UK FCA Regulatory Brief

Headline

FCA issues Final Notice and £71 million fine against unregistered crypto exchange for operating without required UK registration

Executive Summary

The Financial Conduct Authority has issued a Final Notice against a crypto asset exchange operating under the trading name CryptoRoute, imposing a £71.2 million financial penalty for carrying on regulated cryptoasset activity in the United Kingdom without the required registration under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. The FCA determined that CryptoRoute operated a cryptoasset exchange and custodian wallet provider serving approximately 142,000 UK customers between January 2023 and October 2025, during which period the firm failed to implement adequate anti-money laundering controls, customer due diligence procedures, or transaction monitoring systems as required under the MLRs.

Key Regulatory Signals

• Unregistered Activity Enforcement Precedent: The £71.2 million penalty represents the FCA's largest enforcement action against an unregistered cryptoasset business and signals a materially escalated enforcement posture against firms operating without MLR registration, establishing a deterrent reference point for other unregistered operators serving UK customers.
• Extraterritorial Reach Confirmed: CryptoRoute was incorporated and operated its technology infrastructure outside the UK, confirming the FCA's position that firms targeting UK customers through digital channels are subject to MLR registration requirements regardless of their place of incorporation, a posture that expands the effective jurisdictional reach of UK financial crime regulation.
• AML Control Deficiency Standards: The Final Notice details specific AML control failures including absence of customer risk assessment frameworks, failure to conduct enhanced due diligence on high-risk customers, and non-implementation of transaction monitoring systems, providing a compliance baseline against which registered and prospective registrants should benchmark their own control environments.
• Consumer Harm Quantification: The FCA's determination quantified consumer harm at approximately £18 million in customer losses attributable to CryptoRoute's unregistered operations, establishing a methodology for future disgorgement and restitution calculations in cryptoasset enforcement proceedings.
• MiCA Regulatory Convergence: The enforcement action aligns with the European Union's Markets in Crypto-Assets Regulation enforcement trajectory, where parallel unauthorized activity cases are proceeding through NCAs in France, Germany, and the Netherlands, indicating cross-jurisdictional regulatory convergence in cryptoasset enforcement standards.

Regulatory Delta

The FCA's prior cryptoasset enforcement posture was defined primarily by the January 2021 consumer warning regarding unregistered cryptoasset businesses and subsequent actions against firms operating under the Temporary Permissions Regime, including the revocation of several provisional registrations in 2023-2024. This Final Notice represents a qualitative escalation in that it targets a firm that never sought registration and operated entirely outside the UK regulatory perimeter, establishing that the FCA will pursue substantial financial penalties against offshore operators targeting UK consumers rather than limiting enforcement to border-control measures such as website blocking orders under Section 349 of FSMA 2000. The action also aligns with HM Treasury's ongoing consultation on expanding the cryptoasset regulatory perimeter under the Financial Services and Markets Act 2023, which would bring additional cryptoasset activities within FCA's direct supervisory scope.

Materiality Classification

High — Largest FCA enforcement action against an unregistered cryptoasset business, establishing extraterritorial enforcement precedent and materially elevating compliance expectations for all firms operating in or targeting the UK cryptoasset market.

Time Horizon

Immediate — Final Notice is effective upon publication; unregistered cryptoasset businesses serving UK customers face immediate enforcement risk and should seek legal counsel on registration obligations without delay.

Intelligence Outlook

Monitor the FCA's cryptoasset enforcement register for additional Final Notices against unregistered operators. Track HM Treasury's cryptoasset regulatory perimeter consultation for expanded FCA supervisory authority expected to take effect in late 2026 or early 2027.