Platforms · Software · Providers · Markets
The FCA opened a consultation on 23 October 2026 proposing changes to its Financial Crime Guide, including guidance for cryptoasset firms ahead of the authorisation regime due to start on 25 October 2027. The proposals set out how the regulator expects firms to apply existing controls; the FCA says they do not create new AML requirements.
Monitoring must follow identified risk
For firms monitoring deposits, the draft puts the emphasis on being able to justify both an alert and the depth of a transaction trace. A preset transfer count should not end an investigation if what the firm has found warrants further checks. The FCA does not prescribe a standard tracing distance.
The same expectation applies when an external provider supplies monitoring or risk scores. Firms should understand the basis for a score, be able to account for the provider's conclusions, tailor tools to their own exposure and retain records of decisions. An alert should also be assessed against the customer information the firm already holds.
If activity points to a significant shift in a customer's profile, the draft expects firms to refresh due diligence records and reconsider the customer's risk. It cautions against leaving that signal as an alert with no corresponding review of the customer file.
Transfers can trigger enhanced checks
The draft identifies transfers involving unhosted wallets, privacy coins or mixers as cases that may call for enhanced due diligence, while making clear that these features alone do not prove misconduct. Firms should weigh the services a customer has used, their operating locations and whether they are regulated. A blockchain connection to criminal or sanctioned activity is among the cases the FCA says requires enhanced checks.
The guidance also addresses incomplete sender or recipient details. Under the existing Travel Rule, a firm should seek missing information from its counterparty and decide how to proceed based on the risk if it does not arrive.
Repeated non-provision of required details must be reported to the FCA. The draft's treatment of monitoring decisions was also reported by Finance Magnates.
Comments on the proposals can be submitted until 24 December 2026. The FCA will review responses before issuing final guidance.
The integration question
For technology and operations teams, the practical test is whether a monitoring alert can be connected to the evidence and customer records that explain the decision. Can staff see why a trace stopped, what a provider's score relied on and whether later findings changed the customer's due diligence or risk assessment?
Firms should also check how missing Travel Rule details are captured, followed up with counterparties and considered in a risk-based decision. The draft does not set a single tracing threshold, so operators will need to establish how their systems record the reasons for taking a trace further or ending it.
