FCA Proposes Risk-Based Crypto Transaction Tracing Guidance

FCA crypto guidance proposed by the UK Financial Conduct Authority states that cryptoasset firms should be able to explain why their monitoring systems flag a transaction and how far they trace its history, with the depth of tracing driven by identified risk rather than a fixed limit.

The FCA opened a consultation on 23 October on broader updates to its Financial Crime Guide, including cryptoasset checks ahead of the authorisation regime starting on 25 October 2027. The regulator said the guide would clarify supervisory expectations rather than introduce new anti-money-laundering requirements.

FCA crypto guidance: Monitoring tools and provider findings

UK cryptoasset firms are already required to check customers and monitor transactions for money-laundering risks. The draft focuses on weaknesses in how those checks are carried out, including cases where a firm has a procedure in place but does not adapt it to what a particular transaction reveals.

The FCA gives the example of a platform tracing the origin of a crypto deposit that stops after a preset number of transfers even when the information found so far calls for a closer look. It treats that as poor practice and sets no universal tracing limit; how far a firm follows the funds should depend on the risks it identifies. The same principle applies when a firm uses an outside provider to monitor transactions.

A risk score can help direct attention, but the firm must understand what lies behind it and be able to explain the provider's findings, according to the draft. The guidance also points to adjusting monitoring tools to the firm's own risks and keeping a record of the decisions they produce.

Those findings should be compared with what the firm already knows about the customer. If transaction activity reveals a material change in the customer's profile, the firm should update its due diligence information and reassess the risk rather than leave the alert isolated in a monitoring system.

When enhanced due diligence may be warranted

Firms also need to decide when routine AML monitoring is not enough. The FCA points to transfers from unhosted wallets and the use of privacy coins or mixers as circumstances that may warrant enhanced due diligence. These features can raise questions about a transaction but do not by themselves establish wrongdoing. To assess the risk, a firm should also consider which providers the customer has used, where they operate and whether they are regulated.

The draft lists a blockchain link to criminal or sanctioned activity among the situations requiring enhanced due diligence.

Firms also need basic information about who sent and received the assets. If those details are missing from a transfer, the existing Travel Rule calls for the firm to request them from the counterparty and make a risk-based decision if they remain unavailable. Repeated failures to provide the required information must be reported to the FCA.

The examples remain open for comment until 24 December 2026. The FCA will consider the responses before publishing the final guidance.