Proposed amendments to MLRs – New change in control regime for cryptoasset businesses

At the moment, the FCA's only powers over crypto businesses which do not carry on investment, payment services, e-money or other UK regulated business come from its role as their anti-money laundering and counter-terrorist financing supervisor. This will change in due course in respect of stablecoin businesses (with HMT consulting on bringing these into scope) and in respect of financial promotions of certain cryptoassets (both HMT and FCA are consulting on this). However, there is a more imminent change which will extend the FCA's currently fairly limited powers. This will be brought about through a statutory instrument (SI), a draft of which was laid before Parliament on 15 June, amending the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs).

For cryptoasset firms, the key changes to MLRs to be aware of are:

1. the introduction of a new change in control regime for the sector which will require acquirers of cryptoasset businesses (or their parents) to seek prior approval from the FCA before the acquisition can take place; and
2. the "Travel Rule" which will expand the application of FATF Recommendation 16, regarding information sharing requirements for wire transfers, to cryptoassets. (In the EU, the European Commission's proposal to implement the Travel Rule by amending the EU Funds Transfer Regulation is currently going through the EU legislative process.)

The changes to the change in control regime will come into effect 21 days after the SI is passed, whilst the introduction of the Travel Rule is proposed to come into effect on 1 September 2023, with cryptoasset businesses expected in the interim to implement solutions to enable compliance.

This post focuses on the proposed change in control regime. Our earlier post on navigating the UK MLR registration regime for crypto firms is available here.

Change in control regime for registered cryptoasset businesses

The FCA has been frustrated for some time with not having the power to object to the acquisition of crypto firms under the MLRs, as shown in its public statements (for example, here). Its main concern is that firms can access the UK cryptoasset market and bypass the MLR registration gateway by acquiring cryptoasset firms which are already registered. Although there are "fit and proper" requirements under the MLRs which must be met at all times by crypto firms, key individuals and beneficial owners, and the FCA already has powers to cancel the registration of the firm being acquired, the FCA estimates that it would take up to 90 days from the date of acquisition by an "unsuitable controller" for the crypto firm's registration to be cancelled.

To prevent the risk of illicit activities from taking place during this period, the draft SI amends the MLRs by requiring proposed acquirers of registered cryptoasset exchange providers or custodian wallet providers to notify the FCA ahead of an acquisition or an increase in control. Firms should note that the requirement will also apply to the acquisition, or increase in control, of parent undertakings of in-scope crypto businesses. A "controller" for the purposes of the crypto change in control regime will follow the definition of a beneficial owner under the MLRs, broadly, a person who owns or controls more than 25%[i] of the shares or voting rights in the business, or controls the business or its management.

The FCA will also be given powers to undertake a "fit and proper" assessment of the acquirer and the power to object to the acquisition before it takes place. Any person who acquires a cryptoasset firm following an objection from the FCA would be guilty of an offence and liable to a fine or up to two years' imprisonment.

The proposed approval timing aligns with the change in control regime under the Financial Services and Markets Act 2000 (FSMA) – see diagram below.

One thing to note and that firms should be factoring into their transaction timetables, is that there have been significant delays in the review of FSMA change in control applications for some time now. The FCA recently published an update on approval timing – there is a delay of approximately two months between the submission of a complete notification and allocation to a case officer. Given the current delays, it is possible that approvals will take significantly longer than shown in the diagram below.

Approval Timing

Cryptoasset businesses should keep a close eye on upcoming developments as the direction of travel moves towards increased regulation for this sector both in the UK and the EU. The FCA's own research estimates that 2.3 million adults now hold cryptoassets. This sector will remain high on the FCA's consumer protection agenda for some time.

[i] A different test is applicable to trusts and similar legal arrangements