As Bitcoin and other cryptocurrencies increase in popularity as a payment method, so does the associated risk of them being exploited for money laundering and other criminal activities.

In this article, we look at how crypto is regulated for anti-money laundering (AML) purposes in the UK.

What is cryptocurrency?

Cryptocurrency is a virtual or digital currency that allows people to make payments through an online system. It eliminates the need to carry physical money and is not reliant on a central authority, such as a bank, to uphold it.

Bitcoin, which launched in 2009, was the first digital currency and remains the biggest, best-known, and most commonly used. Other cryptocurrencies include Ethereum, Tezos and Ripple.

How do crypto asset transactions work?

Cryptocurrency is not a tangible asset. It is stored in digital wallets, similar to an online bank account. To buy and sell with crypto, users generate a pair of alphanumeric digital keys: a public key and a private key.

The public key is like an account number used to identify the user, and the private key is the equivalent of the user’s PIN.

These keys are used to send and receive transactions. They are a way of identifying the parties to a transaction and proving their ownership over the assets they intend to transact.

Cryptocurrency transactions are managed by blockchain technology, which is equivalent to a bank’s balance sheet or ledger, known as ‘distributed ledger technology’ (DLT).

DLT allows data to be recorded and stored across a network of participants, eliminating the need for a single central data storage point or a central authority that grants participants permission to access and participate in the network, such as a government or a bank.

Is cryptocurrency secure?

Cryptoassets were designed to give individuals greater control over their finances by serving as a decentralised form of electronic currency that enabled peer-to-peer global transactions without the input of a centralised authority.

There are two ways users can own and transact with crypto assets:

1. Through third-party intermediaries (like banks). Brokers on these exchange platforms trade cryptocurrencies and safeguard the cryptoassets on behalf of the consumer.

2. Directly. In this case, users store their assets and user information themselves in a personal hardware wallet.

Cryptocurrency received its name because of the encryption it uses to verify transactions. Advanced coding is involved in storing and transmitting cryptocurrency data between wallets and to public ledgers, which is designed to provide security and safety.

However, as cryptocurrency transactions are inherently anonymous, decentralised and often involve cross-border trades, crypto is highly susceptible to money laundering and other criminal activities.

How is cryptocurrency at risk of being used for illegal activities?

Although there is no definitive figure for the proportion of crypto asset transactions that fund criminal activity, the National Crime Agency’s National Assessment Centre (NAC) estimated that over £1 billion of illicit cash was transferred overseas using crypto assets in 2021.

Cryptocurrency is at risk of being exploited for criminal activity in the following ways:

• Extortion. Ransomware extortion is a malware attack in which attackers encrypt files and demand a crypto payment for the decryption key.
• Fraud. Fake investment schemes whereby scammers promise high returns on a low initial investment are used to steal money and personal information.
• Trafficking. Marketplaces on the dark web use cryptocurrency to facilitate illegal trading, for example, the sale of drugs and unlicensed firearms.
• Terrorism. Terrorist organisations use cryptocurrency to get around sanctions.

How is cryptocurrency regulated for AML in the UK?

The Financial Conduct Authority (FCA) has been the anti-money laundering and counter-terrorist financing (AML/CTF) supervisor of UK cryptoasset businesses since 10 January 2020.

If businesses intend to provide certain cryptoasset services by way of business in the UK, they must register with the FCA under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs).

Cryptoasset businesses must comply with the requirements of the Regulations, including conducting appropriate customer due diligence and checks before onboarding clients. Requirements under the MLRs include:

• Take appropriate steps to identify and assess the risks of money laundering, proliferation financing and terrorist financing which the business is subject to.
• Have appropriate policies, systems, and controls in place to mitigate the risk of the business being used for the purposes of money laundering, terrorist financing, and proliferation financing.
• Where appropriate, for the size and nature of its business, appoint an individual who is a member of the board or senior management to be responsible for compliance with the MLRs and the nominated officer. The nominated officer is also responsible for reporting suspicious activity to the National Crime Agency (NCA) under Part 7 (Money Laundering) of the Proceeds of Crime Act 2002.
• Where appropriate, for the size and nature of its business, establish an independent internal audit function with responsibility for examining and evaluating the adequacy and effectiveness of the policies, controls and procedures, and making recommendations, as well as monitoring the controls.
• Undertake screening of employees.
• Undertake customer due diligence when entering into a business relationship or occasional transactions.
• Apply more intrusive due diligence, known as enhanced due diligence, when dealing with customers who may present a higher risk of money laundering, terrorist financing and proliferation financing. This includes customers who meet the definition of a politically exposed person (PEP).
• Undertake ongoing monitoring of all customers to ensure that transactions are consistent with the business’ knowledge of its customer, the customer’s business and risk profile.

More information about compliance requirements is available on the FCA’s website by clicking here.

The UK Advertising Standards Agency (ASA) has also become involved in cryptoasset oversight, regulating the promotion of cryptoassets to consumers by increasing its scrutiny of social media, web pages and ads.

AML compliance regulations for cryptoassets were strengthened at the end of 2023 when the Economic Crime and Transparency Act came into force.

This important piece of legislation gave the police and the NCA greater powers to seize, freeze and recover crypto assets. In exceptional circumstances, these authorities also have the power to destroy seized cryptocurrency.

AML Solutions for Regulated Services

We can help organisations of all shapes and sizes from across different sectors undertake a review of their policies, controls, and procedures to ensure that they are compliant with AML regulations and, therefore, avoid any breaches.

A review of this nature provides valuable insight into a business when performed correctly. Along with an overview of risk, these crucial assessments also highlight issues within the business, so it is essential to undertake a proper review. All of a company’s building blocks must be considered, including its staff, clients, operations, and finances.

By working with Regulation & Compliance Office, a business can be assured that we will bring the required level of knowledge and expertise needed to perform the review, which adds value to the business and is not simply a box-ticking exercise. Our team can also provide a full range of services that include:

• Consultancy.
• Compliance Policies.
• Training.
• Handbooks.
• Auditing.

Our services focus on businesses’ Anti-Money Laundering and Regulatory requirements through the implementation of effective policies, procedures, training, and consultancy. We also provide continued monitoring of staff and ongoing training to ensure that everyone within a business is aware of the latest requirements and complies with their responsibilities.

We offer a full range of services focused on ensuring businesses across all regulated sectors create, maintain and evidence their compliance with the requirements of their regulators and legislation. We work with businesses of all sizes, from the smaller high street or niche businesses to the large multi-office and multinationals.

Get In Touch

We adopt a sensible and pragmatic approach to fees, ensuring we are competitive and always add value. As necessary, we will agree on packaged services to control cost and enable clients to spread payments to alleviate cash flow, yet ensure services are provided when needed.

If you want to discuss our services in more detail,  call us on: 0203 985 8550 or email us at: info@regulationandcomplianceoffice.co.uk