The Money Laundering and Terrorist Financing (Amendment) Regulations 2026

“(3A)

Regulation 29 applies to a customer provided with a pooled account (within the meaning of paragraph (10) of that regulation) by a relevant person.”.

“(3A)

If, at any time after an authorised person whose supervisory authority is the FCA (“A”) has provided the FCA with any information under this regulation—

(a)

there is a material change affecting any matter contained in that information; or

(b)

it becomes apparent to A that the information contains an inaccuracy,

then A must provide the FCA with details of the change or a correction of the inaccuracy within 30 days beginning with the date of the occurrence of the change or the discovery of the inaccuracy.”.

“(10)

Paragraphs (11) to (18) apply if the relevant person provides a customer with a new account into which monies are pooled (“pooled account”) on or after the day on which this paragraph comes into force.

(11)

When providing a customer with a pooled account, the relevant person must—

(a)

take reasonable measures to understand the purpose of the pooled account and how the customer proposes to use it;

(b)

take steps to be satisfied that the purpose and proposed use under sub-paragraph (a) is consistent with the relevant person’s knowledge of the customer, the customer’s business and risk profile, and must conduct updated customer due diligence measures where it is not so satisfied; and

(c)

once satisfied under sub-paragraph (b), assess the level of risk of money laundering and terrorist financing associated with the customer using the pooled account and take reasonable steps to manage and mitigate the risks arising from that use by the customer.

(12)

In making an assessment under paragraph (11)(c), the relevant person must consider, among other things, the appropriateness of imposing controls on the pooled account to manage and mitigate the risks.

(13)

The relevant person must be able to demonstrate to its supervisory authority that the extent of the measures it has taken to satisfy the requirements under paragraphs (11) and (12) is appropriate in view of the risks of money laundering and terrorist financing.

(14)

When a customer has a pooled account with a relevant person, the customer must make available to the relevant person, on request from the relevant person, information on the identity of the persons on whose behalf monies are held in the pooled account and information on the identity of any beneficial owners of those persons.

(15)

A customer which is provided with a pooled account by a relevant person must maintain accurate and up-to-date records in writing of all the monies that are paid into and out of the pooled account for a period of five years beginning, in the case of each payment into or out of the account, on the date on which the customer knows, or has reasonable grounds to believe, that the payment is complete.

(16)

A customer of the relevant person must on request by any law enforcement authority provide information about itself and the management and use of any pooled account it has with the relevant person to that law enforcement authority.

(17)

A customer is not required under paragraph (13), (14) or (16) to provide information which that person would be entitled to refuse to provide on grounds of legal professional privilege in proceedings in the High Court (or, in Scotland, on the ground of confidentiality of communications in the Court of Session).

(18)

A disclosure made under paragraph (13), (14) or (16) is not to be taken to breach a duty of confidentiality owed by a professional legal adviser to a client of the adviser or any other restriction, however imposed, on the disclosure of information.”.

“Insolvent bank customers 30ZA.

(1)

Subject to paragraphs (2) and (3), a credit institution may permit an insolvent bank customer to open an account and transact from it before completing customer due diligence measures.

(2)

Before permitting an insolvent bank customer to open an account and transact from it under paragraph (1), the credit institution must—

(a)

identify the customer in accordance with regulation 28(2)(a); and

(b)

where applicable, identify a person purporting to act on the customer’s behalf and verify that such person is authorised so to act in accordance with regulation 28(10)(a) and (b).

(3)

After permitting an insolvent bank customer to open an account and transact from it under paragraph (1), the credit institution must—

(a)

apply the other customer due diligence measures required by regulation 28 as soon as practicable; and

(b)

if it becomes apparent that any of the situations or cases set out in regulation 33(1) apply, carry out no further transactions from the insolvent bank customer’s account until it has completed the customer due diligence measures required by regulation 28, with the exception of regulation 28(11).

(4)

For the purposes of this regulation, a credit institution is to be treated as identifying an insolvent bank customer that is a body corporate if the credit institution—

(a)

obtains the information listed in regulation 28(3)(a); and

(b)

where the insolvent bank customer is not a company which is listed on a regulated market—

(i)

takes reasonable measures to determine the information listed in regulation 28(3)(b); and

(ii)

identifies the beneficial owner where the customer is beneficially owned by another person.

(5)

In this regulation—

“insolvency date” in respect of an insolvent bank means the date on which a bank insolvency order is made in relation to the bank under section 94 (the order) of the Banking Act 200913.

“insolvent bank” means either—

(a)

a bank as defined in section 2 (interpretation: “bank”) of the Banking Act 2009 that has entered into the procedure in Part 2 of that Act; or

(b)

a building society as defined in section 119 (interpretation) of the Building Societies Act 198614 that has entered into the procedure in Part 2 of the Banking Act 2009, as applied and modified by section 90C (application of bank insolvency and administration legislation to building societies) of the Building Societies Act 1986;

“insolvent bank customer” means any customer—

(a)

which the credit institution is reasonably satisfied was a customer of an insolvent bank at the insolvency date in respect of that insolvent bank; and

(b)

with whom the credit institution begins to establish a business relationship within the period of 30 days beginning with the insolvency date in respect of that insolvent bank.”.

“Enhanced customer due diligence: cryptoasset exchange providers, custodian wallet providers and correspondent relationships34A.

(1)

A cryptoasset exchange provider or a custodian wallet provider (the “correspondent”) which has or proposes to have a correspondent relationship involving the execution of services of a type described in regulation 14A(1) or (2) with another provider providing similar services (the “respondent”) from a third country must, in addition to the measures required by regulation 33—

(a)

gather sufficient information about the respondent to understand fully the nature of its business;

(b)

determine from publicly-available information from credible sources the reputation of the respondent and the quality of the supervision to which the respondent is subject;

(c)

assess the respondent's controls to counter money laundering and terrorist financing;

(d)

obtain approval from senior management before establishing a new correspondent relationship;

(e)

document the responsibilities of the respondent and correspondent in the correspondent relationship; and

(f)

be satisfied that, in respect of those of the respondent's customers who have direct access to accounts with the correspondent, the respondent—

(i)

has verified the identity of, and conducts ongoing customer due diligence measures in relation to, such customers; and

(ii)

is able to provide to the correspondent, upon request, the documents or information obtained when applying such customer due diligence measures.

(2)

Cryptoasset exchange providers and custodian wallet providers must not enter into, or continue, a correspondent relationship with a shell bank.

(3)

Cryptoasset exchange providers and custodian wallet providers must take appropriate enhanced measures to ensure that they do not enter into, or continue, a correspondent relationship with a credit institution or financial institution which is known to allow its accounts to be used by a shell bank.

(4)

For the purposes of this regulation—

(a)

“cryptoasset” has the meaning given by regulation 14A(3)(a) and includes a right to, or interest in, the cryptoasset;

(b)

“correspondent relationship” means the relationship between and among cryptoasset exchange providers, custodian wallet providers, credit institutions and financial institutions including where similar services are provided by a correspondent to a respondent, and including relationships established for transactions in, or transfers of, cryptoassets;

(c)

“shell bank” has the meaning given by regulation 34(4)(b).”.

“Schedule 6BChanges in Control of Registered Cryptoasset Businesses

Regulation 60B

Modifications: Control over registered cryptoasset businesses registered before 25th October 2027

1.

Part 12 of FSMA (control over authorised persons) applies, with the modifications specified in paragraph 2, to a registered cryptoasset business that is included in the register before 25th October 2027 and to which Part 12 of FSMA would not otherwise apply.

2.

The modifications specified in this paragraph are—

(a)

references to a “UK authorised person” are to be read as references to a registered cryptoasset business;

(b)

references to “appropriate regulator” and “each regulator” are to be read as references to the FCA;

(c)

section 178 (obligation to notify the appropriate regulator: acquisitions of control)38 is to be read as if subsections (2ZA) and (2A) were omitted;

(d)

section 181 (acquiring control)39 is to be read as if it said—

“181.Acquiring control

(1)

For the purposes of this Part, a person (“A”) acquires control over a registered cryptoasset business (“B”) if, should the acquisition proceed—

(a)

A would become a beneficial owner within the meaning of regulation 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 of—

(i)

B; or

(ii)

a parent undertaking of B (“P”); or

(b)

if paragraph (a) does not apply A would—

(i)

hold 10% or more of the shares in B or P;

(ii)

hold 10% or more of the voting power in B or P; or

(iii)

otherwise hold shares or voting power in B or P as a result of which A is able to exercise significant influence over the management of B.”;

(e)

section 182 (increasing control)40 is to be read as if it said—

“182.Increasing control

(1)

For the purposes of this Part, a person (“A”) increases control over a registered cryptoasset business (“B”) if, should the increase in control proceed—

(a)

A would become a beneficial owner within the meaning given by regulation 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 of—

(i)

B; or

(ii)

a parent undertaking of B (“P”); or

(b)

if paragraph (a) does not apply—

(i)

the percentage of shares which A holds in B or P would increase by any of the steps mentioned in subsection (2);

(ii)

the percentage of voting power A holds in B or P would increase by any of the steps mentioned in subsection (2); or

(iii)

A becomes a parent undertaking of B.

(2)

The steps are—

(a)

from less than 20% to 20% or more;

(b)

from less than 30% to 30% or more;

(c)

from less than 50% to 50% or more.”;

(f)

section 183 (reducing or ceasing to have control)41 is to be read as if it said—

“183.Reducing or ceasing to have control

(1)

For the purposes of this Part, a person (“A”) reduces control over a registered cryptoasset business (“B”) if, should the decrease in control proceed—

(a)

A would cease to be a beneficial owner within the meaning given by regulation 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 of—

(i)

B; or

(ii)

a parent undertaking of B (“P”); or

(b)

if paragraph (a) does not apply—

(i)

the percentage of shares which A holds in B or P would decrease by any of the steps mentioned in subsection (2);

(ii)

the percentage of voting power A holds in B or P would decrease by any of the steps mentioned in subsection (2); or

(iii)

A ceases to be a parent undertaking of B.

(2)

The steps are—

(a)

from 50% or more to less than 50%;

(b)

from 30% or more to less than 30%;

(c)

from 20% or more to less than 20%.

(3)

For the purposes of this Part, A ceases to have control over B if—

(a)

A ceases to be a beneficial owner within the meaning given by regulation 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 of B or P; or

(b)

if paragraph (a) does not apply, A ceases to be in the position of holding—

(i)

10% or more of the shares in B;

(ii)

10% or more of the voting power in B or P; or

(iii)

shares or voting power in B or P as a result of which A is able to exercise significant influence over the management of B.”;

(g)

section 184 (disregarded holdings)42 is to be read as if subsections (4) to (10) were omitted;

(h)

section 185 (assessment: general)43 is to be read as if—

(i)

in subsection (2)(a), “and the financial soundness of the acquisition” were omitted;

(ii)

in subsection (3)(a), in relation to a section 178 notice-giver who falls within section 181(a) or 182(1)(a), for “matters” there were substituted “matter”;

(i)

section 186 (assessment criteria)44 is to be read in relation to a section 178 notice-giver who falls within section 181(a) or 182(1)(a) as if it said—

“186.Assessment criterion

The matter specified in section 185(3)(a) is whether the section 178 notice-giver is a fit and proper person within the meaning of regulation 58A of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (fit and proper test: cryptoasset businesses).”;

(j)

section 187 (approval with conditions)45 is to be read as if subsection (2)(b) were omitted;

(k)

section 187A (assessment: consultation by PRA with FCA)46 is to be disregarded;

(l)

section 187B (assessment: consultation by FCA with PRA) is to be disregarded;

(m)

section 187C (variation etc of conditions) is to be disregarded;

(n)

section 189 (assessment: procedure)47 is to be read as if—

(i)

subsections (1A), (1ZB) and (1B) were omitted;

(ii)

in subsection (6), “Unless section 190A applies” were omitted;

(o)

section 190 (requests for further information)48 is to be read as if subsections (1A) and (4)(b) were omitted;

(p)

section 190A (assessment and resolution)49 is to be disregarded;

(q)

section 191A (objection by the appropriate regulator)50 is to be read as if—

(i)

in subsection (2)(c), for “matters in” there were substituted “matter specified in”;

(ii)

subsection (4A) were omitted;

(r)

section 191B (restriction notices)51 is to be read as if—

(i)

in subsection (2)(a), after “voting power” there were inserted “or otherwise being a beneficial owner (within the meaning of regulations 5 or 6 of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017) of the registered cryptoasset business (“B”) or a parent undertaking of B”;

(ii)

in subsection (2)(b), “in relation to the shares or voting power,” were omitted;

(iii)

subsection (2A) were omitted;

(iv)

after subsection (3) there were inserted—

“(3ZA)

In a restriction notice, the FCA may direct that, in respect of a beneficial owner of B or P, until further notice, no influence over the management or activities of B is to be exercisable by the beneficial owner.”;

(v)

subsection (3A) were omitted;

(vi)

in subsection (6)(b), after “held in” there were inserted “, or beneficial ownership of,”;

(s)

section 191C (orders for sale of shares)52 is to be read as if—

(i)

subsections (2A), (7) and (8) were omitted;

(ii)

in subsection (2B) for “Where the appropriate regulator is the FCA, it” there were substituted “The FCA”;

(t)

section 191D (obligation to notify the appropriate regulator: dispositions of control)53 is to be read as if subsection (1A) were omitted;

(u)

section 191F (offences under this Part)54 is to be read as if—

(i)

in subsection (2), “or section 190A applies” were omitted;

(ii)

subsection (4A) were omitted;

(iii)

for subsections (8) and (9) there were substituted—

“(8)

A person guilty of an offence under subsection (1) to (3) or (5) to (7) is liable—

(a)

on summary conviction—

(i)

in England and Wales, to a fine;

(ii)

in Scotland or Northern Ireland, to a fine not exceeding the statutory minimum;

(b)

on conviction on indictment, to a fine.

(9)

A person guilty of an offence under subsection (4) is liable—

(a)

on summary conviction—

(i)

in England and Wales, to a fine;

(ii)

in Scotland and Northern Ireland, to a fine not exceeding the statutory minimum;

(b)

on conviction on indictment, to imprisonment for a term not exceeding two years or a fine, or both.”;

(iv)

after subsection (9) there were inserted—

“(10)

A person is not guilty of an offence under this section if that person took all reasonable steps and exercised all due diligence to avoid committing the offence.”;

(v)

section 191G (interpretation)55 is to be read—

(i)

as if the definitions of “the appropriate regulator”, “qualifying credit institution” and “UK authorised person” were omitted;

(ii)

at the appropriate places there were inserted—

““registered cryptoasset business” means a cryptoasset exchange provider or a custodian wallet provider which is included in the register maintained by the FCA under regulation 54(1A) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.”.

Modifications: Control over registered cryptoasset businesses registered on and after 25 October 2027

3.

Part 12 of FSMA (control over authorised persons) applies, with the modifications specified in paragraph 4, to a registered cryptoasset business that is included in the register on or after 25th October 2027 and to which Part 12 of FSMA would not otherwise apply.

4.

The modifications specified in this paragraph are—

(a)

references to a “UK authorised person” are to be read as references to a registered cryptoasset business;

(b)

references to “appropriate regulator” and “each regulator” are to be read as references to the FCA;

(c)

section 178 (obligation to notify the appropriate regulator: acquisitions of control) is to be read as if subsections (2ZA) and (2A) were omitted;

(d)

section 184 (disregarded holdings) is to be read as if subsections (4) to (10) were omitted;

(e)

section 185 (assessment: general) is to be read as if in subsection (2)(a), “and the financial soundness of the acquisition” were omitted;

(f)

section 187 (approval with conditions) is to be read as if subsection (2)(b) were omitted;

(g)

section 187A (assessment: consultation by PRA with FCA) is to be disregarded;

(h)

section 187B (assessment: consultation by FCA with PRA) is to be disregarded;

(i)

section 187C (variation etc of conditions) is to be disregarded;

(j)

section 189 (assessment: procedure) is to be read as if—

(i)

subsections (1A), (1ZB) and (1B) were omitted;

(ii)

in subsection (6), “Unless section 190A applies” were omitted;

(k)

section 190 (requests for further information) is to be read as if subsections (1A) and (4)(b) were omitted;

(l)

section 190A (assessment and resolution) is to be disregarded;

(m)

section 191A (objection by the appropriate regulator) is to be read as if—

(i)

in subsection (2)(c), for “matters in” there were substituted “matter specified in”;

(ii)

subsection (4A) were omitted.

(n)

section 191B (restriction notices) is to be read as if subsection (2A) were omitted;

(o)

section 191C (orders for sale of shares) is to be read as if—

(i)

subsections (2A), (7) and (8) were omitted;

(ii)

for “Where the appropriate regulator is the FCA, it” there were substituted “the FCA”;

(p)

section 191D (obligation to notify the appropriate regulator: dispositions of control) is to be read as if subsection (1A) were omitted;

(q)

section 191F (offences under this Part) is to be read as if—

(i)

in subsection (2), “or section 190A applies” were omitted;

(ii)

subsection (4A) were omitted;

(iii)

for subsections (8) and (9) there were substituted—

“(8)

A person guilty of an offence under subsection (1) to (3) or (5) to (7) is liable—

(a)

on summary conviction—

(i)

in England and Wales, to a fine;

(ii)

in Scotland and Northern Ireland, to a fine not exceeding the statutory minimum;

(b)

on conviction on indictment, to a fine.

(9)

A person guilty of an offence under subsection (4) is liable—

(a)

on summary conviction—

(i)

in England and Wales, to a fine;

(ii)

in Scotland or Northern Ireland, to a fine not exceeding the statutory maximum;

(b)

on conviction on indictment, to imprisonment for a term not exceeding two years or a fine, or both.”;

(iv)

after subsection (9) there were inserted—

“(10)

A person is not guilty of an offence under this section if that person took all reasonable steps and exercised all due diligence to avoid committing the offence.”

(r)

section 191G (interpretation) is to be read as if—

(i)

the definitions of “the appropriate regulator”, “qualifying credit institution” and “UK authorised person” were omitted;

(ii)

at the appropriate place there were inserted—

““registered cryptoasset business” means a cryptoasset exchange provider or a custodian wallet provider which is included in the register maintained by the FCA under regulation 54(1A) of the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.”.

Interpretation

5.

In this Schedule—

“cryptoasset business” means a cryptoasset exchange provider or a custodian wallet provider;

“cryptoasset exchange provider” has the meaning given by regulation 14A(1)56;

“custodian wallet provider” has the meaning given by regulation 14A(2);

“registered cryptoasset business” means a cryptoasset exchange provider which is included in the register maintained by the FCA under regulation 54(1A)57.”.