Cryptoasset brokers and trading platforms must be able to justify how far they trace the history of a transaction and explain why their monitoring systems raise an alert, under FCA crypto guidance published for consultation on 23 October 2026. The Financial Conduct Authority opened the consultation as part of broader proposed updates to its Financial Crime Guide, with cryptoasset-specific checks timed to land ahead of the new authorisation regime, which is expected to come into force on 25 October 2027.
The draft guidance would clarify the FCA’s supervisory expectations. It does not, according to the FCA, introduce new anti-money-laundering (AML) requirements on top of those already in force.
What the FCA Wants Firms to Change
UK cryptoasset firms are already required to carry out customer checks and monitor transactions for money-laundering risks. The FCA’s concern is with how those obligations are being carried out in practice. A firm may have a formal procedure without adjusting it to reflect what a specific transaction actually shows.
The draft points to a common weakness: a platform tracing the origin of a crypto deposit might stop after a fixed number of hops along the blockchain, even when the information gathered up to that point suggests the trail warrants following further. The FCA treats that as poor practice. There is no universal tracing limit in the proposed guidance; how far a firm follows the funds should be determined by the risks it identifies as the trace progresses.
The same principle applies when a firm uses an external provider to generate transaction-monitoring outputs. A risk score from a third-party tool can help direct attention, but the firm must understand the methodology behind it and be capable of explaining what the provider’s findings mean. The guidance also calls for monitoring tools to be calibrated to a firm’s own risk profile, with the decisions those tools produce properly recorded.
Crucially, alerts cannot sit in isolation. If transaction activity points to a material change in a customer’s profile, the firm is expected to update its due-diligence (know-your-customer) records and reassess the risk, rather than log the alert and move on.
When Standard Monitoring Is Not Enough
The draft sets out circumstances in which routine AML monitoring may be insufficient and enhanced due diligence is warranted. Transfers from unhosted wallets and the use of privacy coins or mixers are listed as features that can raise questions, though the FCA notes they do not by themselves establish wrongdoing.
Firms assessing such transactions are also expected to consider which providers a customer has used, where those providers are based and whether they are regulated. Where a blockchain link to criminal or sanctioned activity is identified, the draft treats enhanced due diligence as required rather than discretionary.
The Travel Rule, which already obliges firms to pass on information about who sent and received cryptoassets, remains relevant here. If those details are absent from a transfer, the firm must seek them from the counterparty and make a risk-based decision should they remain unavailable. Repeated failures by a counterparty to supply the required information must be reported to the FCA.
The final rules for the new regime are set out in Policy Statement PS26/13, published in June 2026, and cover areas including safeguarding, conduct, and prudential requirements. Parliament brought cryptoassets within the FCA’s regulatory remit through The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, made on 4 February 2026, as set out on the FCA’s new regime page.
The consultation on the draft Financial Crime Guide examples, including all the cryptoasset transaction-monitoring proposals, remains open until 24 December 2026. The FCA will review responses before publishing final guidance.
