiving the value.
If the counterparty is an unhosted wallet, there is no regulated party on the other end
With no regulated business to exchange this information with, this is where most real friction sits.
Since 1 September 2023, Part 7A of the Money Laundering Regulations has required this information to travel with certain cryptoasset transfers. It is the direct crypto equivalent of correspondent banking information requirements.
Why crypto KYC does not map cleanly onto a traditional onboarding checklist
Crypto specific enhanced due diligence requirements for certain correspondent style relationships come into force on 1 February 2027, formalising what many firms already do informally, treating unhosted wallet counterparties and lower transparency jurisdictions with a materially higher bar than a standard retail crypto customer.