VASP licensing in the United Kingdom sits at the intersection of anti-money laundering law and an increasingly assertive financial-promotion regime. Any business providing a cryptoasset service (an activity involving the exchange, transfer, custody or arrangement of digital assets) to UK customers must, at minimum, register with the Financial Conduct Authority (FCA) under the Money Laundering Regulations. Failing that step before trading exposes the business to criminal liability, frozen payment rails and the permanent reputational harm of an FCA warning notice. This page sets out the regulated perimeter, the application pathway, the cross-border complications that catch inbound operators off-guard, and the structural decision every operator must make before it files.
What does the UK regime actually regulate?
The FCA's cryptoasset regime is, at its core, an anti-money laundering registration rather than a full prudential authorisation – but that distinction is increasingly narrowed by financial-promotion rules that now sit alongside it. Under the applicable Money Laundering Regulations, any firm that carries on a cryptoasset exchange provider or custodian wallet provider business in the United Kingdom must register with the FCA before commencing activity. The registration requirement applies regardless of whether the firm is incorporated in the UK or overseas; what matters is whether the business is directed at UK consumers or settled through UK infrastructure.
The financial-promotion overlay sharpened significantly when the FCA extended its financial-promotion rules to cryptoassets. Under that regime, firms communicating or approving promotional material about qualifying cryptoassets to UK recipients must either be FCA-registered for cryptoassets, be an FCA-authorised person, or have their promotions approved by one. The practical effect is that a foreign exchange with UK users faces both the registration trigger and the promotion-approval requirement, even if it never touches a UK bank account. In our practice, operators consistently underestimate this second layer until enforcement correspondence arrives.
The FCA also sits within a broader UK digital-assets regulatory architecture that is evolving. Legislation is progressing to bring crypto trading venues, stablecoins and custody into a full authorisation regime, moving the UK closer to the post-MiCA posture of the EU. Operators building for the long term must account for that trajectory now, not at the point the new obligations take effect.
Operating in the UK without registration or promotion-approval can result in criminal prosecution of both the entity and its principals. In our cross-border practice, we regularly advise firms that assumed a CIMA or BVI FSC registration insulated them from UK obligations. It does not. Territorial reach turns on where the service is directed, not where the entity sits.
Who needs to register with the FCA?
The registration obligation catches a broader population than most operators initially assume. An exchange offering spot trading in Bitcoin or Ethereum to UK residents is clearly in scope. So is a custody provider holding keys on behalf of UK institutional clients. Peer-to-peer platforms, token-swap aggregators and fiat on-ramp providers all fall within the definition of cryptoasset exchange provider under the applicable provisions.
A business that provides only software – wallet infrastructure, for instance – sits in a grey zone. The FCA's position has been that the activity test turns on whether the firm is itself carrying on the regulated activity or merely enabling a third party to do so. That distinction is highly fact-specific. We have seen arrangements where a technology provider's commercial relationship with the end-user, combined with fee structures, brought it inside the perimeter.
For funds and institutional vehicles, the securities dimension matters separately. If the token is a specified investment under the Financial Services and Markets Act framework, the activity may require full FCA authorisation – a materially higher bar than MLR registration. The crypto MLR registration is not a substitute for authorisation where authorisation is required.
DeFi protocols present the hardest classification question in the current UK environment. The FCA has signalled that the absence of a central operator does not automatically place a protocol outside the perimeter if a person or group is sufficiently in control. Operators deploying or operating protocols with UK user exposure should treat the classification analysis as mandatory, not optional.
To pressure-test your regulatory perimeter analysis before you apply, contact OBOLUS at info@oboluslaw.com. The process above describes the standard scope. Your entity structure, user base and product set change the analysis materially.
How does the FCA registration process work?
The FCA cryptoasset registration process is conducted through the FCA Connect portal and involves a structured submission covering corporate structure, beneficial ownership, AML/KYC policies, technology and security controls, and the fitness-and-propriety of senior management. The FCA has been explicit that it applies the same scrutiny to cryptoasset registrations as to full authorisations: incomplete or superficial submissions are routinely refused or withdrawn.
The process begins with an internal readiness assessment. The FCA expects to see a documented AML risk assessment tailored to the firm's specific product and client mix, a functional transaction-monitoring regime, clear customer-due-diligence procedures, and controls that address the specific risks the FCA has publicly identified in the sector – including exposure to high-risk jurisdictions, peer-to-peer transaction risks and the use of privacy-enhancing technologies.
The FCA will assess whether the firm's senior management – specifically its Money Laundering Reporting Officer and the individuals responsible for its AML framework – are genuinely fit for their roles. In practice, the quality of those individuals and the credibility of the governance structure are as important as the policy documentation. Regulators in the leading hubs increasingly expect substance behind the paperwork.
Timeline is not fixed by statute. In our cross-border practice, we have seen registration processes extend well beyond initial estimates, particularly where the FCA returns multiple rounds of questions about the AML framework or beneficial-ownership disclosure. Applicants should build contingency into their commercial timelines. Operating under the "Temporary Registration Regime" – which allowed certain firms to continue operating while their applications were assessed – has now closed for new entrants, meaning a new applicant may not commence activity until registration is granted.
A common structural error is filing a registration in the name of a holding company rather than the operational entity. The registered entity must itself be the one carrying on the regulated activity. Where a group operates through multiple entities, each relevant entity may need its own registration or a carefully structured intra-group service arrangement reviewed against the FCA's perimeter rules.
How do the UK financial-promotion rules affect my operation?
The financial-promotion regime is, for many inbound operators, the more immediately disruptive of the two layers. The rules require that any communication inviting or inducing a person to engage in investment activity – including buying, selling or holding a qualifying cryptoasset – must either be issued by an FCA-authorised or FCA-registered person, or be approved by one before it is communicated to UK recipients.
The regime applies to social media posts, website content, app-store descriptions and email campaigns, as well as to more formal marketing materials. Geo-blocking UK IP addresses is a common attempted workaround; the FCA has made clear that effective geo-blocking must be robust and consistently applied, and that nominal IP blocking paired with open onboarding is unlikely to satisfy the promotion rules.
The FCA has issued public warnings against multiple firms and referred matters to prosecutors where financial promotions were issued in breach of the applicable rules. For a firm building a UK user base, the promotion question must be resolved at the same time as – and in some cases before – the registration question.
The interaction between the promotion rules and the incoming stablecoin and trading-venue authorisation regimes means the compliance surface will expand further. Building a scalable promotions compliance function now, rather than retrofitting one under deadline, is the structurally sound approach.
What AML and Travel Rule obligations apply?
UK cryptoasset businesses registered under the Money Laundering Regulations are subject to the full suite of FATF-aligned AML/CFT obligations, including customer due diligence, enhanced due diligence for higher-risk relationships, ongoing monitoring, and suspicious activity reporting to the National Crime Agency. The Travel Rule – the obligation, derived from the FATF Recommendation 15 framework, to pass originator and beneficiary data alongside a virtual-asset transfer – also applies in the UK.
The UK Travel Rule applies to cryptoasset businesses transferring virtual assets. The obligation requires that originator and beneficiary information is collected, verified and transmitted with each in-scope transfer. Where the counterpart is a VASP (virtual asset service provider) in a jurisdiction that has not yet implemented the Travel Rule, the UK business must apply specific risk-based procedures – it cannot simply omit the data because the counterpart cannot receive it.
In practice, Travel Rule compliance requires a technology solution capable of sending and receiving structured data, a policy for unhosted wallet interactions, and a documented approach to the "sunrise problem" (the gap where some jurisdictions have implemented the rule and others have not). In our practice, we regularly advise firms on selecting and implementing Travel Rule solutions that satisfy both the UK regime and the requirements of the other jurisdictions in which the business operates – particularly relevant for businesses that also hold or are applying for a MiCA CASP authorisation, a VARA licence or a MAS licence under Singapore's Payment Services Act regime.
How does the UK licensing position interact with cross-border banking and tax?
For a business domiciled outside the UK but serving UK clients, the regulatory and banking questions are inseparable. UK correspondent banks and electronic money institutions generally require evidence of an FCA cryptoasset registration – or at minimum a credible application in progress – before onboarding a cryptoasset business. The absence of a clear UK regulatory status makes UK sterling settlement materially harder to secure and maintain.
The cross-border structure of many digital-asset businesses – an operating entity in one jurisdiction, a custody entity in another, users distributed globally – raises the question of which entity carries the UK regulatory obligation. Where a foreign-incorporated entity directs activity at UK users, the FCA's view has been that it must itself register or structure its offering so that the UK-facing activity is conducted by a UK-registered entity. The use of a UK subsidiary as the registered operator, with the offshore entity acting as a technology or liquidity provider under a documented intra-group arrangement, is a common structural solution, but it requires careful analysis of the service flow and the actual regulatory perimeter.
On the tax dimension: the UK HMRC treats cryptoassets as a distinct asset class, and the tax treatment of businesses holding, trading or providing services in relation to cryptoassets is specific to the nature of the activity. Staking rewards, trading profits and custody fees each follow different treatment paths. A business restructuring its UK presence to achieve regulatory compliance should run the tax analysis concurrently – the structural choices made for regulatory purposes can have significant and sometimes adverse tax consequences if not reviewed with tax counsel. See our analysis of staking and rewards taxation for the broader compliance picture.
In a recent licensing matter, an exchange group had structured its European operations through a MiCA-transitioning EU entity and was directing UK users to that entity's platform. The UK financial-promotion rules applied notwithstanding the EU authorisation, and the absence of a UK FCA registration meant the entity could not lawfully approve its own UK-facing promotions. We restructured the intra-group service flow to segregate the UK user base, identified a path to FCA registration for the UK operational entity, and resolved the promotions position ahead of a planned UK market-entry campaign. The matter concluded without enforcement contact.
If your structure involves UK users alongside an EU, UAE or offshore primary licence, the combined analysis is where the exposure sits. To map the licence, banking and tax stack for your build, write to info@oboluslaw.com.
Which operator profile fits the UK path?
The UK FCA registration is the right primary regulatory step for operators who are already, or intend to become, focused on the UK market – exchanges, custodians and payment-layer businesses with UK sterling volumes and UK institutional or retail clients. It is not a global licence; its scope is the UK perimeter, and it provides no passport into the EU, the UAE or Singapore.
Profile A – an exchange with a UK corporate entity, UK banking relationships and a primarily UK user base – should pursue FCA registration as its first licence. The registration carries genuine substance requirements, but for a well-governed business with a functioning AML programme, it is achievable. Timeline varies depending on the FCA's review cadence and the completeness of the submission; plan for a process that extends over several months, potentially longer.
Profile B – a business with a global user base that includes UK residents but whose primary market is the EU or the Gulf – should determine whether the UK registration is triggered by the actual territorial reach of its services. If UK users represent a meaningful portion of volume, registration is typically required; the fact that the primary licence is a MiCA CASP or a VARA licence does not displace the UK obligation. In this profile, a UK-resident entity acting as the registered operator for UK-directed activity – backed by the offshore entity as technology provider – is often the cleanest structural solution.
Profile C – a fund or institutional vehicle investing in digital assets on its own account, without providing exchange or custody services to external clients – may fall outside the cryptoasset registration perimeter, but must still analyse the financial-promotion rules and, if the tokens are specified investments, the full FCA authorisation question. This profile is the one most likely to trigger the securities-overlay analysis rather than the MLR-registration track.
Profile D – a DeFi operator or protocol deployer with UK user exposure – faces the most uncertain position. The FCA's approach to decentralised architectures is evolving, and the incoming legislation will address certain aspects. The prudent course is to obtain a classification opinion before taking the view that the protocol falls outside the perimeter.
Does an offshore licence remove the need for UK registration?
A common assumption among founders is that a BVI FSC registration, a CIMA licence or even a MiCA CASP authorisation covers their UK users and removes the need for a separate FCA filing. That assumption is incorrect, and acting on it is one of the more expensive mistakes in the sector. The UK regime is territorially triggered by the activity – directing services at UK clients, approving UK-facing promotions, holding UK client assets – not by the domicile of the entity. No offshore or EU licence displaces the UK registration obligation where UK activity is present.
The FCA publishes a public register of registered and refused cryptoasset businesses. Businesses operating in apparent breach – particularly those with visible UK marketing and no registration – are routinely identified and pursued. The enforcement toolkit includes public warning notices, criminal prosecution and, in some cases, injunctive relief to stop activity. Where a business has been refused registration, it is placed on the FCA's list of unauthorised firms, which materially damages banking and institutional relationships globally.
The Isle of Man offers a complementary licensing option for businesses with a specific interest in that jurisdiction's crypto regime. Our Isle of Man VASP licensing guide covers the regulatory path there in full. For UK licensing questions specifically, the FCA registration path described on this page is the operative regime.
For businesses that have already had a registration refused or withdrawn, the position is recoverable – but it requires a structural review of what the FCA identified as the basis for refusal, a remediation of those deficiencies, and in most cases a fresh application or a supervised resubmission. We advise on both the initial application and the remediation path.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full multi-jurisdiction licensing practice overview
- VASP licensing in the Isle of Man – a complementary British Isles licensing option for crypto operators
- Staking and rewards taxation: the compliance burden in practice – the UK and cross-border tax treatment of staking income
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise exchanges, custodians, token issuers and funds on licensing across 70+ jurisdictions, on disputes and on-chain asset recovery across 25+ forums, and on the tax, banking and compliance structures that sit around them. Digital assets are the entirety of our practice, and we act only for businesses – not retail clients. We map the licence, banking and tax stack across operating, custody and payment layers before you commit to a structure. To discuss your situation, contact info@oboluslaw.com or message us at t.me/oboluslaw.
FAQ
How long does a crypto licence take to obtain?
For UK FCA cryptoasset registration, the timeline is not fixed by statute and varies with the complexity of the application and the FCA's review cadence. A well-prepared submission from a business with a functioning AML framework typically takes several months; more complex structures or submissions that prompt multiple rounds of FCA questions can take considerably longer. Building a realistic contingency into the commercial timeline is essential, as new entrants may not commence activity until registration is granted.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. The right jurisdiction depends on your user base, your product, your banking needs, and your growth plan. A business focused on UK clients needs FCA registration regardless of where it is incorporated. A business targeting EU clients needs a MiCA CASP. A Gulf-facing operation may require a VARA or FSRA licence. Most serious operators need a stack – not a single filing. We assess the full multi-jurisdiction picture before advising on primary and secondary licence strategy.
Do I need a separate custody licence?
In the UK, custodian wallet providers are a distinct category under the Money Laundering Regulations and require their own FCA registration. If an exchange also holds client assets, the entity carrying on the custody activity must be separately registered – or the exchange's registration must expressly cover custody. Where a group segregates trading and custody into separate entities, each entity requires its own registration. Under the incoming UK authorisation regime, custody is expected to carry additional prudential requirements separate from the AML registration track.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialist in FCA cryptoasset registration, multi-jurisdiction licence stacks and inbound operator structuring across UK, EU and Gulf regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.