FCA Crypto Guidance Proposes Enhanced Due Diligence for Unhosted Wallets

The UK Financial Conduct Authority issued consultation paper CP26/38 on 23 October 2026 that updates its non-binding Financial Crime Guide with examples of good practice for transactions to or from unhosted crypto wallets.

FCA Crypto Guidance Outlines Enhanced Due Diligence Expectations

The draft text, including proposed section FCG 3.2.8, presents enhanced due diligence on unhosted wallet transfers as an example of good practice for UK firms receiving cryptoassets. The guidance also recommends consideration of enhanced checks when transactions involve privacy-enhancing tools such as mixers or privacy coins, or when blockchain analysis indicates links to sanctioned addresses or criminal activity.

Firms are expected to apply risk-based blockchain tracing rather than fixed transaction hop limits or arbitrary thresholds. The paper states that rigid cut-offs without risk assessment constitute poor practice. Companies that rely on third-party monitoring tools must understand how those tools generate scores, calibrate them to their own risk profiles, and be able to explain the results to supervisors.

The FCA emphasises that the document contains no new rules and imposes no binding requirements. Firms should nevertheless read and consider the examples when designing or reviewing their financial crime controls. The consultation closes on 24 December 2026, after which the regulator will publish a Policy Statement with final text.

Regulatory Context and Upcoming UK Crypto Regime

CP26/38 forms part of preparations for the expanded cryptoasset regime under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, scheduled to take effect on 25 October 2027. That framework will require authorisation for a wider range of cryptoasset activities, while existing Money Laundering Regulations registration continues to apply in the interim.

The updates sit alongside separate FCA consultations on decentralised finance and perimeter guidance published earlier in 2026. The unhosted wallet section addresses a specific risk area that has drawn supervisory attention across multiple jurisdictions. Similar expectations appear in guidance from the Financial Action Task Force and several EU member states on travel rule implementation and self-hosted wallet controls.

Market participants note that the guidance aligns with existing expectations for risk-based customer due diligence under the Money Laundering Regulations. The new examples provide concrete illustrations rather than prescriptive obligations, giving firms flexibility to tailor controls to transaction size, counterparty type and blockchain analytics output.

Industry Response and Practical Steps for Compliance Teams

UK-registered cryptoasset firms are reviewing current wallet screening procedures against the draft examples ahead of the consultation deadline. Several trade associations have indicated they will submit comments on the calibration of risk scores and the documentation burden associated with third-party tool outputs.

Compliance teams are advised to document how their existing policies address unhosted wallet transfers, privacy coin activity and sanctions screening results. Where gaps appear, firms may need to adjust policies or enhance staff training before the 2027 authorisation regime begins. The FCA has signalled that it will use supervisory engagements to assess whether firms have considered the published examples.

Feedback received during the consultation will shape the final version of the Financial Crime Guide and may influence future enforcement priorities once the expanded regime is live. Firms that maintain clear records of their risk assessments and tool calibration decisions are better positioned to demonstrate compliance during future FCA reviews.