Chasing their tails? How can regulation keep up with crypto?

The arrival of bitcoin in 2009 heralded the start of the crypto asset phenomenon and since then the market has exploded with new blockchain technologies and decentralised digital currencies. Regulatory authorities in the UK have long agonised over how to regulate products and activities within the crypto assets arena, and whilst the government plays catch-up with the new markets evolving in this area, criminals are using the lack of law and regulation as an opportunity to launder money and 'get rich quick'. In this article, written for Financial Regulation International, Emma Radmore and Lucy Hadrill explore the current regulatory landscape and what the future holds for crypto in the UK.

Are crypto assets regulated in the UK?

Crypto assets are cryptographically secured digital representations of value or contractual rights that use some form of distributed ledger technology (DLT) and can be transferred, stored or traded electronically. Crypto assets are considered to be very high risk, speculative investments and historically activities involving such investments have been unregulated. The speed of the market and technological developments powering crypto has made it hard for regulation to assess what and how to regulate, and to keep up with how to categorise it. Currently whether or not a crypto asset is regulated in the UK broadly depends on its intrinsic structure as well as its designed use.

Regulated crypto assets – these are:

• Security tokens, which have characteristics akin to investments such as shares or debt instruments and are essentially digital versions of these traditional securities, are likely to fall inside the FCA's regulatory perimeter. These tokens are likely to provide rights such as ownership or entitlement to share in future profits and therefore amount to a specified investment under the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001. Security tokens may also be transferable securities or other financial instruments under MiFID II as onshored into UK legislation
• E-money tokens meet the definition of e-money under the Electronic Money Regulations 2011 as being digital payment instruments that store value, can be redeemed at par value at any time and offer holders a direct claim on the issue, and therefore fall within scope of regulation.

Unregulated crypto assets – these are:

• Utility tokens which can be redeemed for access to a specific product or service that is typically provided using a DLT platform
• Exchange tokens which are used as a means of exchange or for investment. These include cryptocurrencies such as Bitcoin, Litecoin etc.

However, whilst certain crypt oassets are outside the FCA's perimeter, some investment products, such as derivatives contracts which reference crypto assets, may fall within scope of regulation. Similarly, arrangements involving crypto assets may constitute collective investment schemes and so may also be caught.

Stable tokens (stablecoins) are designed to stablilse their value by referencing an asset such as a fiat currency. Although these do not usually fall within any regulated category, the Government consulted in January 2021 on the use of these tokens as a payment method and therefore whether to bring in a new category of regulated token – the stable token, and to introduce a proportionate form of regulation for key players. On 4 April, it confirmed that it would be proceeding with its proposals. The exact manner of implementation remains to be finalised, but in principle there will be a new regulated activity, and many of the provisions of the E-Money Regulations will be adapted to apply to in-scope stablecoins and those that conduct regulated activities in relation to them.

Separately, and later this year, there will be further consultation on the regulation of other crypto-assets and activities.

Which crypto businesses have to register with the FCA under the MLRs?

Since 10 January 2020, firms carrying on certain activities involving regulated crypto assets in the UK have needed to comply with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs), including the requirement to register with the FCA for anti-money laundering (AML) and counter-terrorist financing supervision. The FCA has repeatedly warned that carrying on a registrable crypto business in the UK without registration under the MLRs constitutes a criminal offence.

The businesses which are caught by the registration requirement are currently:

• Crypto asset exchange providers, i.e. firms which (i) exchange (or arrange for the exchange of) crypto assets for money or vice versa, or exchange one crypto asset for another or (ii) operate a crypto ATM
• Custodian wallet providers, i.e. firms which safeguard and/or administer (i) crypto assets on behalf of their customers or (ii) private cryptographic keys in order to hold, store or transfer crypto assets.

Crypto firms are also subject to "fit and proper" requirements under the MLRs. Various key individuals must also be assessed (by the FCA) as fit and proper for the role, including officers, managers and beneficial owners (i.e. those who own or control more than 25% of the shares or voting rights) in the business. These individuals will need to pass the “fit and proper person” test before the business can be fully registered or remain registered. Applications must disclose any issues as to why the business or person may not be fit and proper; the FCA treats non-disclosure very seriously.

The registration process

Since 10 January 2021, all existing crypto asset exchange providers and custodian wallet providers had to either be registered with the FCA or must fall within the FCA's Temporary Registrations Regime (TRR) and appear on the FCA's list of firms with temporary registration. The FCA introduced the TRR to allow those crypto asset businesses that were in existence and had applied for registration before 16 December 2020 to carry on business pending the FCA's approval or rejection of their application.

New crypto asset businesses (which began operating after 9 January 2020) have to register with the FCA before beginning to conduct business. Any firm which had not registered under the TRR or which begins crypto asset activities without registration risks FCA enforcement action.

Applicants must complete an online application form in which the FCA will request information about the applicant and key individuals in the business. The information the FCA requires includes the firm's:

• Programme of operations
• Business plan
• Marketing plan
• Structural organisation
• Systems and controls
• Individuals, beneficial owners, and close links
• Governance arrangement and internal control mechanisms
• AML/counter terrorist finance framework and risk assessment
• Business-wide risk assessment, and
• All cryptoa sset public keys/wallet addresses.

It is likely that the FCA will request additional information after an application has been submitted in order to make its assessment. It will also undertake a fit and proper assessment as described above. FCA's assessments are detailed and thorough. While it has to determine a completed application within 3 months, it has been finding it needs to ask for significant additional information from firms, which is delaying the start of that timescale.

Registration fees are payable depending on the UK crypto asset income of the business. For businesses with a UK crypto asset income of up to £250,000, a fee of £2,000 will be charged, whilst for businesses with UK crypto asset income greater than £250,000, a fee of £10,000 will be charged.

Why are applications failing?

According to the FCA, more than 80% of the firms it has assessed to date have either been rejected or firms have withdrawn their applications as they were not meeting the required AML standards. Firms that do not provide any additional information FCA requests are also being turned down.

One area that has received the FCA's attention is crypto ATMs. Crypto ATMs allow users to deposit cash in exchange for cryptocurrency which is transferred to a digital wallet. The FCA had previously raised concerns that the ATMs could be used for money laundering as they require minimal background checks and this issue was considered in a recent case in the Upper Tribunal. In this case, FCA refused to register Gidiplus Limited, a bitcoin ATM operator which had been registered under the TRR. The FCA was not satisfied about the firm's AML systems and controls, particularly in respect of its risk assessments, customer due diligence and transaction monitoring. It argued that due to weak identity checks for small transactions (less than £250), money launderers could use multiple "mules" to make small transactions in order to avoid getting noticed by authorities. It also expressed significant concerns about the individual who was the firm's director, majority shareholder and was to be responsible for AML compliance. It transpired that the individual did not know what the commonly used term "smurfing" meant, and also that he had misled three banks as to the nature of the firm's business, on the basis that he thought the banks would not do business with a crypto firm. Gidiplus appealed to the Upper Tribunal wanting both to dispute the decision and apply for suspension of its effect until there was a ruling on the refusal decision. The Tribunal refused to apply the suspension, as the firm had not put forward any jusitifcation for how it would act compliantly pending the review of the refusal, nor did it seem to understand any of FCA's original objections.

FCA powers

The FCA has not been afraid to bare its enforcement teeth in this area and has recently warned operators of crypto ATMs to shut down their machines or risk facing enforcement action. As noted above, any firm operating a crypto ATM in the UK must be registered under the MLRs, however as at 14 March 2022, none of the crypto asset firms registered with the FCA had been approved to offer crypto ATM services. As such, all crypto ATMs in the UK – of which there are approximately 80 – are illegal, and consumers should refrain from using them.

FCA has also issued a number of statements about changes in control of crypto firms. Although as noted above FCA will assess the fitness and properness of beneficial owners on application for registration, it does not have the power to pre-approve changes in control as it does for firms it regulates under FSMA. However, once it is aware of a new beneficial owner, it can then take action to suspend or cancel a crypto-business' registration if it is not satisfied that new owner is fit and proper. 

More recently, there has been a broader crackdown on cryptocurrency providers as western sanctions on Russia start to bite. In a joint statement issued on 11 March 2022, OFSI, the FCA and the BoE reminded financial institutions and registered crypto asset firms of their obligations to ensure customers do not try to circumvent the sanctions and that crypto asset firms must take steps to ensure they are compliant with their legal obligations in relation to sanctions. The key message from the regulators here is that financial sanctions regulations do not differentiate between crypto assets and other forms of assets and the FCA has again warned that it will act if it sees authorised firms supporting crypto firms that are operating illegally.

The FCA has also released a list of screening controls and red flag indicators that would suggest an increased risk of sanctions evasion. These include:

• A customer who is resident in or conducting transactions to or from a jurisdiction which is subject to sanctions, or which is on the UK’s High Risk Third Countries list for anti-money laundering and counter-terrorist financing purposes, or any jurisdiction identified as posing an increased risk of illicit financial activity

• Transactions to or from a wallet address associated with a sanctioned entity, or a wallet address otherwise deemed to be high-risk, based on its transaction history or that of associated addresses

• Transactions involving a crypto asset exchange or custodian wallet provider known to have poor CDD procedures or which is otherwise deemed high-risk

• The use of tools designed to obfuscate the location of the customer (e.g. an IP address associated with a virtual private network or proxy) or the source of crypto assets (e.g. mixers and tumblers), or

• Other red flag indicators that are normally associated with money laundering more broadly. In both situations, the aim of the illicit actor is to make an illegal transaction seem legitimate.

What does the future hold?

While the UK waits for the government to intervene on fully regulating the sector, the regulators have had to step in. From 31 March this year, all firms operating crypto services in the UK must be registered with the FCA. For firms which had temporary registrations, the FCA has concluded its assessments and the TRR duly closed on 1 April. However, the FCA has kept the TRR open for a small number of firms where it considers it strictly necessary to allow them to continue operating under their temporary registrations. The relevant firms may be pursuing an appeal or may have particular wind-down circumstances, for example. It has a public list of unregistered crypto businesses, and a list of firms still under the TRR, so that any consumer wishing to deal with a crypto business and not finding it on the main FS Register can check its status. As of 31 March 2022, only 6 firms remained on the TRR.

Firms looking to enter the arena should therefore ensure they do not begin operating until they are registered under the MLRs and should ensure that they have robust AML systems and controls in place before applying to the FCA.

Despite taking these initial steps, regulation of the crypto asset market remains uncertain and the FCA and the BoE have continued to issue numerous warnings to consumers over the last few months in respect of investments into crypto assets. The FCA has repeatedly highlighted the risks that such investment "generally involves taking very high risks with investors' money. If consumers invest in these types of product, they should be prepared to lose all their money." However, many consumers seem undeterred by these warnings and in fact crypto investments, in particular those seemingly backed by celebrities and other social media influencers, have increased. Worryingly, this upwards trend is appearing alongside research showing a decrease in consumer understanding of crypto assets and what it being purchased.

No matter your opinion over the crypto asset craze, it is clear that it has the potential to completely disrupt monetary policy across the globe. With hundreds of new tokens offered each month, it seems as though the effort to regulate cryptocurrencies and other crypto assets may remain a game of cat and mouse for some time. However, despite the current uncertainty, all players active in the crypto market should anticipate a tightening of regulation in the months and years to come.