WhatsApp and Telegram +44 7563 115980
[email protected]
BCC runs compliance for cryptoasset firms supervised by the Financial Conduct Authority (FCA), covering firms registered under the Money Laundering Regulations today and firms moving into the new authorisation regime.
Selected engagements from more than 250 licences obtained since 2013, for payment, e-money and cryptoasset firms.
Volkswagen
Payment InstitutionObtained Nexpay’s FCA Authorised Payment Institution licence.
Electronic Money InstitutionObtained Dzing Finance’s FCA Authorised Electronic Money Institution licence.
Obtained Orbital’s FCA Authorised Payment Institution licence.
The short answer
UK cryptoasset firms are currently registered with the FCA under the Money Laundering Regulations 2017 (MLRs) and must meet anti-money laundering, travel rule and financial promotion rules. A new authorisation regime is expected to start on 25 October 2027, with no automatic conversion of registrations. A crypto compliance consultant tests current controls, fixes gaps and prepares the firm for full FCA authorisation.
Cryptoasset exchange providers and custodian wallet providers operating in the UK must be registered with the FCA under the MLRs. From the expected commencement date of 25 October 2027, the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring cryptoasset activities into the full Financial Services and Markets Act 2000 (FSMA) authorisation regime, with conduct, prudential, custody, operational resilience and market abuse rules.
The FCA has said there will be no automatic conversion: registered firms must be authorised under FSMA. Its application window opened on 30 September 2026 and closes on 28 February 2027. Firms that apply in the window and are still awaiting a decision at commencement can continue under a saving provision. Firms that apply later fall into a transitional provision that only allows them to perform existing contracts, and firms that do not apply must run off their UK business. Compliance work now has to satisfy the MLRs today and build what the authorisation file will be judged on.
Read our guide to UK crypto authorisation under the new regime
Under the MLRs, beneficial owners, officers and managers of a registered cryptoasset business must be approved by the FCA as fit and proper under regulation 58A, and changes must be notified. Under the new regime, authorised cryptoasset firms come within the Senior Managers and Certification Regime (SM&CR), which means named senior managers approved in advance, statements of responsibilities, certification of key staff and the conduct rules.
We map today's officers and managers onto the senior manager functions the firm will need, identify gaps in experience or time commitment, and prepare the individuals for FCA interview. Investors and acquirers face the same change: under the MLRs a new beneficial owner needs FCA approval, and once the firm is authorised under FSMA, change in control rules apply, with the FCA allowed up to 60 working days to assess a complete notification. We prepare both.
Financial crime is the core of crypto supervision. A registered firm needs a written business-wide risk assessment, customer due diligence and enhanced due diligence for higher-risk customers, blockchain analytics to trace the source of funds, sanctions screening and suspicious activity reporting. Regulation 21 of the MLRs requires a nominated officer, the money laundering reporting officer (MLRO).
The travel rule in Part 7A of the MLRs requires originator and beneficiary information to travel with cryptoasset transfers, including the handling of transfers to and from jurisdictions that have not implemented equivalent rules and unhosted wallets. We test onboarding files, wallet screening, alert handling and travel rule exception logs, and produce an MLRO annual report that stands up to scrutiny. Where the firm has no suitable MLRO, we provide one.
Since 8 October 2023, cryptoasset promotions to UK consumers have been within the financial promotion regime. They must be communicated or approved by an authorised person, or communicated by an MLR registered cryptoasset business, and must meet the rules in COBS 4.12A of the Conduct of Business sourcebook, including risk warnings, a 24-hour cooling-off period for first-time investors, client categorisation and appropriateness assessments. Promotions are a frequent cause of FCA intervention, so we review each campaign channel, including social media and affiliates.
Once authorised under FSMA, firms will also be subject to the Consumer Duty in PRIN 2A, which requires good outcomes on products and services, price and value, understanding and support. We write the policy set the new regime will require, including conflicts of interest, client asset handling, complaints and vulnerable customers, so it is in place and tested before the firm applies.
Firms that hold cryptoassets for clients are the most exposed to loss and the most closely examined. Under the new regime, custody will be a regulated activity with client asset protections, and the FCA will expect clear legal segregation, reconciliations, key management controls and records that would allow assets to be returned on insolvency. Today, MLR registered custodians are not subject to those custody rules, but the FCA expects them to be honest with customers about how assets are held.
UK stablecoin issuance is a separate regulated activity under the new regime, and firms using stablecoins for payments must consider whether e-money or payment services rules also apply. We review custody arrangements, wallet structures, reconciliations and terms of business against the target rules, and help firms decide which permissions their model needs.
Read whether stablecoin payments need an EMI, PI or cryptoasset permission
A compliance monitoring programme gives the board and the FCA evidence that controls operate as described. For a crypto firm, testing should focus on onboarding, wallet screening, transaction monitoring, travel rule exceptions, financial promotions, custody reconciliations and complaints, and should be refreshed from the business-wide risk assessment each year.
Registered firms must respond to FCA information requests and notify material changes under the MLRs. Authorised firms will move onto the FCA's regular regulatory reporting and the complaints rules in the Dispute Resolution sourcebook (DISP), including the eight-week deadline for a final response under DISP 1.6.2R and access to the Financial Ombudsman Service. We build the monitoring plan, the reporting calendar and the complaints process now, so the firm is not building them during its first year of authorisation.
The FCA has confirmed that operational resilience rules will apply to cryptoasset firms under the new regime: the SYSC 15A chapter of the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) has a version dated 25 October 2027. Firms will need to identify important business services, set impact tolerances and test them. Crypto firms rely heavily on third parties for custody technology, blockchain analytics, liquidity and banking, so outsourcing oversight, exit plans and incident reporting matter from day one.
There is no capital requirement for MLR registration, but the new regime introduces a prudential regime for cryptoasset firms, with own funds and liquidity requirements set by the FCA. We help firms size their capital and liquidity needs, model wind-down costs and document third-party risk so the authorisation application shows the firm can absorb losses and exit in an orderly way.
Every engagement follows the same four stages, scaled to the size of the cryptoasset firm and the urgency of the issue.
Assessment comes first: we review your permissions, governance, policies, management information and recent FCA correspondence against the rules that apply to you. You then receive written findings, ranked by regulatory risk, with each gap tied to the specific rule it breaches and a named owner for the fix. Remediation follows: we redraft policies and procedures, rebuild monitoring plans, correct returns and prepare board papers, and we can attend FCA meetings alongside your senior managers. Finally, ongoing support keeps the position steady after remediation, through a retained monthly review, an annual compliance monitoring programme or outsourced roles such as an outsourced MLRO or compliance officer.
Buckingham Capital Consulting (BCC) was established in 2013 and has obtained more than 250 licences in over 60 countries for payment, e-money and crypto firms. We open global markets to payment, e-money and crypto businesses: the licences to enter, the banking to operate and the compliance to scale.
For crypto firms moving from registration to authorisation, that means compliance work and the licence application are handled by the same team, so the controls the firm runs today become the evidence its application relies on.
Because BCC also arranges banking for regulated firms, our compliance work is written with the questions banks and safeguarding providers ask in mind. A firm whose controls satisfy the FCA and its bank at the same time spends less time answering the same questions twice. To discuss your firm, use the contact form and tell us your permissions, your current team and the issue you need resolved.
No. The FCA has said there will be no automatic conversion. MLR registered firms must apply for authorisation under FSMA. The application window runs from 30 September 2026 to 28 February 2027, and firms that apply within it can continue operating under a saving provision while a decision is pending.
The FCA expects the new regime to come into force on 25 October 2027. Firms that are not authorised by then and did not apply in the window fall into a transitional provision that only allows existing contracts to be performed.
Not to MLR registered firms, which instead need FCA approval of beneficial owners, officers and managers under regulation 58A of the MLRs. Firms authorised under the new regime will be within SM&CR, with approved senior managers, certification and conduct rules.
A crypto compliance consultant reviews the business-wide risk assessment, customer due diligence, blockchain analytics, travel rule handling, sanctions screening, financial promotions, custody arrangements and governance, then fixes gaps and prepares the firm for FCA authorisation under the new regime.
Only if the promotion is communicated or approved by an authorised person, or communicated by an MLR registered cryptoasset business, and it meets COBS 4.12A. That includes risk warnings, a 24-hour cooling-off period for first-time investors and appropriateness assessments.
Yes. BCC can act as outsourced MLRO for a cryptoasset firm, supported by a risk assessment, a monitoring plan and an annual MLRO report to the board, and can support the transition of that role into the new authorised regime.
Tell us what you need and where you operate.