In practice, specific ML/TF risks arise depending on how cryptoasset transfers are structured and which parties are involved. The following scenarios illustrate key compliance challenges.

Suppose a UK-registered cryptoasset business sends a cryptoasset transfer to another cryptoasset business. If the originator transmits incomplete or inaccurate originator information, the beneficiary cryptoasset business must match received data against its own Customer Due Diligence records. Where information is missing or inconsistent, the beneficiary cryptoasset business must request the missing details and, if not resolved, consider rejecting the transfer or filing a Suspicious Activity Report. Repeated failures by the originator to provide required information must be reported to the FCA.

Where a cryptoasset transfer involves an unhosted wallet, there is no counterparty institution to receive or transmit Travel Rule data. The originating cryptoasset business is not required to send information to the unhosted wallet but must obtain the information required under Part 7A, applying the specific rules for unhosted wallet transfers and a risk-based approach. The FCA expects firms to assess ownership or control of the wallet rather than applying a blanket block.

If a beneficiary cryptoasset business is in an overseas jurisdiction where the Travel Rule is not yet implemented, the overseas cryptoasset business may lack the infrastructure or obligation to receive Travel Rule data. The UK originator cryptoasset business must still collect and verify the required originator and beneficiary information and retain it, even if the counterparty cannot receive it. The FCA expects the originator to take all reasonable steps to establish whether the overseas firm can accept the data and to conduct a risk-based assessment before proceeding with the transfer.

Bills of exchange are rooted in traditional commercial practices, but they remain widely used in modern trade finance and international transactions. Because of their flexibility and ability to be transferred between parties, they are commercially useful. 

However, these same features can also create opportunities for fraud, layering of funds, and disguised value transfer. UK regulators, therefore, expect firms to handle such instruments to apply risk-based AML controls that mitigate their exposure to any potential risks.

Criminal property risk often comes up in routine professional activity rather than in an obvious situation.

A firm may unknowingly facilitate a property purchase funded by undisclosed proceeds from fraud; handle client funds derived from tax evasion or asset forfeiture, and later discover that they originated from bribery or sanctions evasion.

Inconsistent explanations of source-of-funds, unusual transactions or unexplained third-party payments, adverse media linking a client to a criminal investigation, or insufficient information about them are some of the strong reasons for suspicion.

In some cases, historic criminal conduct may only become apparent after engagement has begun.

Importantly, liability can arise even if the firm was not involved in the underlying offence. Where knowledge or suspicion exists, internal reporting to the Money Laundering Reporting Officer (MLRO) and inappropriate escalation are essential to manage legal exposure.

Legal responsibility arises as soon as a Nominated Officer learns about any suspicion of Money Laundering. They are primarily responsible for receiving internal reports of suspicious activity and must promptly and objectively assess employee-submitted SARs.

Risk arises when reports are not reviewed in a timely manner, or if commercial pressure influences the reporting duties of the nominated officer, liability may follow.

Documentation failures are another common reason for exposure.

If an SAR is not submitted, the rationale must be clearly documented. Without a defensible audit trail demonstrating structured assessment and reasoning, the company may face difficulties in defending it during the supervisory review.

Terrorist property risk can arise in a range of practical situations. A firm may onboard a client and later encounter that they have links to a proscribed organisation.

Charitable transfers to high-risk regions without any clear explanations, or cross-border remittances involving conflict-affected areas, may also trigger concern. Importantly, terrorist financing does not always involve large amounts. Small-value transactions may still contribute to risk if they support extremist networks in any way. Law firms, money service businesses, accountancy practices, and estate agents may all encounter exposure where funds pass through client accounts or transactional structures.

If red flags suggest a potential link to terrorism, the nominated officer or money laundering report officer (MLRO) must escalate the matter immediately and restrict or halt all the transactions or, where appropriate.

Delay or inaction on the red flags may create personal and corporate liability.