How Far Should Crypto Firms Trace a Transaction? FCA Says Risk Should Decide

Brokers and trading platforms handling cryptoassets should be able to explain why their monitoring systems flag a transaction and how far they trace its history, according to proposed guidance from the UK Financial Conduct Authority.

London's trading industry is coming home!

On 23 October, the FCA opened a consultation on broader updates to its Financial Crime Guide, including cryptoasset checks ahead of the authorisation regime starting on 25 October 2027. The guide would clarify supervisory expectations, not introduce new AML requirements.

Firms Need to Understand Their Monitoring Tools

UK cryptoasset firms already have to check customers and monitor transactions for money-laundering risks. The FCA’s draft focuses on weaknesses in how those checks are carried out: a firm may have a procedure in place without adapting it to what a particular transaction reveals.

A platform tracing the origin of a crypto deposit, for example, might stop after a preset number of transfers even when the information found so far calls for a closer look.

The FCA treats that as poor practice. It sets no universal tracing limit; how far a firm follows the funds should depend on the risks it identifies. The same applies when a firm uses an outside provider to monitor transactions.

A risk score can help direct attention, but the firm must understand what lies behind it and be able to explain the provider’s findings. The draft guidance also points to adjusting monitoring tools to the firm’s own risks and keeping a record of the decisions they produce.

Those findings need to be compared with what the firm already knows about the customer. If transaction activity reveals a material change in the customer’s profile, the firm should update its due diligence information and reassess the risk, rather than leave the alert isolated in a monitoring system.

When Crypto Transfers Need Closer Scrutiny

Firms also need to decide when routine AML monitoring is not enough. The FCA points to transfers from unhosted wallets and the use of privacy coins or mixers as circumstances that may warrant enhanced due diligence.

These features can raise questions about a transaction, but do not by themselves establish wrongdoing. To assess the risk, a firm should also consider which providers the customer has used, where they operate and whether they are regulated.

Some findings call for a stronger response: the draft lists a blockchain link to criminal or sanctioned activity among the situations requiring enhanced due diligence.

The firm also needs basic information about who sent and received the assets. If those details are missing from a transfer, the existing Travel Rule calls for the firm to request them from the counterparty and make a risk-based decision if they remain unavailable.

Repeated failures to provide the required information must be reported to the FCA. These examples remain open for comment until 24 December 2026. The FCA will consider the responses before publishing the final guidance.