U.K. FCA Draft Flags Rigid Crypto Tracing Limits Without Risk Measures

The U.K. Financial Conduct Authority (FCA) proposed risk-based crypto tracing guidance, calling rigid limits on blockchain transfers poor practice when firms lack measures suited to identified risks.

The FCA opened a consultation Oct. 23 proposing changes to its Financial Crime Guide. The guide spans seven subjects: fraud, cryptoasset risks, sanctions, preventing proliferation financing, data security, systems and controls for financial crime, and efforts against money laundering and terrorist financing. The FCA said the guide “does not contain rules nor impose any new requirements.”

The draft addresses how far firms trace a blockchain transaction by counting transfers in its path, or “hops.” It sets no universal hop count or threshold for when tracing should end. The proposal criticizes a fixed cutoff when a firm has not put measures in place that match the risks it identified.

Firms using outside monitoring technology should be able to explain and support the basis for the tools’ findings or scores. They should calibrate the tools to identified risks, document their decisions and update customer due diligence when monitoring shows a material change in a customer’s profile.

The proposed guidance also tells firms to consider enhanced due diligence, as appropriate, when customers or transactions involve unhosted wallets or privacy-enhancing measures such as mixers, tumblers and privacy-enhancing coins. It also identifies blockchain-analysis findings that indicate exposure to criminal or sanctioned activity as a reason to consider enhanced checks.

The draft restates Travel Rule expectations. Firms should collect, verify and transmit originator and beneficiary information. If details are missing, they should request them from counterparties, make a risk-based decision if information remains unavailable and report persistent failures to comply to the FCA. U.K. cryptoasset businesses have been required to follow the rule since Sept. 1, 2023.

Separately, the FCA authorization regime for certain cryptoasset activities is scheduled to begin Oct. 25, 2027. Some firms entering the regime will also remain subject to the Money Laundering Regulations and other financial-crime laws.

The FCA plans to publish the final guide after reviewing the comments. Comments are due Dec. 24.