Holding cryptoassets does not by itself make a client high risk, but the UK’s 2025 national risk assessment rates money laundering through cryptoassets as high, so the questions an accountant asks need to be sharper. The central task is tracing the wealth back to where it entered the crypto world: which bank account funded the first purchases, which exchanges were used, and what records link the wallets to the client. Where gains are cashed out, the firm checks that the money comes back through an identifiable exchange into an account in the client’s own name.

Does a crypto holding make a client high risk?

Not automatically. ICAEW’s guidance on cryptoassets for accountants says that, given how widely they are held, the mere presence of cryptoassets in a client’s portfolio does not necessarily make the client a high money laundering risk, and that the primary questions will be about source of wealth and source of funds. Many people buy small amounts through mainstream apps for legitimate reasons.

The context has hardened, though. The National Risk Assessment of Money Laundering and Terrorist Financing 2025 says the risk of money laundering through cryptoassets has increased since 2020 and is now assessed as high. Regulation 33(6)(b) of the Money Laundering Regulations 2017 (MLR 2017) also lists, as factors pointing to higher risk, products or transactions that might favour anonymity and the use of new or developing technologies. These belong in the client risk assessment, weighed against the size of the holding, how it was built up and how transparent the client is.

How are cryptoassets used to launder money?

The national risk assessment describes cryptoasset service providers as a key off ramp for converting criminal cryptoassets into ordinary currency, with significant amounts of identifiable laundered funds ending up at a small number of centralised exchanges. It also notes the use of money mule accounts to convert and move relatively small amounts, typically less than £10,000, at a time.

ICAEW’s guidance explains how cryptoassets can feature at every stage: proceeds of crime received in crypto on the dark web, conversion between cryptoassets, use of mixers (services that pool and shuffle transactions to break the link between sender and recipient), splitting large holdings across many wallets, and cashing out through crypto ATMs or exchanges with weak checks. Its worked example ends with the laundered funds being invested in property, luxury assets or businesses, which is often the point at which an accountant is engaged.

How do you evidence source of wealth for crypto?

HMRC’s anti money laundering guidance (AMLG11630) describes source of wealth as the activities that generated the client’s overall wealth, and lists crypto wallets among the documents that can evidence it, alongside accounts, share registers, property portfolios and bank statements. The aim is a credible story of how the holding was built, not an audit of every trade. Useful evidence includes:

  • bank statements showing the original transfers of ordinary money to an exchange, from an account in the client’s name;
  • exchange account statements or transaction downloads showing purchases, trades and withdrawals;
  • wallet addresses the client controls, which can be checked against the public blockchain;
  • evidence of any crypto received as income, such as mining, staking or payment for work;
  • the client’s own capital gains records.

The last point is helpful. HMRC’s Cryptoassets Manual (CRYPTO10400) puts the onus on individuals to keep records of each transaction, including the type of cryptoasset, date, whether bought or sold, number of units, sterling value at the time, cumulative holding, and bank statements and wallet addresses. A client who has kept the records needed for tax will usually be able to evidence source of wealth too. The tax side is covered in how HMRC taxes cryptoassets.

ICAEW’s guidance suggests asking whether trading or investment records show the origin of the funds, whether the blockchain can be interrogated, whether mixers or other anonymising services have been used, and whether the client has moved funds without using a third party wallet provider. For the general approach, see source of funds and source of wealth checks.

What should you check when crypto is cashed out?

Source of funds, in HMRC’s words, means establishing the provenance of the particular funds used in a transaction, including the remitting account and the activity that generated them. Under regulation 28(11)(a), source of funds is examined where necessary as part of ongoing monitoring, to keep transactions consistent with the firm’s knowledge of the client. When a client uses crypto proceeds to buy property, inject capital into a company or settle a trust, the firm should be able to follow the money from the exchange to the client’s bank account.

Points to check include whether the exchange is registered with the FCA. The FCA explains that cryptoasset exchange providers and custodian wallet providers carrying on business in the UK must register with it under MLR 2017 before providing in scope services, though registration is not an endorsement and customers are unlikely to have Financial Ombudsman or FSCS protection. The national risk assessment notes that in April 2025 the FCA listed 32 UK businesses that appeared to be carrying on cryptoasset activity without registration.

From 1 January 2026, under the Cryptoasset Reporting Framework, exchanges and other cryptoasset service providers must collect customers’ full name, address, country of tax residence and tax identification number (CRYPTO10410). Clients dealing through mainstream platforms should therefore have identifiable account records, and HMRC will increasingly receive data that can be compared with tax returns.

What if the early purchases cannot be evidenced?

This is common. HMRC’s manual itself notes that exchanges may keep records only for a short period, or may no longer exist. A practice can then look for other evidence: bank statements from the period showing payments to an exchange, old confirmation emails, or blockchain records linking a known wallet address to the holding. The firm then judges whether the explanation is plausible for that client and records its reasoning.

If the gap cannot be closed and the firm cannot complete the due diligence it requires under regulation 28, regulation 31 says it must not establish the business relationship or carry out the transaction, must end any existing relationship, and must consider whether a disclosure is required under the Proceeds of Crime Act 2002. A gap is not itself grounds for suspicion, but unexplained wealth, reluctance to explain or use of mixers may be; see suspicious activity reports.

What about clients who run crypto businesses?

A client who mines, issues tokens, raises funds through a token sale or operates an exchange presents different risks from an investor. ICAEW’s guidance suggests considering the reputation of the cryptoasset, its issuers and exchanges, any perceived corruption or criminal activity associated with them, and whether their anti money laundering controls exist and work. A client that offers exchange or custody services in the UK should be on the FCA register. The FCA says a new regime for cryptoasset regulation is expected to come into force on 25 October 2027. These clients are more likely to need enhanced due diligence.

What does this look like in practice?

Illustration only. A new client, a salaried engineer, wants help with a large capital gain after selling bitcoin and plans to use £150,000 of the proceeds towards a house.

  1. The practice asks how and when the bitcoin was bought. The client says he invested £8,000 in 2017 and 2018 from his salary.
  2. He provides bank statements showing transfers to a well known exchange in those years, and the exchange’s transaction history, which shows purchases, no later deposits from other sources and a recent sale.
  3. The sale proceeds went from the exchange to his own UK bank account. The exchange appears on the FCA register.
  4. The growth is consistent with bitcoin’s price history, and the client’s records also support the capital gains computation.
  5. The practice rates the client normal risk and records the evidence. Had the bitcoin arrived from an unknown wallet, or been routed through a mixer, it would have asked further questions before going ahead.

What are the warning signs and common mistakes?

  • Accepting a screenshot of a wallet balance as evidence of source of wealth.
  • Asking where the proceeds went but not how the holding was acquired.
  • Ignoring transfers from wallets the client cannot explain, or the use of mixers or privacy coins.
  • Proceeds paid out to third party accounts or through several exchanges for no clear reason.
  • Wealth out of proportion to the client’s known income and investment history.
  • Treating every crypto holder as high risk, which wastes effort and drives away legitimate clients. The wider list of warning signs is in money laundering red flags for accountants.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.