The Financial Conduct Authority has proposed that crypto firms carry out due diligence on personal, unhosted wallets, laying the idea out in new guidance that is explicitly nonbinding. The consultation lists unhosted-wallet checks as good practice rather than a hard rule, and it pushes back on two things firms have leaned on: unexplained third-party risk scores and rigid tracing requirements.
In plain terms, the FCA is sketching what it thinks careful firms should do when a customer wants to move assets to or from a wallet the firm doesn't control. It is not writing a rulebook. The guidance, if finalized, would sit as expectation rather than obligation — a distinction that matters for anyone deciding how much compliance budget to spend.
What the FCA actually asked for
The core proposal is due diligence on unhosted wallets. That's the regulator's term for wallets where the user, not a licensed intermediary, holds the keys. The guidance frames checks on those wallets as good practice — the sort of thing a well-run firm would do — rather than something the FCA can enforce on its own.
It doesn't spell out a single method. Instead, the document treats wallet vetting as a judgment call that firms should be able to explain. That's a softer line than some jurisdictions have taken, where specific verification steps are written into statute.
The pushback on scores and tracing
Two criticisms stand out. The first targets unexplained third-party scores — risk ratings that analytics vendors hand to firms, often without saying how the number was produced. The FCA's guidance treats blind reliance on those scores as poor practice. If a firm is going to block or flag a customer's wallet, it should know why.
The second targets rigid tracing rules. Rules that force firms to follow every hop of a transaction, regardless of context, come in for criticism too. The guidance suggests that inflexible tracing isn't the same thing as good diligence, and that firms should weigh the facts of a transfer rather than mechanically applying a rule.
Both points land on the same theme: process for its own sake doesn't impress the regulator. Being able to justify a decision does.
Why nonbinding matters
The word "nonbinding" is doing a lot of work here. Guidance doesn't carry the force of rules, and the FCA can't fine a firm simply for ignoring it. But it does shape how the regulator reads a firm's conduct when something goes wrong, and firms tend to treat it as a signal of where supervision is heading.
For crypto businesses, that creates a familiar calculation. Adopt the checks early and absorb the cost, or wait and risk being measured against guidance that was never technically mandatory. Neither option is free.
What comes next
The proposal is out for consultation, and the FCA hasn't said when it will publish the final version or whether the language will change. Until then, the document is a draft — and firms weighing how to handle personal wallets have a window to respond before the regulator settles its position.
