If you plan to apply for UK cryptoasset authorisation, the FCA has just told you what its financial crime supervisors will expect to see. On 23 October 2026 it opened CP26/38, a consultation on updates to its Financial Crime Guide, with a new set of cryptoasset examples tied to the regime that starts on 25 October 2027. Comments close on 24 December 2026, so there is a two-month window to shape the final text.
For a licensing decision the message is practical. The guide is general guidance, not new rules, but the FCA reads applications and later supervises firms against it. A crypto business that can show wallet screening, blockchain analytics and a working Travel Rule process at gateway stage is in a stronger position than one that promises to build them after approval.
What does CP26/38 say about crypto firms?
The proposals add good and poor practice examples for cryptoasset businesses. Three themes stand out.
Unhosted wallets and mixers
The proposed text treats enhanced due diligence on transactions involving unhosted wallets as good practice, and lists funding from unhosted wallets as a higher-risk trigger. A self-assessment question asks whether your business model is exposed to anonymity or privacy coins, mixers or tumblers. Expect an application reviewer to ask how you would answer it.
Blockchain analytics
Using blockchain analytics for source-of-funds checks and for ongoing on-chain monitoring is described as good practice. Making no use of analytics data in ongoing monitoring is described as poor practice. The FCA is not asking for a particular vendor, but a firm should be able to explain what its tooling flags and why.
The Travel Rule
The guide restates that cryptoasset transfer obligations have applied since 1 September 2023. Firms should collect, verify and transmit originator and beneficiary information, and report persistent failures by counterparties to the FCA. If you already operate under the UK registration, this is a reminder of current duties. If you are applying for the first time, it describes what your policies must already cover.
Why the FCA is raising the bar now
The consultation cites the 2025 National Risk Assessment, which rates money laundering risk for cryptoassets as high and terrorist financing risk as medium. That rating explains the tone. Firms registered since January 2020 and new entrants will be judged against the same financial crime expectations once authorisation applies.
What founders and compliance leads should do before 24 December
First, map your transaction monitoring and onboarding controls against the examples and note any gaps in writing. Second, check your Travel Rule tooling works with the counterparties you actually use. Third, decide whether to respond to the consultation: the examples will become the yardstick for supervisors, and practical objections carry weight.
If you are still choosing where to launch, compare the UK against EU routes on the crypto comparison page and read the UK crypto licensing profile. Firms that also issue or hold customer money should review the UK e-money profile, because the same financial crime guide applies across both. Our reports track how these regimes are moving.
Sources
This article is for information only and is not legal advice.