The primary regulatory body for blockchain and crypto-asset businesses in the UK is the FCA, which is in the process of developing and implementing a comprehensive regulatory framework for the industry. The Prudential Regulatory Authority and the Bank of England are more concerned with matters of prudential and systemic risk for the UK financial services sector, and as such have tended to take less of an interest in the industry, given that it is still relatively nascent. One exception to this, however, has been in relation to stablecoins, where the Bank of England is developing its position in terms of regulating stablecoins that pose a potential systemic risk. The Bank of England has faced some criticism for its approach here, given that it has considered for example limiting the amount of stablecoins that persons may hold – a measure considered unworkable in practice. However, as no stablecoin has been deemed a systemic risk as yet, it is unclear how this might play out in practice.

In terms of international alignment, the United Kingdom has actively implemented laws and standards proposed by international bodies such as the Financial Action Task Force and the Bank for International Settlements, and in certain aspects has sought to go further than is required by these bodies, with a view to being perceived as a gold standard jurisdiction for the industry. It is notable that various regulators internationally have collaborated with the FCA in terms of helping to set a global approach to regulation of blockchain and crypto-assets – cementing the FCA’s position as helping to lead on global regulation of the sector.

The FCA has provided a helpful guide which clearly sets out the different bases on which crypto-assets can be categorised, and was one of the first regulators globally to do this. The approach aligns with the general position under United Kingdom law, in that if a crypto-asset meets the definition of a specified investment then it is regulated, otherwise it is an unregulated token. The nature of the regulated specified investment depends on whether the crypto-asset meets the definition of electronic money (in which case it is classified as an e-money token) or a security token (in which case it is classified as a security token). Otherwise, crypto-assets are classified as “unregulated”.

However, it is worth noting that the fact that a crypto-asset is considered “unregulated” does not, in fact, mean that such crypto-assets are not subject to regulation. Currently, the following activities in relation to all crypto-assets (regardless of regulatory classification) are regulated and require registration with the FCA under the Money Laundering Regulations 2017 (MLRs).

• Acting as a crypto-asset exchange provider (including in the context of acting as an ATM, Peer-to-Peer Provider, or issuer of new crypto-assets). The scope of this activity is broad, as it includes exchanging or arranging, or making arrangements with a view to the exchange of crypto-assets for money or money for crypto-assets, or one crypto-asset for another, meaning that mere introductions are considered as acting as a crypto-asset exchange provider.
• Acting as a custodian wallet provider, being a firm or sole practitioner who by way of business provides services to safeguard, or to safeguard and administer crypto-assets on behalf of its customers, or private cryptographic keys on behalf of its customers in order to hold, store and transfer crypto-assets, when providing such services.

Furthermore, businesses located outside of the UK, and which therefore fall outside the territorial scope of the MLRs, may still be subject to the General Prohibition. This applies to crypto-assets that are both fungible and transferrable, and (subject to certain relatively narrow exceptions) requires firms to get approval from a competent FCA authorised firm before such can be sold into the UK.

The above regime for unregulated crypto-assets is likely to be entirely changed by October 2027, and instead there will be a full authorisation regime. This will mean that there is a comprehensive regulatory regime for firms covering matter such as a conduct of business, market abuse and capital requirements, in addition to the existing AML obligations. Activities caught by the new regime will include issuing a qualifying stablecoin, safeguarding of qualifying crypto-assets and relevant specified investments, operating a qualifying crypto-asset trading platform, dealing in qualifying crypto-assets as principal or agent, arranging deals in qualifying crypto-assets and staking qualifying crypto-assets.

The definition of “qualifying crypto-asset” for the purpose of these rules is generally one that is fungible, transferrable, not solely a record of value or contractual rights (including rights in another crypto-asset), does not fall within certain exclusions for example in relation to certain crypto-assets limited to acquiring certain goods/services and is otherwise unregulated.

There are two particular points to note here. Firstly, the regime will require in-scope firms to set up local UK subsidiaries to address the UK market, and so the ability to instead get cross-border promotions approved will be ended. Secondly, NFTs will generally still be outside of regulation. The expected impact on the UK industry of the changes is expected to be widespread.

If a fund is used to access a crypto-asset product, then generally investors are buying units in the relevant fund rather than direct exposure to the product. In this respect, the legal nature of the investment fundamentally changes to one of investing into a fund.

Funds that invest in crypto-assets are generally required to be AIFs, and as such are not available to the general retail. Whilst there is no legal distinction between AIFs investing into crypto-assets and other classes, in our experience there are often practical differences, due to the complexity of (for example) calculating the NAV of such funds. This means that crypto AIFs tend to use specific service providers that specialise in catering for the crypto-asset industry, and so for example in terms of choosing the host in which to locate the fund, managers are advised to use those hosts that have the specific capabilities to work with crypto funds.

Generally, ICOs are not issued from the UK, because this activity triggers the requirement to register with the FCA as a crypto-asset exchange provider, and the cost of this outweighs the benefit for firms (particularly as new underdeveloped business models may struggle to satisfy the criteria for registration, which generally assume a fully functioning business).

At the moment, there are no specific disclosure requirements for whitepapers in the UK, rather there are general obligations in terms of transparency and fairness, which can broadly be seen in terms of the fact that documents should be clear, fair and not misleading. However, over the next year specific disclosure requirements will be set for crypto-assets wanting to list on UK exchanges, and so this will change soon.

There is not currently a market abuse or insider dealing framework with respect to unregulated crypto-assets in the United Kingdom. With respect to security tokens, the market abuse rules apply on the same basis as they apply to the underlying security.

In the near future, however, new market abuse and insider dealing rules will be applied to qualifying crypto-assets. These new rules will prohibit insider dealing, the unlawful disclosure of inside information, market manipulation of qualifying crypto-assets admitted to trading on a crypto-asset asset trading platform, and they require the public disclosure of inside information on relevant qualifying crypto-assets admitted to trading on a crypto-asset asset trading platform.

Non-compliance with UK requirements is taken seriously by the FCA, which is actively pursuing firms that do not comply.

Much of the focus in the UK has been on firms selling cross-border into the UK in breach of the restriction on financial promotions. Breach of these requirements is a criminal offence, punishable by a potentially unlimited fine, as well as a custodial sentence of up to two years. Whilst most firms have responded to the FCA’s actions by quickly taking steps to ensure compliance, we have seen the FCA take criminal proceedings against HTX (formerly known as Huobi), for unlawfully promoting crypto-asset services to UK consumers without proper authorisation.

Another issue to consider here is the fact that, given that breach of the UK rules is a criminal offence, service providers (such as banking partners) who handle money and assets deriving from the breach are handling the proceeds of a crime, which itself is a criminal offence. As such, service providers are unlikely to support a firm that is in breach of the UK rules.

As new rules come into force next year, an additional consideration could be that contracts entered into in breach of UK rules may be deemed unenforceable, meaning that UK persons may have the right to get their money back in full should something sold in breach of the UK rules lose value.

Under the current rules, the are two different regimes that trigger the need for a licence for firms operating in the UK.

The first is where a crypto-asset functions as a security or e-money, in which case there are FCA authorisation requirements under FSMA on the same basis as applies to securities and e-money generally.

The second applies to all types of crypto-asset, and requires registration under the MLRs where a firms is involved by way of business in one or more of the following services (i) exchanging, or arranging or making arrangements with a view to the exchange of, crypto-assets for money, money for crypto-assets or one crypto-asset for another, or (ii) services to safeguard, or to safeguard and administer, either crypto-assets or private cryptographic keys on behalf of its customers.

Currently, both the above regimes only apply to firms in the UK, and firms selling cross-border into the UK are instead subject to restrictions on making promotions into the UK that require (subject to certain exemptions) approval from an FCA authorised firm to sell into the UK.

Next year, however, this will change, as the MLRs registration regime will be wound down, and instead all relevant business in crypto-assets will fall within scope of FSMA. The breadth of regulated activities will expanded (on which see response to 2.2 Crypto-Asset Regulatory Frameworks). Furthermore, instead of obtaining approval, in-scope firms seeking to sell into the UK will be required to set up a local UK entity and obtain direct FCA authorisation.

As the new rules will likely come into force by October 2027, there will be no grandfathering provision for currently unregulated business – and as such firms are being encouraged to apply for FCA licensing early to be able to continue to undertake UK business.

Currently, for unregulated crypto-assets becoming FCA registered, the requirements are focused on obligations in relation to prevention of money laundering/terrorist financing, and well as ensuring that financial promotions comply with UK marketing rules and that front ends to sell crypto-assets are in compliance with UK rules (designed to increase customer friction and ensure that crypto-assets are only sold where appropriate). In terms of local personnel, currently the requirement is to have one MLRO, and there are no prudential requirements (however firms are expected to have clear planning to show how they will have continued solvency, as well as a credible wind-down plan).

As the new regime comes into force, this will change as crypto-asset firms will be required to operate at a level commensurate with FCA authorised firms, for example with respect to compliance with conduct-of-business requirements as well as capital adequacy.

Firms licensed by the FCA are required to obtain approval before a change of control. The exact threshold for obtaining this approval depends on whether the firm is performing FCA authorised or FCA registered activities, and the exact nature of those activities.

For crypto-asset firms dealing in unregulated tokens, currently the threshold is 25% of the shares of voting power in the firm.

The FCA has made it clear that acquiring a firm should be considered as a way of avoiding the level of due diligence that would be applied by the FCA when getting a direct authorisation. Potential new owners will therefore need to be able to clearly articulate their regulatory business plan for the business, and expect to be subject to the same checks as the exiting owners before being able to buy an FCA regulated firm.

In the UK, there are currently various MoUs with other jurisdictions, which signal an intent by the UK FCA and other regulators globally to work together to facilitate the growth of firms operating on both jurisdictions.

Two jurisdictions worthy of particular consideration are Gibraltar, which has entered into a passporting regime with the UK, as well as Switzerland, which under the Berne Financial Services Agreement has an agreement for mutual recognition with the UK. These developments show the UK steadily repositioning itself post-Brexit and show the general pathways likely to be taken by UK firms for cost-effective international expansion. 

There are restrictions that apply to selling in the UK (i) security tokens; and (ii) otherwise unregulated tokens that are fungible and transferrable. These, for example, require that any invitation or inducement to buy, sell or subscribe for or underwrite crypto-assets are approved by FCA authorised persons. Firms which are licenced by the FCA (including under the MLRs) are able to approve their own promotions.

There are exemptions to the financial promotions restrictions, however for unregulated crypto-assets these are generally narrowly defined. There is no reverse solicitation exemption. Of the exemptions that can apply, the two most in use are those in relation to investment professionals and high net worth companies (technically there is also an exemption for sophisticated investors, however in practice it is not a viable route). There is no exemption for high net worth individuals (which may be able to use an exemption for example in relation to certain security tokens). To use an exemption there are requirements to make certain disclosures and obtain evidence that the exemption is being used properly.

Firms seeking to obtain approval to be able service the UK generally with respect to unregulated tokens that are fungible and transferrable, are subject to strict requirements, including cooling off periods, disclosure requirements, limitations on the amount of crypto-asset ownership, and appropriateness assessments. As the new rules come into force, they will also be required to obtain local FCA authorisation, and to comply with the UK’s requirements generally in relation to their business.

Crypto-assets, such as unregulated NFTs, that otherwise fall outside the financial promotion restrictions, will still be subject to the oversight of the Advertising Standards Authority, which has general jurisdiction over any advertising in the UK, and ensuring that it complies with the UK’s code on advertising. The Advertising Standards Authority has authority to impose fines on firms which fail to comply with the UK’s standards for advertising.

There is no clear basis on which firms can use white-label solutions to sell into the UK by leveraging the licence of an already-existing entity. For example, the appointed representative regime, which allows traditional securities firms to operate under the licence of an existing FCA authorised firm for certain activities, is not available for crypto-assets.

However, innovative solutions are coming into the market to try to resolve this issue, for example in terms of partnerships where a regulated firm carries out all the relevant regulated activities. These set-ups can raise tricky questions, for example in terms of who owns the client, and can become expensive to set up. The situation is evolving, however, as firms get clarity in terms of expectations from the FCA in terms of how such set-ups can operate.

There is no general prohibition of DeFi in the UK, and there is a general acceptance that the DeFi concept has advantages. However, the issues that DeFi faces in the UK are that:

• “making arrangements with a view to” dealing in crypto-assets is generally regulated. This activity is widely interpreted, and as such DeFi firms in the UK will likely be required to obtain a licence – however, the intrinsic nature of DeFi is that there is no entity to obtain the licence, and so it becomes impossible to get; and
• the financial promotions restriction requires approval by an FCA authorised firm. Again, this is going to be tricky to achieve, given that such firms will want to have performed due diligence on the firm they are approving, and there is no such firm to approve.

Instead, the direction of travel in the UK tends to be that DeFi enterprises will sell cross-border to FCA licensed firms (which may therefore receive the relevant communications, using an exemption), and the FCA licensed firms may then design products backed by DeFi which can be sold to the UK market. The licensed firm therefore acts as a centralised bridge into the UK market, and the regulatory direction is generally to support the use of such bridges as providing the required protection for UK consumers.

Whilst there is no prohibition on DeFi in the UK, for the reasons provided in 5.1 Ability to Use DeFi, practically speaking DeFi does not operate in the UK. We do however often see service companies to DeFi projects operate from the UK, as for example providing intellectual property and coding support to offshore DeFi projects is not regulated. This is usually accompanied by contracts and policies/procedures enabling a clear delineation of ownership and roles in using and developing the intellectual property.

From an FCA perspective, much of the focus is on how DeFi is marketed into the UK, as the person making the relevant communication is a centralised point against which the FCA can take enforcement action as required. The view is generally taken that if a DeFi project is outside the UK and there is no communication to UK persons of it, then there should be no harm to UK persons as a consequence.

The position taken by judges is evolving. Cases such as Tulip Trading indicate that in the case of “true” DeFi, it may be possible to argue that no person is responsible for the DeFi proposition, and so there is no person liable for it. However, this will be tricky to provide as, in fact, most DeFi projects tend, in reality, to be centralised– and it is unlikely that a judge will allow a project to claim immunity simply by announcing that it is DeFi.

Payments in crypto-assets are permitted, although there is currently there is no particular regulation in this regard. Whilst this means that the simple sending of crypto-assets from one person to another is generally unregulated, there is complexity in terms of how crypto-assets used for payments are sold. This is because such activity is generally subject to the crypto-assets rules under the MLRs and financial promotion rules, which may not make practical sense given that they are to some extent derived from the approach taken in a securities context.

The UK is, however, currently designing and implementing a regulatory regime for UK stablecoins, which is discussed in 6.2 Stablecoins.

There is no bespoke regulation of RWAs in the UK, and as such RWAs need to be considered against the existing security and crypto-asset regulatory frameworks under FSMA and (currently) the MLRs.

Given that the application of the MLRs is generally unaffected by the classification of the crypto-asset, rather they are determined by the activities taken in relation to them, MRLs are not considered further here.

As regards FSMA, a key question is whether or not the RWA constitutes a unit in a collective investment scheme. In this respect, in very broad terms, there is a distinction between RWAs where the asset is effectively inert and those where the asset is managed.

The former, which would include – eg, gold stored in a vault, may be structured so as not to be a security. In this respect, the token may be considered equivalent to a warehouse receipt, which is not a type of security.

Where discretion is managed in relation to an asset, such as with respect to real estate, then the RWA is generally considered a unit in a collective investment scheme. This is because the act of management may influence the value of the asset, and since day-to-day control of the decision-making process is not with the token holders, as the participants in the asset, the overall set-up is considered a collective investment scheme. It is worth noting that the definition of collective investment scheme is broader than its EU equivalent – the collective investment undertaking – and as such RWAs may be considered securities in the UK but not the EU. The impact of this determination can be stark, and it can result in retail persons being prohibited from participating in the RWA. Furthermore, even if the RWA is not sold into the UK, if the management of the RWA is done in the UK, that can separately trigger the need for a fund management authorisation. Because of this impact, alternative solutions for such RWAs have been considered, for example via the innovative use of debt instruments. Whilst these may work legally, generally the impact of using of these structures is to increase the intrinsic risk of the set-up.

Lastly, it is worth noting that the delivery terms of a RWA need to be considered carefully, in terms of whether there is a derivative. This is generally not the case, as most RWAs are either deliverable on demand, or incapable of delivery (ie, holders of the token simply get the fiat value of the RWA on redemption). However, as the ingenuity of RWA structures develop, care needs to be taken not to inadvertently be selling a regulated option, future or contract for difference.