Crypto Businesses in the UK: An Overview
If a company wants to do Crypto business in the UK, it needs to get itself registered with the Financial Conduct Authority (FCA) for the purpose of cryptoasset registration or AML/CTF crypto registration. All the Crypto businesses that have started their operations from 10th January 2020 onwards are required to get themselves registered under the FCA AML/CTFcryptoasset registration regime.
FCA is the body that has been established under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 as a new counter-terrorist financial and anti-money laundering supervisor of the crypto-based businesses in the UK. If you want to set up a crypto-based business in the UK, you need to register yourself with the FCA AML/CTF cryptoasset registration regime.
Regulation of Crypto Businesses in the UK
The Crypto business in the UK is regulated by the FCA on the basis of the risk-based approach, i.e. the businesses that pose the maximum risk of money laundering and terrorist financing undergo far more detailed scrutiny both at the time of registration and for the ongoing supervision compared to simpler and safer businesses. A similar approach is adopted by the FCA while taking enforcement actions when a misconduct or breach has taken place.
The FCA assesses your business and expects you to demonstrate that you have adequate and required policies and procedural documents along with other internal controls to properly manage the risks of money laundering and terrorist financing. As a business, you need to be aware of the potential risks and mitigation measures related to your business to effectively reduce the risks of terrorist financing and money laundering.
As a company also, you are required to adopt a risk-based approach to your business according to the size, nature and complexity of your business. For example, if your company is offering multiple payment services and cryptoasset services, then the risk-based approach will be higher compared to a situation where your company is offering a single regulated service.
Test to determine which Crypto businesses in the UK need to register under the Cryptoasset registration regime
The FCA considers the application of the money laundering regulations on the crypto businesses on a case-by-case basis which differs from one business to another. Generally, crypto businesses that have a physical presence in the UK through which they conduct their cryptoasset businesses are subjected to these regulations. However, having a physical presence is not the only factor to be considered. There are other factors too that cumulatively decide whether the cryptoasset business needs to follow the regulations or not. One example where the cryptoasset regulations will be applicable would be the case where a cryptoasset exchange provider has an ATM located in the UK, irrespective of the jurisdiction where the operator is located or where its offices are based.
The following test you should apply to your cryptoasset business in order to determine whether your business falls within the ambit of the Money Laundering regulations or not:
- Check the activities undertaken by the Crypto business
The first thing you need to determine is whether your business is involved in exchanges, arrangements in pursuance of exchanging cryptoassets for money or vice versa or one cryptoasset for another cryptoasset.
You should also check whether your business uses automated processes for exchanging money for cyptoassets or vice versa. For example, an ATM.
Another thing to be considered is whether your business offers custodian wallet services to the customers to safeguardcryptoassetson behalf of your customers or provides private cryptographic keys for holding, storing and transferring cryptoasset.
- Check whether such activities are being carried out as a ‘business activity’
If the answer to the above-mentioned activities comes in the affirmative, then the second thing you need to check is whether the cryptoasset activity is being carried on in the form of ‘business activity’ in the UK or not. Some of the other factors to find out whether a cryptoasset activity is a business activity in the UK or not are as follows:
- Commercial element: if you advertise or act in a way to suggest that you are offering cryptoasset services by way of a business.
- Commercial benefit: if you are deriving any direct or indirect benefit from this service or not.
- Relevance with other businesses: whether the cryptoasset activity is a significant part of the total business activities undertaken by your firm or not
- Regularity: whether the frequency of the transactions suggests that the activities are being carried on as a business activity or not
If the answer to the abovementioned factors comes in the affirmative, then you need to get your business registered under the FCA cryptoasset registration regime before carrying on any further activity.
On the other hand, if the answer to the above-mentioned factors comes in negative, then your cryptoassets activities will not be required to be registered under the regime. However, you may be called upon by the FCA to explain why your activities do not fall within the scope of the abovementioned factors.
Compliance Requirements for Crypto businesses in the UK
- Identifying Risks related to your business: all Cryptoasset businesses need to identify the terrorist financing and money laundering risks associated with their business activities.
- Identifying Risks related to new technologies: you also need to assess the terrorist financing and money laundering risks associated with new technologies.
- Have mitigating controls: You are required to embed appropriate policies, systems and controls to mitigate the terrorist financing and money laundering risks.
- Appointing a chief Anti-Money Laundering Officer: Depending on the nature and size of your business, you are also required to appoint a board member or a senior management team to supervise the overall compliance of the money laundering regulations in your business.
- Independent internal audit function: wherever appropriate, depending on the size and nature of your business, you should establish an independent internal audit function.
- Screening of employees: you should pre-screen employees before employing them in such businesses
- Due Diligence: You should always prioritise conducting customer due diligence before embarking on a business transaction or a business relationship.
- Enhanced due diligence measures: wherever applicable, apply the enhanced due diligence measures in cases where a customer presents a higher terrorism financing/ money laundering risk. Higher risk is presented by a person as a politically exposed person.
- Ongoing Monitoring: you should continue ongoing monitoring of all the customers.
Information to be furnished to FCA about the Business
The following information needs to be furnished to the FCA for the registration of your crypto businesses in the UK:
- Business Plan -
The business plan sets out the business objectives, governance, plans, employees, customers, and projections of the business. Enough details have to be provided in the business plan showing that you have thoroughly thought through the proposal and the adequacy of financial and non-financial resources required in the business. The details related to the volume of transactions, types and number of clients, pricing of the product and the main lines of income and expenses.
- Programme of Operations -
The programme of operations should clearly demarcate the specific cryptoasset activities that the business will be undertaking.
- Structural Organisation -
You have to describe the structure and organisation of your business.A description of the relevant outsourcing arrangements has to be provided too.
- Marketing Plan -
In the marketing plan, you need to provide a description of the distribution channels and targeted customers.
- Details of the individuals, beneficial owners and close links -
The directors that are responsible for running the company must satisfy the regulators that they have a good reputation and the requisite knowledge and relevant experience to run the affairs of the crypto business properly. The businesses have to appoint a person who will be responsible for compliance with money laundering regulations, monitoring and managing compliance related to money laundering and terrorist financing and also act as a nominated officer under the Proceeds of Crimes Act 2002.
The person appointed to carry out these functions can be the same person also. However, the company has to satisfy FCA that such a person has the training, knowledge and experience along with sufficient autonomy as well as access to information and resources to carry out the above functions independently.
- Systems and Controls -
The business needs to apprise the regulator about the key IT systems used to run the operations and the details of security policies and procedures.
- AML/CTF framework and Risk Assessment -
The business also needs to highlight the risks specific to its business activities as well as the mitigation strategies for such risks. The training material used for training staff against Anti-Money Laundering and Countering Terrorist Finance risks should also be included.
- Internal Control mechanisms and governance arrangements -
The registration process for crypto businesses in the UK requires furnishing the details of the governance arrangements and internal control mechanisms implemented in the system to identify and deal with the risks associated with the financing of terrorism and money laundering.
- All the wallet addresses/ cryptoasset public keys -
The business is also required to submit the details of the cryptoasset addresses held by the business and used in the day-to-day activities of the business.
Apart from the above, some other submissions that are required by businesses to furnish to the regulator are as follows
- Customer due diligence and procedures –
Apart from the basic due diligence procedure, businesses also need to submit enhanced due diligence procedures to meet the minimum standards set out in the regulations.
- Beneficial owner forms for the shareholders
- Business continuity plan
- Money laundering reporting forms for all the key persons of the company, such as the directors, officers and executives etc.
- Budget requirements and financials for the first 3 years of the business
- Service license agreements and outsourcing arrangements policies
- Recording procedures and record-keeping
- Transaction monitoring procedures
- Customer onboarding agreements and processes
- Business-wide risk assessment, mitigation and monitoring policy
Registration fee for Crypto Businesses in the UK
The registration fees for the registration of FCA Cryptoasset registration are as follows:
- £ 2000 for those businesses where the cryptoasset income is not more than £ 250,000.
- £ 10,000 for those businesses where the cryptoasset income is beyond £ 250,000
Enterslice is a global Consulting firm offering its Crypto business advisory services across the globe.