Financial crime compliance for crypto.
Travel Rule procedures, wallet and counterparty screening, blockchain analytics and the AML framework your FCA authorisation application will be judged on, for exchanges, custodians, brokers and stablecoin firms.
Held to a bank’s standard, on a deadline.
Regulators expect crypto businesses to meet the same financial crime standard as banks, with far less time to build it.
FCA authorisation
The new regime requires FSMA authorisation. MLR-registered firms do not convert automatically, and the application window closes on 28 February 2027.
Cross-border transfers
Originator and beneficiary information must travel with transfers, across counterparties and chains.
On-chain risk
Wallets and counterparties must be screened continuously for sanctions and illicit-finance exposure.
Supervisory pressure
Supervisors apply intense scrutiny to digital assets, and the bar keeps rising.
The FCA crypto gateway is open. The deadline is real.
The new UK cryptoasset regime requires FSMA authorisation. Firms registered under the MLRs do not convert automatically, payment and e-money firms offering crypto are in scope, and firms that do not apply must run off their UK business before the regime commences.
30 Sep 2026
Gateway opened. Applications accepted through FCA Connect.
28 Feb 2027
Application window closes. Apply by now for a decision before commencement.
Late applicants
No expedited assessment. Unauthorised at commencement means the transitional provision: no new UK customers.
Non-applicants
Must run off UK cryptoasset business before the regime commences.
What we test before the FCA does.
We review your financial crime framework against what an authorisation application needs to evidence, not merely describe, and tell you where the gaps are.
Business-wide risk assessment
Written for your actual products, customers, chains and jurisdictions, not a template.
Customer risk rating and EDD
Risk factors calibrated to crypto, with source of funds for customers funding in cryptoassets.
Sanctions controls
Customers, counterparties and wallet addresses, with a documented approach to alert adjudication.
Travel Rule procedures
Counterparty due diligence, unhosted wallets and transfers to jurisdictions without the rule.
Monitoring and escalation
Blockchain analytics and transaction monitoring with clear triage, MLRO escalation and suspicious activity reporting.
Governance and oversight
A capable MLRO, board MI, outsourcing oversight and evidence that the controls actually operate.
The Travel Rule, documented properly.
Since 1 September 2023, UK cryptoasset businesses have had to send and receive originator and beneficiary information with cryptoasset transfers, with full information required on transfers of 1,000 euros or more.
Most firms have a messaging solution. Far fewer have documented the procedures around it, and those procedures are exactly what the FCA examines.
- Due diligence on counterparty VASPs before you send or receive
- Transfers to and from jurisdictions without the Travel Rule
- Unhosted wallets: ownership checks and risk assessment
- Missing or incomplete information: request, reject, return or report
- Records and evidence that the procedure actually operates
Wallets, addresses and on-chain exposure.
Crypto risk is visible on the blockchain. Your controls need to show you looked, and what you decided.
Wallet screening
Customer and counterparty wallet addresses screened before funds move, against sanctions designations that include addresses and known illicit sources.
Exposure analysis
Direct and indirect exposure to mixers, darknet markets, scams and sanctioned entities, with risk thresholds you can defend.
Blockchain analytics
Choosing and calibrating an analytics provider, and documenting why its rules and thresholds fit your risk.
Alert triage
A documented process for reviewing, closing and escalating on-chain alerts to the MLRO, with reasons recorded.
Tainted deposits
What to do when a customer deposit has exposure to a sanctioned or illicit source: freeze, investigate, report.
Source of funds in crypto
Tracing the fiat on-ramp, trading history and wallet provenance to evidence where a customer’s crypto wealth came from.
The six gaps we find most often.
From supporting crypto businesses through FCA review, these are the failures that cause the most damage.
Generic risk assessment
A business-wide risk assessment that reads like a template rather than the specific risks of the business.
No customer risk rating
Applying the same CDD to every customer. A privacy-coin trader and a small retail buyer are not the same risk.
Travel Rule procedures missing
A technical solution but no documented procedure, especially for unhosted wallets and non-compliant counterparties.
Monitoring without triage
Analytics tools that generate alerts, but no documented process for reviewing, closing or escalating them.
Untrained staff
Policies that exist on paper but have never reached the people responsible for implementing them.
No MLRO governance
An MLRO in name only, with no annual report, no management information and no documented escalation decisions.
Regulatory readiness across the UK and Pakistan.
We support digital asset businesses on both sides of their regulatory journey, applying the same institutional standard in each jurisdiction.
FCA-aligned financial crime controls
For firms operating in, or entering, the UK market.
- FCA authorisation expectations and supporting evidence
- Risk-based AML and financial crime controls
- Governance, oversight and accountability
- Travel Rule and ongoing screening procedures
PVARA-aligned VASP compliance
For virtual asset service providers under Pakistan’s PVARA regime.
- PVARA licensing and NOC requirements
- AML obligations and CDD expectations
- Governance and fit-and-proper considerations
- goAML reporting and Travel Rule readiness
Everything your application relies on.
Everything you need to apply, operate and evidence a compliant digital asset business.
- FCA authorisation pack
Financial crime documentation to support your authorisation application. - AML/CTF framework
A risk-based programme proportionate to your business model. - Travel Rule procedures
Originator and beneficiary handling across counterparties. - Wallet & counterparty screening
Sanctions and illicit-finance screening records. - Business-wide risk assessment
Documented assessment of your financial crime risk. - Policies & procedures
Board-approved policies mapped to your obligations. - Blockchain analytics integration
Selecting and embedding on-chain analytics into your controls. - Ongoing compliance support
Continuous oversight, screening and advisory.
Built for digital asset businesses.
Exchanges
Centralised and decentralised trading venues.
Brokers
Crypto brokerage and OTC desks.
Custodians
Digital asset custody and wallet providers.
Stablecoin firms
Issuers and payment-token businesses.
Tokenisation businesses
Real-world asset and security-token platforms.
Crypto startups
Early-stage firms preparing for authorisation.
The KYCifi Crypto Compliance Guide.
Written by specialists who have built and run AML frameworks for exchanges, custodians and stablecoin firms across the UK and Pakistan.
- FCA authorisation and PVARA licensing expectations
- Building an audit-ready AML programme
- Travel Rule and wallet-screening controls
- The onboarding evidence banks now demand
Your guide is ready.
Your download should begin automatically.
Ready before the window closes?
Book a readiness call, or send one live case for a free assessment. We will tell you where your framework stands against what the FCA will test.