A crypto company’s AML framework must explain how the business identifies financial crime risk, makes customer and transaction decisions, investigates concerns and records its actions.
An AML manual alone cannot demonstrate that these arrangements work. Application preparation should connect the legal requirements to procedures, systems, responsible people and evidence.
The FCA’s published MLR registration guidance expressly expects policies supported by operational procedures, tailored tools and evidence of control effectiveness. These expectations concern MLR registration and should be read alongside the requirements applicable to any FSMA authorisation application. FCA
For management, the practical question is:
Can we show what happens when a financial crime risk arises, who decides the response and how the decision is evidenced?
1. Establish the Applicable Legal Framework
Begin with a documented assessment of the applicant’s activities and obligations.
Relevant sources include the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, applicable proceeds-of-crime and terrorist-financing legislation, sanctions requirements and relevant FCA rules.
The expanded crypto framework also addresses financial crime requirements in PS26/13, Chapter 9. FSMA preparation should therefore assess the applicable Handbook requirements alongside the firm’s MLR obligations. fca.org.uk
Distinguish:
- Current operations and obligations.
- Proposed authorised activities.
- Future products.
- Responsibilities of other group entities.
- Controls performed by external providers.
This creates a reliable foundation for the AML framework and prevents documents describing a business different from the one being proposed.
2. Build a Business-Specific Risk Assessment
The business-wide risk assessment should explain the financial crime exposure created by the applicant’s services.
For practical preparation, examine:
- Customer types and ownership structures.
- Products and transaction features.
- Countries and cross-border relationships.
- Onboarding and delivery channels.
- Fiat and cryptoasset flows.
- Providers and counterparties.
- Wallet and withdrawal arrangements.
Assess proliferation financing expressly. Regulation 18A(1) requires relevant persons to identify and assess their business’s proliferation financing risks; regulation 19A addresses corresponding policies, controls and procedures. legislation.gov.uk
A useful assessment distinguishes the risk itself from a control weakness.
For example, exposure to transactions associated with illicit activity is a risk. An unreviewed alert backlog is a weakness in the arrangements intended to manage it.
Record the methodology, supporting information and conclusions so the assessment can be reviewed and updated consistently.
3. Connect Customer Risk to Actual Decisions
A customer risk assessment should influence the treatment of the customer.
For internal design, identify how the outcome affects:
- Information requested.
- Verification.
- Approval authority.
- Monitoring.
- Review frequency.
- Restrictions or escalation.
Under regulation 33, enhanced customer due diligence and enhanced ongoing monitoring apply in specified circumstances, in addition to the relevant ordinary due diligence requirements. A numerical score should not override a mandatory legal trigger. legislation.gov.uk
Test the methodology with representative customer profiles.
For each case, ask whether the outcome is understandable, whether it leads to the intended action and whether staff can explain any override.
4. Turn Due Diligence Policies Into Staff Instructions
A practical procedure should tell staff what to do when information is complete, incomplete or inconsistent.
For example, specify:
- Which evidence is accepted.
- Who reviews discrepancies.
- How ownership structures are examined.
- When additional enquiries are required.
- Who approves exceptional cases.
- Where supporting records are stored.
Consider a customer who attributes crypto holdings to trading profits but cannot provide a complete platform history. A useful process identifies the enquiries and corroborating evidence needed, the unresolved gaps and the person authorised to decide the outcome.
Source of funds and source of wealth serve different purposes. Where enquiries are required, distinguish the origin of the relevant funds from the wider explanation of accumulated wealth.
Avoid treating wallet ownership, a blockchain history or an account at another provider as conclusive proof of lawful origin.
5. Configure Tools Around the Business
The FCA’s MLR guidance expects applicants to explain the selected tools, their configuration and how they address the business’s risks. For transaction monitoring, it discusses both fiat and on-chain monitoring, including rules and thresholds. It also makes clear that the FCA does not endorse particular AML tools. FCA
For implementation, document:
- Data entering each tool.
- Coverage and limitations.
- Configuration decisions.
- Alert routing.
- Access permissions.
- Manual controls.
- Testing and change approval.
A supplier demonstration is useful background. The applicant should also understand how its own configuration behaves with its products, customers and transaction data.
Record whether the system is selected, configured, tested or operating. Those stages should be accurately reflected in application answers.
6. Define the Alert Investigation Process
An alert needs a documented route from initial review to closure or escalation.
A suggested investigation record includes:
| Record field | Purpose |
| Alert and transaction details | Identify what triggered the review |
| Customer context | Compare activity with known circumstances |
| Enquiries performed | Explain the investigation |
| Evidence reviewed | Support the conclusion |
| Decision and rationale | Record why action was taken |
| Reviewer and approval | Establish accountability |
| Follow-up | Track further monitoring or remediation |
Define how urgent cases and overdue alerts are handled.
For quality assurance, review a sample of decisions. The objective is to assess whether investigations are sufficiently reasoned and supported, rather than simply count closed alerts.
7. Integrate the Travel Rule Into Transfers
The UK cryptoasset Travel Rule has applied since 1 September 2023. The FCA explains expectations concerning collection, verification and sharing of transfer information, including transfers involving jurisdictions that have not implemented the rule. Firms remain responsible when using third-party suppliers. FCA
For practical implementation, determine:
- How counterparty information is obtained.
- How missing information is handled.
- When transfers require further review.
- Who decides whether assets may be made available.
- How provider failures are managed.
- Where transfer information and decisions are retained.
Assess relevant unhosted-wallet arrangements against the applicable provisions. Do not assume every transfer follows the same information-sharing process.
Test the procedure with incomplete data and provider outages, as well as straightforward transfers.
8. Keep Suspicious Activity and Sanctions Decisions Clear
Procedures should distinguish internal escalation, external reporting and decisions about proposed transactions.
The NCA explains that a Defence Against Money Laundering request concerns specified activity and does not establish that funds are legitimate. It also confirms that a DAML does not remove the need for an OFSI licence where one is required for sanctioned assets. Understanding DAMLs and DAFTs
A practical framework should identify:
- Who receives internal reports.
- Who assesses reporting obligations.
- Who considers any defence request.
- How sanctions concerns are escalated.
- How customer communications are controlled.
- Where legal advice and decisions are recorded.
Train staff to refer concerns through the approved process. Customer-facing teams need clear guidance on communications and confidentiality.
9. Give the MLRO Capacity and Information
The financial crime framework should explain how the MLRO obtains information and exercises authority.
For internal assessment, consider:
- Access to customer and transaction records.
- Reporting lines.
- Staffing support.
- Other commitments.
- Escalation to management.
- Cover during absence.
- Training and competence.
Practise realistic cases with the MLRO and relevant staff. Identify where the procedure is unclear, where information is unavailable and where authority needs clarification.
Those findings should lead to improvements in the underlying arrangements.
10. Test Controls Before Describing Them as Effective
Pre-launch testing can provide useful evidence without live customer activity.
Suggested scenarios include:
- An inconsistent customer profile.
- Missing ownership information.
- A potential sanctions match.
- Activity exceeding expected behaviour.
- A monitoring rule failing to trigger.
- Missing Travel Rule information.
- A provider outage.
- An overdue investigation.
For each test, record the expected result, actual result, deficiency, owner and retest outcome.
Label simulated records clearly. Application evidence should distinguish testing from live operational experience.
Testing should also examine whether staff understand the procedure. A system generating an alert does not establish that the investigation and escalation process works.
11. Prepare an AML Evidence Pack
A useful pack connects the framework to implementation.
| Evidence | What it helps demonstrate |
| Risk assessments | Understanding of the applicant’s exposure |
| Policies and procedures | Approved decisions and staff instructions |
| Tool configuration records | How systems support the controls |
| Testing reports | Observed performance and deficiencies |
| Investigation examples | Quality of review and decision-making |
| Training records | Preparation of relevant personnel |
| Provider arrangements | Services, oversight and dependencies |
| Management reporting | Visibility of risks and weaknesses |
| Remediation log | Ownership and resolution of findings |
Check consistency across the business plan, customer journey, procedures and systems.
If a document describes a control that is still being developed, explain its status and dependencies accurately.
How CRYPTOVERSE Can Support Your AML Preparation
CRYPTOVERSE is a specialist legal and regulatory firm for UK FCA cryptoasset authorisation support.
We can help assess financial crime requirements, review risk assessments, prepare policies and procedures, identify implementation gaps and organise supporting application evidence.
Our approach connects legal requirements with the applicant’s services, transaction flows and management responsibilities.
Contact CRYPTOVERSE to discuss your UK crypto AML framework and application readiness.
FAQs
1. What are the FCA crypto AML requirements?
FCA crypto AML requirements involve assessing financial crime risks and establishing appropriate controls for customer due diligence, transaction monitoring, suspicious activity escalation, sanctions compliance and recordkeeping, according to the obligations applicable to the business.
2. Is an AML policy enough for FCA crypto authorisation?
No. An AML policy is only one component of the framework. Firms should also demonstrate practical procedures, defined responsibilities, appropriate monitoring tools, staff training, testing and supporting evidence.
3. What is a cryptoasset transaction monitoring system?
A cryptoasset transaction monitoring system helps identify unusual or potentially suspicious activity involving cryptoasset transactions. Depending on the business model, monitoring may include on-chain transactions, customer behaviour, fiat payments and risk-based alerts requiring investigation.
4. What is the Travel Rule for UK crypto businesses?
The Travel Rule requires relevant cryptoasset businesses to collect, verify and share specified originator and beneficiary information for qualifying cryptoasset transfers, in accordance with applicable requirements. Firms should establish procedures for missing information, exceptions and third-party provider failures.
5. How can a crypto business demonstrate AML compliance to the FCA?
A crypto business can prepare evidence such as business-wide risk assessments, AML policies, customer due diligence procedures, monitoring configurations, alert investigation records, staff training records, testing reports and remediation logs. The evidence should accurately reflect the controls implemented and any outstanding gaps.