There are two primary regulations in the UK for VASP activities (including custody, exchange services and token sales) within the UK:
The first applies to UK based businesses and the second has global application. In practice, the two regimes work together such that unless you are already an authorised person, or registered under CARR you need any cryptoasset financial promotion to be approved by an authorised person unless it is fully exempt (e.g. offers to professional investment firms). This is the case for all overseas firms that are not authorised by the FCA (or passported into the UK from Gibraltar).
See Gateway Regime below for the method by which non-UK firms can offer cryptoassets in compliance with the FinProm restrictions.
See also our latest post about the proposed new UK authorisation regime under FSMA.
Even if a firm is not providing services in or from the UK, the UK has rules that regulate such businesses if they offer cryptoassets in or to the UK. The regime applies to financial promotions that are capable of having an effect in the UK.
All retail clients are in scope and only professional institutional investors are not considered retail (i.e. high net worth individuals and sophisticated investors are within the definition of retail client).
The regime is implemented into the existing Financial Services and Markets Act 2000 (FSMA) by way of the (Financial Promotion) (Amendment Order) 2023 from 08 October 2023. The Financial Services and Markets Act 2023 (FSMA 2023) amends the definition of “investment activities”, to bring invitations and inducements relating to cryptoassets within the regulatory framework and therefore within the FCA’s regulatory reach.
It applies to a wide range of persons and communications:
These obligations apply to all cryptoasset financial promotions, regardless of whether they constitute a DOFP (See Back End Rules below):
Promotions include websites, blog posts, mobile phone apps, videos (e.g. YouTube promoters) and social media channels (X, LinkedIn etc). The FCA expect that the vast majority, if not all, of websites and apps that enable a UK person to invest in cryptoassets will be in scope of the financial promotions regime.
Financial promotions are unlikely to be considered to be fair, clear and not misleading unless an offer or promotion sets out with sufficient clarity and prominence the:
Anyone who communicates a financial promotion for a cryptoasset should have sufficient evidence, and carry out due diligence, on the substance of a promotion and underlying cryptoasset before communicating it to accurately disclose risks to clients in a way that is fair, clear and not misleading.
Due diligence is a key component of the financial promotions regime. To help firms understand their obligations, the FCA set out guidance in FG23/3 on conducting due diligence before communicating a financial promotion on both the cryptoasset or cryptoasset service being promoted and claims made in the promotion.
The FCA Guidance states that a firm may need to consider (amongst other things):
“There are 3 main reasons why firms will need to conduct due diligence.
• Disclosing of risks. To ensure a financial promotion is fair, clear and not misleading firms will need to conduct due diligence on the cryptoasset or cryptoasset service to understand its relevant risks. This is to enable firms to accurately and clearly disclose those risks in the promotion, including in the required risk summaries, and to assess consumers’ understanding of those risks as part of the appropriateness assessment through the customer journey.
• Accuracy and fairness of claims made. To ensure a financial promotion is fair, clear and not misleading firms should conduct due diligence on any claims made in the promotion. For example, claims about how a form of stability is maintained and claims on how advertised rates of return are achieved.
• Supporting good consumer outcomes. Beyond being able to ensure that a promotion is fair, clear and not misleading, authorised persons communicating or approving cryptoasset financial promotions may need to conduct additional due diligence. This is to meet their obligations under the Duty, where relevant, to ensure promotions support good consumer outcomes and avoid causing foreseeable harm.”
A general financial promotion is any communication inviting or inducing someone to engage in investment activity. This could be an advert, website content, or any other material aimed at promoting financial products or services.
Example: An online advert for an investment product targeting retail clients would need to include prominent risk warnings upfront, especially if the investment involves high-risk products like cryptoassets or leveraged derivatives.
Financial incentives to purchase cryptoassets (including refer-a-friend bonuses) will be unlawful. The FCA rules do however clarify when an intrinsic benefit is permissible:
“We wish to clarify that we would not consider benefits that are intrinsic to the cryptoasset or exclusively bound up with its function and/or business model to be considered an ‘incentive’. This might include features or benefits that are part of the terms and conditions associated with a particular cryptoasset. For example, cryptoassets that serve to provide the owner with voting rights, and which are used for the purpose of establishing governance arrangements for a particular platform or project would not be considered an incentive.”
The requirements for promoting invitations to purchase qualifying cryptoassets – (known as Direct Offer Financial Promotions (DOFPs) – to clients are referred to as the additional ‘back end’ rules and they include:
A DOFP is defined as:
“a financial promotion that contains:
and which specifies the manner of response or includes a form by which any response may be made.”
Retail consumers must be given a 24-hour cooling-off period before they can proceed with an investment following the promotion of high-risk financial products, such as cryptoassets. This applies to first-time investors in these products to give them adequate time to reflect on the risks before committing funds.
In a DOFP, firms must ensure that clients are provided with all relevant risk information before they make a final decision to invest. This often involves providing a detailed risk disclosure document at the point where the client is about to execute the transaction.
The risk warning must be tailored to the product being offered and placed in a clear and prominent manner at the point where the client is taking action. This can be viewed as a “back-end” obligation because it applies at the final step where the client decides to purchase the product.
Suitability or Appropriateness Considerations: If the promotion leads to a suitability check or an appropriateness test, this would also factor into ensuring that the client understands the risks at the point of sale.
DOFPs can only be made to investors that have already been categorised as:
The categorisations require the investor to sign a declaration stating that they meet the relevant criteria to fall within the relevant category. Sophisticated investors can not self-certify. Declarations are only valid for a 12-month period. This means firms will need to re-categorise investors again after the 12-month period has expired if they wish to make further direct DOFPs.
Less Restrictive Financial Promotions: You can communicate more complex or high-risk products to HNW and Sophisticated clients without needing to meet all the stringent requirements that apply to retail clients. However, firms must still include appropriate risk warnings.
The aim of appropriateness is to determine whether the client has the necessary knowledge and experience to understand the risks associated with the financial product they want to buy. This check ensures that the client is not investing in a product that is too complex for them to understand. COBS 10 includes the rules on Appropriateness.
Firms must assess whether the qualifying cryptoasset is appropriate for the consumer before they process an application or order in response to a DOFP. This requires the firm to assess that the consumer has the necessary experience and knowledge to understand the risks associated with the specified cryptoasset.
Guidance in the FCA handbook include the topics the FCA would expect firms to include is intended to set a baseline standard and help firms understand their obligations. Firms may need to ask additional or alternative questions to ensure that the retail client has the necessary knowledge to understand the risks involved in the specific type of cryptoasset offered. FCA rules are not prescriptive on how appropriateness assessment should be conducted.
Note: for persons providing advice on cryptoassets the suitability requirements are also relevant.
Suitability requirements are contained in COBS 9 which distinguishes between suitability checks (for ensuring that a product is in line with a client’s personal financial situation and goals) and appropriateness checks (which ensure the client has the knowledge to understand the risks of the specific product).
The financial promotions regime applies to all firms marketing cryptoassets to UK consumers regardless of whether the firm is based overseas and whatever technology is used to make the promotion.
There are now only 4 routes to legally promoting cryptoassets to retail customers:
Firms that are not authorised or registered under CARR rely on authorised firms, known as “s21 approvers,” (Financial Promotion Approvers) to approve their financial promotions targeted at UK clients.
The Financial Promotion Gateway Regime, is a new regulatory framework in the UK that aims to enhance control over the approval of financial promotions by authorised firms on behalf of unauthorised persons. It ensures the FCA have oversight in real-time of the types of promotions being approved by authorised persons in behalf others.
FSMS 2023 amended section 21 of FSMA to introduce the s21 gateway. This gateway requires authorised firms seeking to approve financial promotions for unauthorised persons to obtain explicit permission from the FCA, signifying a shift from a system where approval was a general entitlement to one where it is a specific permission granted based on the FCA’s continuous assessment of the firm’s competence and capabilities.
Approvers are required to notify the FCA within one week using the FCA connect platform when they approve a financial promotion for a qualifying cryptoasset, or a product subject to a retail mass marketing restriction.
The rules relating to corporate clients are different and allow for certain promotions to qualifying corporates, associations and trusts.
While some exemptions that apply to traditional financial promotions are not applicable to cryptoassets, certain general exemptions within the Financial Promotion Order (FPO) apply, as long as their conditions are met.
The main one is the Investment Professionals Exemption, which allows communications to individuals considered investment professionals, including banks, investment firms, and other entities whose regular business activities involve the subject of the communication. It includes trusts, partnerships and companies having above specified financial asset thresholds.
This exemption also covers governments, local authorities, and international organisations.
Payment companies, social media companies and advertisers are also required to ensure that illegal financial promotions are not communicated to UK consumers by unregistered cryptoasset firms.
This led some banks and payment companies to shut down UK crypto payments activities until they were clearer on how to comply. CoinDesk – Why Some Crypto Firms Are Suspending Services in the U.K.
Now that the FinProm regime for cryptoassets is more settled it is possible to navigate the relevant issues with payment companies and media organisations.
In addition, if a business model involves receiving economic benefits to encourage persons to invest in cryptoassets (there are many persons using affiliate links on social media platforms including X and Youtube) then they can also be caught by the general financial promotion restriction even if they are not directly providing the cryptoasset custody, exchange or investment services:
“A hypertext link may or may not be a financial promotion in itself. This will depend on the nature of the hypertext link and the context in which it is placed. However, taken in isolation, a hypertext link which is purely the name or logo of the destination will not be a financial promotion in its own right. More sophisticated links, such as banners or changeable text, may be financial promotions. This will depend upon the facts in each case.
…In some cases, however, the operator (‘O’) of a website which hosts a link to another website, may be causing the communication of a financial promotion on that other website. This will only arise when O has made arrangements with the operator of the other website under which O is to procure users of his site to access the link provided with a view to their engaging in investment activity.” (FCA – PERG, 8.22)
Yes if they involve an offer to subscribe for qualifying cryptoassets being fungible and transferable cryptoassets that are not limited network tokens or within scope of other rules (e.g. e-money tokens, other regulated investment tokens).
There’s no explicit guidance on whether airdrops fall under the UK’s financial promotion regime. Airdrops vary significantly. Some might be simple giveaways, while others might require users to perform actions (like holding another token or participating in a network) which could be seen as an “investment.” This makes it difficult for the FCA to issue a blanket ruling.
Cryptoasset derivative products and crypto ETNs remain banned for UK retail clients. In addition the rules on Non-Mass Market Investments also apply and prohibit promotions for:
Limited use cryptoassets, are excluded from the definition of “qualifying cryptoassets” and therefore are not subject to the same financial promotion restrictions.
A cryptoasset is considered “limited use” if it can only be redeemed with the issuer and cannot be otherwise transferred or sold; and it meets one of the following conditions:
The cryptoasset restriction applies only to cryptoassets that are fungible and transferable (such as tokens and cryptocurrencies).
It does not extend to non-fungible tokens that do not have an investment or payment function. NFTs are currently generally treated as collectibles rather than financial investments. However, care is needed with edge cases (such as fan tokens) which may have the characteristics of an investment depending in their structure and the manner in which they are marketed.
Cryptoassets that meet the criteria of one of the other types of controlled investment, or electronic money or fiat currency will not constitute qualifying cryptoassets however they will be within scope of the other applicable regimes.
Cryptoassets that can only be used in a limited way are also excluded – in line with the limited network exclusion that applies in relation to payment services.
UK financial services law and the FinProm regime distinguish regulated tokens and unregulated cryptoassets and tokens:
With a few exceptions, the FinProm regime also applies to unregulated tokens (known as ‘qualifying cryptoassets‘).
Yes. Only professional investors (e.g. government bodies and agencies, banks, investment funds, venture capital firms, insurers, higher value trusts, partnership and companies) are out of scope of the FinProm restrictions for promoters.
The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs), provide that many activities related to cryptoassets require registration for anti-money laundering and counter terrorist financing (AML/CTF) purposes.
UK-based firms carrying out these activities (including exchanging and custody on a customer’s behalf) must be registered with the UK Financial Conduct Authority (FCA) If such firms are not registered, they are at risk of being subject to the FCA’s criminal and enforcement powers.
Registrants must have suitable due diligence procedures in place and implement adequate AML/CTF systems and controls. However, CARR requires the submission of a range of information that is more akin to the full prudential regime and goes much further than what is actually required to assess the suitability of a business to combat criminal misuse of their services.
The requirements are substantial and resulted in only a few successful registrations when it was first implemented and many operators left the UK market. In addition, the success rate for applicants is consistently below 15%.
The MLRs provide that many activities related to cryptoassets require FCA registration for anti-money laundering and counter terrorist financing purposes (AML & CTF), even when they are not regulated financial services activities requiring Financial Conduct Authority (FCA) authorisation.
The relevant in scope cryptoasset activities are those carried out by:
“a firm or sole practitioner who by way of business provides one or more of the following services, including where the firm or sole practitioner does so as creator or issuer of any of the cryptoassets involved, when providing such services—
(a) exchanging, or arranging or making arrangements with a view to the exchange of, cryptoassets for money or money for cryptoassets,
(b) exchanging, or arranging or making arrangements with a view to the exchange of, one cryptoasset for another, or
(c) operating a machine which utilises automated processes to exchange cryptoassets for money or money for cryptoassets” (MLR 14A(1)).
“a firm or sole practitioner who by way of business provides services to safeguard, or to safeguard and administer—
(a) cryptoassets on behalf of its customers, or
(b) private cryptographic keys on behalf of its customers in order to hold, store and transfer cryptoassets, when providing such services” (MLR 14A(2)).
NFTs
The position with respect to NFTs and the AML regime is not crystal clear and it has not been clarified by the FCA or in JMLSG Guidance (i.e. specifically stated as being in or out of scope). The definition is arguable wide enough to include NFTs particularly if they are not standard collectible items or represent a higher AMl risk. We also note that FATF guidance excludes such tokens from being within the scope of their guidance on suitable national AML requirements.
The boundary issues for NFTs have also not been subject to any public enforcement action. by the FCA or UK court cases that would help understand if and when NFTs should be considered as in-scope stores of value or contractual value tokens.
In practice, the nature of the NFTs and the context is crucial to assess whether they give contractual rights or appear to operate as a fungible store of value (similar to cryptoassets in scope of financial services rules) and are therefore likely to be the type of token which the FCA wishes to bring within the regulatory perimeter.
We also await the follow up to the closed Treasury consultation ‘Improving the effectiveness of the Money Laundering Regulations‘ as this may result in regulatory clarity as to if or when NFT issuers or platforms should be considered in scope for AML purposes, particularly once the FSMA authorisation regime is in place for cryptoassets (since they will not usually be within scope of that regime).
The following businesses are definitely caught by the two relevant cryptoasset exchange and custodian definitions:
CARR requires a UK presence for persons wishing to register under the MLRs (which also enables them to take advantage of the exemption in respect of financial promotions of cryptoassets for such persons under FinProm).
The following definitely constitute a qualifying UK presence for the purposes of the MLRs:
Note: if you are not an authorised firm by the FCA or registered under CARR you can not make financial promotions of cryptoassets in the UK without approval by an authorised firm.
The FCA website sets out the various steps, documents and requirements for registering as a VASP under the UK CA AML/CTF Regime. Applicants must register from a UK establishment.
The FCA website sets out the information the FCA expect in an AML/CTF application.
To register a cryptoasset business in the UK, you need to provide the FCA with a comprehensive overview of your operations, including:
Business details:
Technical & Compliance:
Fit and Proper Test:
This information helps the FCA assess your business’s legitimacy, financial stability, and compliance with AML/CTF regulations. It’s crucial to be thorough and accurate in your application to avoid delays or rejection.
The JMLSG guidance gives some examples of activities likely to be out of scope and some borderline cases:
22.11 The definition [of a cryptoasset exchange provider] is broad, providing for exchanging as well as “arranging or making arrangements with a view to the exchange.” This may include activities relating to a dedicated peer-to-peer platform. However, it is not intended to capture a firm that only provides a forum where buyers and sellers can post their bids and offers, such as a bulletin board where the availability of the assets are merely made known and the parties trade at an outside venue either through individual wallets or other wallets not hosted by the forum or a connected firm. Such business models will, however, be considered on a case-by-case basis.
22.12 Software developers and other providers connected to a decentralized cryptoasset exchange and payment system may fall outside of the scope of the definition, and are more likely to do so if they derive no income or benefit from consequent transactions (also see paras 22.25 and 22.26 below).”
However, we note that this guidance seems overly restrictive and does not appear to be technologically neutral.
In the regulated payments sector it is clear that companies that are not involved in the payment flows, e.g. AISPs, are out of scope of AML/CTF obligations because it is not proportionate on a risk based approach to apply the same to them.
In addition, the Payment Services Directive (which is still implemented in the UK) provides:
“…Where agents act on behalf of both the payer and the payee (such as certain e-commerce platform), they should be excluded [from being a regulated payment service provider] only if they do not, at any time enter into possession or control of client funds” (Recital 11, PSD2)
In our view, a technology provider that does not handle client funds or cryptoassets should be able to defend themselves from a claim that they must register for AML/CTF under the UK Cryptoasset Registration Regime since it is not proportionate or risk based to apply the regime to them. Whether they are in scope of the FinProm regime is a different matter.
The JMLSG Guidance appears to conflate AML/CTF risks and obligations with wider regulatory boundary issues (i.e. intermediary activities). It would be much better to separate the two issues and for the UK to decide which activities require authorisation or registration permissions for financial services activity and which for AML/CTF risks (the two are not the same).
However, we caution that to the extent that a technology provider operated a marketplace that enables and promotes the regular sale or exchange of qualifying cryptoassets and they receive a benefit from each transaction then it would be harder to resist being in-scope.
The UK implemented the Travel Rule from 1 September 2023 for VASPs (defined as crypto businesses). The Travel Rule in the UK only applies to UK-based crypto-businesses being ‘cryptoasset exchange providers’ or ‘custodian wallet providers’ (as defined in the MLR) also known as Virtual Asset Service Providers (VASPs).
A sending VASP is the VASP initiating the transfer on behalf of the sender (originator).
Collect and Verify Originator Information: The sending VASP must collect the following minimum details:
Upon request, for intra-UK transfers, and for all cross-border transfers the following additional info is required:
A receiving VASP is the VASP receiving crypto-assets on behalf of the beneficiary (recipient).
Obtain and Assess Information: The receiving VASP must obtain the transmitted information from the sending VASP, including the originator and beneficiary details.
Verify Beneficiary Information: The receiving VASP is responsible for verifying the beneficiary’s identity.
Report Suspicious Activity: If a VASP identifies any suspicious activity or discrepancies in the transmitted information, they must report it under AML/CTF rules to the relevant authorities (such as the National Crime Agency in the UK).
The FCA has issued guidance on how it expects regulated firms to comply.
In addition, the JMLSG has issued Cryptoasset Transfer Guidance.
Currently stablecoins are not explicitly covered by the Electronic Money Regulations 2011 (EMRs). However, the FCA interprets stablecoins functioning as digital representations of fiat currency—redeemable at par and used for payments—as falling within the e-money definition under the EMRs. This interpretation obliges issuers to comply with safeguarding, redemption, and conduct requirements under the existing e-money framework
The Financial Services and Markets Act 2023 (FSMA 2023) provides the statutory authority to implement this phased regulation. It enables the government to extend existing regimes, including e-money rules, or create bespoke requirements tailored to stablecoins and cryptoassets with the Financial Conduct Authority (FCA) and the Bank of England (BoE) playing key roles in developing and enforcing specific rules.
In order to provide greater clarity, the UK government is implementing a phased approach to regulate stablecoins explicitly, initially focusing on fiat-backed stablecoins intended for payments (Phase 1) and later expanding to encompass a broader range of cryptoassets (Phase 2) as part of the wider proposed changes to the authorisation regime (see above).The regulatory changes aim to address stablecoins more broadly, including those that might not strictly fit the e-money definition but still pose potential risks to consumers or the financial system.
The initial focus of stablecoin regulation is on fiat-backed stablecoins, defined as cryptoassets pegged to and backed by one or more specified fiat currencies. This phase prioritises regulating activities like issuance, custody, and the use of stablecoins in payment chains.
Dual Regulation: Some stablecoin entities may fall under the regulatory purview of both the FCA and the BoE. A Memorandum of Understanding between the authorities will clarify how this dual regulation will function, ensuring a coordinated and streamlined approach.
Compliance is Crucial: Firms operating from the UK or in the UK cryptoasset market must understand both CARR and FinProm to avoid legal and regulatory risks.
Navigating the Regulatory Regimes: UK-based firms should carefully consider FCA CARR registration requirements and the stringent application process and both UK and overseas firms must ensure they meet the FinProm promotion requirements.
Strategic Partnerships: Cryptoasset firms can leverage partnerships with authorised UK firms to navigate the complexities of FinProm and access the UK market.
Staying Updated: The regulatory landscape is evolving rapidly, and firms must stay informed about upcoming changes, such as the proposed full authorisation regime (wider than FinProm) and the proposed stablecoin regulations.
We expect a full authorisation regime similar to that which applies to CASPs under MiCA to be brought into law in 2025. The recent HMT consultation sets out the framework for a number of different activities which HMT considers the highest risk and specific regulatory requirements for these activities. An authorisation regime will also open up the possibility of Gibraltar implementing a similar regime and enabling passporting from Gibraltar under the GAR regime.
In addition, we await the conclusion to the FCA and BoE consultations on fiat stablecoins and the interaction with the e-money regime: Ramparts – UK Stablecoin Discussion Papers
The Gibraltar Authorisation Regime (GAR) represents the permanent legislative framework enabling Gibraltar-based financial services firms, including payment service providers (PSPs) and e-money institutions (EMIs), to access the UK market following Brexit. It requires transparency and careful management by Gibraltar firms benefiting from UK market access.
Operational resilience is no longer a technology function but a primary board responsibility, inextricable from solvency, business continuity, and market conduct.
Mandatory VAT Defences:Mastering the Two-Item Rule and managing the Fixed Establishment Trap.
Overview of current UK approach to systemic stablecoins and comparison with how MiCAR regulates important (significant) stablecoins
Latest updates on the latest implementation status of the Markets in Crypto-Assets Regulation (MiCAR).
