FCA lists extra checks on unhosted wallet deposits as good practice, not as a rule, and sets no threshold

The Financial Conduct Authority (FCA) wants UK crypto firms to treat deposits from unhosted wallets as a reason for closer checks, but it is not making that a rule. In draft changes to its Financial Crime Guide, published on 23 October 2026 in consultation paper CP26/38, the regulator lists “enhanced due diligence” on customers or transactions funded by unhosted wallets as an example of good practice. Comments are open until 24 December 2026.

The proposal sets no amount above which checks start, and it does not ban or cap transfers to or from a wallet a customer controls. The paper says the Guide “does not contain rules nor impose any new requirements.” What it does do is tell firms how the FCA will judge their controls once the UK crypto regime starts on 25 October 2027, and it lists two practices as poor: stopping a trace after a fixed number of “hops”, and relying on analytics scores that nobody at the firm can explain.

That is a different approach from the European Union, where an exchange must already check, by law, whether a self-hosted address belongs to its customer once a transfer goes above EUR 1,000. Coindaro read the 91-page consultation paper, including the draft text of the Guide in Appendix 1; the FCA web page itself only lists the topics.

CP26/38 is the third FCA crypto consultation in a week. On 21 October the regulator opened its perimeter guidance and its DeFi guidance, covered in our report on the FCA perimeter consultation and trade-routing apps. That paper decides who needs a licence. This one covers how licensed firms should fight money laundering.

What the FCA draft says about unhosted wallets

An unhosted wallet, also called a self-hosted or personal wallet, is one where the user holds the private keys, rather than an exchange or a custodian. Hardware wallets and non-custodial phone or browser apps fall in this group. Our glossary entry on self-custody explains the difference with an account held on an exchange.

The wallet passage sits in chapter 3 of the Guide, on money laundering and terrorist financing, under FCG 3.2.8, the section on enhanced due diligence in higher-risk situations. The draft adds two lines to its column of good practice. The first describes a firm that considers when customers or transactions linked to cryptoassets present a higher risk and “applies enhanced due diligence as appropriate, including customers or transactions funded by unhosted wallets.” The same line puts mixers, tumblers and privacy-enhancing coins in the same bracket. The second line is shorter: a firm applies enhanced due diligence for transactions involving unhosted wallets.

Enhanced due diligence, or EDD, is the heavier layer of customer checks that UK money laundering law already requires in high-risk cases: more questions about where money comes from, closer monitoring of the account, sometimes approval by a senior manager. The draft does not list which questions a firm should ask about a personal wallet, and it does not say that a firm must prove the customer owns the wallet. Those details are left to the firm.

The wording “as appropriate” matters. The FCA does not say every deposit from a personal wallet is suspicious. It says a firm should consider when such transactions present a higher risk and act on that assessment. The Guide in force today already mentions “transactions involving the use of self-hosted addresses” in FCG 3.2.7, according to the FCA Handbook. The draft turns that mention into examples of what the FCA considers good practice.

One case is firmer. In FCG 3.2.7, which lists situations where the Money Laundering Regulations require specific EDD measures, the draft includes transactions where findings from blockchain analysis indicate exposure to criminal or sanctioned activity. There, EDD “must be performed”, in the Guide’s words.

Tracing funds: no fixed hop count, no black-box scores

The second change concerns ongoing monitoring, in FCG 3.2.5. Among examples of poor practice, the draft describes a crypto firm that applies “a rigid rule concerning the number of ‘hops’ or relevant transfers it scrutinises” without accounting for risk. A hop is one step in the chain of transfers between addresses. A fixed cut-off, say two hops back from a deposit, ends the check at the same point whatever the earlier steps show.

The draft does not set a number of its own. It asks for measures that fit the risk: a firm that spots a mixer or a flagged address a few steps back may need to keep tracing, while a short, clean history may not call for more.

A second poor-practice example targets outsourced analytics. A firm that uses third-party technology in its controls “and is unable to explain or evidence the basis for findings made or scoring applied” falls short, according to the draft. The line names no supplier, but it fits the blockchain analytics tools whose risk scores exchanges use to accept or block deposits. The good-practice side describes a firm that calibrates its tools to its own risks and keeps an audit trail for every rule and decision.

Doing too little is criticised as well: the draft lists as poor practice a firm that makes no use of data or blockchain analytics in its ongoing monitoring once crypto activity is identified. And in the section on customer checks, FCG 3.2.4, it states that a firm using third-party tools for key parts of its customer due diligence or transaction monitoring “remains responsible” for oversight and for meeting its obligations.

Banks, stablecoin issuers and the travel rule

The wallet lines are the most visible part, but the crypto changes reach further. In FCG 3.2.3, on risk assessment, the draft asks any firm covered by the chapter, which includes banks, to weigh where the crypto services a customer used operate when that customer’s wealth or funds come from crypto. The example given contrasts a regulated crypto firm in a low-risk country with an unregulated one in a high-risk country. Exposure to anonymity, privacy or decentralised products also counts.

For stablecoins, the draft says a UK-authorised issuer, or a third party running its anti-money laundering checks, should carry out customer checks within a reasonable time at onboarding and at redemption, and that redemption should only happen once the relevant financial crime obligations are met. A line in FCG 3.2.7 asks firms to consider strengthening their controls when they are exposed to qualifying stablecoins issued outside the UK, particularly where their rules differ from the UK’s.

On the travel rule, which has applied to UK crypto transfers since 1 September 2023, the draft adds guidance for incomplete messages. When required details about the sender or the recipient are incomplete or missing, a firm should have a process to ask the counterparty, then make a risk-based decision on the transaction if the information still does not arrive. Firms are also reminded that they must report persistent failure to comply with the travel rule to the FCA, which already set out its expectations in a 2023 statement on the cryptoasset travel rule.

Not a new rule, says the FCA, and no cost estimate

Guidance has a different legal weight from a rule. According to the paper, the Guide gathers general guidance, good and poor practice examples drawn from supervision, and self-assessment questions. Firms are expected to read it and use it together with their own judgement. In Annex 2 the paper adds that departing from it does not, of itself, indicate a breach of FCA rules, a point CryptoSlate also made in its report on 26 October.

Non-binding does not mean ignored. The FCA writes that it expects firms to have read and considered the Guide, and it presents the crypto examples as help for firms that are preparing their applications for authorisation.

No cost benefit analysis came with the paper. In Annex 2 the FCA says the updates “reflect existing regulatory expectations and established industry practice” and that it does not expect a material increase in compliance work or material costs to consumers.

The paper gives its own reasons for the crypto section. The UK’s 2025 National Risk Assessment rated the money laundering risk of cryptoassets as high and the terrorist financing risk as medium, and the FCA notes that the cross-border speed of blockchain transfers makes detection hard. Many firms, it adds, will be new to these obligations.

The UK crypto timetable: from registration to authorisation

Crypto exchanges and custodian wallet providers have had to register with the FCA under the Money Laundering Regulations since January 2020. That registration regime is being replaced. Under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026, firms that carry out regulated crypto activities in the UK will need full FCA authorisation from 25 October 2027 and will have to follow the FCA’s financial crime rules, which the paper says were published in PS26/13.

Applications for authorisation opened on 30 September 2026 and close on 28 February 2027, according to the FCA’s pages on the new regime. The Financial Crime Guide update is meant to help applicants build controls before they file.

UK vs EU on self-hosted wallets: guidance against a legal duty

The EU went the other way. Under the Transfer of Funds Regulation, Regulation (EU) 2023/1113, which has applied since 30 December 2024, a crypto-asset service provider that sends to or receives from a self-hosted address must collect information about the transfer. Above EUR 1,000 it must also take measures to assess whether that address is owned or controlled by its own customer (Articles 14 and 16).

The European Banking Authority published travel rule guidelines in July 2024 on how firms should carry out that ownership check. Secondary sources describe the number of verification methods required in the final text differently, and Coindaro has not checked that point against the EBA document, so we do not state it here.

So a French or Italian user who withdraws more than EUR 1,000 from an exchange to a personal wallet may already be asked to show that the wallet is theirs; how the platform checks it varies. In France the AMF and the ACPR supervise crypto firms under MiCA; in Italy it is Consob and the Banca d’Italia, with the OAM keeping the register of older virtual asset providers. The EU will go further from 10 July 2027, when the Anti-Money Laundering Regulation bans anonymous crypto accounts, as listed in our event page on the EU AML Regulation.

Other countries have been harsher. Russia will end peer-to-peer crypto trading between individuals on 1 July 2027, and its central bank says a person may not move coins from a regulated account to their own non-custodial wallet, as we reported in our piece on Russia’s P2P and wallet restrictions. Next to that, and next to the EU threshold, the UK draft is the lightest of the three: it leaves the transfer open and asks the firm to judge the risk.

What changes for a UK user who withdraws to a personal wallet

Nothing changes today. CP26/38 is a draft, and the final Guide will only come with a Policy Statement whose date the FCA has not given.

If the text stays as it is, a UK exchange that receives coins from a customer’s own wallet is more likely to ask where they came from, especially if the coins passed through a mixer or touched a privacy coin. Being asked is not an accusation. The draft also makes it harder for an exchange to justify a refusal based only on a vendor’s score that its own staff cannot explain.

With no threshold in the draft, a small deposit can attract questions if other risk factors appear, and a large one need not if the history is clean. That is the trade-off of a risk-based model: fewer automatic checks, more room for each firm to decide, and less predictability for the user. For the basics of custody and the types of wallet, see our guide crypto wallets explained.

How to respond, and what is still unknown

Responses go through the online form on the FCA page, or by email to [email protected] for those who cannot use the form. Annex 1 of the paper lists five questions, among them whether respondents agree with the drafting and whether they foresee unintended consequences. The FCA will publish its feedback together with the final text of the Guide in a Policy Statement.

Several points remain open. The draft does not say how a firm should establish that a personal wallet is linked to its customer, if at all. It does not distinguish between deposits and withdrawals beyond the phrase “funded by unhosted wallets” in one line and “involving unhosted wallets” in the other. No UK industry body had published a reaction by 26 October, as far as Coindaro could find. Comments close on 24 December 2026; the regime they prepare for begins on 25 October 2027.