Money Laundering and Terrorist Financing (Amendment) (No. 2) Regulations 2022

The regulations form a multi-part amendment rather than a standalone crypto licensing regime. They introduced a new Part 7A governing information that must accompany certain cryptoasset transfers, strengthened the Financial Conduct Authority's oversight of changes in control at registered cryptoasset businesses, and added measures concerning proliferation-financing risk, beneficial-ownership discrepancies, suspicious activity reporting and information sharing.

The explanatory material states that the cryptoasset transfer provisions implement the Financial Action Task Force recommendation commonly known as the Travel Rule. For this purpose, a cryptoasset business means a cryptoasset exchange provider or custodian wallet provider. Part 7A can apply where at least one business participating in an inter-business transfer carries on business in the United Kingdom.

For an inter-business cryptoasset transfer, the originating business must ensure that specified information accompanies the transfer. The core data includes the names of the originator and beneficiary, relevant business names, and account numbers or a unique transaction identifier. When a transfer involves a cryptoasset business outside the United Kingdom and is at least €1,000, including linked transfers, additional originator information is required. The originating business must verify required originator information from an independent source before sending the transfer.

The amendment also introduced a €1,000 customer due diligence trigger for cryptoasset exchange providers and custodian wallet providers. Apparently linked transfers are aggregated when assessing that threshold. The threshold-based requirements sit alongside the broader risk-based and customer due diligence duties in the 2017 regulations.

Beneficiary businesses must check for missing or non-corresponding information, while intermediaries must check for missing information. Where required data is absent, the receiving business must request it and consider delaying or returning the transfer using risk-based factors. Repeated failures by another cryptoasset business must be reported to the FCA.

The rules do not impose an identical data request on every transfer involving an unhosted wallet. Instead, a cryptoasset business may request information according to its assessment of money laundering, terrorist financing and proliferation-financing risk. Where the business requests information but does not receive it, the regulations restrict it from making the cryptoasset available to the beneficiary.

The regulations expanded FCA oversight of registered cryptoasset businesses by creating a change-in-control process. The FCA may assess a proposed acquisition or increase in control and may object before the change occurs under procedures adapted from the Financial Services and Markets Act 2000. The instrument also made Part 7A obligations enforceable as relevant requirements and requires cryptoasset businesses to respond fully and without delay to qualifying written requests from law-enforcement authorities.

Beyond crypto transfers, the instrument requires HM Treasury to arrange a national assessment of proliferation-financing risk. Relevant persons must identify and assess their own exposure, generally keep an up-to-date written record, and maintain risk-based policies, controls and procedures. Other amendments include an ongoing duty to report material beneficial-ownership discrepancies and changes supporting information exchange and suspicious activity reporting.

The instrument had four commencement stages: 11 August 2022 for regulations 1, 2 and 12; 1 September 2022 for most provisions; 1 April 2023 for regulations 9, 16 and 17; and 1 September 2023 for regulation 5 and Part 7A. All scheduled stages have therefore commenced. Because S.I. 2022/860 operates by amending the 2017 regulations, the current consolidated text and FCA publications provide the clearest view of the rules as subsequently amended.