Does the NFT represent a regulated financial instrument?
The UK’s Financial Conduct Authority (“FCA”) regulates DLT tokens offered to UK customers if the underlying asset is a specified financial instrument (such as debt or equity instruments), or if it can be used as electronic money. Where the underlying asset is a specified financial instrument, the company may be required to comply with the same regulatory obligations as investment firms. They will be subject to a dedicated regime requiring them to obtain a licence from the FCA and there will be restrictions on how and to whom their services can be offered. Companies offering electronic money tokens may be subject to the same regulations as electronic money providers and they must similarly be licenced and operate in line with regulatory conditions and restrictions. Both types of firm will have strict reporting requirements to the FCA.
Does the NFT represent an unregulated token?
Most NFTs are not linked to specified investments or electronic money and are not within the FCA’s licencing regime. This generally means that firms offering services to exchange NFTs for cash or other crypto-assets on behalf others, or custody services over NFTs (e.g. secure digital wallets), are not required to obtain a licence from the FCA or to comply with onerous conduct of business or systems and controls requirements to the same extent as regulated firms.
The FCA's AML requirement for crypto-business
Notwithstanding the absence of a specific FCA regulatory regime for NFTs, there is a need for firms who provide exchange or custody services for any NFT to comply with the regulations governing anti-money laundering (“AML”), which include the requirement to be registered with (as opposed to licenced by) a competent regulatory authority. The FCA is the competent UK authority for the Money Laundering Regulations 2017 as amended (the “MLRs”).
The MLRs define activities which require firms to apply processes and procedures to identify and mitigate the risks of their businesses being used for money laundering or terrorist financing purposes. Included in the relevant activities are services in respect of crypto-assets. Crypto-assets are defined as "a cryptographically secured digital representation of value or contractual rights that uses a form of DLT and can be transferred, stored or traded electronically". This broad definition includes many NFTs and, where firms provide custody or are engaged in the exchange or making arrangements for the exchange of these NFTs (“crypto-business”) a requirement to comply with the MLRs, including FCA registration, is triggered.
Theoretically, FCA registration for AML purposes is far less onerous than gaining a licence from the FCA to provide regulated services. In practice, however, many registrants have struggled to meet the FCAs high AML expectations for crypto-business. In the two years in which firms have been able to register with the FCA, only 34 have been successful. In the first quarter of 2022, only one firm has successfully been added to the register of crypto-asset businesses. In contrast, 248 crypto-businesses are currently identified on the FCA’s list of unregistered firms. Firms found to be conducting crypto-business without first being registered with the FCA may face financial penalties, censure and/or closure of their business.
Key challenges in satisfying the FCA’s AML requirements
The FCA’s reasons for rejecting registration applications will vary from firm to firm. However, several clear messages are starting to emerge from the FCA in relation to how firms are failing to meet the registration requirements.
Firstly, the FCA has highlighted the need for senior management of crypto-businesses to meet expected standards of fitness and propriety. This includes the need to have a deep understanding of the AML risks inherent to crypto-business. In February 2022 the UK’s Upper Tribunal reached its decision in the first appeal brought by a firm against the FCA’s rejection of its registration application. Rejecting the appeal of crypto-asset exchange, Gidiplus Limited, the tribunal found that a proposed senior manager responsible for compliance with the MLRs had only undertaken 1.5 hours of AML training and appeared to lack suitable skills and experience to allow him to deal with the risks of money laundering posed by his business.
Secondly, we are seeing many firms fail to prepare business wide AML risk assessments. The MLRs require crypto-businesses to produce and keep updated a risk assessment which adequately identifies all of the risks of their business and implements measures to mitigate those risks. NFT firms must recognise that the digital nature of their business makes them more susceptible to identity fraud and cyber security threats. Concurrently, if the NFT firm cannot demonstrate that it has measures in place to adequately identify customers, customers’ source of wealth and funds, and/or they are unable to show high levels of data and cyber security, the firm will not receive FCA approval.
Finally, firms wishing to receive FCA registration must commit to being firmly within the scope of FCA oversight. Because of the decentralised way that NFT and other crypto businesses are operated, or tokens created, an effective system of regulation requires the crypto-business to have people and resources that are easily accessible by the FCA in the UK. This is necessary to give force to FCA supervision and enforcement powers. As a result of its failure to commit to full FCA oversight, Binance Markets Limited had its permission to provide crypto services revoked in June of 2021. The firm failed to provide complete responses and, in some instances, refused to provide any information in response to direct requests from the FCA.
The FCA will not award registration to businesses that cannot be effectively supervised by them. This includes failures to explain basic issues, such as who is responsible for key functions within the UK or how they are organised.
Companies operating in the NFT sector must note that the lack of a dedicated FCA regulatory regime for NFTs does not absolve them of regulatory responsibilities. There may be significant hurdles to overcome before NFT companies will be permitted to provide their services to UK customers. This is a fast-evolving sector and we expect compliance with AML requirements to be just the first step in the UK government’s journey towards developing an NFT regulatory regime. It is important then that NFT companies get this first part right.
ABOUT BAKER BOTTS L.L.P.
Baker Botts is an international law firm of approximately 650 lawyers practicing throughout a network of offices around the globe. Based on our experience and knowledge of our clients' industries, we are recognized as a leading firm in the energy, technology, and life sciences sectors. Since 1840, we have provided creative and effective legal solutions for our clients while demonstrating an unrelenting commitment to excellence. For more information, please visit bakerbotts.com.