FCA Financial Crime Guide rewrite targets crypto tracing gaps
Britain's markets regulator wants crypto firms to trace funds as far as the risk demands, explain what their analytics tools flag and chase missing Travel Rule data, a year before its new licensing regime starts.
The FCA Financial Crime Guide is being rewritten with crypto firms squarely in mind. Britain's Financial Conduct Authority opened a consultation on Friday, Oct. 23, proposing updates that tell crypto businesses how far to trace transactions, how to use blockchain analytics and what to do when Travel Rule information is missing. Comments are due by Dec. 24, 2026.
What happened
The regulator said the changes are meant to keep the guide in step with emerging risks, "such as those linked to AI, cryptoassets and evolving sanctions regimes." The paper, CP26/38, applies to every firm the FCA supervises for financial crime, including those registered under the Money Laundering Regulations. The guide spans seven subjects, from fraud, sanctions and data security to proliferation financing, money laundering and terrorist financing, with a dedicated section on cryptoasset risks, TokenPost noted.
On tracing, the draft sets no universal number of "hops," or transfers, that a firm must follow back through a blockchain. Instead, stopping at a preset cutoff when the findings so far call for a deeper look is described as poor practice, Finance Magnates reported. How far a firm follows the money should depend on the risks it has identified.
Firms that rely on outside monitoring vendors should be able to explain and justify the scores those tools produce, calibrate them to their own risk assessments and document decisions, according to TokenPost. Customers using unhosted wallets, mixers, tumblers or privacy coins may warrant enhanced due diligence, as may any blockchain link to criminal or sanctioned activity. When monitoring shows a material change in a customer's profile, firms are expected to update their due diligence rather than rely on the checks made at onboarding.
Why it matters
The guidance "does not contain rules nor impose any new requirements," the FCA said, but supervisors use it to judge whether controls are adequate. In practice, that shifts the test from having a policy to proving it works in individual cases, a point the regulator makes repeatedly in the draft.
The Travel Rule section restates existing duties. Firms must collect, verify and pass on originator and beneficiary details; if information is missing, they should ask the counterparty, make a risk-based decision if it never arrives and report persistent failures to the FCA. U.K. crypto firms have been bound by the rule since Sept. 1, 2023.
Timing matters. The FCA's authorization regime for crypto activities is due to begin on Oct. 25, 2027, and the updated FCA Financial Crime Guide will be part of the yardstick for applicants. We covered the authorization gateway when it opened, and Europe is moving in a similar direction, as shown by France's push on DeFi liability.
What's next
After the consultation closes, the FCA will publish feedback and the final text in a policy statement. It also proposes to issue some future guidance on its own, without consultation where none is required, and fold it into the guide later.
For exchanges and brokers, the immediate task is to check whether their tracing and screening rules can be defended case by case. The full CP26/38 consultation sets out the proposed FCA Financial Crime Guide text and how to respond.
This article is for information only and is not investment advice.