The UK National Risk Assessment 2025: A Seismic Shift In The Payment And Crypto Risk Landscape
The release of the UK National Risk Assessment 2025 marks a watershed moment for the financial services sector, particularly for electronic money institutions (EMIs), payment service providers (PSPs) (IMHO this should be referring to Authorised Payment Institutions (APIs) since they are recognised as a separate type of authorisation whilst PSPs cover all, EMIs, APIs and even credit institutions providing payment services but who asked me- the government, of course, knows better!), money service businesses (MSBs), and cryptoasset service providers (CASPs).
With money laundering risks escalating from medium to high for EMIs and PSPs, MSBs maintaining their high-risk status, and cryptoassets emerging as a formidable new threat vector, the regulatory landscape has fundamentally shifted. So much so with all legislative novelty and draft of cryptoasset regulated activities order in the UK, and all of the enforcement actions in the sector all across the globe. This comprehensive article unpacks what these changes mean for your business and why the time for enhanced compliance measures is now, not later, and why the argument “We can do it since Jeff’s EMI is also doing it!” won’t cut it any longer. What was recognised as a major threat and numerous failures all across the board in the sector by the Financial Conduct Authority (FCA) is now on the front page and transposed in the UK National Risk Assessment 2025.
Note: If you’re unsure how to implement this at your firm and how you should conduct a risk assessment, you can refer to this article, which is accompanied by a free risk assessment template.
The Evolution Since 2020: From Growing Pains to Growing Risks
The UK National Risk Assessment 2025 paints a dramatically different picture from its 2020 predecessor. Perhaps most notable is the elevation of EMIs and PSPs from medium to high risk – a change that reflects not just increased criminal exploitation but also the sector’s explosive growth and lag of 5 years in relation to the potential for exploitation. Despite the recent decrease in the number of firms, the sector has grown significantly in scale in the UK since 2020, with more people turning to non-bank payment providers online.
The numbers tell a compelling story: FCA-registered/authorised EMIs’ total payments value grew from £477 billion in 2020 to £1.1 trillion in 2023, while FCA-registered/authorised Payments firms’ total payments value increased from £444 billion to £963 billion in the same period. This represents a staggering combined growth from £921 billion to over £2 trillion in just three years, a testament to both the sector’s success and its increased attractiveness to criminal actors who can hide their ill-got gains among those of legitimate businesses.
Meanwhile, MSBs have witnessed a different trajectory. At the end of 2023/24, 983 MSB principals were registered with HMRC and operated out of 29,845 premises either as branches or agents. However, the sector has and continues to reduce in size, as principals, agents and premises have all fallen significantly (51%) between 2017 and December 2024. Think here of derisking by the banks and cash becoming the kryptonite of each super-compliant PSP. This contraction, assessed as potentially due to both commercial factors and heightened compliance approaches by HMRC, hasn’t reduced the risk – MSBs remain firmly in the high-risk category.
Cryptoasset Service Providers: The Digital Wild West Tamed?
The transformation of the cryptoasset sector since 2020 is nothing short of remarkable both in terms of international growth and implications that it has for the UK. The UK National Risk Assessment 2025 reveals that the risk of money laundering through cryptoassets has increased significantly since 2020 with cryptoassets increasingly appearing in money laundering intelligence over this period. This isn’t just about Bitcoin anymore – stablecoins such as Tether are now most commonly used to launder money. If you wonder how that could be done, we have a step-by-step guide ready for you here (and yes, this is an article explaining how to launder money via cryptoassets; one on prevention can be found here).
The scale of adoption tells its own story. The consumer base for cryptoassets has grown since 2020 with 2024 FCA research finding that 12% (extrapolated to around 7 million) of UK adults owned cryptoassets, compared to 4.4% (2.2 million) they calculated in 2021. Yet the regulatory gatekeeping has been fierce: 368 applications for registration were submitted, 86% of firms who applied for registration did not meet the standard for registration, meaning that only a small number of cryptoasset firms that applied for registration met the UK’s AML standard. So whilst it is up till now a mere registration (as opposed to the full-scale authorisation), the process actually looks closer to the EMI authorisation due to the sheer number of requirements.
The Criminal Crypto Convergence
What makes the crypto risk particularly acute is its intersection with traditional financial services. Cryptoasset service providers have a high level of risk exposure due to the volume and value of activities they conduct in the ecosystem, the speed of transactions, their intermediary role within the global cryptoasset sector, as well as their connection with the traditional financial system.
The UK National Risk Assessment 2025 identifies a particularly concerning trend: the NCA estimate that $1.7-5.1 billion in illicit cryptoassets transactions are linked to the UK annually (through regulated and unregulated businesses). This staggering figure represents just the tip of the iceberg, as Chainalysis found that $22.2 billion was sent from illicit addresses globally in 2023 – this figure is a lower bound estimate of the total amount laundered, as it is only based on illicit addresses that have already been identified. Since we are speaking about a UK National Risk Assessment 2025, consider this data already dated, in the latest full year report for 2024, Chainalysis estimated $51 billion to be illicit volumes and data for half of 2025 is projected to meet or even exceed volumes of 2024. So overall, the picture becomes only dimmer.
UK National Risk Assessment 2025: Sophisticated Schemes and Evolving Typologies
The methods criminals use to exploit cryptoassets have evolved dramatically. Similar to traditional finance, a commonly used method of laundering cryptoassets is the use of money mules and mule accounts; laundering networks make use of numerous third-party accounts (either paid for, fraudulently accessed or stolen) to convert and move relatively small volumes (typically less than £10,000) of criminal funds at a time. Remember the report of Transparency International on crypto-to-fiat money mules? If you haven’t read that, you should, specifically considering the convergence of cryptoasset providers and EMIs discussed further.
But interestingly, it’s the over-the-counter (OTC) market that presents perhaps the greatest vulnerability. The NCA assess that it is likely hundreds of millions of pounds per year are being laundered through Over the Counter cryptoasset brokers in the UK. These services are particularly attractive because over-the-counter broker-facilitated trades in the UK have been identified as being cashed out in countries such as Albania, Colombia, Russia, Singapore, UAE and Vietnam.
EMIs and PSPs: The New High-Risk Frontier
The UK National Risk Assessment 2025 identifies a confluence of factors that have pushed EMIs and PSPs into high-risk territory. The rapid scaling of the sector since 2020, increased complexity and diversification of services, has contributed to the sector’s attractiveness for criminals, with increased options to manage and launder funds cross-border.
One of the most concerning vulnerabilities lies in the sector’s very strengths. From a customer perspective, EMIs and PSPs may have simpler onboarding processes in comparison to high street banks, with no physical presence required to set up accounts and a simpler process than for most banks. What makes these services attractive to legitimate customers – convenience, speed, and accessibility – also creates opportunities for exploitation.
The UK National Risk Assessment 2025 highlights particular concern about outsourcing practices. The FCA has noted that the outsourcing of anti-money laundering compliance functions to third-party providers can create vulnerabilities in EMIs’ and PSPs’ controls. When third-party providers lack familiarity with specific products and risks, gaps emerge that criminals can exploit. This said, utilising third parties can actually enhance your game and keep you at the forefront whilst countering AML/CTF concerns. You can read and access our guide on AML/CTF compliance matters below, which explains how to set up that appropriately within your firm.
Virtual IBANs: The Hidden Risk Multiplier
Perhaps no innovation exemplifies the double-edged sword of fintech advancement quite like virtual IBANs. Multiple virtual IBANs (VIBANs) can be issued and linked to a single payment account with customers able to move funds between them. This reduces the visibility of transactions to the authorised banking and custodial partners as the money moves between virtual ledger positions without moving into or from a bank account. The UK National Risk Assessment 2025 echoes findings of the European Banking Authority (EBA) in its vIBAN study of 2024, which would be a good read for each compliance professional.
The UK National Risk Assessment 2025 presents a stark case study that illustrates this vulnerability: HMRC has several civil and criminal investigations into an OCG who operated an alternative banking platform (ABP) to engage in money laundering predicated by cheating the revenue using a mini umbrella company (MUC) fraud. The platform enabled fraud through virtual bank accounts, with about £2.5 billion being laundered per annum with more than £500 million of this being estimated revenue loss.
UK National Risk Assessment 2025: The Crypto-EMI Nexus
The convergence of traditional payment services with cryptoassets creates unprecedented risks. As of March 2025, there were five EMI and Payments firms registered with the FCA to provide cryptoasset services either themselves or through a related-group company. However, since 2020 there has been a significant increase in the number of firms with e-money agents who are principally cryptoasset firms.
This intersection is particularly problematic because there is a high money laundering and terrorist financing risk associated with this, where the UK-incorporated EMI and Payments firms may provide the ‘on ramps’ and ‘off ramps’ (the exchange of fiat currencies for cryptoassets and vice versa), for a cryptoasset service provider. Actually, some EMIs even have completely shifted their business priorities to onboarding solely crypto firms due to the wonderful margins available in such business models. Some even acquired cryptoasset providers registered with the FCA to provide all the services under one roof (wink, wink, you know who I’m speaking about).
MSBs: The Persistent High-Risk Challenge
Despite the digital revolution in payments, the UK National Risk Assessment 2025 confirms that for MSBs, cash remains widely used by criminals who continue to exploit features of the MSB sector to move or convert criminal funds. The fundamental vulnerabilities haven’t changed: the global reach of money remitters, including to high risk jurisdictions, the ease of making cash transactions, including the anonymous nature of the origins of cash, the one-off nature of many transactions and the speed of transactions are key features that make the sector particularly attractive to criminals.
The Unregistered Underground
One of the most troubling findings in the UK National Risk Assessment 2025 concerns unregistered MSB activity. Not all businesses are registered, either out of choice or ignorance of the requirements to do so. The report includes a compelling case study: an MSB was trading for a year and a half without being registered under the MLRs for supervision. During this period, the MSB transmitted funds to the value of £543,680, using Informal Value Transfer Systems.
This underground economy operates without oversight, creating significant vulnerabilities in the UK’s financial defenses. The true scale of the number of unregistered MSBs is not known, but HMRC has a long-running project monitoring un-registered activity. In our practice, we receive quite many dubious requests from businesses claiming that they operate such arrangements and wish to become legit and get authorisation for this purpose, so the sentiment is shared here and there is actually an issue.
Terrorist Financing: An Escalating Threat Across All Sectors
The terrorism financing landscape has shifted dramatically since 2020. For EMIs and PSPs, the terrorist financing risk of EMIs and PSPs has increased from medium to high. MSBs maintain their high-risk status, while cryptoassets present unique challenges.
For crypto specifically, the risk of registered cryptoasset firms being used to finance terrorism has grown but remains medium. However, the UK National Risk Assessment 2025 warns that the prevalence of cryptoassets in terrorist financing cases has also grown, citing the case of Hisham Chaudhary, who converted around £55,000 from various sources, including his salary, into Bitcoin to send to contacts in Türkiye to extract Islamic State supporters from internally displaced people camps in Syria. Here, let’s open the guide on terrorism financing for dummies 101 and recall what the main difference is between money laundering and terrorist financing. Rightfully, this is the reason why the FCA in some interactions was quite peculiar with the entities looking to get authorised in relation to where the cryptoassets are travelling after they are received. As we all know, “with great power comes great responsibility”, and that is true for crypto – with unrestricted transferability comes great illicit activity.
Supervisory Response: A Multi-Front Battle
FCA’s Crypto Crackdown
The regulatory response to crypto risks has been particularly robust. The UK National Risk Assessment 2025 reveals extensive enforcement action: the number registered cryptoasset firms has increased from four at the end of 2020 to 48 as of 10 April 2025. The FCA maintains a robust gateway and supervises registered firms to ensure they remain compliant with the MLRs.
The FCA’s approach to unregistered crypto activity has been uncompromising. In a compelling example, in 2023, the FCA visited 38 locations across the UK suspected of hosting crypto ATMs. This resulted in the FCA disrupting 30 machines operating unlawfully across the country. The results speak for themselves: The number of crypto ATMs advertised on CoinATMRadar in the UK has fallen from more than 80 in 2022 to nil in 2024. Furthermore, just last week, seven more were seized, and two individuals have been arrested on suspicion of money laundering and running an illegal cryptoasset exchange.
Cross-Sector Regulatory Intensity
For EMIs and PSPs, the FCA has significantly increased its focus on the prevention of financial crime in this sector in recent years and has recorded a 231% increase in EMI and PSP MLR-related supervisory activity between 2020 and 2024. This isn’t just about increased inspections – it’s about fundamental changes in supervisory approach. This was already evidenced back in 2022 when the FCA’s Payments Supervision Department was renamed the Payments Market Intervention Department.
Compliance Challenges: The New Reality
For cryptoasset providers, the compliance challenge is particularly acute. The process of investigating criminal use of cryptoassets is made more complicated by the constantly shifting and developing nature of the crypto environment and the significantly increased size of the market.
The UK National Risk Assessment 2025 identifies emerging threats that keep evolving: criminals and professional money launderers continue to increase the sophistication of their techniques, adapting quickly to law enforcement intervention. For example, there is evidence to suggest privacy wallets are now used more commonly than mixers to launder funds.
Information Sharing: The Missing Link
Across all sectors, information sharing remains a critical gap. For cryptoassets, the “Public-Private Crypto Forum” provides cryptoasset firms, alongside law enforcement agencies, HM Government and supervisors, a means to share knowledge and gain a better understanding of cryptoassets’ existing and emerging terrorist finance risks. Yet participation remains limited.
Strategic Implications for Risk Management
For Cryptoasset Service Providers: Adapt or Perish
The UK National Risk Assessment 2025 makes clear that the era of regulatory ambiguity is over. Firms must:
- Embrace blockchain analytics: some cryptoasset firms exposed to other asset flows use a unique tool to analyse blockchain activity to identify the source of cryptoassets and any associations with illicit activity.
- Prepare for enhanced scrutiny: With only 14% of applicants meeting registration standards, the bar is exceptionally high and this will only be raised higher with changes to the FSMA with the cryptoasset order 2025.
- Monitor emerging risks: The top three emerging terrorist financing risks for the cryptoasset sector are: Crypto hacking… Crowdfunding donation-based platforms… Utilisation of privacy protocols.
For EMIs and PSPs: The Crypto Connection Cannot Be Ignored
Given the increasing convergence between traditional payment services and crypto, EMIs and PSPs must:
- Scrutinize agent relationships: With the rise of crypto firms acting as e-money agents (or distributors/outsourced service providers/introducers, potato-potato), enhanced due diligence is essential.
- Enhance transaction monitoring: Traditional approaches may miss crypto-related red flags so ensure that you also monitor and supervise how cryptoasset service providers perform monitoring of illicit funds.
- Prepare for regulatory convergence: The lines between crypto and traditional payments are blurring fast, but don’t think that this negates the requirement to have appropriate governance controls internally.
- Don’t forget basics: Consider how risks can be mitigated with new technologies, but don’t overly rely on them, as control and supervision remain ultimately with the firm. A risk-based approach should be appropriately implemented, and controls fine-tuned in line with the UK National Risk Assessment 2025.
Looking Ahead: The Integrated Risk Landscape
The UK National Risk Assessment 2025 signals that the future of financial crime risk is interconnected. The boundaries between EMIs, PSPs, MSBs, and crypto providers are dissolving, creating a complex ecosystem where risks cascade across sectors. You can now see even those who traditionally accepted only cash utilising crypto rails for remittance services due to the relative stability, liquidity and currency controls in the destination countries.
For cryptoassets specifically, the assessment warns: as the government introduces a more comprehensive regulatory framework on a wider range of cryptoasset activities, covering issues ranging from governance and conduct to operational resilience rules, it envisages that the increased robust regulation should help with mitigating the risks of illicit use of cryptoassets, thereby reducing the residual money laundering risks.
A New Era Demands New Responses
The UK National Risk Assessment 2025 represents more than a periodic update – it’s a fundamental recalibration of the UK’s understanding of financial crime risk. The elevation of EMIs and PSPs to high-risk status, the persistence of MSB vulnerabilities, and the emergence of cryptoassets as a major threat vector demand immediate and sustained action.
For firms operating across these sectors, the message is unambiguous: yesterday’s compliance won’t meet tomorrow’s threats. The UK National Risk Assessment 2025 shows that criminals have evolved their methods, exploiting technological innovations and regulatory gaps with increasing sophistication. The convergence of traditional and crypto payment systems creates new vulnerabilities that no single firm can address alone.
As we navigate this new landscape, one thing is certain: the UK National Risk Assessment 2025 has redrawn the risk map for financial services. Those who fail to heed its warnings may find themselves not just facing regulatory sanctions but potentially becoming unwitting accomplices to serious crime. In this new era, robust compliance isn’t just good practice – it’s the price of entry to the UK’s financial ecosystem. If you’re unsure how to implement the updated UK National Risk Assessment 2025 at your firm, you can check out our article explaining the process, which is accompanied by a template or reach out to us.
