AML Rules for Crypto Businesses in the UK: What You Must Know in 2026

If you're running a crypto business in the UK, you're not just dealing with blockchain tech and wallet addresses-you're up against one of the strictest anti-money laundering (AML) regimes in the world. By March 2026, the rules have changed again, and the cost of getting it wrong isn't just a fine. It's a shutdown. No registration. No operations. No exceptions.

Who Exactly Needs to Register?

The UK doesn't treat all crypto firms the same. Only two types are legally required to register with the Financial Conduct Authority (FCA): cryptoasset exchange providers and custodian wallet providers. That means if you run a platform where people trade Bitcoin for Ethereum, you need to register. If you hold crypto on behalf of customers-like a digital vault-you need to register. That’s it.

Other services? Like decentralized exchanges (DEXs), NFT marketplaces, or mining pools? Right now, they’re not under the same mandatory registration. But that’s changing fast. The new Financial Services and Markets Act (FSMA) 2025 will bring almost all crypto businesses under one licensing system by early 2026. So if you're planning to scale, assume you’ll need to register. Don’t wait for the law to catch up.

The Core AML Requirements

The FCA doesn’t just ask for paperwork. You need systems. Real ones. Here’s what you absolutely must have in place:

• Customer Due Diligence (CDD): You must verify every customer’s identity using at least two independent sources-like a government ID plus a utility bill or bank statement. No selfies with IDs anymore. Automated tools that check passports or driver’s licenses against official databases are now standard.
• Enhanced Due Diligence (EDD): If someone is a Politically Exposed Person (PEP), or if they’re from a high-risk country (like Nigeria, Venezuela, or Russia), you need deeper checks. That means more documentation, source of wealth verification, and senior management approval. The FCA found that 62% of failed applications had weak EDD processes.
• Transaction Monitoring: Your system must flag suspicious activity in real time. That includes sudden large transfers, rapid inflows and outflows, or transactions linked to known darknet markets. False positives are common-some firms see 28% of all alerts as false-but you still have to investigate every one.
• The Travel Rule: If a transaction is over £1,000, you must collect and send the sender’s and receiver’s full names, account numbers, and addresses to the other party. This isn’t optional. It’s mandatory. And it applies even if the other party isn’t in the UK. If they’re on a non-regulated platform? You still have to try.
• Record Keeping: Keep all customer data, transaction logs, and internal reports for five full years. The FCA can audit you at any time. If your logs are incomplete or deleted? You’re in trouble.

The Registration Process: A Real-World Nightmare

Here’s the truth: 87.3% of crypto firms fail their first FCA registration attempt. Why? Because most think it’s a form to fill out. It’s not. It’s a full operational overhaul.

On average, companies spend £287,500 just to get started. That’s not a typo. It includes hiring compliance officers, buying monitoring software, training staff, and hiring external consultants. Annual upkeep? Around £142,300 per year. And the process takes 9.2 months on average. Some take 14 months.

One company on Reddit, CryptoComplianceUK, spent over £500,000 and 14 months just to get approved. Another, BlockchainComply, said once they cleared the hurdle, the FCA’s clear rules actually made their global expansion easier. So it’s brutal-but if you make it through, you gain credibility.

The FCA doesn’t give second chances easily. If you’re rejected, you can appeal-but you can’t keep operating while you wait. That means cash flow dries up fast. Many small firms just quit.

How the UK Compares to the Rest of the World

Compared to other countries, the UK is the strictest. Here’s how it stacks up:

The UK’s 10% ownership change rule is the tightest in the world. If a shareholder buys just 10% more stock, you must notify the FCA. In the EU, it’s 20%. In the US? No such rule. Singapore doesn’t even require it for private firms. This level of control is why so many firms struggle.

And yet, the UK’s advantage is clarity. Once you’re registered, you know exactly what’s expected. The US? You could be regulated by three agencies at once. The EU? Each country has its own twist. The UK is centralized, predictable, and ruthless.

What’s Changing in 2026?

The big shift is coming: the Financial Services and Markets Act (FSMA) 2025 will replace the current MLR 2017 system. By Q1 2026, the old registration process will vanish. In its place: a full licensing regime.

Here’s what changes:

• Dual system ends: No more separate FCA registration under MLR. All crypto firms will be licensed under FSMA.
• Counterparty Due Diligence (CPDD): You must now verify not just your customers-but the other side of every transaction over £1,000. Even if they’re on a non-regulated platform. This is new. And it’s hard.
• 10% ownership rule becomes law: The threshold for reporting ownership changes drops permanently to 10%. No more wiggle room.
• Advertising rules tighten: You can’t say “guaranteed returns” or “risk-free.” You must disclose losses clearly in all ads. 63% of firms failed this in 2025.

The FCA says this will reduce fraud. Critics say it will kill innovation. The numbers tell the story: 184 crypto firms were registered in January 2024. By June 2025, only 147 remained. That’s a 20% drop in just 18 months. And more are leaving.

Real Costs and Hidden Pitfalls

Most firms don’t realize how much compliance costs beyond the obvious.

• False positives: Your system might flag 28 out of every 100 transactions as suspicious. Each one requires manual review. That’s hours of staff time. Many firms hire 3-5 compliance officers just for monitoring.
• Sanctions list updates: You need real-time access to 12+ global sanctions lists. If one list is outdated, you’re non-compliant. 41.6% of applicants failed this in 2024.
• Staff training: Every compliance officer needs 35 hours of training per year. That’s almost a full week. And it’s mandatory.
• Integration headaches: Connecting blockchain analytics tools (like Chainalysis or Elliptic) to your KYC system? It’s expensive. One firm spent £185,000 just to make them talk to each other.

And here’s the kicker: even if you do everything right, the FCA can still reject you if they think your senior management isn’t “fit and proper.” That means background checks on your CEO, CFO, and even your CTO. If your CFO had a minor financial offense five years ago? That could be enough.

What Should You Do Now?

If you’re not registered yet:

1. Stop operating immediately. The FCA doesn’t care if you’re “just starting.” If you’re handling customer crypto, you’re already breaking the law.
2. Get a compliance consultant. Don’t try to do this in-house. Firms that hire experts have a 78% higher approval rate.
3. Start with your tech stack. Buy or build a system that does real-time monitoring, sanctions screening, and Travel Rule data capture. Test it.
4. Train your team. Make sure everyone knows the rules. One slip-up in customer verification can tank your application.
5. Prepare for the FSMA transition. Even if you get registered under MLR, you’ll need to reapply under FSMA in 2026. Start building for that now.

If you’re already registered? You’re ahead. But don’t relax. The rules keep tightening. Audit your systems quarterly. Update your training. Watch for new FCA guidance. The next change could come next month.

Final Reality Check

The UK isn’t trying to ban crypto. It’s trying to make it clean. And it’s working. Crypto tax revenue jumped from £147 million in 2021 to £483 million in 2025. That’s a 227% increase. Legitimate business is growing.

But the price of entry is high. You need money. You need time. You need expertise. And you need patience.

If you can’t meet these standards? You won’t survive. But if you do? You’ll be one of the few crypto firms in the world that’s truly compliant-and trusted.