If you’re running a crypto business and want to serve customers in the UK, you must register with the Financial Conduct Authority (FCA) as a Virtual Asset Service Provider (VASP). There’s no gray area. No exceptions. No loopholes. Since September 1, 2023, it’s been illegal to operate any crypto service-whether it’s exchanges, wallet providers, or crypto ATMs-without FCA authorization if you’re targeting UK customers. This isn’t just paperwork. It’s a full regulatory overhaul designed to stop money laundering, protect consumers, and bring crypto into the same compliance cage as banks.
Who Exactly Needs to Register?
It’s not just about having a UK office. The FCA looks at what you’re doing, not just where you’re based. If you’re marketing your crypto services to people in the UK-through ads, social media, websites in English, or even just having a .co.uk domain-you’re already operating in the UK market. That means you need to register. Even if your servers are in Singapore and your team is in Estonia, if UK customers can sign up and trade, the FCA considers you in scope. The rules are clear: if you’re receiving direct or indirect benefits from crypto activities involving UK customers, or if you’re doing these activities with any kind of regularity, you’re a VASP. That includes:- Running a crypto exchange accessible to UK users
- Operating a crypto ATM located in the UK
- Providing custodial wallet services to UK residents
- Offering crypto-to-fiat trading with GBP
- Marketing your platform using UK-based influencers or Google Ads targeting London, Manchester, or Edinburgh
The Core Requirements: It’s Not Just a Form
Registration isn’t a checkbox. It’s a complete rebuild of how your business operates. The FCA expects you to meet the same standards as a bank. Here’s what you need to have in place before you even hit submit:- AML and KYC systems: You must verify every customer’s identity using government-issued ID, proof of address, and facial recognition tools. You can’t just accept screenshots. You need a live verification process that meets international standards.
- Transaction monitoring: Your system must flag unusual activity-large transfers, rapid deposits and withdrawals, patterns matching known laundering techniques. This isn’t software you buy off the shelf. It needs customization and daily oversight.
- Travel Rule compliance: Starting September 2023, every crypto transfer over £1,000 must carry originator and beneficiary data-name, account number, address. If you’re sending funds to an unhosted wallet (like a personal MetaMask), you must collect and verify the recipient’s identity. Most platforms fail this part. It’s the #1 reason applications get rejected.
- Financial strength: You must prove you have enough capital to cover at least six months of operating costs. This isn’t just your bank balance. The FCA wants audited financial statements, cash flow projections, and evidence you can survive a market crash without collapsing.
- Cybersecurity: Your systems must be penetration-tested annually. You need multi-factor authentication, encrypted data storage, and a documented incident response plan. No excuses. Hackers target crypto firms because they know many still use outdated tech.
- Segregation of assets: Client crypto and fiat funds must be kept completely separate from your company’s money. No commingling. No using customer deposits to pay staff salaries.
The Application Process: What They Actually Look At
You apply through the FCA’s online Connect system. But before you even start, you need to prepare a mountain of documents:- Company incorporation papers
- Organizational chart showing all key roles
- Detailed AML/CFT policy manual
- Proof of IT security controls
- Business plan covering the next three years
- Background checks for all directors and senior managers
Why So Many Applications Get Rejected
The rejection rate is high. Over 60% of first-time applications are turned down. Why? Most companies think they can copy-paste a compliance template from a blog. They can’t. The top three reasons applications fail:- Weak KYC/AML systems: Using basic ID scanners without live verification, not recording the source of funds, or failing to monitor for red flags like rapid layering.
- No Travel Rule solution: Not having a way to collect and transmit required data for transfers over £1,000. Many platforms claim they’re compliant but can’t produce logs proving they did it.
- Banking access issues: The FCA requires you to have a UK business bank account. Many banks still refuse to work with crypto firms. If you don’t have one, your application is dead on arrival.
What Happens After You Register?
Getting approved isn’t the end. It’s the start of ongoing scrutiny. The FCA doesn’t give you a certificate and forget about you. You must:- Submit annual financial audits
- Report suspicious activity within 24 hours
- Update your AML policies every six months
- Notify the FCA of any changes in ownership, management, or key systems
- Undergo unannounced inspections
What If You Don’t Register?
The FCA doesn’t just send warning letters. They take action.- Your website can be blocked by UK ISPs
- Your domain can be seized
- You can be fined up to £1 million or more
- Individual directors can be personally prosecuted
- Your name can be published on the FCA’s warning list, killing your reputation
Where Do You Go From Here?
If you’re serious about operating in the UK, start now. The FCA isn’t going to delay enforcement. They’re holding information sessions across the country-including Edinburgh in autumn 2025-to help businesses prepare. Don’t wait for a deadline. You won’t get one. Here’s your action plan:- Review the FCA’s official VASP guidance document-don’t rely on summaries.
- Map out every service you offer and determine which ones trigger registration.
- Build or upgrade your KYC, AML, and Travel Rule systems. Test them with real data.
- Secure a UK business bank account. If your current bank says no, try specialist fintech banks like Wirecard or Revolut Business.
- Prepare your application documents at least six months before you plan to launch in the UK.
- Consider hiring a regulatory consultant. It’s not a cost-it’s insurance.
Frequently Asked Questions
Do I need to register if my crypto business is based outside the UK?
Yes-if you’re marketing your services to UK customers or allowing them to trade on your platform. Location doesn’t matter. Targeting UK users does. The FCA looks at where your customers are, not where your servers are. Even if you have no UK office, if your website is in English, accepts GBP, or runs ads targeting UK cities, you’re required to register.
How long does VASP registration take in the UK?
There’s no fixed timeline. Simple applications with strong documentation can take 3-6 months. Complex ones, especially those with weak compliance systems or banking issues, can take over a year. The FCA doesn’t publish processing times because every case is different. The key is submitting a complete, error-free application. Rushing it will only delay you.
What’s the Travel Rule, and why is it so hard to comply with?
The Travel Rule requires VASPs to share the name, account number, and address of both the sender and receiver for every crypto transfer over £1,000. The problem? Most wallets (like MetaMask or Trust Wallet) are unhosted-you don’t control them. So you need systems that can verify the identity of the person behind that wallet address. Few platforms have built this properly. The FCA has already rejected applications for failing to demonstrate how they collect and verify this data.
Can I use a third-party AML provider instead of building my own system?
Yes, but you’re still responsible. If you use a third-party like ComplyAdvantage or Elliptic, you must prove you’re actively monitoring their alerts, investigating flagged transactions, and keeping records. The FCA doesn’t accept “we used a vendor” as an excuse. You must show you’re managing the risk-not outsourcing it.
What happens if my bank refuses to work with my crypto business?
You can’t register without a UK business bank account. If traditional banks say no, you need to switch to fintech banks that specialize in crypto, like Revolut Business, Wirecard, or Salt Edge. Some firms use payment processors like Stripe or Adyen for fiat on/off ramps, but these often require pre-approval from the FCA. Don’t wait until your application to solve this-start talking to these providers early.
Is there a fee to register as a VASP in the UK?
Yes. The FCA charges an application fee based on your expected annual revenue. For most crypto businesses, it ranges from £5,000 to £25,000. There’s also an annual fee after approval, which can be £10,000 or more depending on your size. These fees are non-refundable, even if your application is rejected.
