Credibility is the UK's Crypto Advantage - Royal United Services Institute (RUSI)

With the publication last month of the Financial Conduct Authority’s (FCA) cryptoassets regime policy statements, the UK has reached an important milestone in its regulation of the virtual asset industry. After years in which policy debates have oscillated between enthusiasm for innovation and concern about criminal misuse, the question is now whether the UK can ensure effective regulation without stifling responsible innovation or leaving material risks to grow in the shadows.

The package represented by the statements is broad. It covers admissions and disclosures, market abuse, stablecoin issuance, custody, trading platforms, intermediaries, staking, prudential requirements, operational resilience and the application of key parts of the FCA Handbook to regulated crypto activities. In other words, the UK is moving from partial oversight to a much more complete regulatory architecture, through which credibility and reliability (as underlined in a recent FCA webinar) may become its greatest competitive advantage.

However, achieving this is a harder task than it first appears. Crypto is no longer a self-contained market of speculative tokens and specialist exchanges. Stablecoins, tokenised deposits, decentralised finance, privacy-enhancing technologies and emerging forms of automated payments are increasingly interacting with the traditional financial system, presenting co-mingled risks that may accelerate and amplify existing financial system vulnerabilities. Furthermore, as explored at a recent workshop hosted by the Centre for Finance and Security at RUSI in partnership with EY, a further risk is emerging: that the UK may design regulation for the parts of the crypto ecosystem that are most visible, while the most important risks migrate to the boundaries between – and outside – regulatory systems.

That matters for both financial crime policy and the UK’s ambition to remain a leading centre for financial innovation. A regulatory regime that cleans up the most obvious parts of the market but fails to address the less visible infrastructure through which illicit finance moves will not be judged effective for long – and will be open to ongoing exploitation by criminal actors who are known to ‘shop around’ for systemic weaknesses. Equally, a regime that imposes high burdens without offering clarity, predictability and credibility will struggle to attract the responsible firms the UK says it wants.

The first point underlined by the roundtable discussion was that crypto does not simply create a set of wholly new crimes. Fraud, money laundering, sanctions evasion, terrorist financing and asset concealment all existed long before the advent of virtual assets. What crypto changes is the speed, scale, geographic dimension and visibility of those risks. It can accelerate payments, compress laundering chains, enable value to move across borders outside traditional correspondent banking channels and allow criminals to exploit gaps between regulatory systems.

In that sense, crypto often amplifies existing risks rather than creating new ones. But amplification can itself become transformation. When a technology enables crime to happen at greater speed, across more jurisdictions and through infrastructure that sits outside established controls, the operational challenge becomes different. The distinction between ‘new crime’ and ‘old crime in new clothes’ begins to matter less than whether the existing regulatory and enforcement architecture can keep pace.

This is particularly clear in the relationship between crypto and traditional finance. For years, banks have built compliance systems around known customers, monitored transactions and established counterparties. Cryptoasset firms have developed their own tools, including blockchain analytics, wallet scoring and on-chain tracing. Both systems can produce useful intelligence. But the most intense risks emerge where these two worlds meet.

A traditional financial institution and a regulated crypto exchange may both have information about their customers, but neither necessarily has a full view of the activity that preceded or follows a transaction, particularly where funds pass through decentralised exchanges, mixers, peer-to-peer markets, self-hosted wallets, privacy chains or offshore providers. This resembles the familiar correspondent banking problem of understanding a customer’s customer, but with added velocity and technical complexity.