Self-custodial wallet / non-custodial software in United Kingdom
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in United Kingdom without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No direct AML registration required — the publisher of non-custodial wallet software does not fall within the definition of 'custodian wallet provider' under MLR 2017 (which covers firms that safeguard private keys on behalf of customers)
- However, if the software generates revenue via integrated exchange/on-ramp services, such ancillary services may trigger FCA registration obligations
- If the wallet software publishes financial promotions (e.g., marketing itself as an investment tool), the Financial Promotions Order (crypto amendment, Oct 2023) classifies crypto as restricted mass-market investments, triggering FCA authorization for the promotion
- Sanctions screening obligations under OFSI may apply if the publisher has any UK nexus and processes transactions (e.g., via integrated swap features) — must freeze assets of designated persons and report to OFSI
Key Restrictions
- Must not offer any custody or control over user private keys, or it will trigger custodian wallet provider classification under MLR 2017
- If the software includes integrated exchange/trading features (e.g., swaps), those features may be deemed exchange activity requiring FCA registration
- Financial promotions rules under FSMA 2023 and Financial Promotions Order apply to marketing of the wallet to UK residents — risk warnings required, no misleading promotions, incentive restrictions apply
- Publishing non-custodial software alone is not a regulated activity under current UK law (MLR 2017 scope is exchange providers and custodian wallet providers only)
- Future FSMA-based regime (2025-2026) may expand the regulatory perimeter to cover wider cryptoasset activities — monitoring required
Key Risks
- Regulatory perimeter ambiguity — the FCA may reinterpret what constitutes 'custodian wallet provider' broadly; any technical capability to influence transactions could attract scrutiny
- Unregistered firms face FCA enforcement actions including fines, suspensions, or closures — FCA has an ~85% rejection/withdrawal rate for registrations, indicating aggressive supervisory posture
- Financial promotions rules create risk even for non-custodial software: marketing wallet features to UK residents without FCA-approved promotions risks enforcement
- Sanctions compliance risk: if the wallet integrates any transaction routing (e.g., swaps, bridges), the publisher may be expected to block sanctioned addresses, even without custody
- Future regulatory expansion (FSMA 2025-2026) may capture non-custodial wallet publishers under new definitions — structural pivot may be needed
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
FCA — MLR registration and AML/CTF supervision of cryptoasset businesses (since 10 January 2020), supervision of cryptoasset financial promotions (since 8 October 2023), and authorisation, conduct and prudential regulation under SI 2026/102 from 25 October 2027. Of 393 MLR applications determined since January 2020, 68 were registered, 46 rejected, 265 withdrawn and 14 refused (as at 1 October 2026).
Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (SI 2017/692), as amended by SI 2019/1511 with effect from 10 January 2020 — AML/CTF registration and supervision of cryptoasset exchange providers and custodian wallet providers (regs 14A, 56, 58A); travel rule in Part 7A from 1 September 2023 (SI 2022/860).
Financial Services and Markets Act 2000, as amended by FSMA 2023 s.69 (in force 29 August 2023) — s.22 extended so regulated activities may relate to cryptoassets and s.417 given a cryptoasset definition; the regulated activities themselves are created by SI 2026/102 from 25 October 2027, and the crypto financial-promotions regime came from SI 2023/612 (7 October 2023).
Financial Services and Markets Act 2000 (Financial Promotion) (Amendment) Order 2023 (SI 2023/612, made 7 June 2023, in force for all purposes 7 October 2023) — adds "qualifying cryptoasset" as a controlled investment and creates the art 73ZA exemption for MLR-registered firms' own promotions; the FCA classifies qualifying cryptoassets as restricted mass market investments in COBS 4.12A and has applied the regime since 8 October 2023.
FCA MLR registration is required for cryptoasset exchange providers and custodian wallet providers. Since January 2020 the FCA has received 427 applications and determined 393: 68 registered (17%), 46 rejected (12%), 265 withdrawn (67%) and 14 refused (4%) as at 1 October 2026. The FSMA-based regime under SI 2026/102 (trading platforms, dealing, arranging, safeguarding, staking, qualifying stablecoin issuance) starts 25 October 2027.
Custodian wallet providers currently need MLR registration, which imposes AML/CTF duties only and no safeguarding rules; from 25 October 2027 safeguarding qualifying cryptoassets is a regulated activity (RAO art 9N, SI 2026/102) requiring FCA authorisation, the FCA applies CASS 17 to client cryptoassets, and CRYPTOPRU prudential requirements apply (PS26/12, 30 June 2026).
A "custodian wallet provider" under MLRs 2017 reg 14A is a firm or sole practitioner that by way of business provides services to safeguard, or to safeguard and administer, cryptoassets on behalf of its customers, or private cryptographic keys on behalf of its customers in order to hold, store and transfer cryptoassets.
Cryptoasset exchange providers and custodian wallet providers registered with the FCA under the Money Laundering Regulations 2017 reg 14A have been "relevant firms" under every UK sanctions regime since 30 August 2022 (SI 2022/818) and must screen for designated persons and report to OFSI; the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (SI 2026/102) bring safeguarding of qualifying cryptoassets and other cryptoasset activities into FSMA authorisation on 25 October 2027, with the FCA application window running 30 September 2026 to 28 February 2027 and no automatic conversion of MLR registrations.
Cryptoasset exchange providers and custodian wallet providers have been "relevant firms" under every UK sanctions regime since 30 August 2022 (SI 2022/818) and must freeze funds and economic resources of designated persons, not make funds available to them, and report to OFSI any designated-person holdings and suspected breaches; OFSI published "Sanctions compliance in the Cryptoassets sector: Threat Assessment" on 21 July 2025 setting out the sector-specific evasion risks it expects firms to control.
UK sanctions offences created under SAMLA 2018 regulations carry a statutory maximum of 10 years imprisonment on indictment (SAMLA s.17(5)); OFSI may impose civil monetary penalties under the Policing and Crime Act 2017 s.146 of up to the greater of £1,000,000 and 50% of the estimated value of the funds or economic resources involved; carrying on unauthorised regulated activity (FSMA 2000 s.23) and contravening the Money Laundering Regulations 2017 (reg 86) each carry up to two years imprisonment and a fine on indictment.
FCA cryptoasset enforcement to date comprises three actions: CB Payments Ltd (Coinbase group) fined £3,503,546 on 25 July 2024 under the Electronic Money Regulations 2011 after onboarding 13,416 high-risk customers in breach of a voluntary requirement; Olumide Osunkoya sentenced to four years at Southwark Crown Court on 28 February 2025 for running an unregistered crypto ATM network worth over £2.5m, the first UK criminal conviction for unregistered cryptoasset activity; and legal proceedings begun against HTX (formerly Huobi) on 10 February 2026 for illegal financial promotions to UK consumers. Firms that do not apply for FSMA authorisation in the 30 September 2026 to 28 February 2027 window must run off UK cryptoasset business before the regime commences on 25 October 2027 or breach the FSMA s.19 general prohibition.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — publishing non-custodial (self-custodial) wallet software does not itself trigger VASP/custodian wallet provider classification under current UK law (MLR 2017), so no FCA AML registration is required for pure software publishing; however, integrated exchange/swap features, any form of key custody, or marketing the software to UK residents triggers financial promotions rules and may require FCA authorization, with an ~85% registration rejection rate and a future FSMA regime (2025-2026) that may expand the regulatory perimeter.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?