The Financial Conduct Authority (FCA), the United Kingdom’s primary financial regulatory body, has opened a consultation on proposed updates to its Financial Crime Guide, targeting how firms should approach crypto transactions involving personal wallets. The consultation, CP26/38, began on October 23, 2026, with responses due by December 24, 2026.
Consultation seeks input on crypto due diligence
Under the draft guidance, the FCA recommends that firms apply enhanced due diligence to transactions involving unhosted, or personal, cryptocurrency wallets. These wallets are not managed by an exchange or other third party; instead, users maintain direct control of the wallet’s private keys.
The FCA’s proposed approach highlights additional checks for funds transferred from unhosted wallets as best practice, emphasizing the importance of robust procedures when clients send crypto from these personal accounts. Enhanced due diligence typically includes deeper verification and a more thorough assessment of the risks associated with specific transactions.
The new guidance is not legally binding and does not introduce new rules or requirements for regulated businesses. However, the FCA expects firms to carefully consider the Guide when designing their anti-financial crime controls. Non-compliance with the Guide, on its own, will not be treated as a violation of FCA regulations.
The FCA urges firms to perform “enhanced due diligence” when processing transactions initiated from unhosted wallets, recognizing these transfers may involve higher risks than those from managed accounts.
Personal wallet transactions have historically posed additional challenges for regulated firms, as client identity verification can be more complex when customers control their own wallets instead of using custodial solutions.
Mini dictionary: Unhosted (personal) wallets are cryptocurrency wallets in which the user controls the private keys and does not rely on third-party custody or centralized services, contrasting with wallets managed by exchanges.
Third-party tools and transaction tracing under scrutiny
The FCA’s draft also addresses how firms should approach risk assessment when using third-party software or analytics. Section FCG 3.2.5 of the guide warns against relying on external risk scores or technology if firms cannot clearly explain or substantiate the basis for those assessments. The regulator stresses that firms are still accountable for compliance, regardless of their use of third-party providers.
The FCA considers it poor practice for firms to use risk scores or risk indicators from outside vendors without being able to evidence or justify the methodology and results.
Additionally, the FCA criticizes inflexible rules specifying how many “hops” or stages in a transaction’s path must be traced. The draft suggests that rigidly tracing a set number of stages, without considering underlying risk factors, may not be a sound risk management approach.
| Requirement | Draft Guidance | FCA Criticism |
|---|---|---|
| Enhanced due diligence on unhosted wallets | Recommended as good practice | Applies higher scrutiny to personal wallet transfers |
| Use of third-party risk scores | Permitted with substantiated methodology | Poor practice if firms cannot justify the risk score |
| Transaction tracing (“hops”) | Not prescriptive on number of hops | Rigid limits disregarding risk are not encouraged |
Impact on regulated firms and next steps
The FCA states that these changes are meant to clarify expectations rather than create substantial new compliance obligations or additional costs for firms or consumers. The regulator believes the proposals primarily align with existing practice across the industry.
These recommendations will complement the UK’s Travel Rule, which has required crypto businesses to collect, verify, and transmit certain transfer information since September 1, 2023. The updated Guide is also set to align with a revised UK regulatory regime for crypto assets expected to take effect in October 2027.
The consultation and proposed updates to the Financial Crime Guide cover a wider range of topics beyond crypto, including fraud, sanctions compliance, proliferation financing, data security, anti-money-laundering and measures to prevent terrorist financing.
All firms subject to FCA oversight for financial crime—such as crypto asset businesses registered under Money Laundering Regulations—are invited to submit written feedback by the December 24, 2026 deadline. The FCA has not specified when it will publish the final guidance but plans to review feedback and release the policy statement in due course.
