Custodial wallet / SaaS in United Kingdom
Hosted wallet provider that holds keys on behalf of end users, often white-labeled to businesses (custody as a service).
Custodial SaaS is conditionally permitted in United Kingdom with a local entity, subject to AML obligations and high licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- High
- Last updated
- 2026-07-13
AML Obligations
- FCA registration under the Money Laundering Regulations 2017 (MLRs) required — covers custodian wallet providers safeguarding cryptoassets or private keys on behalf of customers (gb.licensing.custodian-wallet-providers-firms-that)
- AML/KYC obligations under the MLRs for both the custodial wallet SaaS operator and its white-label clients — each VASP activity requires its own registration (gb.licensing.legislation-money-laundering-regulations-2017-amended)
- Sanctions screening and reporting to OFSI — immediate freeze and reporting of designated persons' assets, with unlimited fines and up to 7–10 years imprisonment for non-compliance (gb.aml.ofsi-enforcement-uk-vasps-must)
- Financial promotions compliance — crypto classified as restricted mass-market investments under the Financial Promotions Order (crypto amendment) 2023, requiring risk warnings and banning misleading promotions (gb.licensing.legislation-financial-promotions-order-crypto-amendment)
- Future expanded regime (FSMA 2023) from 2025–2026 will add tiered capital requirements, custody-specific safeguarding rules, and require FCA approval by Feb 2028 (gb.aml.fca-oversight-registered-vasps-under)
Key Restrictions
- Must register with the FCA as a custodian wallet provider — ~85% rejection/withdrawal rate, only ~40 firms registered to date (gb.licensing.vasp)
- SaaS operator and white-label client may each need separate FCA registration if the client performs VASP activities — unclear regulatory guidance on principal-agent licensing lines (gb.licensing.custody)
- Financial promotions directed at UK persons require compliance with risk warnings, no misleading promotions, incentive restrictions (gb.licensing.exchange)
- Future regime (2025–2026) will introduce MiCA-style tiered capital requirements for custody services (gb.licensing.custody)
- Segregation requirements apply under safeguarding rules, but detailed proof-of-reserves or insurance requirements not yet codified in current regime
Key Risks
- Very high FCA registration rejection/withdrawal rate (~85%) — significant risk of non-registration leading to enforcement action or inability to launch (gb.licensing.vasp)
- Regulatory ambiguity on whether the SaaS provider, the white-label client, or both require individual FCA registration for the same end-user relationship (gb.licensing.custody)
- Unlimited fines and criminal sanctions under the Sanctions and Anti-Money Laundering Act 2018 and FSMA for operating without authorisation or breaching sanctions (gb.aml.civilcriminal-fines-unlimited-fines-asset)
- Transition risk — current MLR-based regime being replaced by comprehensive FSMA 2023 framework (2025–2026); operators may need to relicense under new rules (gb.licensing.legislation-financial-services-and-markets-act-2000-amended-2023)
- No EU passporting access post-Brexit — must obtain separate UK authorisation even if regulated elsewhere in Europe
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FCA — Crypto registration (MLR 2017), financial promotions, AML supervision — ~85% rejection rate
Money Laundering Regulations 2017 (amended) (2017) — AML/KYC — crypto exchanges and custodian wallet providers
Financial Services and Markets Act 2000 (amended 2023) (2023) — Crypto as regulated activity, financial promotions regime
Financial Promotions Order (crypto amendment) (2023) — Crypto classified as restricted mass-market investments — effective Oct 8, 2023
VASP: FCA registration required for all cryptoasset businesses (exchange + custodian wallet providers). ~85% rejection/withdrawal rate. Only ~40 firms registered. Future comprehensive FSMA-based regime (2025-2026) will cover trading platforms, intermediation, lending, staking, stablecoins.
CUSTODY: FCA registration + safeguarding requirements. Future regime will introduce MiCA-style tiered capital requirements.
Custodian Wallet Providers: Firms that safeguard cryptoassets or private cryptographic keys on behalf of customers.
Scope: Cryptoasset businesses operating in the UK (regardless of where their customers are) are required to register with the FCA. This includes:
Cryptoasset Exchange Providers: Firms that exchange cryptoassets for fiat currency or other cryptoassets.
Anti-Money Laundering (AML) & Counter-Terrorist Financing (CTF) – The Money Laundering Regulations 2017 (MLRs):
AML Supervision: Registers and supervises cryptoasset businesses under the Money Laundering Regulations.
Financial Promotions: Enforces rules regarding the marketing and advertising of cryptoassets.
OFSI Enforcement: UK VASPs must immediately freeze and restrict assets of designated persons (DPs), report holdings or suspected sanctions evasion to OFSI (e.g., via crypto transfers by DPs), and avoid processing transactions involving sanctioned parties; OFSI's 2022 Cryptoassets Threat Assessment highlights risks like pseudonymity enabling evasion.
FCA Oversight: Registered VASPs under the Financial Services and Markets Act (FSMA) must integrate sanctions screening into AML/CTF frameworks, with new rules from 2027 expanding custody definitions and requiring FCA approval by Feb 2028.
Civil/Criminal Fines: Unlimited fines, asset seizures, or imprisonment up to 7-10 years under Sanctions and Anti-Money Laundering Act 2018 and FSMA; OFSI can impose monetary penalties.
FCA Actions: Fines, suspensions, or permanent closures for unregistered firms missing 2027-2028 deadlines; e.g., FCA clashes with Binance over compliance.
Prohibited dealings with prescribed countries like Russia (post-2022 embargoes), North Korea, Iran, or Syria-linked entities; crypto transfers to/from these are high-risk and often blocked.
No services to sanctioned jurisdictions or DPs globally; UK firms must block transactions even in unregulated markets if involving UK nexus.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — custodial wallet SaaS is permitted in the UK but requires FCA registration under the MLRs as a custodian wallet provider (with ~85% rejection rate), compliance with financial promotions rules, sanctions screening, and transition to a future comprehensive FSMA-based custody regime by 2028; the allocation of AML obligations between the SaaS provider and its white-label clients remains ambiguous.
Questions this verdict aims to answer
- What custody license / qualified-custodian status applies?
- What segregation, insurance, and proof-of-reserves rules apply?
- What AML obligations attach to the SaaS vs the white-label client?