Britain's Financial Conduct Authority opened a consultation on October 23 on financial-crime guidance for crypto businesses, including customer checks, blockchain analytics and the Travel Rule. The Financial Crime Guide proposal, CP26/38, closes for responses on December 24.
The proposed changes address all firms the FCA supervises for financial crime, including cryptoasset businesses registered under the money-laundering regulations. The regulator will consider responses before issuing a policy statement containing the amended guide.
The crime proposal sets out examples of good and poor practice for enhanced due diligence, onboarding and monitoring. It also addresses governance as businesses grow, alongside wider changes covering fraud, sanctions, data security and the use of artificial intelligence. Another proposed self-assessment asks whether policies and staff training distinguish Proceeds of Crime Act duties from those under the Terrorism Act.
Guidance is not a new rulebook
The distinction between guidance and legal requirements matters here. The existing Financial Crime Guide says its guidance is not binding: departing from an example does not, by itself, mean a firm has breached an FCA rule. The regulator instead supervises whether businesses comply with the rules and legal obligations that apply to them.
That does not make the guide optional reading. Firms are expected to know the relevant guidance and consider it when designing and maintaining their controls. They can meet their obligations through other methods. The guide says applicable legal requirements prevail if there is a discrepancy, and it does not attempt to reproduce every obligation in one document.
Its wording separates three levels. “Must” identifies requirements imposed by legislation or FCA rules. “Should” describes the regulator's usual expectation while allowing other ways of complying. “May” introduces examples that go beyond basic compliance. The guide also calls for proportionate application, taking account of a firm's nature, size and complexity. Those distinctions remain relevant when reading the proposed additions, rather than treating every illustrative example as a new mandatory procedure.
DeFi consultation closes in November
The DeFi consultation, GC26/7, proposes non-Handbook guidance for firms providing financial services through decentralised finance. It addresses existing operational-resilience and financial-crime rules, as well as the Money Laundering Regulations. The FCA says managing these risks is intended to protect consumers and market integrity while promoting competition.
The intended regulated audience includes firms within the operational-resilience provisions in SYSC 15A, the compliance and financial-crime provisions in SYSC 6, and the money-laundering regulations. The FCA also identifies unauthorised businesses interacting with DeFi, advisers, consumer groups and policymakers as potentially interested readers.
The proposal offers observations on DeFi risks and illustrative measures firms may consider. The FCA describes DeFi as financial services using distributed-ledger technology, extensive automation and open, interoperable technology, sometimes without a traditional intermediary. These features can increase operational and financial-crime exposure for firms and their clients.
Responses are due on November 18. The consultation webpage says final guidance is planned for January 2027, after feedback is considered. It directs firms to read the perimeter consultation alongside it.
Which activities need permission?
CP26/36 addresses proposed guidance on exclusions from regulated crypto activities following legislative changes. Examples include temporary settlement arrangements, temporary holding of UK qualifying stablecoins for payments and arrangements involving assets backing those stablecoins. It also covers specified proprietary trading and technical services that merely enable access to third-party services or decentralised protocols.
The FCA says the guidance should help firms avoid inadvertently crossing the regulatory boundary when the regime begins on October 25, 2027. Existing authorised firms considering additional permissions are among the intended readers. The exclusions do not establish a blanket exemption for decentralised services.
The regulator offers limited forbearance where uncertainty over the technical-services exclusion has materially affected a firm's ability to submit a complete application. A firm must demonstrate that impact and submit an otherwise complete application within the application period. Extra time would address incomplete aspects relating to the arranging permission, rather than replace the application requirement.
This consultation closes on November 18, with final guidance targeted for January 2027. The FCA directs affected firms to its pre-application support service.
Related reading: the UK crypto authorisation window and HMRC's crypto VAT guidance.
Contains Financial Conduct Authority information licensed under the Open Government Licence v3.0.
