← All insights Finance and crypto

Running a cryptoasset business in the United Kingdom: where regulation actually bites

You have built something that touches cryptoassets, and the working assumption inside the business is that the law has not caught up yet. In the United Kingdom it largely has. The exposure is rarely sitting where the founders are looking for it.

Two beliefs do most of the damage. The first is that regulation follows technology, so a novel structure must fall outside rules written before it existed. The second is that a model outside one regime is therefore outside all of them. Regulation in the United Kingdom attaches to activity rather than to architecture, and the questions it asks are commercial ones: whose money is it, who is holding it, who can affect whether it can be got back, and who is being invited to part with it.

That is not an argument for building an exchange's compliance function around a wallet. It is an argument for knowing which side of a line the business is standing on before the line is tested, because the consequences are not symmetrical. Carrying on an activity that required a permission is not a paperwork failure. Agreements made in the course of it may in some circumstances be unwound at the customer's election, and the people who ran the business carry exposure that does not stop at the company.

The question founders open with settles very little

The conversation almost always opens with whether a token is a security. It is an understandable place to start and it settles very little. The same asset can sit inside an arrangement that is plainly regulated and inside one that is not, because what gets examined is what the business does with it: whether it exchanges it, holds it on behalf of someone else, arranges deals in it, lends against it, pools it with other people's, or promises something in return for it.

The more useful observation concerns how businesses actually cross the line. Almost nobody decides to become a regulated firm. A product team adds an interest-bearing balance because retention is poor. A growth team adds a staking pool because deposits have flattened. A treasury function begins quoting prices to customers because it is already doing the trades anyway. Each of those is a roadmap decision taken on commercial grounds, and each can change the character of the business without anyone in the room believing they have made a legal choice at all. By the time the question is asked, the feature is live and customers are already inside it.

Registration and authorisation answer different questions

Businesses carrying on certain cryptoasset activities in the United Kingdom must register with the Financial Conduct Authority for the purposes of the money laundering rules. That registration is concerned with financial crime controls: establishing who your customers are, monitoring what they do, and reporting what has to be reported. It is a demanding thing to obtain, and it is not an approval of the product.

Authorisation answers a different question, which is whether the firm may carry on activities that are regulated in their own right. A business can hold the first and still need the second. What follows is a familiar commercial problem: customers, banking partners and the firm's own marketing all read a place on a register as a general blessing, and the language drifts to match. Pulling that language back once it is in the market is considerably harder than never letting it out.

The perimeter is also moving. The direction of travel in the United Kingdom has been to draw more cryptoasset activity inside the regulated framework rather than less, so a model comfortably outside it as things stand is not permanently outside it.

Decentralised describes the architecture, not the responsibility

A regulator reads an arrangement broadly as a customer experiences it, and asks whether there is somebody whose decisions determine what happens to what the customer holds. The technical answer that no single party controls the ledger seldom disposes of that. Somebody controls the upgrade. Somebody runs the interface through which most users reach the protocol. Somebody holds the treasury, decides what is listed, writes the announcement that moves the price, and is paid out of the proceeds.

The gap that catches businesses is between governance as documented and governance as practised. Where the published materials describe a distributed community and the decisions are in fact taken among the founders and ratified afterwards, the documentation records an intention rather than a fact. That distinction is not academic, because how decisions were actually taken is a matter capable of being established.

There is a further difficulty peculiar to this argument. The harder a business markets the claim that it merely publishes software, the more marketing exists; and marketing that encourages people to acquire an asset in the expectation of gain is precisely what a promotion regime concerns itself with.

Promotion is where most businesses first cross a line

A communication inviting or inducing someone in the United Kingdom to engage in investment activity generally has to be made or approved by an authorised firm unless an exemption applies, and cryptoasset promotions aimed at consumers now sit squarely within that framework. The rules govern how risk is presented, restrict incentives to invest, and require that a consumer be given room to reflect before committing for the first time.

This is the regime businesses breach without noticing, because the mechanisms a growth team reaches for first are the ones it restricts. A referral bonus is an incentive to invest. A sign-up reward paid in the asset is an incentive to invest. An affiliate programme is a promotional apparatus operated by people the firm does not supervise and cannot readily see, and the firm answers for what is said on its behalf. Whoever signs off the compliance position is usually not the person approving the campaign.

Where the company is incorporated matters far less than where the customers are. A service that opens accounts to people in the United Kingdom, prices in sterling and buys advertising aimed at a United Kingdom audience is communicating with that audience whatever the entity's address. This is also the regime whose consequences become visible first, because they arrive from app stores, advertising platforms and payment providers rather than from any tribunal.

Supervisory attention follows harm

Supervisory resource is finite, and it is pointed at what is causing loss. What draws attention is a run of complaining consumers, a withdrawal that has been paused, funds that have not come back, a bank filing reports about an account, or a journalist holding a case study. The precise legal characterisation of the product is then worked out to fit the harm. It is very seldom the starting point.

That is uncomfortable for a founder who has paid for an opinion and filed it. An elegant analysis offers no protection at the moment customers cannot get their money out. The operational events that generate complaints, such as a paused withdrawal, a repricing, or a migration that leaves balances stranded, are the same events that generate official interest.

A second exposure runs alongside the regulatory one and is routinely forgotten. Customers can bring claims in the courts of England and Wales founded on the contract and on what they were told, and that litigation follows its own logic entirely. If the business fails, whether customer holdings were held for customers or treated as the firm's own assets decides whether those customers recover their property or queue as creditors. Under the law of England and Wales the arrangement either created a trust over those assets or it did not, and that turns on how the terms and the accounts were set up long before anybody was worried, not on what everyone intended once the money is short.

When to spend nothing

Not every cryptoasset business needs a permission, and buying a compliance programme designed for an exchange in order to run a wallet that never touches a customer's keys is money spent on reassurance. Where a model does not hold customer funds, does not exchange, does not arrange and does not promote to consumers, the honest answer may be that there is little to do beyond keeping it that way and understanding what would change it.

Two things are worth avoiding while the position is unsettled. The first is making a formal application before the model has stopped moving, because an application is assessed against the business you have described, and a description that keeps changing becomes a problem in its own right. The second is restructuring offshore as a reflex. Moving the company does not move the customers, and a business whose users are in the United Kingdom has solved nothing by acquiring a different registered address.

It is also worth not announcing a conclusion. A public statement that the business is unregulated, or that its token is not caught, is itself a communication about an investment, and it will be quoted back with complete accuracy. Meanwhile, keep the material that shows what the arrangement really was. The announcements in the community channels, the deck shown to early buyers and the internal discussion of what was promised are the documents that characterise the business.

Whether an arrangement is read by what it does or by how it describes itself is a judgement made on the whole picture. Founders know their own intentions. What decides the position is how the arrangement reads to somebody who has never met them and is looking at it after something has gone wrong.

This guide is general information about how these matters usually run. It is not advice, and nothing becomes advice until terms are agreed in writing. Brandleys Legal Ltd delivers reserved legal activities alongside regulated partners.