CMS Expert Guide to Crypto Regulation in United Kingdom

1. How is crypto regulated?

AML RegulationFinancial Services Regulation

The Fifth Money Laundering Directive (5MLD) extended the Fourth Money Laundering Directive (4MLD) regime to “providers engaged in exchange services between virtual and fiat currencies” and to “custodian wallet providers”. 

Prior to the UK’s exit from the EU, 5MLD was transposed into UK national law via amendments to The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs).  

The MLRs framework applies to all cryptoassets and is determined by what is done with the cryptoasset and whether it creates a money laundering risk. Depending on the answer to these questions, cryptoasset firms may need to register with the Financial Conduct Authority (FCA). 

Cryptoassets are not currently subject to bespoke financial services regulation in the UK, although the government is currently consulting on amendments to existing financial regulatory frameworks to provide for this.  

In the meantime, whether or not cryptoassets are subject to financial services regulation will depend on whether they fall within the scope of existing frameworks. 

Financial services are regulated under the Financial Services and Markets Act 2000 (FSMA 2000), Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (RAO) and other legislation, most notably the Electronic Money Regulations 2011 and the Payment Services Regulations 2017.  

In recent developments, the government introduced legislation bringing “qualifying cryptoassets” (defined below) into the scope of the existing financial promotions regime, under the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005 (FPO). 

Furthermore, the new Financial Services and Market Act 2023 (FSMA 2023) provides for the establishment of a regulatory regime for fiat-backed stablecoins used for payments.  

More broadly, the government intends to create new “designated activities” tailored to cryptoassets where such activities mirror, or closely resemble, regulated activities in scope of the RAO. This new designated activities regime (DAR) has been introduced under FSMA 2023 and the government intends to use it where regulation under the RAO may not be appropriate.  

The FCA principally oversees authorisation and enforcement under FSMA 2000 and the other legislation mentioned above.  

It is notable that all of the regimes operate independently and businesses may therefore require multiple registrations and authorisations. 

2. Are the following activities regulated or unregulated in your jurisdiction? ― Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking

AML RegulationFinancial Services Regulation

The only regulation covering cryptoassets per se in the UK at present is under the MLRs, in connection with anti-money laundering (AML) and counter-terrorist financing (CTF). Under the MLRs, the FCA is the AML and CTF supervisor for certain cryptoasset service providers in the UK. 

The MLRs prohibit these cryptoasset service providers from operating in the UK unless they are registered with the FCA. The FCA then supervises their compliance with the MLRs.  

The following cryptoasset service providers are within scope of the MLRs: 

  • Cryptoasset exchange providers (i.e. persons exchanging, or arranging or making arrangements with a view to the exchange of, cryptoassets for money, money for cryptoassets or one cryptoasset for another). 
  • Custodian wallet providers, which is to say persons providing services to safeguard, or to safeguard and administer: 
  • Crypto ATMs (i.e. persons operating a machine, which utilises automated processes to exchange cryptoassets for money or money for cryptoassets). 

Cryptoasset businesses, which fall within the above categories are required to register with the FCA (after which they are listed on its cryptoasset register) in order to operate in the UK. 

Additionally, a cryptoasset business will need to demonstrate that it has policies, controls and procedures in place to effectively manage money laundering and terrorist financing risks proportionate to the size and nature of the business’ activities. 

If a cryptoasset has the characteristics of a “specified investment” under the RAO (e.g. a share in a company, a debenture, e-money, a unit in a collective investment scheme or a derivative), then exchange and custody of that cryptoasset will likely entail regulated activities under FSMA 2000 such as dealing in investments and safeguarding investments. 

Borrowing/lending of cryptoassets is not explicitly regulated in the UK. It is arguable that the lending of cryptoassets to consumers could fall within scope of consumer credit regulation, but the FCA does not appear to have sanctioned any firms or made any public announcements in this regard. 

Yield/staking is a complicated area. Depending on the specifics of the particular business model, it is possible that the arrangements could fall within the definition of a collective investment scheme under FSMA 2000 and be subject to regulation. Again, the FCA does not appear to have sanctioned any firms or made any public announcements in this regard. However, we are aware that the FCA has challenged certain firms regarding their yield/staking products on the basis that they may be collective investment schemes. In its recent consultation on the future regulatory regime for cryptoassets, HM Treasury has also suggested that staking services could entail the operation of a collective investment scheme depending on how they are operated. In its response to the consultation, HM Treasury confirmed that it is accelerating exploratory work to develop a clear definition of cryptoasset staking on a proof-of-stake (PoS) blockchain and to establish a taxonomy of the different PoS staking business models currently on the market. 

Section 21 of FSMA 2000 prohibits persons from communicating a financial promotion (i.e. an invitation or inducement to engage in investment activity) unless (i) it is made or approved by an authorised person; (ii) it is made by an exempt person; or (iii) it falls within an exemption.  

FSMA 2000 defines “investment activity” as: 

1. entering or offering to enter into an agreement the making or performance of which by either party constitutes a controlled activity; or 

2. exercising any rights conferred by a controlled investment to acquire, dispose of, underwrite or convert a controlled investment. 

If a cryptoasset falls within the definition of a “specified investment” under FSMA 2000, then it will likely constitute a “controlled investment” under the FPO. Similarly, if an activity falls within the scope of regulated activities under FSMA 2000 (e.g. dealing in securities), then it will likely constitute a “controlled activity” under FSMA 2000. 

In addition, the financial promotions regime under the FPO was recently expanded to cover ‘qualifying cryptoassets’, meaning “any cryptographically secured digital representation of value or contractual rights that: (a) can be transferred, stored or traded electronically, and (b) uses technology supporting the recording of storage of data (which may include distributed ledger technology).” The definition does not catch NFTs, central bank digital currencies, cryptoassets that meet the definition of e-money, or an existing “controlled investment” (i.e. a security token). 

Under the newly expanded regime, invitations or inducements to engage in the following controlled activities in relation to qualifying cryptoassets will be within scope: 

  • dealing in securities and contractually based investments; 
  • arranging deals in investments; 
  • managing investments; 
  • advising on investments; and 
  • agreeing to carry on specified kinds of activity. 

Notably, the above regulation means that the prohibition will generally not apply to the promotion of cryptoasset custody services. 

For qualifying cryptoassets, certain exemptions are specifically disapplied, including those for promotions to high net worth individuals and self-certified sophisticated investors. However, another route to the lawful communication of a financial promotion in relation to a qualifying cryptoasset (in addition to the routes described above for other types of controlled investment) is if it is made by a person registered by the FCA under the MLRs. 

More broadly, Prospectus Regulation rules may apply to cryptoasset firms. If a firm is issuing a token that is a “transferable security” (including negotiable securities akin to shares or bonds), and the tokens are offered to the public in the UK or traded on a regulated market, the issuer must publish a prospectus unless an exemption applies. 

Furthermore, issuers must also comply with Market Abuse regulations, the FCA’s listing rules and advertising laws.  

3. How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?

AML RegulationFinancial Services Regulation
Historically, applications under the MLRs have taken between three months, at best, and over two years, at worst. We understand that the FCA now expects new applications to be processed in around six to eight months, but this remains to be seen. Processing times for applications under FSMA 2000 will vary from six months to a year depending on the activity requiring authorisation. However, where cryptoassets or cryptoasset services are involved in the business model, an application will be subject to additional scrutiny and may take longer. In such circumstances, the FCA will also be likely to tie a FSMA 2000 application to any MLRs application (and vice versa).  

4. What would be the approximate overall cost of obtaining a licence?

AML RegulationFinancial Services Regulation

The application fee is GBP 2,000 for forecasted first-year revenues from cryptoasset services lower than GBP 250,000; or the fee is GBP 10,000 if revenues are higher than GBP 250,000. Legal and other professional fees will be necessary. 

The application fee will depend on the particular application. 

Legal and other professional fees will be necessary. 

5. What is the probability (%) of success in obtaining a licence?

AML RegulationFinancial Services Regulation
Historically, the success rate has been about 10% to 20%. However, the overwhelming majority of initial applicants were ill-advised and their applications ill-prepared. A well-advised applicant with a high-quality application should expect their application to be approved. The FCA has recently announced that it will be setting a higher bar for approving applications for authorisation. In particular, applicants will be expected to demonstrate that they will have a successful and sustainable business model, in addition to satisfying compliance requirements. 

6. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence

AML RegulationFinancial Services Regulation

Some requirements are set out below. Although this list is not exhaustive, a business should:  

  • take appropriate steps to identify and assess the risks of money laundering and terrorist financing; 
  • assess the ML/TF risks related to any new technologies prior to launch and take appropriate measures to manage and mitigate those risks; 
  • undertake customer due diligence (CDD); and 
  • apply more stringent due diligence, known as enhanced due diligence (EDD), when dealing with customers who may present a higher ML/TF risk.  

The FCA has set out a more extensive, albeit non-exhaustive list.  

Cryptoasset startups must comply with the wider rules and guidance for authorisation under FSMA 2000, if applicable, and in addition comply with the ML/TF-related requirements under the MLRs. 

Disclaimer: This chapter was last updated on 6 November 2023 and does not reflect any subsequent developments. The information provided is intended for general informational purposes and should not be construed as legal advice.

Portrait ofMatthew Nyman
Matthew Nyman
Of Counsel
London
Portrait ofCharles Kerrigan
Charles Kerrigan
Partner
London
Portrait ofTom Marshall
Tom Marshall
Senior Associate
London
Antonia Bain
Erica Stanford