Crypto Exchange Regulation: A 2026 Compliance Guide

The most expensive mistake in crypto exchange regulation is assuming that an FCA cryptoasset registration gives you permission to operate a fully regulated exchange. It doesn't. In the UK, registration for anti-money-laundering supervision and authorisation for broader financial-services activities sit on different regulatory foundations, with different evidence, controls and consequences.

A founder should therefore stop asking, “Which crypto licence do we need?” The useful question is, “Which activities will our business perform, for whom, through which entities, and under which regulatory gateway?” That activity map should drive jurisdiction, product design, governance, technology, outsourcing and the application narrative from the beginning.

Table of Contents

• Why Crypto Exchange Regulation Is Not One Question
  • Build the permissions map before the product roadmap
• The UK Regulatory Ladder from Registration to Authorisation
  • Treat each rung as a launch decision
• Cross-Jurisdiction Approaches Compared
  • Pick the starting jurisdiction by operating reality
• AML, KYC and the Travel Rule in Practice
  • Make the Travel Rule operational
• Custody, Safeguarding and Client Asset Protection
  • Decide what the exchange actually controls
• Market Conduct, Operational Resilience and Governance
  • Turn obligations into one control architecture
  • Evidence matters as much as policy
• Designing a Compliance Programme That Survives Scrutiny
  • Policy must follow the activity map
  • People need defined authority
  • Systems should produce defensible evidence
  • Review the perimeter whenever the product changes

Why Crypto Exchange Regulation Is Not One Question

An exchange may operate a matching venue, execute customer orders, arrange transactions, safeguard assets, provide wallet services, offer staking or support fiat payments. Those activities don't automatically share one permission. A platform that only introduces customers to another execution venue sits in a different position from a business that operates the venue, controls customer assets and makes markets against its users.

The UK's initial crypto regime illustrates the distinction. The FCA became supervisor for relevant cryptoasset businesses on 10 January 2020 under the UK implementation of the Fifth Money Laundering Directive. That regime covers activities including operating a cryptoasset exchange and providing custodian wallet services, but its central purpose is financial-crime supervision, not full financial-services authorisation. Firms must register and demonstrate effective customer due diligence, transaction monitoring, sanctions compliance, governance and financial-crime risk management. The FCA's explanation of the regime and its application outcomes is set out in its cryptoasset registration guidance.

Among applications determined since January 2020, 391 cases had been decided, with only 68, or 17%, registered. A further 46, or 12%, were rejected, 14, or 4%, were refused, and 263, or 67%, were withdrawn, according to the same FCA registration data. Those figures are not a pass-rate prediction for your business. They are a warning that registration is a substantive supervisory gateway, not an administrative formality.

Build the permissions map before the product roadmap

Start with a service inventory, not a licence checklist:

• Trading venue activity: Determine whether the entity operates a platform, matches orders, executes orders or merely introduces customers.
• Custody and wallet control: Identify who holds private keys, controls withdrawal logic and bears responsibility when assets are lost or frozen.
• Dealing and arranging: Separate principal dealing, agency execution and arranging another firm's transaction.
• Staking and yield features: Document whether the business merely facilitates protocol activity or promises a return, pools assets or exercises discretion.
• Fiat functionality: Assess whether payment, e-money or other financial-services permissions are engaged by the customer journey and fund flows.

Two businesses can use the same “exchange” branding while occupying completely different regulatory positions. Treating them as equivalent produces defective policies, inaccurate application answers and technology that can't support the stated operating model.

Practical rule: If a product manager can't explain which entity performs each customer-facing activity, the regulatory perimeter hasn't been mapped well enough.

The UK Regulatory Ladder from Registration to Authorisation

The UK ladder has a hard lower step and a developing upper structure. An in-scope crypto exchange providing services by way of business must register with the FCA before starting operations under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. Operating without FCA registration, or applicable temporary permission, is a criminal offence. The FCA's AML and counter-terrorist-financing requirements make the operational consequence clear: perimeter analysis and registration belong in the launch gate, not in a post-launch remediation plan.

Registration requires more than a corporate description. The evidence should connect the proposed business model to customer types, transaction flows, outsourcing, governance, financial-crime risk assessment, customer due diligence, transaction monitoring, sanctions controls and suspicious-activity escalation. A polished policy library won't compensate for contradictions between those documents and the platform's actual behaviour.

Treat each rung as a launch decision

First, define the perimeter. Record the customers you intend to serve, the assets you will support, the entity that contracts with customers and every third party touching funds, keys, data or execution. Include features that may arrive later. A stablecoin settlement feature or a new custody arrangement can change the route.

Second, obtain the required AML registration before in-scope operations begin. Registration demonstrates that the firm can manage financial-crime risk under the MLR framework. It doesn't establish that the firm has all permissions needed for broader regulated activities.

Third, design for the wider FSMA regime. The UK has moved beyond a primarily AML registration model. Financial-promotion controls were extended to qualifying cryptoassets on 8 October 2023, requiring promotions generally to be made or approved by an authorised person, fall within an applicable exemption, or be issued by an eligible FCA-registered cryptoasset business under the temporary arrangement. Promotions must be fair, clear and not misleading. The official financial-promotions dataset and policy material records the government's estimate that the temporary arrangement would affect 39 businesses per year.

Fourth, map future Part 4A permissions. The 2026 framework identifies operating a qualifying cryptoasset trading platform as a controlled activity and includes issuing qualifying stablecoins, safeguarding certain cryptoassets, dealing, arranging and staking. Full commencement is set for 25 October 2027, so a firm operating under narrower AML supervision should treat the period before then as an authorisation preparation window, not as spare time. The 2026 cryptoasset legislation is the source for that future activity structure and commencement point.

Fifth, build the reporting and notification mechanics. Every registered cryptoasset business must submit an annual REP-CRIM financial-crime return through RegData within 60 business days of its accounting reference date, as stated by the FCA. Data ownership, reconciliation and management sign-off should exist before registration because weak metrics expose gaps between written controls and implemented controls.

The distinction that matters is simple: registration may permit a narrow operating route, while authorisation governs a broader set of financial activities. Don't present one as the other to investors, banking partners, customers or the regulator.

Cross-Jurisdiction Approaches Compared

Choosing a jurisdiction on the basis of a headline such as “crypto-friendly” is poor strategy. Founders should compare the operational questions that determine whether the business can launch, scale and maintain banking, custody and market access.

The UK offers a staged path in which AML registration currently sits below the broader authorisation framework. The EU's MiCA model is designed around a harmonised cryptoasset service-provider framework and passporting logic. The UAE requires a more granular analysis because Dubai's VARA framework and the financial-centre regimes of ADGM and the DFSA don't amount to one universal route. The US remains a federal and state problem, with the answer depending heavily on the asset, activity, customer base and relevant state requirements.

Pick the starting jurisdiction by operating reality

Choose the jurisdiction that matches the customers, banking model, custody structure and management location. A lower perceived entry barrier is irrelevant if the firm cannot explain its transaction flows, secure dependable banking or satisfy the regulator's expectations for local substance.

Cross-border expansion also creates duplication. A shared technology platform doesn't create shared regulatory responsibility. Each entity still needs a defensible explanation of its customers, permissions, outsourcing, governance and controls.

AML, KYC and the Travel Rule in Practice

AML compliance fails when a firm treats it as a folder of policies. An exchange needs a working decision system that links customer identity, wallet activity, fiat movement, sanctions screening, case management and reporting.

The customer lifecycle should be designed as a sequence of controlled events:

1. Onboarding: Capture identity, residence, expected activity, customer type, beneficial ownership and purpose of the account. Escalate incomplete or contradictory information before activation.
2. Risk assessment: Apply documented factors covering geography, product, customer, wallet exposure, transaction behaviour and delivery channel. Higher-risk customers should receive enhanced review, including appropriate source-of-funds or source-of-wealth analysis.
3. Screening: Screen customers, beneficial owners, counterparties and relevant wallet exposure against sanctions and politically exposed person data. Adverse-media review should have defined escalation criteria rather than relying on an analyst's personal judgement.
4. Ongoing monitoring: Compare actual activity with the customer profile, investigate unusual patterns and preserve the rationale for closing, restricting or escalating an alert.
5. Suspicious activity escalation: Route cases to the MLRO or designated decision-maker, record the internal rationale and manage tipping-off risks when communicating with the customer.

The UK Travel Rule has applied to cryptoasset firms since September 2023. It requires firms to collect, verify and share information about the originator and beneficiary of cryptoasset transfers. The OFSI cryptoasset threat assessment also identifies the FCA as the UK AML and counter-terrorist-financing supervisor for cryptoasset firms and advises firms to check the FCA register when dealing with crypto businesses.

Make the Travel Rule operational

Travel Rule compliance needs a workflow for every relevant transfer:

• Scope detection: Identify whether the transfer is in scope and whether it is inbound, outbound, internal or connected to an external wallet.
• Field mapping: Define the originator and beneficiary data required, the message standard, the receiving counterparty and the retention point.
• Verification: Validate counterparty details, regulatory status and wallet attribution where relevant. Don't treat an address as proof of ownership.
• Exception handling: Hold, reject or escalate transfers when information is missing, inconsistent or unreliable. The decision must be recorded.
• Control testing: Use test transfers, vendor due diligence, exception logs and audit trails to show that the workflow operates beyond paper.

The FCA's annual REP-CRIM return adds a reporting discipline to the programme. Assign ownership for every metric, document data lineage and reconcile source systems before management approval. Useful management information includes alert volumes, ageing, false-positive analysis, investigation outcomes, sanctions matches, Travel Rule exceptions, blocked transfers, filing decisions and overdue remediation.

Technology should support the control design. An exchange may combine an identity and screening provider, blockchain analytics, a transaction-monitoring engine and a case-management platform, but the integrations must create one investigation record. The regulator won't accept a gap merely because the relevant evidence sits in four disconnected systems.

Custody, Safeguarding and Client Asset Protection

Custody is where an exchange's legal perimeter meets its technical architecture. The central question isn't whether the website calls a wallet “non-custodial”. It is who can initiate, approve, delay, reverse or prevent a transfer, and who bears the obligation to protect the customer's assets.

A business that safeguards cryptoassets or the means of control for clients needs a separate analysis from a business that merely provides software or routes an instruction to an independent custodian. The assessment should cover private-key generation, signing authority, withdrawal approvals, access controls, wallet segregation, disaster recovery, reconciliation and the legal relationship between the customer, exchange and custody provider.

Decide what the exchange actually controls

Hot wallets support operational liquidity but expose the firm to online compromise. Warm and cold arrangements can reduce online exposure, but they introduce access, recovery and availability dependencies. None of these labels, by themselves, proves that the control framework is adequate.

Use this decision table before selecting an architecture:

Under the planned framework, an authorised cryptoasset firm or specified investment cryptoasset firm must notify the FCA before acting as a cryptoasset exchange provider or custodian wallet provider, or within 28 days after beginning to do so. The 2026 legislation also provides that firms authorised for the new cryptoasset activities, or for other activities involving specified investment cryptoassets, won't need to apply separately for AML registration as a cryptoasset exchange provider or custodian wallet provider. The relevant UK statutory instrument should be read alongside the firm's actual activity map.

Outsourcing doesn't transfer accountability. If an exchange uses a custody provider, it still needs to understand the provider's controls, monitor service performance, test incident arrangements and maintain an exit plan. Insurance may address part of the loss profile, but it can't replace key governance, reconciliation or customer-asset records.

Market Conduct, Operational Resilience and Governance

A regulated exchange isn't judged only by whether it can process trades. It must show that customers receive orderly execution, conflicts are controlled, systems remain recoverable and senior managers understand their responsibilities.

Market conduct begins with the venue's mechanics. Document how orders are prioritised, how prices are formed, how outages affect execution, how exceptional volatility is handled and how the firm detects manipulation. If the exchange is vertically integrated, separate the interests of the venue, proprietary trading, market making, custody and customer execution. A conflict register is useful only when it connects to information barriers, approvals, surveillance and remediation.

Turn obligations into one control architecture

Market conduct should cover order handling, fair access, price discovery, conflicts of interest, market surveillance and escalation of suspected abuse. Customer-facing communications and promotions must also meet the fair, clear and not misleading standard that applies to qualifying cryptoasset promotions.

Operational resilience should identify important business services, dependencies, impact tolerances, recovery priorities and credible disruption scenarios. Test the exchange engine, wallet infrastructure, key-management systems, cloud providers, market-data feeds, screening tools and communication channels as a connected service. A recovery plan that restores the matching engine but leaves withdrawals, customer support or compliance records unavailable isn't a resilient operating model.

Governance should assign named responsibility for the business model, AML, compliance, operational risk, technology, outsourcing and customer outcomes. Fit and proper assessments should be supported by evidence of competence, time commitment, challenge and escalation. The board needs management information that shows breaches, incidents, customer-asset breaks, alert backlogs, unresolved conflicts and remediation status.

Evidence matters as much as policy

An application should make the control loop visible:

• Obligation: State the rule or supervisory expectation.
• Control: Explain the preventive or detective measure.
• Output: Identify the alert, record, reconciliation, report or decision produced.
• Reviewer: Name the person or committee that assesses the output.
• Remediation: Show how failures are logged, owned, corrected and retested.

That structure helps the FCA distinguish an operating programme from a collection of aspirations. It also exposes unsupported claims early. If the firm says it monitors conflicts but can't produce a register, alert logic, review record and board report, the weakness is operational rather than editorial.

A regulator should be able to follow a control failure from the affected customer or transaction to a named owner, a timestamp, a decision and a remediation record.

Designing a Compliance Programme That Survives Scrutiny

Build the programme around four connected layers: policy, people, systems and evidence. Each layer should close the loop between an obligation and an accountable action. Don't write policies first and search for an operating model later.

Policy must follow the activity map

The policy stack should reflect the business being proposed. It will usually need AML and counter-terrorist financing, customer due diligence, sanctions, transaction monitoring, Travel Rule, market conduct, conflicts, custody, outsourcing, operational resilience, incident management, complaints, financial promotions and regulatory reporting components.

Assign one accountable owner to each policy. Separate the policy owner from the independent reviewer where the organisation's scale permits. Record which arrangements already operate, which will be established before launch and which depend on a third party. This distinction prevents an application from presenting planned controls as existing capabilities.

People need defined authority

The MLRO should have access to customer, transaction and case information, with a documented route to senior management and the board. Compliance and risk staff need authority to challenge product launches, restrict activity and require remediation. Technology owners must understand that auditability, access management, logging and data retention are regulatory control features, not merely engineering preferences.

Competence should be evidenced through role profiles, relevant experience, training records, continuing professional development and reviewed case files. Avoid generic statements that the team is “experienced”. Explain who makes the decision, what information they receive, how they are challenged and how the firm handles absence or succession.

Systems should produce defensible evidence

Connect the core exchange platform to identity verification, sanctions screening, blockchain analytics, Travel Rule messaging, transaction monitoring, case management, custody records and regulatory reporting. Document data lineage from the source event to the management report. Reconcile balances, alerts, customer records and regulatory returns at defined intervals.

A firm can use different tools for different functions, but it needs a controlled integration model. An authorisation consultancy such as Glentorion can help coordinate the application package, operating model, policies, evidence and management interview preparation, while the firm remains responsible for the underlying decisions and controls.

Review the perimeter whenever the product changes

Early activity mapping is cheaper than late remediation because a seemingly modest product change can affect several documents at once. Adding stablecoin settlement may alter payment analysis, custody, financial promotions, transaction monitoring, safeguarding, outsourcing and the application narrative. Adding staking may affect custody, customer terms, operational risk, asset controls and permissions.

Use change control with a regulatory impact assessment. Require product, compliance, legal, risk, technology and finance owners to sign off the consequences before launch. Keep a decision log that records the facts considered, the conclusion, open questions, dependencies and evidence required.

The UK transition makes this discipline urgent. Existing AML registration doesn't remove the need to prepare for the broader activity framework, and the future commencement point of 25 October 2027 creates a defined planning horizon under the 2026 statutory framework. The firm that starts with a precise activity map can align its entity structure, permissions, controls and capital planning. The firm that waits for a final product shape may discover that its core assumptions were never compatible with the route it intended to use.

---

If you're planning a UK or cross-border crypto activity, Glentorion can scope the regulatory route, coordinate application evidence, refine policies and prepare management for regulator interviews. Visit Glentorion to discuss an activity-by-activity authorisation and operational-readiness plan.