The upcoming FSMA regime for cryptoassets will bring a wider range of activities within the UK regulatory perimeter. Activities include operating cryptoasset trading platforms, dealing and arranging deals, safeguarding cryptoassets, qualifying staking activities, lending and borrowing, and qualifying stablecoin issuance will fall within the regulatory framework, subject to the relevant statutory scope and exclusions.
For many firms, this will mean reviewing their existing business models, products and services, and considering whether their financial crime frameworks adequately reflect the activities they intend to undertake.
Each of these activities carries its own financial crime risks. Firms should therefore consider whether their business-wide risk assessments, policies and procedures, and operational controls adequately reflect the nature and extent of their evolving activities. This includes assessing whether crypto-specific controls, such as blockchain analytics and Travel Rule arrangements, are appropriately designed and operating effectively to mitigate the risks identified. The commencement of the regime on 25 October 2027 will bring the relevant regulatory powers into effect, but firms should not view this date as the starting point for ensuring their financial crime controls are appropriate.
The FSMA regime will also bring cryptoasset service providers (CASPs) within the scope of the existing Money Laundering Regulations 2017 (MLRs) through their FSMA authorisation, removing the need for a separate MLR registration requirement. Firms will therefore need to ensure that their systems and controls address the applicable requirements of the MLRs as part of their regulatory framework.
The FCA is also continuing to develop its financial crime expectations for the sector. Its October 2026 consultation, CP26/38, proposes updates to the Financial Crime Guide, including further guidance on cryptoasset-related financial crime risks and systems and controls. This reinforces the importance of firms keeping their financial crime frameworks under review as the regulatory landscape develops.
This article looks at four connected areas: how regulated activities may change a firm’s financial crime risk profile, financial crime considerations, how blockchain analytics can support an effective control framework, and how Travel Rule requirements can be addressed in practice.
PART 1: NEW ACTIVITIES, FINANCIAL CRIME RISKS.
Is your business-wide risk assessment ready for what you will actually be doing?
A business-wide risk assessment developed for a firm’s existing activities should be revisited as new products and services are introduced. Where firms are expanding their offering under the upcoming regime, the risk assessment should reflect the specific risks associated with each activity and how these risks are addressed through appropriate controls.
Examples of risks firms may wish to consider include:
- Trading platforms: The potential for market manipulation, wash trading, the use of multiple accounts to move value, and the challenges of monitoring activity across high volumes of transactions and counterparties.
- Lending and borrowing: The potential for lending products to be used to layer funds, obscure the origin of assets or move value between parties in ways that may not be immediately apparent. Firms should also consider the source of assets used as collateral and the repayment process.
- Staking: The need to understand the source of assets being staked, the flow of rewards, the involvement of third parties and any associated wallet exposure.
- Stablecoins: The potential for stablecoins to be used to move value quickly across borders and between platforms, and the importance of appropriate controls at issuance, redemption and transfer.
- DeFi interactions: The potential exposure arising from interactions with decentralised finance protocols, liquidity pools and third-party platforms, including the challenges of understanding transaction flows and associated wallet exposure.
Firms should consider whether inherent risk ratings for new activities are clearly explained whether monitoring scenarios and customer risk assessment methodologies reflect the associated risks, and whether staff responsible for financial crime controls understand the relevant typologies.
PART 2: FINANCIAL CRIME CONSIDERATIONS.
For firms, this means considering whether their existing financial crime frameworks adequately address the risks arising from their cryptoasset products and services, as well as the applicable regulatory requirements.
This may include reviewing customer due diligence, business-wide risk assessments, ongoing monitoring, sanctions controls, governance arrangements and record-keeping to ensure they remain appropriate to the nature and scale of the firm’s business.
Firms should also consider whether their existing policies and procedures adequately reflect the cryptoasset services they provide or intend to provide, and whether responsibilities across compliance, financial crime and operational teams are clearly established. A holistic approach will be important, ensuring that AML/CTF obligations and wider financial crime risks are addressed through a coherent and integrated framework.
FSMA authorisation does not replace or alter a CASP’s existing AML/CTF obligations under the MLRs. Rather, firms should continue to maintain effective financial crime frameworks that are proportionate to their business activities, products and services, and the risks these present.
PART 3: BLOCKCHAIN ANALYTICS – A TOOL, NOT A CONTROL.
Blockchain analytics tools are an important part of many cryptoasset firms’ financial crime frameworks. However, technology alone is unlikely to be sufficient. Its effectiveness depends on how it is configured, how its outputs are interpreted and how those outputs inform decisions.
Areas firms may wish to consider include:
- Calibration: Whether risk thresholds and rules have been configured to reflect the firm’s own risk appetite and business model, rather than relying solely on default settings, and whether they are periodically reviewed.
Interpreting risk scores: Whether staff understand what a risk score represents, what exposure categories mean and how direct and indirect exposure is assessed. - Integration with customer due diligence: Whether blockchain intelligence is considered alongside customer identity, source of funds, source of wealth and expected transaction activity.
- Documented decision-making: Whether alerts and risk indicators are reviewed and closed with a clear rationale, and whether outputs inform customer due diligence, transaction monitoring and escalation decisions.
- Coverage: Whether the tool supports all the blockchains and tokens the firm offers, and how any limitations or gaps in coverage are managed.
- Vendor oversight: Whether the firm understands the tool’s capabilities and limitations, and whether the vendor relationship is subject to appropriate due diligence and ongoing oversight.
It is also important to recognise the limitations of blockchain analytics. While these tools can help identify wallet exposure, transaction patterns and connections to potentially high-risk entities, they cannot independently establish who controls a wallet, the purpose of a transaction or the legitimacy of the underlying source of wealth.
Technology should therefore be considered as part of a wider financial crime framework, supported by appropriate governance, oversight and documented decision-making. Firms should be able to explain not only which tools they use, but how those tools support their wider financial crime controls.
PART 4: TRAVEL RULE IN PRACTICE.
Travel Rule requirements are an important crypto-specific control, and firms should be able to demonstrate how they are addressed in practice rather than in policy alone.
The UK’s Travel Rule requirements are already established under Part 7A of the MLRs 2017 and will continue to be relevant alongside the new FSMA regime.
Areas firms may wish to consider include:
- Information requirements and thresholds: Whether arrangements distinguish between the basic originator and beneficiary information required for inter-cryptoasset business transfers regardless of value, and the additional information requirements applicable to qualifying cross-border transfers. From 30 June 2026, the threshold in Regulation 64C(4) is expressed as £800 rather than €1,000, including linked transfers.
- Unhosted wallets: The firm’s approach to transfers to and from unhosted wallets, including how the associated risks are assessed and what additional information or checks are applied under the relevant requirements.
- Jurisdictions at different stages of implementation: How the firm handles transfers involving counterparties in jurisdictions where the Travel Rule has not been implemented or is applied differently.
- Missing or incomplete information: How transfers with missing or incomplete originator or beneficiary information are identified and assessed, and whether they are held, rejected or escalated, with decisions supported by a clear rationale.
- Counterparty due diligence: How the firm assesses the cryptoasset businesses it transacts with, and how that assessment informs its approach to transfers.
- Escalation and record-keeping: Whether Travel Rule exceptions are escalated appropriately and decisions are documented.
As firms expand their products and services under the new regime, they may also wish to consider how their Travel Rule arrangements operate across different transaction types, counterparties and transfer channels.
BRINGING IT TOGETHER.
These areas are closely connected. New activities may change a firm’s financial crime risk profile, the business-wide risk assessment should reflect those changes, and crypto-specific controls such as blockchain analytics and Travel Rule arrangements should be designed and calibrated to address them.
Considering these areas together, rather than as separate workstreams, can help firms develop a more coherent approach to financial crime risk management and demonstrate how their controls support their wider business activities.
GOOD PRACTICES.
Practical steps firms may wish to consider as they prepare for the new regime include:
- Activity-specific risk assessment: Reviewing the business-wide risk assessment to ensure it adequately captures the financial crime risks associated with the firm’s products and services, recognising that different offerings may present different vulnerabilities even where they fall within the same regulated activity.
- Regulatory alignment: Reviewing existing policies and procedures to ensure they reflect the applicable requirements of the MLRs and relevant FCA rules and guidance.
- Calibrated technology: Ensuring blockchain analytics and transaction monitoring tools are appropriately configured, tested and periodically reviewed against the firm’s risk profile.
- Clear rationale: Maintaining documented decision-making for alert reviews, Travel Rule exceptions and escalations.
- Vendor oversight: Maintaining appropriate due diligence and ongoing oversight of key technology providers.
- Training: Ensuring staff understand crypto-specific financial crime typologies and the risks associated with new products and services.
- Governance and oversight: Ensuring senior management and relevant financial crime functions have appropriate oversight of the firm’s financial crime risks and controls.
- Independent testing: Periodically reviewing key controls, with findings tracked and any required improvements appropriately addressed.
FINAL THOUGHTS.
The introduction of the FSMA regime provides a timely opportunity for cryptoasset firms to take stock of their existing financial crime frameworks and consider whether these adequately reflect the risks associated with their business models, products and services.
As the sector continues to evolve, firms must ensure that their financial crime controls keep pace with changes in their business activities, products, services and associated risk exposures. This requires more than having appropriate policies and procedures in place: firms should be able to demonstrate that their controls are appropriately designed, effectively implemented, regularly tested and operating as intended.
Ultimately, effective financial crime compliance should not be treated simply as a step towards obtaining FSMA authorisation. It should remain an integral and ongoing part of operating a sustainable and responsible cryptoasset business.
HOW COSEGIC CAN HELP.
We support cryptoasset firms in strengthening their financial crime frameworks and preparing for the new regime through:
- Business-wide risk assessment reviews and enhancements tailored to cryptoasset business models and regulated activities.
- AML audits and virtual asset control framework reviews, including independent assessments of AML/CTF governance, customer due diligence, sanctions compliance, transaction monitoring, blockchain analytics, Travel Rule controls and broader financial crime risk management arrangements.
- Independent testing of AML controls, including CDD, screening, transaction monitoring and Travel Rule compliance.
- Compliance monitoring and quality assurance program design and review.
- Policy and procedure reviews aligned with applicable regulatory requirements and operational practices.
- Ongoing assurance and specialist financial crime resourcing.
If your firm is expanding its activities under the new regime, contact us to discuss how we can support you.
