Platforms · Software · Providers · Markets
Risk should set tracing depth
The UK Financial Conduct Authority (FCA) has opened a consultation on changes to its Financial Crime Guide, proposing that crypto firms match transaction monitoring and tracing to the risks they identify. The guidance is intended to clarify supervisory expectations before the cryptoasset authorisation regime begins on 25 October 2027. It would not add anti-money laundering (AML) requirements.
Existing UK rules require cryptoasset firms to assess customers and scrutinise their transactions for money-laundering concerns. The draft focuses on whether firms respond to the information a transaction reveals, rather than simply following a procedure.
For example, a firm tracing a crypto deposit should not stop at a preset number of transfers if what it has found suggests further investigation. The FCA sets no standard tracing ceiling: the extent of the review should reflect the risks found.
Connect alerts to customer checks
The same expectations apply when a firm relies on an external monitoring provider. A risk score may help prioritise cases, but the firm should understand its basis and explain the provider's result. It should also tune its tools to its own risks and retain records of decisions. Monitoring results should be checked against existing customer information. If activity materially changes the firm's view of a customer, it should update due diligence records and reassess risk, rather than leave the alert separate.
The FCA names transfers involving unhosted wallets, privacy coins or mixers as circumstances that may call for enhanced due diligence, not proof of wrongdoing. Firms should also consider the providers used by a customer, their location and whether they are regulated. A connection on a blockchain to criminal or sanctioned activity is among the cases the draft says warrant enhanced due diligence. The Travel Rule requires firms to obtain missing information about the sender and recipient from the counterparty, then make a risk-based decision if it is not provided.
Repeated failures to supply the information must be reported to the FCA. The proposed examples, first reported by Finance Magnates, are open for comment until 24 December 2026.
| Figure | What it refers to |
|---|---|
| 23 October 2026 | The FCA opened the consultation. |
| 25 October 2027 | The cryptoasset authorisation regime is due to begin. |
| 24 December 2026 | Deadline for comments on the proposed examples. |
What to watch next
Operators can check whether provider scores, customer due diligence records and monitoring decisions can be considered together. Can staff see what drove a score, change the tracing depth when new information emerges, and retain the reasoning behind decisions? Teams can also check whether alerts that alter a customer's risk assessment lead to updated due diligence, rather than remaining isolated in a monitoring queue.
Firms should consider how operations teams request missing sender and recipient details, record what the counterparty returns and handle repeated failures to provide the required information. Who is responsible for deciding when a transfer needs further tracing, and can that decision be explained from the records? The consultation leaves room for firms to assess how much integration and review work their current processes would need to support these steps.
