Crypto Regulations in the UK 2025 — Post‑Brexit Framework for Digital Assets, AML & FCA Licensing

Crypto Regulations in the UK 2025 — Post‑Brexit Framework for Digital Assets, AML & FCA Licensing

The crypto industry in the United Kingdom enters 2025 under a developing regulatory regime shaped by post-Brexit autonomy. After leaving the EU, the UK has been crafting its own cryptoasset rules: the landmark Financial Services and Markets Act (FSMA) 2023 officially brought cryptoassets into the UK’s regulated perimeter, the FCA (Financial Conduct Authority) has tightened licensing and AML supervision, and the FATF Travel Rule was implemented in 2023. 

This informational guide provides a systematic overview of UK crypto regulation in 2025, focusing on FCA registration, AML/KYC requirements, stablecoin oversight, and upcoming rules, to help crypto businesses navigate compliance. For a global perspective, see our comprehensive AML Crypto Compliance Guide. This UK guide is part of our regional series, alongside guides on crypto regulations in the US and in Europe

Note: None of this information should be considered as legal, tax, or investment advice. While we’ve done our best to ensure this information is accurate at the time of publication, laws and practices may change, so please double-check it.  

Overview of UK Crypto Regulations in 2025

The Post-Brexit Landscape and Direction

Following Brexit, the UK is building an independent crypto regulatory framework while aligning with international standards (FATF, G20). The Government has made clear that “cryptoassets are here to stay” and aims to make Britain a global hub for crypto technology and investment.

UK Crypto Regulatory Framework Infographic: HMT, FCA, BoE, NCA Roles in Digital Asset Policy and AML Compliance. How the UK’s Multi-Agency Framework Governs Crypto Regulation

The UK’s multi-agency regulatory model involves several key bodies: (1) HM Treasury (HMT) sets crypto policy and legislation; (2) the Financial Conduct Authority (FCA) is the primary regulator supervising crypto firms; (3) the Bank of England (BoE) oversees financial stability and systemic stablecoins; and (3) law enforcement agencies like the National Crime Agency (NCA) (with its UK Financial Intelligence Unit, UKFIU) handle crypto-related financial crime and receive suspicious activity reports. 

Scope of the UK Cryptoasset Regime

The UK’s Crypto Regulatory Regime in 2025 covers a range of activities and service providers. Under the latest proposals, any business conducting cryptoasset activities “by way of business” will fall within the regulatory perimeter.

In practice, this means crypto exchanges and trading platforms, custodial wallet providers, crypto payment processors, brokers/dealers, lending and staking services, and other Virtual Asset Service Providers (VASPs) are (or soon will be) subject to UK regulation.  The definition of cryptoasset” in UK law is intentionally broad – 

“any cryptographically secured digital representation of value or contractual rights that can be transferred, stored, or traded electronically” 

– ensuring all major token types are captured. Certain assets already regulated as traditional securities or e-money are excluded from the “cryptoasset” category to avoid double regulation. Notably, cryptoassets qualifying under UK law include cryptocurrencies used as investments or as payment tokens, and qualifying stablecoins are explicitly identified for additional oversight. 

Key Legislative Pillars – FSMA 2023 and the MLRs

UK crypto regulation in 2025 rests on two main legal pillars: (1) Financial Services Law (FSMA 2000 as updated by FSMA 2023) and (2) Anti-Money Laundering Law (Money Laundering Regulations 2017, as amended).

The Financial Services and Markets Act 2023 was a watershed, inserting cryptoasset” into the definition of regulated instruments and empowering HMT and the FCA to establish a comprehensive regime. FSMA 2023 explicitly brought crypto within the FCA’s remit and created a new “Designated Activities Regime” for crypto, setting the stage for complete authorization requirements by 2026. It also provided for regulated stablecoins (termed “Digital Settlement Assets”) and enabled the Digital Securities Sandbox (DSS) for experimenting with DLT in markets. On the other hand, the UK’s Money Laundering Regulations (MLRs) have applied to crypto businesses since January 2020, requiring all cryptoasset exchanges and custodian wallet providers to register with the FCA and implement AML/KYC controls. 

In essence, FSMA 2023 established cryptoassets as a regulated financial domain, while the MLRs (2017, updated 2019) enforce AML/CTF compliance on crypto firms. Together, these ensure that crypto businesses operating in the UK are both licensed/authorized and subject to rigorous AML oversight. Notably, firms already registered under the MLR regime will likely need to transition to a full FCA authorization once the new FSMA-based crypto regime commences in 2025–2026.

FCA Registration and Supervision of Crypto Businesses

Who Must Register as a Cryptoasset Firm with the FCA

Under UK regulations, any firm conducting “cryptoasset services” as a business must register with the FCA for AML/CTF supervision. In practice, this covers crypto exchanges (fiat-to-crypto or crypto-to-crypto), trading platforms, custodian wallet providers, OTC brokers, crypto ATMs, payment companies using crypto, and similar services that involve handling customer crypto assets. This requirement has been in force since 10 January 2020, when the UK transposed the EU’s Fifth Anti-Money Laundering Directive, bringing crypto firms into scope of the MLRs. 

By 2025, “UK Crypto Regulation” will effectively mandate that all VASPs active in the UK obtain FCA registration under the MLR regime. To qualify, firms must demonstrate AML policies, customer Due Diligence processes, and that senior management and owners are fit and proper. 

The FCA conducts a detailed vetting of each application, assessing the firm’s governance, personnel, systems & controls, risk assessment, etc., and has been notably stringent in its approach. Only ~15% of applicant firms were approved in the first years of the regime, with many either withdrawing or being refused due to inadequate submissions. Cryptoasset businesses operating in the UK before 2020 had to apply for FCA registration under a temporary licensing scheme, and new entrants must register before doing business. 

FCA Supervision and Ongoing Obligations

Once registered, crypto firms are subject to ongoing FCA supervision to ensure compliance with AML laws and Consumer Protection principles. The FCA acts as the UK’s lead crypto regulator, effectively a “one-stop shop” overseeing crypto exchanges and similar services instead of any separate crypto-specific agency. Firms must appoint an MLRO (Money Laundering Reporting Officer) and maintain up-to-date internal controls to prevent Money Laundering. The FCA can conduct compliance inspections, request audits or reports, and suspend or revoke registrations for firms that breach requirements. 

Key Obligations for Сrypto Firms Include: 

  1. Conducting thorough KYC (Know Your Customer) verification of customers during onboarding; 
  2. Performing ongoing transaction monitoring, screening for sanctions or high-risk individuals; 
  3. Filing Suspicious Activity Reports (SARs) to the UKFIU in cases of suspected money laundering or terrorist financing; 
  4. Firms must also implement systems to comply with the Travel Rule for information-sharing on crypto transfers. 

Any changes in ownership or control of a registered crypto firm require FCA approval. By 2025, the FCA will have also introduced rules beyond AML. For example, a Financial Promotion Rules require risk warnings on crypto ads. 

In short, getting registered is only step one. Staying compliant is an ONGOING DUTY, and the FCA’s oversight of crypto businesses is intensifying as the sector matures.

AML and KYC Requirements for Crypto Companies

AML Under the MLRs and Alignment with FATF Standards

Anti-Money Laundering compliance is a cornerstone of UK Crypto Regulation. The Money Laundering Regulations (2017), as amended. set out  AML/CTF requirements for cryptoasset firms, closely aligned with FATF’s Global Standards. The UK was one of the first jurisdictions to extend AML laws to crypto, requiring Customer Due Diligence (CDD), record-keeping, and suspicious activity reporting for crypto transactions.

Crypto companies must implement a full AML Program: this includes (1) Risk Assessing their business, (2) Onboarding customers with verified identity (KYC), (3) Monitoring transactions for red flags, and (3) Having internal controls and training in place. 

The rules mirror those for banks and financial institutions, ensuring that VASPs are not a weak link in combating illicit finance. 

In July 2022, HM Treasury amended the MLRs to explicitly mandate the Travel Rule for crypto transfers (effective Sept 2023), tightening AML oversight. The FCA expects applicant firms to “display a comprehensive understanding of the UK AML/CTF regime as documented in the MLRs”, evidencing that senior management is knowledgeable and that robust policies are in place. 

By 2025, the UK’s AML regime for crypto will be fully in line with FATF Recommendation 15: crypto firms will be “obliged entities” under AML Law, subject to the same preventive measures as other financial firms. Customer Due Diligence (CDD) must be performed at onboarding and for certain high-value or high-risk transactions, including verifying the customer’s identity using reliable documents or data. Enhanced Due Diligence is required for higher-risk customers. Ongoing Monitoring is also crucial. Firms need systems to monitor customer transactions in real time, detect anomalous patterns, and screen wallet addresses for sanctions or darknet ties. If any transaction appears suspicious, the firm must file a Suspicious Activity Report (SAR) with the NCA’s UKFIU without tipping off the customer. 

KYC, Transaction Monitoring, and the Risk-Based Approach

In practical terms, UK crypto businesses must integrate KYC/KYB Processes, KYT (Know Your Transaction), and a Risk-Based Compliance Approach into their operations. 

The UK AML Mandate Summarized
  1. KYC involves collecting and verifying customers' identification information during the onboarding process. For individual users, this typically means obtaining full name, date of birth, photo ID, and proof of address, and verifying these against trusted sources. For corporate clients (KYB), the firm must identify the company’s registration details, directors, and ultimate beneficial owners (UBOs), and assess the company's ownership and control structures. The risk-based approach here means that firms should calibrate their level of Due Diligence to the risk profile of the customer or activity.
  2. Transaction Monitoring (KYT) is equally vital. It is expected that crypto firms will monitor transactions. For suspicious indicators such as large transfers right after fiat deposits, rapid in-and-out movements, transactions involving high-risk jurisdictions, or patterns consistent with fraud schemes. Many firms deploy blockchain analytics and KYT solutions (from providers like AMLBot, Chainalysis, Elliptic, etc.) to get real-time risk scores for crypto addresses and to trace fund flows on-chain. These tools help flag if a customer’s crypto withdrawal is headed to a mixer/tumbler or if funds received have links to hacked or dark market wallets. All transactions above certain thresholds must have originator/beneficiary information recorded in accordance with the Travel Rule.
  3. Screening is another key component. Firms must screen customers against sanctions lists (UK Sanctions as well as Global Lists) and against politically exposed persons (PEP) lists, both at onboarding and at regular intervals thereafter. If a customer becomes sanctioned, assets must be frozen and reported immediately. The FCA expects crypto firms to employ ongoing monitoring so that they “detect suspicious transactions and carry out effective sanctions screening”.
  4. Record-keeping is also mandated. All KYC data and transaction records should be retained for at least 5 years (per MLRs), and be readily available to regulators or law enforcement upon request.

Cooperation with NCA and UKFIU on Reporting

UK crypto companies also have duties to cooperate with law enforcement agencies, principally the National Crime Agency (NCA) and its unit, the UK Financial Intelligence Unit (UKFIU). The UKFIU is the central authority that receives and analyzes SARs from the private sector. 

Crypto firms, as “Reporting Entities,” must promptly submit a SAR whenever they know or suspect that a transaction or client may be involved in money laundering or terrorist financing. These SARs are filed through the secure online system (SARs Portal) and must include all relevant details. By filing a SAR, the firm provides intelligence for the NCA to investigate or share with other agencies, possibly. 

In 2025, the UKFIU issued updated SAR Reporting Guidance for all regulated entities, underscoring best practices for submitting high-quality reports and reminding firms to keep their MLRO contact details updated in the SARs system. 

Apart from SAR obligations, crypto firms may also receive Law Enforcement Requests for information on specific accounts or transactions as part of investigations. Cooperation is not optional. Failing to disclose information requested under the proper legal authority can be an offense. 

Additionally, firms must report any knowledge or suspicion of sanctions breaches to the Office of Financial Sanctions Implementation (OFSI) and have systems for Counter-Terrorist Financing (CTF) alerts. The NCA has a dedicated crypto cell to tackle illicit use of crypto, and the FCA works closely with the NCA on enforcement. 

All told, UK Crypto Companies are incorporated into the country’s broader financial crime defense network. They are both expected to prevent illicit activity through AML controls and to report and assist law enforcement when bad actors attempt to abuse their platforms.

The Travel Rule Implementation in the UK

What the UK Travel Rule Requires

A significant development in UK Crypto Regulation in 2023 was the implementation of the FATF’s Travel Rule for cryptoasset transfers. Starting 1 September 2023, all UK Cryptoasset Businesses (CASPs) are required by law to collect, verify, and share specific information about the originator and beneficiary for any crypto transfer, mirroring the data-sharing practices used in bank wire transfers. 

In essence, whenever a user sends crypto to another service, the originating firm must send the beneficiary service identifying information about the sender, and vice versa for incoming transfers. 

The required details typically include the sender’s name, account/wallet number, address, and the recipient’s name and wallet/account number. These details “travel” with the transaction. The rule applies to transfers above £1,000 (or any transfer that appears linked to other sums above that threshold), though many firms choose to use it for all transfers, regardless of amount, for simplicity. 
The UK Travel Rule was legislated via an amendment to the MLRs in July 2022 (introducing Part 7A), but enforcement began in Sept 2023 to give the industry time to prepare. 

Under the rule, if a UK crypto firm sends crypto to a beneficiary institution in a jurisdiction that has also implemented the Travel Rule, both parties must exchange the requisite originator/beneficiary data in real time. If the destination is in a country that has not implemented the Travel Rule, the UK sender must still collect and store the required information even if it cannot transmit it to the other side. Similarly, if a UK firm receives a crypto transfer from a non-compliant country with missing originator information, it must assess the situation. It may refuse to make the crypto available to the recipient, depending on the risk. 

The goal of the Travel Rule is to bring transparency to crypto payments, making it harder for criminals to use crypto for illicit finance by depriving them of anonymity. UK crypto businesses had to incorporate additional data fields and identity verification steps into their transfer workflows to comply. The FCA expects firms to “take all reasonable steps and exercise all due diligence” to comply with the Travel Rule, even when using third-party solution providers. 

Integration and Interoperability Challenges

Implementing the Travel Rule in practice has presented technical and interoperability challenges for the industry. Unlike bank wires, crypto networks don’t natively support sending personal data along with transactions. Thus, VASPs have adopted various solutions. Often, exchanging the required information off-chain through secure APIs or messaging protocols that run in parallel to the blockchain transfer. Several Travel Rule compliance providers (Notabene, TRISA, OpenVASP, Shyft, etc.) have emerged, each offering a network or protocol for VASPs to share data. 

(1) One challenge is Interoperability. If a UK exchange uses one Travel Rule protocol but the foreign exchange uses another, they may not readily communicate. To address this, firms and industry groups have been working on compatibility layers and mutual member lists. The FCA acknowledged “delays in adoption and different timelines for enforcement of the Travel Rule across jurisdictions” and has encouraged UK firms to regularly review which countries have the Travel Rule in place and adapt accordingly.

(2) In the interim, UK VASPs typically must implement a “Sunrise” workaround. When transacting with a counterparty in a non-compliant country, the UK firm still collects and verifies the originator/beneficiary details and retains them internally. Many UK crypto companies have integrated Travel Rule solution APIs into their platforms that automatically look up the beneficiary VASP, securely transmit the required data, or, if the beneficiary cannot receive it, flag the transaction for manual review.

Another issue is ensuring data privacy and security. Transmitting personal data creates liability, so firms encrypt the data and share it only with verified counterparties. Some have likened the current situation to a “patchwork” in which not all global exchanges yet follow the rule, leading to friction. Nonetheless, the UK industry has adapted mainly by using compliance middleware capable of handling various Travel Rule messaging standards. 

KYT tools also assist by providing risk insights on transfers. For example, if customer A is withdrawing to address X, the exchange’s system might first query a Travel Rule directory to identify which VASP (if any) manages address X, then send the required information, while simultaneously using KYT to check whether address X is high-risk. 

The interoperability gap is expected to narrow as more jurisdictions (EU, Singapore, etc.) enforce their Travel Rules by 2024-2026, meaning UK VASPs will increasingly find counterparties ready to swap data. In the meantime, UK firms are advised to document all efforts to comply and maintain logs of any cases of missing information as part of their risk-based approach.

Enforcement and Penalties

UK authorities have made it clear that non-compliance with the Travel Rule will attract enforcement actions. The FCA has stated that crypto firms are responsible for achieving compliance, even if they outsource technical aspects to vendors. Starting in late 2023, the FCA began monitoring firms’ implementation of the rule. If a firm consistently sent transactions without the required data or ignored the requirement altogether, it could be deemed to have breached Regulation 74B of the MLRs, which carries potential criminal penalties or regulatory censure. The FCA can impose fines, issue public censure, or even revoke a firm’s registration for systemic non-compliance. 

In practice, initial FCA action is likely to be supervisory: requiring remediation plans from firms that lag in implementing the rule. However, deliberate or negligent violations can result in strict action. 

Stablecoins and Digital Assets Under FSMA 2023

Regulated Stablecoins and Bank of England Oversight

The UK has brought stablecoins, specifically fiat-referenced cryptoassets used for payments, into the regulatory fold, recognizing their potential systemic importance. 

FSMA 2023 introduced the concept of “Digital Settlement Assets” (DSAs), essentially treating major payment stablecoins as payment systems, similar to those at law. Under this framework, certain stablecoins that reach systemic scale could be regulated by the Bank of England in addition to the FCA. The Bank of England will supervise the payment system aspect, ensuring the stablecoin’s operational resilience and managing risks to financial stability. 

For example, a stablecoin deemed systemically important might be required to meet stringent reserve backing requirements, provide redemption at par in fiat on demand, and have recovery and resolution plans. The FCA, on the other hand, would likely regulate the conduct and consumer-facing side of stablecoin issuers (e.g., authorization of the issuer and wallet providers, safeguarding of customer funds). As of 2025, the UK is finalizing rules for stablecoin issuance. The plan is to create a new FCA authorization category for issuers of “fiat-backed stablecoins” as a regulated activity. Issuers will need to hold high-quality reserve assets, provide redemption rights to coin-holders, and comply with prudential rules commensurate with the risk. 

The Bank of England will oversee stablecoin arrangements that could affect monetary or financial stability, similar to how it oversees large payment systems such as VISA. Notably, the UK chose not to double-regulate stablecoins under both payments regulations and securities rules. Instead, they will be handled under this tailored regime to avoid unnecessary burdens. In practice, if a stablecoin became as widely used as, say, a major e-money wallet, the BoE could designate it and subject it to oversight under the Banking Act 2009. The BoE has also been gearing up its supervisory capacity. It issued a discussion paper in late 2023 on the regulatory regime for systemic stablecoin operators. Issues like operational resilience, settlement finality, and interoperability with traditional payment systems are being considered. The central bank’s involvement signals that the UK views some stablecoins as part of the financial infrastructure, not just crypto products. Additionally, the Special Administration Regime (SAR) for failed payment institutions can be applied to stablecoin issuers to ensure an orderly wind-down if one were to collapse. For crypto businesses, this means that if you issue or heavily use a stablecoin for payments, you’ll be entering a world of dual oversight: prudential scrutiny by the BoE and conduct/AML oversight by the FCA. 

HM Treasury Consultations on Broad Cryptoasset Regulation

HM Treasury (HMT) has been shaping the future UK crypto regime through a series of consultations in 2022-2025.

In February 2023, HMT issued a major consultation and call for evidence on a comprehensive cryptoasset regulatory framework, often dubbed the “Future Financial Services Regulatory Regime for Cryptoassets”. After evaluating industry feedback, HMT published its Final Proposals in late October 2023, confirming that it will proceed with bringing an array of crypto activities into the financial services regulatory perimeter.

Key Proposals Include:

1) Creating new regulated activities in the RAO (Regulated Activities Order) for operating a crypto exchange, providing custody, arranging deals in cryptoassets, issuing crypto tokens, and so on – effectively a licensing regime similar to MiCA but within the UK’s existing FSMA structure.

2) The HMT also consulted on the failure regime for stablecoin firms (May 2022) and determined that both the FCA and BoE will have roles in supervising stablecoins and managing potential failures.

3) Further, in July 2023, HMT consulted on establishing the Digital Securities Sandbox (DSS), which was legislated in FSMA 2023.

4) In 2024 and 2025, HMT has signaled focus on areas like DeFi and crypto lending, exploring if and how decentralized finance protocols might be brought under regulation, and whether specific rules are needed for crypto market abuse, NFTs, etc.

5) Another consultation anticipated is on crypto taxation. HMT’s approach has been relatively pragmatic and industry-friendly: they rejected a parliamentary committee’s suggestion to regulate unbacked crypto as gambling, firmly maintaining it will be treated as a financial activity with appropriate safeguards.

The Treasury has also emphasized “same risk, same regulatory outcome” to guide its policy, ensuring that crypto activities that parallel traditional finance receive equivalent regulation.

By early 2025, the near-final draft legislation (the Cryptoassets Order 2025) will have been released for comment, detailing how each type of crypto service will be incorporated into law.

In short, HM Treasury’s consultations are paving the way for a phased but comprehensive crypto regime covering everything from primary issuance of tokens to secondary trading, custody, lending, and beyond. The Treasury works closely with the FCA and BoE, so that once policy is settled, the regulators can roll out rules and guidelines.

Crypto businesses should keep abreast of HMT’s proposals. The consultation documents and response papers (available on gov.uk) provide a clear indication of the future rulebook. The message from HMT is that by 2025–2026, the UK intends to have fully integrated crypto into its financial regulatory framework, maintaining high standards without stifling innovation.

Digital Securities Sandbox (DSS)

One of the most forward-looking initiatives in the UK’s post-Brexit strategy is the Digital Securities Sandbox (DSS). It is a controlled environment for testing tokenization and DLT-based market infrastructure. Launched under powers in FSMA 2023, the DSS became operational in 2024 as a joint program run by the FCA and the Bank of England.

The DSS allows firms to experiment with issuing, trading, and settling digital securities using distributed ledger technology, within a legal sandbox that can temporarily waive or modify certain regulations.

The goal is to foster innovation in a safe way and gather insights for future regulatory adjustments. Participants in the DSS (which could include fintech companies, exchanges, or even traditional institutions exploring blockchain) must still meet criteria and limits set by the regulators.

The Bank of England and FCA have three overarching aims for the DSS: facilitate innovation in markets, protect financial stability as new tech is trialed, and protect market integrity by applying appropriate safeguards even during experiments.

In practice, this means DSS projects might be exempted from certain existing rules that don’t mesh with DLT but will operate under bespoke rules designed by the sandbox oversight committee. The sandbox is time-limited (currently set to run until 8 January 2029) by which time the successful innovations are expected to transition into the mainstream regulatory framework. Early use cases include tokenized bonds and digital equities where, for instance, ownership can be recorded on a blockchain rather than traditional ledgers. The sandbox enables these to be issued and traded with regulatory approval but without needing full legislative changes first. It effectively gives regulators a chance to see how tokenized markets function in reality, and adjust rules accordingly.

The DSS also dovetails with the UK’s ambition to lead in financial market innovation. It was highlighted in the government’s April 2022 crypto hub announcement as a key measure. Importantly, lessons from the DSS will inform the development of a permanent regime for digital securities. For example, how to handle corporate actions on chain, how custody of digital bonds should be regulated, etc.

For crypto businesses, the DSS represents a pathway to engage with regulators early and shape the future rules. It’s especially relevant for platforms dealing with security tokens, DeFi protocols aiming to interface with real-world assets, or exchanges seeking to trade tokenized financial instruments. Success in the DSS could mean being among the first licensed operators when the UK eventually permits full-scale tokenized markets.

Taxation and Reporting Under HMRC Rules

How Crypto Taxation Works in the UK

HM Revenue & Customs (HMRC) has gradually built out guidance on the taxation of cryptoassets, ensuring that crypto transactions are not beyond the reach of the taxman. By 2025, the tax treatment of crypto in the UK is surprisingly clear: individuals are subject to Capital Gains Tax (CGT) on profits from disposing of cryptoassets (at rates of 10% or 20% depending on income level), and trading profits (if one is trading frequently or as a business) could be treated as income. For businesses, corporate tax rules apply to crypto just like other assets. Any crypto held as an investment on the balance sheet triggers a taxable gain or loss when sold, and crypto trading profits are part of taxable income. VAT is generally not charged on cryptocurrency exchange services, though when crypto is used to pay for goods/services, normal VAT rules apply to the underlying transaction. 

Mining rewards may be taxable income if done in a businesslike manner. One complexity the UK has addressed is the handling of airdrops, forks, and staking income. Typically, these are subject to Income Tax when received, and then CGT on any gains when disposed. Importantly, HMRC ties taxation to residency: UK tax residents owe taxes on worldwide crypto gains, while non-residents mostly are outside UK CGT. 

By 2025, HMRC has joined efforts with other countries to improve tax transparency in crypto. HMRC requires that individuals report their crypto gains in the annual self-assessment tax return. Since many people have started holding crypto, HMRC has updated its manuals to clarify common scenarios. 

For instance, each different cryptoasset is treated as a separate asset class for CGT, and the “pooling” method is used (similar to stocks) to calculate cost basis. Meaning an investor keeps a pooled average cost for each crypto asset type they hold and calculates gains when some are sold. If an individual’s total gains (from crypto plus any other assets) exceed the annual CGT allowance, they must pay CGT. 

Crypto received as salary is taxed as income (PAYE) based on value at receipt, and thereafter any change in value is a capital gain or loss. HMRC has also clarified that exchanging one crypto for another counts as a disposal for CGT. So crypto-to-crypto trades are taxable events in GBP terms. 

There’s no separate “Crypto Tax”. It’s all under existing frameworks of CGT, income tax, and corporation tax. One notable aspect is inheritance tax: cryptoassets are treated as property, so they are part of one’s estate and potentially liable to 40% IHT if one’s estate is above the threshold.

For foreign companies or investors, using UK-based crypto services does not by itself pull them into UK tax jurisdiction. HMRC’s approach has been to integrate crypto into the tax system in a way that is tech-neutral. The emphasis is on self-reporting. Taxpayers must keep records of their transactions (trades, sales, receipts) in GBP value and declare gains. Given the pseudonymous nature of crypto, HMRC has been enhancing its capabilities. It can issue information requests to exchanges (and has done so) to obtain customer trading data for compliance checks.

Recordkeeping and Reporting Obligations

Hand-in-hand with taxation comes the duty for proper record-keeping and reporting. UK crypto businesses and individuals are required to maintain detailed records of their crypto transactions for at least 5 years. These records should include dates of each transaction, the type of crypto, the amount in both crypto and fiat value at the time, the other party, and the purpose (especially for businesses). 

For exchanges or brokers, this means keeping logs of all customer trades, withdrawals, deposits, etc. For individuals, it means tracking your buys, sells, trades, receipts, and spending of crypto. Since prices fluctuate, one must note the GBP value at each event for accurate tax calculation. Many crypto users rely on specialized software or platforms to aggregate their trading data across exchanges and wallets to produce tax reports. 

On the reporting side, businesses have specific obligations. If you’re a UK company accepting crypto or transacting in crypto, you still report in GBP in your financial statements; any significant holdings of crypto may need disclosure in notes as intangible assets. If you’re a crypto exchange, you might have to file annual reports of aggregate transactions or customer data if required by HMRC. Additionally, any suspected tax evasion via crypto should be reported. Financial institutions in the traditional sense have to report certain info to HMRC. Crypto firms will likely fall under similar obligations as regulations evolve.

For now, a crucial upcoming requirement is that under the new CARF rules (effective 2026), UK cryptoasset service providers will have to report user and transaction data to HMRC annually. 

This means exchanges, wallet providers, etc., will need to file reports of customers’ gains and transactions, much like stock brokers issue 1099-B forms in the US. The UK is thus moving toward automatic tax information exchange in crypto. Internally, crypto firms should prepare to capture tax-relevant data: for example, cost basis allocation for customers, or tracking large withdrawals that might need to be flagged. 

On the individual side, when filing a self-assessment, one must include crypto disposals in the Capital Gains pages and/or any mining/staking income in the appropriate income section. HMRC’s online guidance walks through examples. If an individual has complex crypto activity, they might need to attach computations. For corporation tax, crypto gains are part of the company’s taxable profits and are reported in the tax return (CT600) like other profits. 

All these reporting obligations are enforceable. HMRC can inquire into a return and ask for evidence to substantiate the reported figures. Thus, meticulous record-keeping is not only good practice but legally required. With the increased scrutiny on crypto, those who fail to keep proper records may find themselves unable to justify their tax positions, leading to HMRC assessments or penalties.

Future Integration with Global Tax Transparency

In line with global efforts to crack down on offshore tax evasion, the UK is gearing up to implement the OECD’s Crypto-Asset Reporting Framework (CARF) and to enhance international tax transparency for crypto. 

In April 2025, the UK government confirmed it will adopt CARF, meaning that from 1 January 2026, UK-based crypto service providers must collect detailed user and transaction data for tax reporting. This data will then be reported to HMRC and potentially shared with foreign tax authorities under information exchange agreements, similar to how bank information is shared under the Common Reporting Standard (CRS). 

Under CARF, exchanges and wallet providers will collect information such as name, address, tax identification number (TIN), and transaction details (gross proceeds, fair market value, etc.) for customers who transact above certain thresholds. This essentially imposes a due diligence duty on crypto providers to identify the tax residency of their users and keep records of their trades and transfers. 

The goal is that a UK resident’s crypto gains won’t escape HMRC’s notice just because they occur on an offshore exchange – that exchange (if in a CARF-participating jurisdiction) will report the activity back to HMRC. 

Conversely, the UK will share data on, say, a French resident using a UK platform with French authorities. This multilateral approach is spearheaded by the OECD and supported by G20 nations to close the crypto tax gap. In October 2023, G20 finance ministers endorsed rapid implementation of CARF. The EU is also incorporating CARF via the DAC8 directive by 2026. 

So the global trend is clear: crypto will no longer be “hidden” wealth. The UK’s CARF regulations set a timeline: data collection from 2026, first reports due by end of May 2027 covering 2026 activity. 

Crypto firms will need to register with HMRC as reporting entities by January 2027. Penalties up to £300 per user apply for failing to report or for inaccuracies. This parallels similar obligations that banks and brokers have had for years. For the industry, this means ramping up KYC to gather tax residence info and upgrading back-office systems to generate annual tax reports. 

In the long run, this integration with global tax systems will legitimize crypto as just another asset class, but it will also definitively end the notion that one can easily hide assets in crypto. 

HMRC’s enthusiasm for data-driven enforcement is high. They already work with blockchain analytics to identify tax cheats. Once CARF is live, expect HMRC to send “nudge” letters to taxpayers if discrepancies appear between HMRC’s data and what was filed on a tax return. Additionally, the UK may align with any future updates to CRS (often called “CRS 2.0”) to include cryptoassets held by financial institutions. 

All told, by 2026–2027 the UK intends to have full visibility of crypto holdings and profits of its taxpayers, working hand-in-hand with other countries. Crypto businesses that adapt to these reporting duties will find themselves well-positioned in a regulated, transparent global market.

Comparison with EU MiCA and Global Standards

UK vs EU: Flexibility vs Harmonization

A common question is how the UK’s emerging crypto regime compares to the EU’s MiCA (Markets in Crypto-Assets Regulation). MiCA, which comes into full effect in 2024, creates a uniform, passportable crypto regulatory framework across all EU member states. It imposes licensing for CASPs (Crypto Asset Service Providers), with detailed requirements. The UK, outside the EU, has chosen a somewhat different path: instead of a single new rulebook, it’s integrating crypto into existing financial laws (FSMA, RAO, etc.), giving regulators discretion to craft rules via the FCA Handbook. This arguably offers more flexibility. 

For instance, HMT can tweak definitions or carve-outs via secondary legislation, and the FCA can tailor requirements per activity, without needing pan-European consensus. The trade-off is that the UK regime might initially be less clear-cut than MiCA’s one-stop rulebook. 

However, it avoids the bureaucracy and delay of EU-wide negotiations. There will be no “passporting” of crypto licenses in the UK. Firms will need a UK authorization to serve UK clients, and likewise UK firms will need to seek EU authorization to serve the bloc. This could be seen as a downside for UK businesses, but the UK hopes to compensate by being more agile and innovation-friendly. Indeed, the UK opted to bring stablecoin and broader crypto rules in simultaneously, whereas the EU staggered. The UK believes a unified approach is more efficient now. 

Another distinction: MiCA is quite prescriptive on things like whitepaper disclosures and capital requirements for CASPs. The UK may allow more principles-based compliance. On the flip side, MiCA provides legal certainty across 27 countries and a huge market – something the UK alone can’t match in scale. From a business perspective, UK vs EU might be seen as flexibility vs harmonization. The UK can adjust rules quickly if needed (for example, to accommodate DeFi or NFTs, which MiCA largely left out), whereas MiCA’s advantage is a single license opens all EU markets. 

The UK also prides itself on a proportionate approach. For instance, UK regulators are considering temporary exemptions for certain requirements during phase-in to not stifle startups, whereas MiCA was criticized by some as one-size-fits-all. 

It’s worth noting that the outcomes aimed for are similar. Both jurisdictions want strong consumer protection, market integrity, and AML compliance. The UK’s regime will certainly be equivalent to MiCA in rigor, even if implemented differently. 

One interesting aspect is DeFi. The EU’s MiCA doesn’t yet cover decentralized, autonomous platforms, while the UK is already exploring how to address DeFi under existing laws. 

Another difference is rhetoric… The EU framework is often seen as more strict on algorithmic stablecoins (banning those above certain size until regulated), whereas the UK has not moved to explicitly ban any crypto category, preferring to keep innovation in scope and supervise it. 

Over time, we might see the UK and EU regimes converge in practice, especially if firms push for interoperability. But for now, UK crypto businesses should treat MiCA as a separate foreign regime. If they plan to operate in Europe, they must comply with MiCA. And EU-based firms will need to go through the FCA process to operate in the UK. This dual regulatory compliance might raise costs for global operators. Some in the industry believe the UK’s more nimble, case-by-case regulatory style could attract certain businesses, whereas the certainty of MiCA might attract more established players who value a single rulebook covering a big market. Ultimately, both models have merits. The EU’s harmonization provides consistency, and the UK’s independent path allows regulatory competition. The UK can potentially create a more competitive environment to draw investment (which aligns with its policy objective of being a crypto hub).

Alignment with FATF and G20 Guidelines

On the international stage, the UK’s crypto regulations align closely with the standards set by bodies like the Financial Action Task Force (FATF) and the G20’s Financial Stability Board (FSB)

The FATF has been a key driver in crypto policy, especially through its Recommendation 15 and the Travel Rule, areas where the UK has been an early adopter. The FCA and HM Treasury actively participate in FATF evaluations and have implemented virtually all FATF crypto recommendations: from licensing to AML measures and Travel Rule compliance. 

In FATF’s June 2023 Report, the UK was noted for moving ahead on Travel Rule enforcement before many others. This proactive stance not only satisfies FATF but also bolsters the UK’s reputation as a jurisdiction that meets global financial crime standards. 

Regarding the G20/FSB, the UK has endorsed the FSB’s high-level recommendations for cryptoasset regulation which call for same activity, same risk, same regulation and specifically urge oversight of stablecoins and crypto conglomerates. 

The UK’s stablecoin regime and upcoming prudential rules for crypto firms reflect these recommendations. When the FSB pushes for global consistency the UK is often already moving in that direction or will calibrate its rules accordingly. 

Another global initiative is the IOSCO crypto-asset trading platform principles on conflicts of interest, safeguarding, etc., which the FCA will likely incorporate into its rulebook for exchanges. 

Moreover, the UK is aligning with the IMF and G20 agenda on crypto. For example, emphasizing the need for cross-border cooperation on supervision and not allowing arbitrage. The UK’s participation in global fora ensures that its domestic regulations won’t diverge wildly from global norms. 

The UK also closely watches the US regulatory approach and often positions itself somewhere in between the US and EU in strictness. One could say the UK aims to be a “globally aligned but innovation-friendly” regulator. By keeping in sync with FATF on AML and with G20 on stability, the UK ensures it won’t be seen as a loophole jurisdiction.

The UK’s commitment to international standards also means that if new risks emerge, the UK will incorporate those in its roadmap. We already see the FCA planning ahead for DeFi oversight. 

In summary, the UK is not going it alone. Its crypto regulation is part of a collaborative global framework. This benefits businesses by creating a more level playing field internationally and reduces the chance of contradictory requirements. It also gives the UK authorities leverage to push for other countries to raise their standards. Thus, a crypto firm in the UK can be confident that complying with UK rules largely means you’re meeting the highest global benchmarks, which is advantageous when dealing with partners and regulators abroad.

Opportunities for Global Crypto Businesses

Despite the strict compliance requirements, the UK’s regulatory clarity offers opportunities for crypto businesses. Especially those aiming for long-term sustainability and mainstream adoption. By establishing a comprehensive legal framework, the UK is signaling that it welcomes legitimate crypto innovation under proper oversight. This provides a stable environment for businesses to invest and build. The UK’s independent approach also allows it to tailor incentives – such as the Financial Conduct Authority’s Sandbox Programs and the Digital Securities Sandbox – which global firms can use to trial new offerings with regulatory support. 

London, as a global financial center, offers an unparalleled talent and capital pool, and coupling that with a crypto-friendly yet safe regulatory regime is an attractive proposition. We see already many crypto fintech startups choosing London as their base to tap into its fintech ecosystem. 

The government’s stance is also business-friendly. It often emphasizes growth and competition. This means rules might be enforced proportionately, and policymakers are open to industry dialogue. 

In contrast to jurisdictions that have banned crypto activities or created overly onerous rules, the UK offers a middle path: oversight without an outright hostile approach. 

Global crypto firms looking for a reputable base of operations might find the UK promising to establish a regulated entity, which can then serve as a stamp of quality in dealings elsewhere. Moreover, with the EU’s MiCA and others coming live, large players will need multiple licensed hubs. 

The timing is also advantageous: the full UK regime is expected around 2025–26, meaning companies have a window now to shape and prepare for it. Those who engage early can influence rules and be ready to fast-track authorization when the gateway opens in 2026. The independent regulatory regime also allows the UK to strike its own international partnerships. Additionally, the UK’s positive approach to institutional adoption means crypto businesses focusing on the intersection of traditional finance and crypto have fertile ground in the UK. 

Essentially, the UK is positioning itself as a global crypto hub where credible businesses can thrive under clear rules –

“Britain is open for business — but closed to fraud, abuse, and instability,”

as the Chancellor put it.

For global businesses, this means if you play by the rules, the UK offers a large, affluent market with government backing for innovation. The early pains of compliance are likely outweighed by the long-term gains of being part of one of the world’s leading regulated crypto markets.

Future Outlook: 2026 and Beyond

FCA Roadmap for DeFi and New Asset Classes

Looking ahead, the FCA has outlined a phased “crypto roadmap” through 2024–2026, and a big part of it is tackling emerging areas like DeFi (Decentralized Finance), NFTs, and other new asset classes that current rules may not fully cover. 

By 2026, after implementing the core regime for centralized crypto activities, the FCA plans to turn its focus to more complex realms. 

In 2025, we can expect consultations on crypto staking and lending. Indeed, HMT indicated it will clarify that crypto staking services are not to be treated as collective investment schemes, removing legal uncertainty, but likely making them a distinct regulated activity. 

DeFi protocols, which often have no central operator, pose a regulatory dilemma. The FCA’s strategy seems to be focusing on regulating the touchpoints and establishing principles that should apply to DeFi platforms. The FCA might explore code audits or certification regimes for DeFi contracts, or impose obligations on those who benefit from or control a protocol to comply with certain requirements. This is uncharted territory globally, but the FCA has signaled openness to innovative approaches (for example, potentially using the Designated Activities Regime (DAR) to set rules for using a DeFi platform without needing to identify a single entity to authorize). 

We could see by 2026 a consultation on extending consumer protection to NFT marketplaces or regulating crypto gaming tokens if they become systemic. Another focus is likely a regulation for larger crypto firms. The Bank of England’s PRA might introduce a tailored capital and liquidity framework for systemically important crypto intermediaries. This could roll out by 2026, meaning big exchanges or custodians may need to hold a minimum capital buffer, similar to e-money institutions or investment firms. 

The FCA will also monitor stablecoin usage.  If, say, a GBP stablecoin takes off, the FCA (with BoE) will want to ensure it doesn’t threaten monetary policy or consumers – but also that it can be integrated. By 2026 regulators might push disclosures of the environmental impact of crypto operations (especially if any bans on PoW were considered, though the UK hasn’t indicated that yet). 

Overall, the FCA’s roadmap shows an iterative approach. Get the basics in place (registration, licensing, promotions rules, stablecoin oversight), then iteratively expand to cover novel crypto activities in a way that maintains the “same risk, same rules” principle. 

This means for crypto businesses, areas like yield farming, liquidity mining, DAO governance tokens, decentralized exchanges (DEXs) etc., which currently lie in a gray area, will likely face tailored regulation in the coming years. The FCA might require, for example, that any DeFi app offering lending to UK consumers either registers or that its UK-facing front-ends ensure users are aware of risks and perhaps enforce some limits. It’s a challenging task, but the UK seems intent on not leaving any significant gaps that could harm consumers or stability. By taking part in FCA calls for input and pilot programs, industry participants can help shape workable rules for these new domains.

How to Stay Compliant in the UK Market

Building an FCA-Ready Compliance Framework

For crypto businesses operating (or aspiring to operate) in the UK, compliance is not an afterthought. It must be built into the core of the business from day one. To be “FCA-ready” means designing your organization, processes, and culture in line with regulatory expectations. 

Key Steps for FCA Approval and Policy Development
  1. Start with Governance. Ensure you have a clear organizational structure, with a dedicated Compliance Officer or MLRO who has sufficient authority and resources. The FCA will assess the fitness and propriety of key personnel, so hiring experienced compliance professionals and giving them independence is crucial. 
  2. Develop a comprehensive AML/CFT Policy that covers risk assessment, customer onboarding, transaction monitoring, sanctions screening, and SAR reporting and have it documented. 
  3. You’ll also need policies on Security (Custody Controls), Operational Resilience (disaster recovery, cyber-security), Treating Customers Fairly, and more, reflecting the FCA’s principles. 
  4. Internal Controls should be put in place. For instance, role-based access controls to sensitive systems, multi-signature approvals for large transfers, and segregation of duties. 
  5. Conduct a Regulatory Gap Analysis against the MLRs and draft UK crypto rules to ensure nothing is missed. The FCA’s application forms often act as a guide on what needs to be in place. 
  6. Building a Compliance Framework also involves setting up a Board or Compliance Committee that regularly reviews compliance reports and incidents. Document everything. If the FCA comes knocking, you should be able to produce audit trails of decisions and improvements. 
  7. Use the FCA’s Guidance (like FG17/6 on AML or the JMLSG guidance) as checklists. Also, embrace the “culture of compliance” – leadership should openly endorse that the company’s strategy includes being a compliant and responsible actor in crypto. 
  8. Another key is to engage with Advisors or Legal Counsel who have experience with FCA requirements to review your framework before you apply for registration or authorization. 
  9. Keep in mind that compliance is not static. Set up a Monitoring and Review Schedule. E.g., an annual AML audit, periodic penetration tests of your cybersecurity, and quarterly internal compliance reports summarizing any issues. 
  10. Being “FCA-ready” is as much about mindset as about checkboxes. It means thinking ahead about regulatory changes and allocating budget and tech resources to implement them timely. Many firms find ISO Certifications (like ISO 27001 for security) helpful to impose discipline which also impresses regulators.

Implementing Travel Rule and KYT Automation

Given the stringent AML obligations in the UK, automation is key to effective and efficient compliance, particularly for the Travel Rule and Transaction Monitoring (KYT, or Know Your Transaction). 

Implementing the Travel Rule in your operations means integrating a solution that can automatically identify when a crypto transfer needs Travel Rule data and then securely transmit that data to the beneficiary institution. 

Many crypto businesses turn to specialist Travel Rule Providers. When choosing one, ensure it’s compatible with global standards and widely adopted protocols. The system should be able to determine, based on the withdrawal address or receiving VASP info, whether the counterparty is Travel Rule-compliant and find the right channel to send the info. 

For example, some solutions use an address directory to map blockchain addresses to VASP identities (when possible), while others require the user to input the beneficiary’s VASP info. In practice, your platform’s withdrawal workflow will need an extra step: if a customer wants to send crypto out, you may prompt them to select the recipient exchange/wallet from a dropdown or enter details about the recipient if sending to a personal wallet. Then your back-end will package the required info and send via API or encrypted email to the beneficiary VASP. 

Automation here reduces error and ensures no transfer goes out without the data attached or recorded. Some firms have also integrated this with their Sanctions Screening. E.g., when the Travel Rule triggers, simultaneously run the beneficiary name through sanctions lists as a double-check. 

On the KYT (Transaction Monitoring) front, manual review of blockchain transactions is impossible at scale, so employing blockchain analytics tools is essential. These tools can flag transactions involving risky counterparties (like dark markets, mixers, scam-associated addresses) in real time. By hooking these into your internal systems, you can create rules such as: if an address is flagged with risk score above X, hold the transfer for compliance review. 

Automation can also handle routine case management. E.g., if a user tries to send to a blacklisted address, automatically stop it and send the user a message that the transfer is under review or not allowed. 

Another aspect is Customer Risk Profiling. With automation, you can assign risk scores to customers and then adapt the monitoring thresholds accordingly. All alerts from KYT tools should feed into a case management system where compliance analysts can document their investigation and resolution.  

Modern RegTech platforms often provide an integrated suite: KYC onboarding, KYT monitoring, Travel Rule compliance, and sometimes even SAR filing workflows. 

Strengthen your UK AML Framework with AMLBot's Crypto AML Compliance

In summary, embrace automation to the fullest extent in compliance. The UK regime’s complexity practically necessitates it. Not only will this keep you compliant, but it also improves security and provides a smoother user experience. The FCA itself has encouraged the use of innovative technology to meet regulatory obligations. So a tech-forward compliance setup is viewed positively. Ultimately, automating compliance allows your business to handle higher volumes and grow, without a proportional explosion in compliance headcount, while maintaining confidence that you are meeting the stringent UK crypto regulation standards day in and day out.

Preparing for FCA Audits and Reviews

Any crypto firm under FCA supervision should expect periodic audits, inspections, or deep-dive reviews by the regulator. 

  1. First, understand what the FCA might scrutinize. Since current crypto oversight is under the AML regime, an FCA visit would likely assess your AML controls and compliance with MLRs. They may request documents like your AML policy, customer risk assessment methodology, training logs, a sample of customer files, SAR filings records, and transaction monitoring alerts history. Ensure these documents are up-to-date and accessible. 
  2. Conduct Internal Testing. Maybe quarterly file reviews and keep records of those internal audits and any remediation taken. The FCA will appreciate a proactive approach where you self-identify issues and fix them. 
  3. Another key area is Governance Minutes. Keep minutes of board meetings or compliance committee meetings where regulatory compliance is discussed, as this evidences management oversight. If you had any compliance breaches or incidents, document how you responded and what improvements were made. The FCA will ask about past incidents and your learnings. Also, be ready to provide metrics. Number of customers onboarded, number refused (and why), number of SARs filed, average onboarding time, etc. 
  4. The FCA often asks for MI (Management Information) to see if you measure your compliance effectiveness. When you anticipate an FCA supervisory visit, it can be useful to perform a mock audit with an external consultant who will critique your state. 
  5. On a practical note, ensure that the relevant staff are available and prepared to answer questions. The FCA could ask your MLRO about how they decide to file a SAR, or ask your CTO about cybersecurity measures. Train your team to answer honestly, directly, and without guessing. Have a clean and organized data room for requested documents. If the FCA sends an RFI letter, respond within deadlines and in a clear format. 
  6. Looking beyond AML: as the FCA starts regulating crypto as financial instruments, audits will expand to cover areas like financial promotions compliance, client asset segregation. So anticipate those.
  7. Also, maintain proper Financial Records. Even though crypto firms aren’t banks, the FCA will want to see that you’re financially sound. This means having audited financial statements, meeting any capital requirements, and an effective financial control environment. 
  8. Another point: Regulatory Reporting. If you have any regular reporting obligations, ensure they are filed accurately and on time. The FCA’s systems will log if you’re late or if data seems inconsistent. Consistent reporting without errors indicates a well-run compliance function. 
  9. Lastly, culture is hard to fake. The FCA supervisors can often sense if a firm treats compliance as a box-tick or genuinely integrates it. They might chat informally with staff to gauge this. So foster a culture where employees understand why behind regulations and are encouraged to flag issues.

Summary – Key Takeaways for Crypto Businesses

  • UK Cryptoassets = Regulated Financial Instruments. The UK’s Financial Services and Markets Act 2023 legally defined cryptoassets as a regulated class of assets. Going into 2025, operating a crypto business in the UK means working under clear laws and rules, much like traditional finance. FSMA 2023 cleared the way for new licensing requirements, stablecoin oversight, and even a sandbox for tokenized securities, signaling that crypto is now part of the UK’s financial system.
  • FCA as the Main Crypto Regulator. The Financial Conduct Authority (FCA) is the lead regulator for crypto businesses in the UK. All exchanges, custodians, trading platforms, and other cryptoasset firms must register with the FCA for AML supervision. The FCA ensures that firms have proper KYC/AML controls, fit-and-proper management, and meet conduct standards. Once the broader crypto regime goes live (expected by 2026), firms will need full FCA authorization to operate. The FCA plays a dual role: gatekeeper (through registration/licensing) and supervisor (through ongoing oversight).
  • AML Compliance and Travel Rule – Non-Negotiable. Anti-Money Laundering and Counter-Terrorist Financing requirements are mandatory across the UK crypto sector. Firms must implement KYC checks, Customer Due Diligence, and Transaction Monitoring in line with the UK’s AML laws, which mirror FATF standards. Since September 2023, the Travel Rule has been in effect. Crypto firms are required to collect and share originator/beneficiary information for transfers, just as banks do. This means investing in compliance infrastructure is a MUST.
  • HM Treasury Steers Strategy & Tax – Prepare for New Rules. HM Treasury (the Finance Ministry) sets the strategic direction, ranging from overall regulatory regime design to the taxation of crypto. Treasury’s consultations in 2023-25 confirm that the UK will implement a comprehensive crypto framework, simultaneous with stablecoin regulation. Crypto businesses should keep an eye on HMT Policy Papers. Upcoming rules will flow from these. On the tax side, HMRC expects crypto profits to be reported and taxed. By 2026, under new HMRC rules and international agreements, UK crypto service providers will report user transaction data to tax authorities. In short, the government wants to foster innovation, but under a framework that ensures taxes are paid and risks are managed, so align your business plans accordingly.
  • Stablecoins and Digital Finance Integration – The Next Wave. The UK is embracing stablecoins and tokenization as part of financial innovation, but doing so safely. Stablecoin issuers used for payments will need to be FCA authorized and meet standards on reserve assets and redemption – a regime similar to e-money is emerging. The Bank of England will oversee any stablecoin that could be systemic, ensuring it doesn’t threaten financial stability. Meanwhile, initiatives like the Digital Securities Sandbox (DSS) are bridging crypto tech and traditional markets, enabling testing of DLT for trading and settlement. This points to a future in which blockchain and traditional finance merge under the regulators’ watch.
  • UK: A Regulated Yet Innovation-Friendly Jurisdiction. Overall, the UK in 2025 remains open to crypto business, but it’s fully a regulated environment. The “wild west” days are over – compliance, transparency, and consumer protection are the entry price to this market. The payoff is a stable environment with government support to become a global crypto hub.

FAQ

Is Crypto Regulated In the UK?

Yes. As of 2025, the UK has a comprehensive regulatory framework for cryptoassets. The Financial Services and Markets Act 2023 officially brought “cryptoassets” within the UK’s financial regulatory perimeter, providing legal clarity and authority for regulators. In parallel, the Money Laundering Regulations (MLRs) require all crypto exchanges, custodians, and wallet providers to register with the FCA and comply with AML/KYC rules. In practice, this means crypto businesses in the UK are subject to similar oversight as other financial firms.

What License Do I Need To Operate A Crypto Company In the UK?

If you are offering crypto exchange, trading, custody, or payment services in the UK, you must currently obtain FCA Registration under AML regulations. This is not a “license” in the traditional sense yet, but a mandatory registration demonstrating compliance with anti-money laundering requirements. The FCA will only register firms that implement proper KYC and transaction monitoring and have fit-and-proper management. Looking ahead, the UK is introducing a whole authorization regime (via an upcoming Cryptoassets Order 2025 under FSMA), which will function like a license. Once in effect, any business engaging in regulated cryptoasset activities will need to apply for FCA permission to operate legally.

In summary: Step 1. Get FCA-registered for AML (the immediate requirement); Step 2. Be prepared to transition to an FCA authorized license when the new rules go live around 2025–26.

What Are The AML and KYC Requirements For UK Crypto Businesses?

UK crypto businesses must meet AML (Anti-Money Laundering) and KYC (Know Your Customer) obligations. Also, firms need to implement a risk-based approach, meaning higher-risk customers get enhanced due diligence, while lower-risk customers can be simplified. Every transaction should be screened for suspicious indicators using KYT (Know Your Transaction) tools. Anything suspicious must trigger a Suspicious Activity Report (SAR) to the UK Financial Intelligence Unit (UKFIU) within the NCA. Additionally, crypto firms must screen customers against sanctions lists and politically exposed persons lists. Recordkeeping is required. All KYC data and transaction records must be kept for at least 5 years. In July 2023, the UK implemented the Travel Rule, which requires firms to collect and share sender/receiver information for crypto transfers.

How Does The Travel Rule Apply In the UK?

The Travel Rule in the UK requires crypto service providers to include identifying information about the sender and recipient with every crypto transfer between VASPs, very much like the rules for bank wire transfers. Effective 1 September 2023, all UK cryptoasset businesses must collect, verify, and share the sender’s name, address, and the recipient’s name and wallet address for transfers. If you’re sending crypto from a UK exchange to, say, another exchange abroad, you (the originator) must send the required customer data to the beneficiary exchange alongside the blockchain transaction. If the beneficiary is in a jurisdiction that hasn’t implemented the Travel Rule yet, you still must collect and store the info on your end, even if you can’t transmit it.

Are Stablecoins Regulated In the UK?

Yes. Stablecoins, particularly fiat-backed stablecoins used for payments, are being brought within the UK regulatory framework. Through FSMA 2023, the government created a category of Digital Settlement Assets” (DSAs), which essentially covers stablecoins that reference fiat currency. Such stablecoins will fall under a regime where:

(1) Issuers of major stablecoins will need to be authorized by the FCA and comply with rules on reserve management, safeguarding of funds, capital, liquidity, and redemption rights for coin-holders.

(2) If a stablecoin is deemed systemically important, the Bank of England will have oversight powers, and a special administration regime can apply to manage a collapse.

(3) Stablecoins used as payment systems can be designated under the Banking Act 2009, bringing them under the BoE’s payment system oversight.In short, the UK is integrating stablecoins into its financial laws. Smaller stablecoins will be regulated primarily by the FCA as payment services, while large-scale stablecoins will be subject to dual regulation by the FCA and the BoE. Notably, algorithmic stablecoins and stablecoins used in trading but not payments may fall outside the initial focus, but could be captured by future broad crypto rules. 

By 2025, HMT will have consulted on expanding the regulation to include stablecoin wallets and custodians. If you operate or plan to issue a stablecoin in the UK, expect to need a license and to follow stringent rules akin to a payment institution or e-money firm, including possibly having to hold high-quality liquid assets to back the stablecoin in circulation fully.

What Is FSMA 2023 And Why Does It Matter For Crypto?

The Financial Services and Markets Act 2023 is a landmark UK Law that, among many financial reforms, explicitly incorporated cryptoassets into the regulatory scope. It amended existing financial laws (FSMA 2000) to include crypto-related activities. Specifically, FSMA 2023:

1. Introduced a definition of “cryptoasset” in legislation, ensuring that regulators have clear jurisdiction.
2. Enabled the creation of new regulated activities via secondary legislation (so crypto trading, lending, custody, etc., can be added as activities that require FCA authorization).
3. Brought crypto promotions under stricter rules. Changes to the Financial Promotion Order now cover “qualifying cryptoassets”, requiring FCA authorization or an exemption to communicate ads legally.
4. Provided a framework for stablecoins (calling them Digital Settlement Assets) to be regulated as part of payment systems oversight.
5. Established the Digital Securities Sandbox, empowering regulators to suspend specific laws to allow testing of DLT in market infrastructures. In essence, FSMA 2023 “plugged in” crypto to the UK’s financial regulation, ending the ambiguity.

Before, the FCA only oversaw crypto for AML. After FSMA 2023, the FCA/HMT rolled out comprehensive rules for crypto as they do for banking, securities, etc. This matters hugely. It means the UK is not banning crypto or leaving it unregulated. It’s actively regulating it, which, in the long run, provides greater market stability and consumer confidence. For crypto entrepreneurs, FSMA 2023 is a clear signal that you must engage with the regulatory system. It also means new opportunities, like the sandbox, and the eventual ability for crypto firms to become fully authorized financial institutions in the UK, potentially passporting into other markets if agreements allow.

How Are Crypto Taxes Handled In the UK?

In the UK, crypto taxation depends on the type of transaction. Capital Gains Tax applies when individuals dispose of crypto for profit, while Income Tax may apply to crypto received as salary, from mining, or staking. Businesses pay Corporation Tax on crypto profits, whether from trading or investment. HMRC requires GBP-based recordkeeping and self-assessment reporting, with new international reporting rules (CARF) coming into effect by 2026. Even spending crypto on goods may trigger a tax event. So accurate tracking and reporting are essential. Taxation and Reporting Under HMRC Rules.

How Can UK Crypto Companies Stay Compliant With AML Regulations?

UK crypto companies must follow the MLRs and the FCA’s risk-based AML framework. It is starting with a documented risk assessment that reflects their products, customers, and jurisdictions. Firms must verify all users through KYC, screen sanctions, identify beneficial owners, and apply Enhanced Due Diligence to high-risk customers. Continuous transaction monitoring is required, supported by blockchain analytics (KYT) to detect illicit patterns and suspicious wallet activity. When red flags appear, companies must file Suspicious Activity Reports (SARs) to the UKFIU without tipping off customers. Compliance with the Travel Rule is mandatory, meaning firms must transmit and receive originator/beneficiary data for all transfers. Sanctions screening must be applied at onboarding and throughout the customer lifecycle. Regular AML training, independent audits, and strict five-year recordkeeping are also expected. Firms must closely follow new guidance from the FCA, HM Treasury, JMLSG, and FATF and adjust policies as regulations evolve.

What Is The Digital Securities Sandbox (DSS)?

The Digital Securities Sandbox (DSS) is a UK regulatory framework created by the FCA and the Bank of England to let firms test blockchain-based financial market infrastructure in a controlled environment. It allows temporary modifications to existing rules so companies can experiment with tokenized securities, on-chain trading, clearing, and settlement. The goal is to evaluate how DLT can improve efficiency, transparency, and market resilience. Participants must meet eligibility criteria, manage risks, and operate within set limits while regulators monitor outcomes. Successful models may later shape permanent regulation for digital assets and market infrastructure.

What Tools Help Automate Compliance For UK Crypto Businesses?

UK crypto businesses rely on RegTech tools to automate KYC, AML, Sanctions Screening, Travel Rule Processes, and Case Management. Identity verification platforms streamline onboarding, while blockchain analytics and KYT solutions — such as AMLBot, Chainalysis, or Elliptic, provide real-time risk scoring, wallet tracing, and automated alerts for suspicious activity. Travel Rule providers help firms securely exchange originator/beneficiary data with other VASPs, ensuring FCA-aligned compliance. Sanctions screening engines and automated monitoring tools continuously rescan customers and transactions against updated watchlists. Case management systems organize investigations, escalation, and SAR documentation for the UKFIU. By integrating these tools, including end-to-end AML/KYT platforms like AMLBot, UK crypto companies can reduce manual workload, maintain accurate audit trails, and meet FCA requirements at scale.


Webinar Replay: Crypto Regulation in Turkey 🇹🇷
🎙️ Hosted by AMLBot | August 6, 2025 | 👨‍⚖️ Speaker: Niko Demchuk 🎤 Guests: Salih Demirtaş (GT İnovasyon), Gökhan Polat (Clovera.io) In 2025, Turkey introduced a sweeping regulatory framework for crypto, from strict licensing to AML rules and stablecoin limits. But many questions remain. That’s why we asked Salih Demirtaş and Gokhan
Webinar Replay: Crypto Regulation in Canada 🇨🇦
🎙️ Hosted by AMLBot | September 9, 2025 | 👨‍⚖️ Speaker: Niko Demchuk 🎤 Guest: Issac Ru, Architect of the first regulated Canadian stablecoin, FinTech & Compliance Expert Canada has become one of the most talked-about G7 markets for crypto — not because it copied the EU or US, but because it built its own registration-based system.
Webinar Replay: Compliance Officer in CASP — Who Really Needs One?
🎙️ Hosted by AMLBot | June 18, 2025 | 👨‍⚖️ Speaker: Niko Demchuk Crypto Compliance Isn’t Optional Anymore. Thinking of launching a CASP (Crypto Asset Service Provider)? Whether you’re already working in compliance or just exploring the role, this session is your go-to crash course on what a Compliance Officer (CO) really does
Webinar Replay: The Future of Crypto Licensing in El Salvador | DASP & Bitcoin Law Explained
Launching a crypto business under El Salvador’s groundbreaking regulatory framework? This in-depth webinar explores how the country is positioning itself as a global hub for digital asset innovation — and what companies need to know to stay compliant and competitive. This episode features José Rodriguez, a blockchain lawyer and licensing