How FCA’s Crackdown Is Rewriting the Playbook for London’s P2P Crypto Startups

Introduction: Why This Playbook Matters Now

The FCA P2P crypto crackdown that unfolded in September 2026 has sent shockwaves through London’s burgeoning peer‑to‑peer (P2P) crypto scene. On September 10 the Financial Conduct Authority, together with HMRC and the Metropolitan Police, raided three commercial premises suspected of running unregistered crypto matching services – a coordinated operation first reported by NewsBTC [Source 1]. The fallout was swift: each business received a cease‑and‑desist notice, faced potential fines, and suffered an immediate reputational hit that scared investors and partners alike. For founders who thought a digital‑only model insulated them from regulator scrutiny, the message is clear – the FCA is now policing the full spectrum of crypto activity, including “offline” matchmaking hubs. This article gives you a step‑by‑step compliance checklist so you can transition from a risky startup to an FCA‑ready platform, rather than just summarising the news.

What Triggered the FCA’s Recent Crackdown?

The regulatory backdrop

The UK is on the cusp of a massive overhaul of crypto supervision. While the FCA’s new authorisation gateway is set to open at the end of September, firms have already been subject to anti‑money‑laundering (AML) registration requirements and strict financial‑promotion rules. What changed this time is the regulator’s shift from focusing solely on licensed exchanges to targeting P2P marketplaces that match buyers and sellers in physical or virtual spaces.

Red‑flag behaviours that attracted attention

The three inspected premises shared a common risk profile: they operated out of visible office locations, advertised lucrative “instant cash‑out” deals on social media and Discord, and handled large cash‑heavy transactions without any AML registration. These signals signalled to the FCA that the operators were conducting unregistered trading – a clear breach of both the AML Registration Regime and the Financial Promotion Order.

Enforcement priorities evolving

Historically, the FCA’s enforcement engine has been calibrated to licensing exchanges and custodians. The recent operation demonstrates a strategic pivot: the regulator now treats P2P matchmaking as a regulated activity when it effectively functions as a trading venue, especially where it is open to retail participants.

On‑Site Enforcement Tactics Unpacked

Pre‑inspection intelligence gathering

Before the September 10 raid, the FCA collaborated closely with HMRC’s tax‑evasion unit and the Metropolitan Police’s financial crime squad. Using surveillance of advertised promotions and financial transaction patterns, they built a dossier that identified the three target locations.

What officers examined on the day

Inspectors demanded immediate access to: - Customer logs and sign‑up records - KYC documentation (ID scans, proof of address) - AML transaction‑monitoring software and alerts - Any marketing material that could be construed as a financial promotion

Evidence was seized on‑site, and each business was handed a cease‑and‑desist notice outlining specific breaches. A follow‑up report is now due to the FCA within 30 days, outlining remediation steps.

Key takeaway for startups

Even if you operate solely online, the FCA can conduct unannounced physical inspections of any address you list as a registered office. Keeping inspection‑ready records, clear audit trails, and a documented compliance programme is therefore non‑negotiable.

Regulatory Gaps Exposed by the Crackdown

Gap	Why it mattered	FCA implication
Missing AML registration	Many P2P operators assumed that because they did not hold customer funds, AML rules didn’t apply.	The FCA treats any service that enables crypto transactions as AML‑covered, regardless of custody.
Financial‑promotion violations	Unapproved adverts on Twitter, TikTok, and Discord were deemed “unauthorised promotions”.	Promotions must be approved by a senior compliance officer and contain clear risk disclosures.
Record‑keeping failures	Operators could not produce transaction logs or audit trails.	FCA rules require five‑year storage of customer and transaction data for inspection.

These deficiencies line up directly with the upcoming authorisation gateway, meaning firms that fail to plug them now will face higher hurdles – or outright rejection – when applying for formal FCA authorisation.

Step‑by‑Step Playbook to Keep Your P2P Platform FCA‑Ready

1️⃣ Register for AML supervision (Form AMS)

When: Submit within 30 days of launching a crypto‑matching service.
Documents: Business registration, ownership structure, risk‑assessment template, and AML policies.
Timeline: FCA typically replies within 6‑8 weeks; factor this into your product roadmap.

2️⃣ Secure FCA authorisation (if required)

Scope: Determine whether you are ‘providing a regulated activity’ (e.g., operating a multilateral trading facility).
Capital: Minimum £125,000 for crypto‑related services; higher if you handle large transaction volumes.
Governance checklist: Board approval, senior compliance officer, internal controls, and a whistle‑blowing policy.

3️⃣ Build a compliant KYC/AML framework

Risk‑based onboarding: Use tiered verification (ID, facial recognition, source‑of‑funds checks) based on transaction size.
Transaction monitoring: Deploy real‑time analytics that flag structuring, rapid turnover, or high‑risk jurisdictions.
SAR filing: Submit Suspicious Activity Reports to the National Crime Agency within 24 hours of detection.

4️⃣ Align financial‑promotion content with FCA rules

Approval workflow: Every public post, tweet, or Discord announcement must be signed off by the compliance officer before release.
Risk disclosures: Include clear statements about price volatility, loss risk, and that the service is not a regulated investment.
Audit logs: Store every version of promotional material with timestamps for at least five years.

5️⃣ Implement robust record‑keeping

Secure storage: Encrypted databases with role‑based access control.
Retention: Keep customer KYC records, transaction histories, and internal policies for a minimum of five years, as mandated by the FCA.
Backup: Off‑site, encrypted backups refreshed daily.

6️⃣ Ongoing monitoring & internal audit

Quarterly self‑assessment: Use a compliance scorecard to rate AML, governance, and promotion controls.
Mock inspections: Conduct internal “surprise” audits mimicking FCA visit checklists.
Staff training: Mandatory quarterly e‑learning covering AML red flags, data protection, and reporting obligations.

7️⃣ Liaise proactively with HMRC & law enforcement

Reporting obligations: File CT‑600 and crypto‑specific tax returns on schedule; disclose any large cash movements over £10,000.
Tax‑compliance checks: Run annual reconciliations with HMRC’s crypto‑tax guidance.
Incident response: Draft a plan that outlines steps for data breaches, regulatory inquiries, and enforcement notices.

By following these seven steps, your P2P platform will be positioned to meet the FCA’s current expectations and future authorisation gateway requirements.

FAQs: Common Compliance Questions from Crypto Entrepreneurs

Q: Do I need FCA authorisation if I only facilitate peer‑to‑peer matching? A: If you simply provide a matchmaking service without taking custody or executing trades, you may fall under the “service of facilitating transactions” umbrella, which still requires AML registration and may need authorisation depending on the level of control you exert over the transaction flow.

Q: What distinguishes “unregistered trading” from a licensed exchange? A: Licensed exchanges hold a full FCA authorisation, adhere to capital and governance standards, and are subject to ongoing supervision. Unregistered trading platforms operate without any of these safeguards, breaching AML registration and financial‑promotion rules.

Q: How can I prove my AML controls are sufficient during an FCA visit? A: Provide up‑to‑date AML policies, risk‑based onboarding records, SAR filings, and a live demonstration of your transaction‑monitoring dashboard.

Q: Is a physical office still required for a UK‑based P2P platform? A: While a virtual office is permissible, the FCA expects a verifiable registered address for correspondence and may inspect that location if it appears on public records.

Q: What are the penalties for breaching the cease‑and‑desist notice? A: Penalties can include unlimited fines, criminal prosecution for fraud, and a five‑year ban from operating any regulated activity in the UK.

Bottom Line & Next Steps for London Crypto Startups

Time is of the essence – the FCA’s authorisation gateway opens at the end of September. Quick‑start checklist: submit AML registration, lock‑down promotion approval workflows, audit your record‑keeping, and run a mock FCA inspection. For a seamless transition, engage an FCA‑approved legal counsel or compliance consultancy today.

Keywords: FCA P2P crypto crackdown, London crypto compliance, unregistered crypto trading, crypto regulatory playbook, illegal crypto enforcement