Operating a crypto exchange in the United Kingdom without the right registration exposes the business to enforcement action, frozen banking relationships and personal liability for directors. The FCA (Financial Conduct Authority) is the competent authority for cryptoasset businesses in Great Britain, and its regime under the Money Laundering Regulations (MLR) is the primary legal gate an inbound operator must clear before trading with UK clients. A second, parallel obligation – the financial-promotion rules – constrains how any exchange communicates with retail audiences, regardless of where the entity is incorporated.
This page sets out the regulated basis, the registration process, the cross-border considerations that operators most often underestimate, and the decision points that determine whether a UK entity, a branch or a passporting arrangement best fits the business model. We advise businesses at every stage of this path, from initial scoping through to post-registration compliance.
What activities require FCA registration in the UK?
Any business carrying on cryptoasset activity as defined under the applicable MLR provisions – including operating an exchange, providing custody, arranging transfers or facilitating peer-to-peer trading for UK clients – must register with the FCA before operating. The obligation attaches to the activity, not the legal domicile of the entity. A Cayman or BVI company that actively markets a trading platform to UK users falls within scope. Regulators have been consistent on this point, and the FCA maintains a public register of both approved and rejected applicants.
The FCA's regime is currently an AML/CTF registration, not a full investment-services authorisation. That distinction matters: the MLR registration tests fitness, the adequacy of AML systems and the competence of key personnel. It does not, on its own, confer permission to deal in financial instruments or accept deposits. Where an exchange lists tokens that the FCA classifies as specified investments, a separate financial-services authorisation is required. In our practice, the boundary between a registrable cryptoasset and a regulable security is the first question we resolve for any new exchange build.
The financial-promotion regime operates independently of the MLR registration. Since the FCA's cryptoasset promotion rules came into force, only FCA-registered or FCA-authorised firms – or their appointed representatives – may communicate or approve promotional material relating to qualifying cryptoassets to UK persons. The reach of this rule extends to foreign operators directing content into the UK. We have seen exchanges assume their offshore incorporation exempts them; it does not.
For a scoped assessment of your UK market-entry requirements, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity, the user base, the token mix and the banking – change the analysis materially. Map your options.
How does the FCA cryptoasset registration process work?
The FCA registration process runs through the Connect portal and requires the applicant to demonstrate, at a minimum: a compliant AML/KYC programme, a written risk assessment aligned to the applicable FATF standards, policies addressing the Travel Rule (the obligation to pass originator and beneficiary data with a transfer), adequate transaction-monitoring systems, and fit-and-proper individuals in key roles including the MLRO (Money Laundering Reporting Officer). All these elements must be documented before submission.
The FCA has historically been one of the more demanding AML registration authorities in the EU/EEA peer group. Its rejection rate for cryptoasset applicants has drawn attention in the industry: a material proportion of applicants either withdraw or receive refusals, many on grounds of AML-programme inadequacy. Timeline varies considerably depending on application quality and FCA case load; the regime does not operate on a fixed statutory clock in the way that, for example, the MiCA CASP authorisation does under its ESMA-supervised timetable. Operators should plan for a process measured in months, with the possibility of substantial information requests at multiple stages.
Key personnel undergo individual fitness and propriety assessment. The MLRO, compliance officer and senior management team must each demonstrate relevant experience and clean regulatory histories across all jurisdictions where they have held relevant roles. For a group with staff distributed across the UAE, Singapore and the UK, this cross-border vetting can extend timelines significantly.
What are the AML and Travel Rule obligations for a UK crypto exchange?
A UK-registered cryptoasset business must implement a full AML/CTF programme consistent with the FATF Recommendations, including Recommendation 15, which requires VASPs to apply the Travel Rule to virtual-asset transfers. The Travel Rule requires the originating VASP to collect, verify and transmit specified originator and beneficiary information to the receiving VASP. The precise data threshold and de-minimis amount are set by domestic legislation and are subject to periodic review; operators should confirm the current threshold at implementation.
In practice, Travel Rule compliance requires a technical solution. The UK cryptoasset market has seen operators adopt a range of TRISA, OpenVASP and proprietary messaging solutions. Connectivity with counterpart VASPs – including those in MiCA-governed EU jurisdictions, MAS-regulated Singapore entities and VARA-regulated Dubai platforms – is an operational dependency, not merely a legal one. Where a counterpart VASP cannot receive Travel Rule data, the sending firm must determine how to handle the transfer in line with its own risk appetite and the FCA's expectations.
Customer due diligence obligations extend to beneficial ownership verification for corporate clients, ongoing monitoring, and Suspicious Activity Reporting to the National Crime Agency (NCA). The UK's anti-money-laundering regime is among the more enforcement-active in the common-law world, and the NCA has cooperated closely with the FCA on cryptoasset-related investigations.
How do UK financial-promotion rules apply to crypto exchanges?
The UK financial-promotion regime imposes some of the strictest communication controls on cryptoasset marketing in any major jurisdiction. Under the applicable rules, a communication that constitutes a financial promotion of a qualifying cryptoasset may only be communicated to UK persons by, or with the approval of, an FCA-authorised person. An FCA-registered firm that is not separately FCA-authorised must therefore either obtain an approver relationship or restrict its communications accordingly.
The rules distinguish between different categories of UK investor – restricted, high-net-worth and certified sophisticated investors – and impose cooling-off periods, risk warnings and direct-offer restrictions depending on the category. For an exchange that onboards both retail and institutional clients, building a compliant onboarding and communication flow is a non-trivial compliance project. The FCA has used its powers to issue alerts about non-compliant promotions by both UK and overseas operators, and these public alerts carry commercial consequences beyond the direct regulatory risk.
Operators running simultaneous campaigns in the EU under MiCA whitepaper rules and in Singapore under MAS DPT licensing will find that the UK's promotion regime does not simply map onto either framework. The three regimes proceed from different legal philosophies, and a global promotion strategy must be disaggregated by jurisdiction.
What are the cross-border tax and banking considerations?
Banking for a UK-registered crypto exchange remains the single most operationally challenging aspect of the setup, and it is the consideration that most inbound operators underestimate at the outset. UK banks apply enhanced due diligence to cryptoasset businesses under their own risk frameworks, and several major clearing banks decline the sector entirely. The practical consequence is that a compliant FCA registration does not guarantee access to sterling settlement infrastructure.
In our practice, we map the banking layer in parallel with the registration process, not after it. An exchange that completes FCA registration but cannot open a UK settlement account faces an operational dead end. Operators with established relationships in ADGM, VARA-regulated Dubai or MAS-regulated Singapore sometimes find that their existing banking infrastructure can bridge the gap while UK rails are established – but this carries its own currency and compliance risk.
On the tax side, the UK tax authority – HMRC – treats cryptoassets as a distinct class of property for capital gains and income purposes. For a UK-incorporated exchange entity, the tax position of trading revenues, token rewards, and any proprietary inventory must be analysed against HMRC's published guidance. Cross-border structuring involving a UK holding entity alongside operating entities in low-tax jurisdictions requires careful transfer-pricing analysis and – where the UK entity holds genuine economic substance – an assessment of the UK's controlled-foreign-company rules. This is territory where the licensing layer and the tax structuring layer interact, and where the two must be designed together rather than sequentially.
If your prior application stalled or your banking relationship was closed, a second read of the structure can surface the root cause and the route forward. Write to OBOLUS at info@oboluslaw.com. Map your options.
Which exchange profiles does the UK regime suit – and which does it not?
The UK's regulatory regime suits a specific profile of exchange operator and is genuinely unsuitable for others; treating it as a universal entry point into English-speaking markets is a common and costly error.
An operator whose primary market is UK retail crypto trading, and who has the compliance infrastructure to satisfy the FCA's AML demands from day one, will benefit from the credibility of FCA registration with institutional counterparties and banking partners. The FCA register carries weight with prime brokers and custodians. The English common-law system also provides strong contractual enforcement and access to world-leading asset-recovery forums – including worldwide freezing orders (injunctions freezing a respondent's assets globally) and Norwich Pharmacal disclosure orders – for any exchange facing client fraud or misappropriation events.
An operator whose users are predominantly non-UK, whose entity sits in Singapore or the UAE, and who has no active marketing directed at UK persons, may conclude that FCA registration adds compliance cost without proportionate commercial return. In that scenario, ensuring that marketing flows and onboarding procedures are structured to exclude UK persons – with documented controls – may be the more efficient path, at least at the early stage.
A third profile is the operator building a multi-jurisdiction group: a MiCA CASP authorisation in an EU member state (passporting across the bloc), a VARA or FSRA licence for the Middle East corridor, and a separate UK entity for the sterling-denominated market. Each entity in that structure must satisfy its own regulatory test; a MiCA passport does not extend to the UK, which sits outside the EU/EEA framework post-Brexit. Operators designing this stack frequently ask us to model the interaction between the FCA requirements and the MiCA CASP obligations simultaneously, because the AML and Travel Rule programmes, while conceptually aligned, differ in their domestic implementation.
Case study: inbound exchange, financial-promotion mis-step
In a recent matter, a digital-asset exchange incorporated outside the UK had been operating under a foreign VASP registration and directing promotional content at UK users through social-media channels. When it began a formal UK registration process, the prior promotional activity surfaced as a material issue in the FCA's fitness assessment. We structured a remediation programme – including a retrospective communications audit, engagement with the FCA's supervisory team and an enhanced financial-promotion compliance framework – that allowed the registration process to continue. The matter resolved without formal enforcement action. The lesson was that the financial-promotion rules create historical exposure that precedes registration, not merely a prospective obligation.
Decision matrix: how to structure your UK crypto exchange entry
For operators considering UK market entry, the choice of legal structure follows the business model. An exchange that intends to serve UK retail users from a UK-incorporated entity – the most straightforward path for long-term market positioning – should plan for FCA MLR registration as the immediate gate, with a parallel assessment of whether any listed tokens trigger financial-services authorisation requirements. Timeline for the registration process should be treated as open-ended, with a minimum of several months the realistic baseline.
An operator that intends to serve only professional or institutional UK clients, and can demonstrate that its onboarding process reliably excludes retail persons, faces a narrower regulatory exposure under the financial-promotion regime. The FCA's categorisation of investor types maps reasonably well to the equivalent concepts under MiCA and the MAS DPT framework, but the categorisation process itself – and the associated documentation – must be jurisdiction-specific.
An operator pursuing a pure offshore model, with no UK incorporation and no active UK marketing, should obtain a legal opinion on the scope of the FCA's jurisdictional reach to its specific fact pattern before committing to that position. The FCA has shown a willingness to take action against overseas operators whose marketing reaches UK audiences, and the definition of "communication to a UK person" is fact-sensitive.
In each scenario, banking and HMRC tax analysis should run concurrently with the regulatory process, not after it. We structure our engagement to cover the licence, the banking and the tax stack in a single scoped assignment, because the interactions between them are where the most consequential decisions arise.
Related at OBOLUS
- Licensing and Registration for Digital Asset Businesses – how we structure licence applications across 70+ jurisdictions for exchanges, custodians and token issuers.
- US Federal and State MTL Renewal and Variation – managing licence lifecycle obligations across US federal and state money-transmitter regimes.
- Stablecoin Freeze Requests: A Cross-Jurisdiction Comparison – how freeze and blacklist authority operates across Tether, Circle and the principal legal forums.
FAQ
How long does a crypto licence take to obtain?
In the UK, the FCA's cryptoasset registration does not operate on a fixed statutory timetable. Applicants should plan for a process measured in months, with the length depending heavily on application quality, the complexity of the business model and the FCA's case load at the time of submission. Thorough pre-submission preparation – including a completed AML risk assessment, Travel Rule programme and documented fitness-and-propriety evidence – materially reduces the risk of extended information requests.
Which jurisdiction is best for licensing my crypto business?
There is no universal answer. The best licensing jurisdiction depends on where the operator's users are located, the entity's preferred banking infrastructure, the token mix (and associated classification risk), and the operator's long-term capital-market ambitions. The UK suits operators whose primary market is sterling-denominated UK users. For multi-market operators, a stacked structure – combining, for example, a MiCA CASP authorisation, a VARA or FSRA licence and a UK MLR registration – may be required. We model the full licence, banking and tax stack before any commitment is made.
Do I need a separate custody licence?
Under the current UK MLR-based regime, custody of cryptoassets for clients is a registrable cryptoasset activity in its own right. If an exchange also holds client assets, both the exchange and custody activities fall within the registration scope. Where the exchange operates a separate legal entity for custody – a structure adopted by several institutional-grade platforms – each entity must satisfy the FCA's registration requirements independently. In other jurisdictions, such as MAS-regulated Singapore or VARA-regulated Dubai, custody and exchange activities may require distinct licence categories under the applicable regime.
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance that sit around them. Digital assets are the whole of our practice. We map the licence stack across operating, custody and payment layers before you commit – so structural problems surface at the design stage, not after registration. We also work alongside forensic partners to convert on-chain evidence into court-ready disclosure applications where misappropriation or fraud is involved. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in inbound regulatory authorisation for digital-asset exchanges and custodians across the UK, EU and Indo-Pacific hubs.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.