Running a crypto business in the UK isn’t just about building a platform or launching a token. If you’re handling digital assets, you’re now part of a tightly regulated financial system. The AML rules for crypto businesses in the UK are among the strictest in the world - and they’re getting stricter. By 2026, the old registration system is disappearing. If you’re not ready, you won’t be allowed to operate.
Who Exactly Needs to Comply?
If your business does any of these, you’re covered:
- Exchanging crypto for fiat money (like GBP)
- Trading one crypto for another
- Providing custodial wallet services (holding crypto for others)
- Operating as a crypto payment processor
It doesn’t matter if you’re a startup in London or a remote team based in Manchester. If you serve UK customers or have a UK presence, you need FCA registration. There are no exceptions. Even if you think you’re "just a tech company," the law says you’re a financial services provider.
As of June 2025, only 147 crypto firms were registered with the FCA. That’s down from 184 in early 2024. The reason? Over 87% of applicants failed their first attempt. Common mistakes? Poor risk assessments, weak staff training, and systems that couldn’t flag suspicious transactions.
The Core Rules: What You Can’t Skip
The UK doesn’t just ask you to "try your best." It demands specific actions. Here’s what every crypto business must do:
1. Customer Due Diligence (CDD)
You must verify every customer’s identity using at least two independent sources. That means:
- Government-issued ID (passport, driver’s license)
- Proof of address (utility bill, bank statement)
- Biometric verification (facial recognition, fingerprint)
You can’t just take a selfie with a ID. The FCA requires automated systems that cross-check data against official databases. Manual checks? They’re not enough. And you must keep these records for five years.
2. Enhanced Due Diligence (EDD)
Not all customers are the same. If someone is a Politically Exposed Person (PEP), or comes from a high-risk country, you need to dig deeper. The FCA defines over 30 high-risk jurisdictions based on FATF lists. Examples include Nigeria, Venezuela, and certain parts of Southeast Asia.
For these customers, you must:
- Get senior management approval before onboarding
- Verify the source of their funds
- Monitor their transactions more closely
Surprisingly, crypto firms here face 37.8% more EDD checks than traditional banks. Why? Because regulators treat crypto as higher risk - even if the customer isn’t.
3. The Travel Rule (£1,000 Threshold)
Since 2022, any crypto transaction over £1,000 must carry specific data. This is called the Travel Rule. You must send:
- Sender’s full name
- Sender’s account number or wallet ID
- Sender’s address
- Beneficiary’s full name
- Beneficiary’s account or wallet ID
This isn’t optional. If you send £1,500 in ETH to another exchange and don’t include this data, you’re violating UK law. The FCA has fined multiple firms for missing this. Even peer-to-peer trades must comply if they exceed the threshold.
4. Transaction Monitoring
You can’t just collect data - you must watch it. Your system must automatically flag:
- Unusual spikes in activity
- Transactions with blacklisted addresses
- Structuring (breaking large amounts into smaller ones to avoid detection)
Here’s the catch: false positives are common. Crypto firms report an average of 28.7% of alerts are wrong. That’s more than double the rate in traditional banking. But you still have to investigate every alert. Ignoring them = fines.
What’s Changing in 2026?
The current system - where crypto firms register under the Money Laundering Regulations (MLR 2017) - is ending. In Q1 2026, the Financial Services and Markets Act (FSMA) 2000 Order 2025 will take effect.
This means:
- Registration under MLR 2017 will no longer be valid
- All crypto firms must apply for a full FCA license under FSMA
- The 10% change-in-control rule kicks in: if any investor buys 10% or more of your company, you must notify the FCA within 14 days
- Counterparty Due Diligence (CPDD) becomes mandatory: you must verify not just your customers, but also the exchanges or wallets you send funds to
That last one is huge. If you send crypto to another platform, you now have to check if that platform is registered, sanctioned, or high-risk. You can’t just assume it’s safe.
And yes - this applies even if you’re not directly dealing with that platform. If your customer sends funds to an unregistered wallet, and you didn’t screen it, you’re liable.
Real Costs - Not Just Time
Most businesses think compliance is about hiring a lawyer. It’s not. It’s about tech.
According to FCA data from March 2025:
- Average setup cost: £287,500
- Annual ongoing cost: £142,300
- Time to get registered: 9.2 months on average
One firm on Reddit spent 14 months and over £500,000 just to get approved. They hired three consultants, bought four compliance platforms, and paid for real-time sanctions list updates. They still got rejected twice before passing.
But here’s the upside: once registered, firms report better investor trust. A CryptoUK survey found 73.4% of registered firms saw improved access to banking and venture capital.
How the UK Compares to Other Countries
Let’s be clear: the UK is not the easiest place to run a crypto business.
Compare it to:
- Singapore (MAS): 38.4% of applicants passed first time. UK: 12.7%
- EU (MiCA): One license covers all 27 countries. UK: separate rules, separate fees
- US: Multiple agencies (FinCEN, SEC, CFTC) - messy, but some states are easier
- Switzerland: Clear guidelines, faster approvals, lower costs
The UK’s advantage? Clarity. Once you’re in, you’re treated like a bank. That means you can partner with traditional institutions. That’s why big firms like Coinbase and Kraken stayed - even with the pain.
What Happens If You Don’t Comply?
There are no gray areas. If you operate without FCA registration after January 2026, you’re breaking the law.
Potential consequences:
- Fines up to £1 million or 15% of annual turnover (whichever is higher)
- Personal liability for directors
- Criminal prosecution for serious breaches
- Asset freezing by OFSI (Office of Financial Sanctions Implementation)
- Public listing on FCA’s warning page - killing your reputation
In 2024, the FCA published 12 warning notices against unregistered crypto firms. Six were shut down within 30 days. Two directors were banned from running any UK financial business for life.
How to Prepare for 2026
If you’re still unregistered, here’s your roadmap:
- Stop operating if you haven’t applied. The clock is ticking. The MLR window closes in Q1 2026.
- Assess your tech stack. Can your system handle real-time sanctions screening? Can it send Travel Rule data automatically? If not, budget for upgrades.
- Hire a compliance officer. Not a consultant. A full-time, FCA-experienced person. The FCA requires senior management oversight.
- Train your team. Minimum 35 hours per year per compliance staff. Use certified platforms - not YouTube videos.
- Apply early. The FCA is prioritizing applications submitted before September 2025. After that, processing times will stretch to 12+ months.
There’s no shortcut. The UK isn’t trying to stop crypto. It’s trying to filter out the bad actors. If you’re serious, you’ll pass. If you’re cutting corners, you’ll get caught.
Final Reality Check
The UK crypto market is shrinking - but getting stronger. From 184 registered firms in 2024 to 147 in 2025. That’s a 20% drop. But those left are the ones with real compliance systems. They’re the ones banks will work with. They’re the ones investors trust.
By 2027, experts predict only 85-95 firms will remain. That’s not failure. That’s consolidation. The UK is becoming a premium, high-bar jurisdiction. You don’t need to be here to survive. But if you want to operate in Europe and attract serious capital, you’ll need to play by these rules.
Do I need to register if I only deal with crypto-to-crypto trades?
Yes. Any business that exchanges one cryptoasset for another must register with the FCA. This includes peer-to-peer platforms, decentralized exchange aggregators, and token swap services. The rule applies regardless of whether fiat money is involved.
Can I use a third-party KYC provider instead of building my own system?
Yes - but only if the provider is FCA-approved and your firm remains fully responsible. You can’t outsource compliance. The FCA holds your management team accountable. If the third party fails, you still get fined. Always audit their systems and keep logs.
What if my customers are outside the UK? Do I still need to comply?
Yes. If your business is based in the UK, or you actively market to UK customers, you must comply - even if most of your users live abroad. The FCA’s jurisdiction is based on where the business operates, not where the customers are.
How often do I need to update customer information?
At least once a year for all customers. For high-risk customers - like PEPs or those from sanctioned countries - you must re-verify every six months. The FCA expects continuous monitoring, not just a one-time check.
Are NFTs covered under these rules?
Only if they’re used as a means of payment or investment. If you’re selling NFTs as digital art with no financial function, you’re likely exempt. But if you’re allowing trading, fractional ownership, or staking, you’re in the same category as crypto exchanges and must register.
