A New Dynamic

Traditionally, a centralised business generally has a clear jurisdiction in which it operates, and so the law and regulation of that jurisdiction will tend to apply to the business. Web2 first challenged this model of law and regulation, by enabling business to more easily be set up in one jurisdiction (often referred to as the “home jurisdiction”) and sell into a separate jurisdiction (often referred to as the “host jurisdiction”). However, the friction between Web2 and the traditional regulation has been limited by the fact that, generally:

• the level of geographical complexity is limited (there is usually a clear dividing line such that it is clear a business in one jurisdiction is selling into another, and so regulators can demarcate their responsibilities); and
• the products sold by Web2 companies do not tend to be “security-like” unless they actually are securities (in comparison with initial coin offerings, which may in their early stages have characteristics in common with an equity raise whilst in their later stages the actual token may not have any security-like characteristics – eg, because it is effectively a voucher for goods or services).

The UK regulatory framework is currently in the process of adapting to meet these challenges, with a view to turning the country into a “crypto hub”. The way in which the UK is seeking to become a crypto hub is by positioning itself as a premium jurisdiction for Web3 business: meaning that there is a proper regulatory framework for these businesses that walk the fine line between, for example, protecting consumers (so that consumers can invest with confidence) and promoting competition (as a diversity of competition offers greater choice and promotes the UK as a place to do business).

This article will examine some of the difficulties that have been faced by the UK in terms of adapting its existing legal and regulatory structure to meet the challenge of becoming a crypto hub, the ways in which businesses have reacted to these recently, and what market observers can expect to see in the near future in terms of change of approach and how businesses may react.

In particular, the following will explore the core theme of regulatory expansion, on the assumption the regulation is a force for good, and its interaction with an industry which has historically sought to avoid regulation.

Activities Performed From the UK: The Current Position

The regime for UK crypto-asset business regulation broadly splits into three. The first regime, set out in the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 (RAO), encapsulates the traditional securities markets. The second, which is focussed in particular on the prevention of money laundering and terrorist financing, is set out in the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs). The third concern invitations or inducements to engage in investment activity, and is set out in the Financial Services and Markets Act 2000 (Financial Promotion) Order 2005 (FPO).

The philosophical starting point of many Web3 businesses being anti-establishment, the fact that the regulatory regimes may place restrictions on potential client base, and the start-up nature of many Web3 businesses (meaning limited resources and budget), have often meant that their initial reaction to both regimes has been to stay outside of their scope. This has been a question, firstly, of whether the business is of a regulated nature, and, if it is, whether it is being performed “in the United Kingdom”.

Introducing the RAO

The RAO requires businesses to obtain authorisation from a UK regulator (at least one of the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA)) where they engage in business that involves both a “specified activity” in relation to a “specified investment”.

The scope of “specified activity” is generally broad, and so, for example, would capture investment advice, and making arrangements with a view to the sale of certain specified investments. The core focus for Web3 business has therefore been on the definition of “specified investment”. There is a definitive list of specified investments, with specific definitions, set out in the RAO, and where a crypto-asset falls within the scope of one of the definitions it is regulated as the relevant specified investment (as regards crypto-assets, FCA guidance has split these out as either security tokens or e-money tokens: tokens which fall outside the definition of a specified investment are unregulated tokens).

The advantage of this approach has been clear regulatory certainty: we can say which tokens are in/outside of scope. This is good for business. The disadvantage of this approach is that tokens may be created that have security-like attributes without having to adhere to the protections which would normally be afforded in a securities sale. This could be bad for consumers, particularly if they are unable to differentiate between investments that do and do not have regulatory protections.

The reaction has therefore been twofold: firstly, the FCA has made clear that Web3 businesses need to avoid consumer confusion. This is by, for example, being clear with customers which products are within the regulatory framework, and which are not. The second reaction has been to extend the regulatory perimeter, so that, for example, investment advice in unregulated crypto-assets becomes a regulated activity, and also new laws targeting the prevention of market abuse. Much of this move has its roots in traditional financial regulation, which in turn has its roots in the same underlying frameworks that are in place in the EU.

Whilst a degree of similarly with the EU is, therefore, to be expected, what is being determined is how far the UK will differentiate itself as an attractive jurisdiction from the EU. One of the advantages of being outside the EU is the fact that UK regulators can be given greater discretion regarding how regulation will be applied and whether regulation can be changed to accommodate changes in the ecosystem. A well-publicised example of this has been the FCA sandbox, which is a mechanism enabling innovative business models to interact with the FCA and, as a result, for the FCA to adapt its approach to allow for these businesses. The popularity of the sandbox has been demonstrated by the number of other jurisdictions which have sought to adopt an equivalent.

In this respect, the concept of the “scale box” is going to be interesting. This builds on the work of the sandbox, which was concerned with testing new propositions, and looks at the issue of how fintechs can scale up their businesses.

Meet the bogeyman: the MLRs

The MLRs regime has had a bumpier reception. The core of this regime has of course been on preventing money laundering; however, the regime has been plagued by two issues.

Firstly, it is unclear what the scope of the regime actually is. In particular, “making arrangements with a view to a transaction” requires registration with the FCA, and the scope of these words is vague. Some practitioners, generally out of caution, have sought to interpret them in accordance with similar wording in the RAO: a doubtful approach as (i) there is inconsistent interpretation of these words for different RAO activities; (ii) arguably, the approach is different to the guidance provided by the Joint Money Laundering Steering Group; and (iii) it has led to absurd outcomes.

Secondly, it has undervalued the role of the FCA. The FCA’s remit in relation to businesses is to regulate various aspects, including conduct of business and prudential requirements. As such, limiting the FCA’s role to just money laundering has caused tension as the regulator has been generally reluctant to approve businesses for registration which do not meet the FCA’s expectations generally on how to run a business. This has led to businesses criticising the FCA for a lack of regulatory clarity, as the perception is that they are being tested on aspects of their business which are not within scope of the regime, and without a clear roadmap of what the FCA expects to see.

Therefore, it is perhaps right that this regime is going to be largely replaced by the expansion of the FCA’s regulatory perimeter when the Financial Services and Markets Bill (FSMB) comes into force. The FSMB will provide a mechanism for giving the FCA the right tools for the job when it comes to regulating crypto-assets. It will be interesting to see how the FCA takes this forward; what is already clear is that the FCA is likely to become more involved in the industry.

Closing the “loophole”: marketing into the UK

The weakness of the above regimes is that they only apply to businesses in the United Kingdom: as such, if a business sets up a subsidiary outside the UK, it may be able to sell into the UK whilst still falling outside of the scope of the regimes.

In the context of securities, this issue is dealt with by a prohibition, set out in the Financial Services and Markets Act 2000 (FSMA), on making an invitation or inducement to engage in investment activity into the UK (whether by an entity inside or outside the UK), called a “financial promotion”, unless that financial promotion has been approved by an entity authorised by the FCA, or it is made in accordance with an exemption.

Security tokens have always been subject to the financial promotion restriction. However, as of October 2023, the financial promotion restriction has now been extended, via an amendment of the FPO, to those unregulated crypto-assets which are both transferrable and fungible. The rationale for this has been that, for example, it would be inappropriate for the regime to apply to non-fungible tokens which (for example) represent theatre tickets: the promotion of theatre tickets is not a financial promotion, and so it is right that it does not become a financial promotion simply by virtue of the fact that the blockchain is used to record the ticket in the form of a non-fungible token.

Whilst there will be exemptions for financial promotions to certain types of potential investor, which exemptions overlap with the traditional securities regime, generally the exemptions available are narrower, as for example there is no exemption for self-certified sophisticated investors.

The broader backdrop here has been interesting, as it demonstrates a different style of regulation. Of particular note is the new requirement that retail investors can only invest up to 10% of their net assets into crypto-assets. The novelty here is the move away from a black and white view of an investment class (where a group of investors are either eligible or not eligible), but rather a more nuanced approach that understands that it may make sense for the general retail public to be able to access certain investment products, so long as they are taking a sensible attitude towards risk management.

A Little Bit of Magic and the Great Migration?

What is clear is that the proposed changes to regulation in the UK will, by their nature, cause more businesses to need to obtain a licence. The UK is one of the most vibrant centres for Web3 globally, and participants will be expected to play by the rules. It is therefore very likely that the near future will see an influx of businesses seeking to become licensed in the UK to perform crypto-asset business. This is particularly likely to be the case as businesses in other jurisdictions, which may be becoming less friendly towards Web3, may look to the UK as a jurisdiction that is striving to achieve legal and regulatory certainty.

However, it is also clear that other jurisdictions are looking to position themselves as alternative places for Web3 firms to do business – and the decentralised nature of Web3 business means that it is relatively easy to shift international structures to take advantage of these jurisdictions. A key question here is, therefore, how the UK will continue to position itself as a jurisdiction of choice. A notable development in this regard is the fact that the FCA has a competition objective, which is focussed on promoting the UK as a place to do business from – and this is one of the drivers of the sandbox and scale box initiatives, discussed above.

Whilst the FCA is an important part of the UK landscape, and indeed tends to be the popular focus of businesses evaluating the UK, it should not be viewed in isolation. There are broader considerations, and in this respect the work of the Law Commission has been valuable for practitioners, in that it caused the UK to become one of the first jurisdictions generally to recognise crypto-assets as a form of property, giving legal certainty to businesses. Moving forwards, the work of the Law Commission in facilitating the adoption of decentralised autonomous organisations (DAOs) by recognising their existence and considering the legal implications of their operation, is likely to be invaluable.

A Unified Approach?

Whilst there is a tendency to emphasise differences between jurisdictions, such variation should not be overemphasised as regulators are increasingly co-ordinating their approaches. An example of this has been as regards the travel rule, which requires crypto-asset service providers to obtain and share certain information from the senders and receivers of crypto-assets. Like most jurisdictions, the UK has generally implemented this requirement, meaning that UK based crypto-asset service providers must ensure they have received and verified the relevant information before permitting transfers between crypto-asset businesses. In this respect, it is worth noting that the effectiveness of the travel rule presupposes a level of international co-operation, as non-UK business will be asked for the relevant information – and if they are unable to supply it, it is harder for UK businesses to work with them. What can be seen here, therefore, is an attempt to foster more of an internationally harmonised approach to deal with an internationally decentralised industry, and therefore the potential for increasingly co-ordinated approaches by regulators to stop regulatory arbitrage.