Kate Gee and Kitty Kirton examine what the FCA’s enforcement action against CB Payments Ltd. means for the crypto sector in Thomson Reuters Regulatory Intelligence

The Financial Conduct Authority (FCA) enforcement action against CB Payments Ltd (CBPL), a gateway for customers to trade cryptoassets within the global Coinbase Group, should be considered a significant warning to firms in the crypto sector. This was the first sanction of its kind in the UK cryptoassets sector taken by the FCA under the Electronic Money Regulations 2011.

By issuing CBPL with a fine of GBP 3,503,546, the FCA has demonstrated that firms in the crypto sector must consider their financial crime controls as very important, not least because firms in this sector are generally considered as being prone to increased money laundering risks and misuse by bad actors.

The FCA found that CBPL repeatedly breached a requirement that prevented the firm from offering services to high-risk customers within the Coinbase Group global trading platform.

Despite being subject to restrictions pursuant to a voluntary requirement (VREQ) entered into in October 2020, CBPL onboarded and/or provided e-money services to 13,416 high-risk customers. An automated ‘flag’ was not placed on relevant customers’ accounts. CBPL permitted approximately 31% of these customers to make 12,912 prohibited deposits with a total value of approximately USD USD 24.9 million, a portion of which was eventually used to execute multiple cryptoasset transactions of approximately USD USD 226 million via other Coinbase Group entities.

The FCA found that the CBPL was in breach of Principle 2 – its breaches were “the result of CBPL’s lack of due skill, care and diligence in the design, testing, implementation and monitoring of the controls put in place to ensure that the VREQ was effective”. This included failing to consider all the various ways in which customers might be onboarded when designing the controls. Because of inadequacies in implementing measures pursuant to the VREQ, and further inadequacies in the monitoring compliance, repeated and material breaches by CBPL went undetected for almost two years.

CBPL worked with the FCA during the investigation and has agreed to finally resolve the matter following the issuing of the fine; it therefore qualified for a 30% discount in the amount levied against it.

That CBPL repeatedly breached the requirements in place by way of the VREQ (to which it had agreed voluntarily) indicates that much more needs to be done with its financial crime controls. Indeed, speaking after the issuing of the fine, Therese Chambers, joint Executive Director of Enforcement and Market Oversight at the FCA, said CBPL had been told its controls had significant weaknesses. She said that repeated breaches of the VREQ requirements “increased the risk that criminals could use CBPL to launder the proceeds of crime”. The fine is a stark reminder to other firms in the sector that if they do not do enough to protect against financial crime and fail to comply with operational restrictions in place they will face scrutiny and enforcement action.

As Therese Chambers stated, the FCA will not “tolerate such laxity, which jeopardises the integrity of our markets”. The message being sent out to the burgeoning crypto/digital assets industry, which is calling for greater regulatory clarity, is that companies like CBPL must conduct their business with due skill, care and diligence to comply with Principle 2 of the FCA’s Principles for Businesses.

Crypto firms that want to remain active in the UK and provide services to UK clients must be prepared and willing to comply with regulatory requirements, and to face the accompanying scrutiny from the regulator.

A firm must demonstrate due skill, care and diligence in putting in place measures to comply with regulatory requirements: that applies across the board – from setting up the relevant processes, refining them as needed, staffing and supervising them appropriately and ensuring that they operate effectively and are fit for purpose. It is particularly important where – as here – a firm is subject to specific requirements, agreed with the authority. Where firms fail to act with due skill, care and diligence, they risk facing enforcement action.

In April 2022, Rishi Sunak, who was Chancellor of the Exchequer at the time, stated the government’s ambition to make the UK a global hub for cryptoasset technologies and investment. At the time he said the measures he outlined would help to ensure firms can invest, innovate and scale up, and were designed to provide cryptoasset firms with the necessary clarity to operate effectively, and to give customers the necessary protection and confidence to invest. Of course, a necessary part of this is regulatory oversight and enforcement.

It is as yet unclear whether the new Labour government will maintain the UK’s aim of being at the forefront of global cryptoasset investment. The party was tight-lipped about its intentions in its manifesto ahead of the General Election victory. Regardless of the political direction of travel, if regulatory action is what is required to ensure that crypto firms put in place the necessary processes to manage money laundering risk and protect against financial crime, then we can expect to see more intervention by the FCA in this sector.