Who is Val Smith and how did she come to regulate crypto at the FCA? (00:01)

[00:01] Delphine Forma: Welcome to the Compliance Champions series. I'm Delphine, Head of Policy Europe at Solidus Labs and the founder of the Crypto Compliance and Legal Telegram Group, and I will be your host for today's session. I have the pleasure to be joined by Val Smith, Head of Department, Payments and Digital Assets Authorisations at the FCA. Val, I am thrilled to have you on the podcast today.

[00:27] Val Smith: Thank you so much. It's lovely to be here today.

[00:30] Delphine Forma: Let's start. Could you give us an introduction about yourself and your role at the FCA, and tell us a little bit more about how you ended up working on crypto?

[00:42] Val Smith: Of course. I'm a member of the FCA's senior leadership team in the UK. I've spent my career in central banking and regulation, and I really enjoy it. For the last 15 years, I've been working with new and innovative firms coming to market, and I think I've found my place here. I really enjoy being able both to support firms and to make sure they are meeting the standards we expect in the UK for a healthy and vibrant market. I'm also co-head of the FCA's Scotland office, based in Edinburgh; we have different presences across the UK. I got into working with the cryptoasset market through my work with new firms. Over the last 15 years, I've done different work with banks and insurance firms and, more latterly, payments and cryptoasset firms.

I also really like change. I enjoy developing something new that works for us all and making sure it makes sense for people as well. Our world of crypto meets all of that. It's a new regime, with different standards and a very different market that we're looking to establish.

[02:00] Delphine Forma: Very interesting. You must have seen a lot of super innovative projects in the last 15 years. I find it fascinating that you can be at the forefront and have a real impact on the market.

[02:14] Val Smith: Absolutely. What we've seen in the UK and across global markets is a significant advancement in how these markets, products and firms look and feel. When we move to the new regime in the UK, that will be a significant step up from where we are now, which is a very focused anti-money laundering regime.

What does the UK's shift from AML registration to FSMA authorisation mean for crypto firms? (02:40)

[02:40] Delphine Forma: Exactly. Let's look at that point in more detail. As you mentioned, the UK is moving from an AML registration regime to a full FSMA authorisation regime for crypto. How significant is that shift, and what will it mean for firms coming from different regulatory starting points?

[03:04] Val Smith: Sure. There's no getting away from FSMA. The Financial Services and Markets Act regime is a much bigger and broader piece of regulation, and I think that rightly reflects the significance and importance of cryptoassets, and the standards we want to see across the market for this type of product. When I say broader, we're looking at quite a lot of things for firms that we might not have looked at before. As I said, the current regime is about anti-money laundering and very focused on controls to prevent financial crime. In the new regime, we're going to be looking more at what the business model and the products look like. What are the consumer protections? How are firms safeguarding the assets they hold on behalf of customers and other firms in the market?

What do their admissions and disclosures look like? How are we making sure the market has the integrity we want? It's also important to note that for existing firms, there is no automatic transition into the new regime. We want to make sure that, from the beginning, all the firms operating in our market and offering the new set of cryptoasset activities in the UK can meet this broader set of standards. So everybody is going to need to apply and demonstrate that they can meet those standards in the UK from October next year. And it's not just crypto firms; it's also our existing authorised firms.

If they want to do any of these new activities, they'll of course be very familiar with our Handbook and our expectations in the UK. But we will be looking for them to demonstrate that they can manage the very specific risks of their crypto activities alongside their traditional business. For new firms, which I mentioned I really enjoy working with, there's probably a more fundamental change in becoming regulated as part of your business. I always think that if you build regulation into your business from the beginning, it's a much smoother and easier way to operate.

We will be looking for them to demonstrate that they've thought about their business model, the people, the governance, and that they treat authorisation as something they want to get right. It's not just an application exercise. I always think we share very similar outcomes with many firms. We want customers to be treated well. We want things to work. We want firms and markets to operate smoothly and well. Those are all common outcomes for us.

How should crypto firms prepare for the FCA authorisation gateway opening on 30 September? (05:57)

[05:57] Delphine Forma: I feel there will be quite a lot of work on your hands, and I believe you will receive a lot of applications. The UK is in an interesting position right now. If you look at crypto firms, it's a little like the EU when it went from pre-MiCA AML registration to a full licensing regime, although the EU approached it in a slightly different way from the UK. And when you mentioned embedding regulation from the beginning: as a former Chief Compliance Officer, I could not agree more with you on that point. The gateway is opening soon, on 30 September.

So if I am a crypto firm planning to apply, what should I be doing now?

[06:56] Val Smith: Right now, if you haven't started, start now: start planning and preparing your application. You're absolutely right. A week today from when we're speaking, at 7am British Summer Time on 30 September, our gateway will open. Critical to a great application is the planning and thought you put into it. There's no getting away from the fact that getting authorised in the UK takes time and effort. October 2027, when our new regime starts, may sound quite far away, but that time will go quickly. The key thing is that we're here to support. When you're thinking about your application, we want you to think about the plan for how you will get from where you are now to 25 October.

How will you make sure you are ready, and how will you present us with the information that shows you're willing, organised and ready to go from October next year? Some other things we look for: we really like you to be clear about your operating model. What business are you going to be doing? Who are your key people? Where will they be based? How will you operate day to day? We will want to understand how you're going to fund the business, who your controllers and beneficial owners are, and how you're going to safeguard the assets you might hold on behalf of others. There's a whole set of things we will want you to understand and then demonstrate to us.

While you're planning and putting together your application for authorisation, do keep up to date with what's going on. This is a new area and it is still developing. In the summer, we published the detail of the new regime, but there are still developments coming out; last week, for example, we published new perimeter guidance. So keep yourself up to date, understand the rules and guidance that have been published, and keep an eye on our website so you get updates as they come. As you build your application, it's really important that you understand the outcomes we're looking for, for example your assets being safeguarded, and then think about how the rules we have set apply to your firm, given the business you want to do.

Make sure you understand the legislation and what it means for you, and if you're new to regulation, familiarise yourself with the FCA Handbook. I would just say the Handbook is a mighty tome. It covers all of financial services for the UK markets, so it's a significant piece. Set aside some time to familiarise yourself with how it works and then think about what is particularly relevant to you. You can also come and speak to us. Since July, we've been running a free pre-application support service, so you can have a meeting with my colleagues at the FCA to talk about the business you intend to do and how you intend to do it.

We can offer some thoughts about things you might want to consider when you put your application together. It's free, and you can book ahead. We ask you to send us some information in advance so we can understand a bit more about your business. We find that it helps the firms that use the service put their applications together. We've also got various resources on our website, and we are out and about at industry events, so if you get the opportunity, you're always very welcome to come and join us at one of those.

[10:44] Delphine Forma: Thank you. I've always admired the work you've done at the FCA. In recent years, the FCA has been very open-minded and has really tried to work more closely with the industry. I think it's so important that your door is open so the industry can come to you, and I think firms should take this opportunity more often. Eight years ago, I would have loved to be able to speak with my regulators the way I'm doing with you right now. So I think it's really important.

[11:17] Val Smith: I agree, and none of it will be a success without that conversation between us and the industry about what will work. While we are the experts in the regulation, it is the firms and the people who run them who are the experts in the business, and you have to bring those things together. I really enjoy that part of it as well: being able to talk to the people doing the business and understand what it means from their point of view.

What does the FCA look for in a crypto authorisation application, and must firms be fully ready? (11:46)

[11:46] Delphine Forma: Fascinating, and I can feel that you're very passionate about it. When you look at applications, you mentioned a few things businesses will need to have in place, such as safeguarding of funds. Will there be particular areas of focus?

[12:15] Val Smith: When I think about an application, there are three places I look, and everything else fits into them. The first is what the firm wants to do: what are its products and services, who does it want to provide them to, where is it going to operate, and how is it funding itself? In other words, what's the business? Once I've looked at the business model, I want to know who is running that business. What's their experience and skill set, what have they done before, and how are they setting up themselves and their key team to run the business in the way we would expect?

Once I understand what the business looks like and who the people are, I want to know what those people have done to set the business up so that it delivers not just for them but also to the regulatory standards. Again, that means embedding the approach to regulation from the beginning so that our outcomes are aligned. So I want to understand how you've set up your systems and controls, your risk management and your governance. What have you put in place to make sure your business runs in the way you need it to and we expect it to? What early warning indicators have you built into your management information? There's a whole set of things around the assurance you have that you're doing what you need to do.

It is that combination that is central to the application: understanding the business and where the risks come from, the people running it and the culture they set, and the environment they create to run the business. And yes, we will look at different elements of that. We will look at the prudential resources that support the business, for example capital, to make sure the business is sound and can run on an ongoing basis. We'll look at your operational resilience, your safeguarding, as I've mentioned, and the consumer protections you're putting in place so that you have good outcomes for your consumers. If you're trading, we'll look at what you need to do in the market for integrity, and a whole range of other things.

But everything comes back to these three core areas: what are you doing, who's doing it, and how have you set yourselves up to do it?

[14:39] Delphine Forma: Indeed, and that's really important. When firms come to you with their application, do you expect them to be fully ready at that point? Do you expect their systems and controls to already be implemented and tested when they hand over their application?

[15:01] Val Smith: When people approach us for authorisation, we expect them to be, as we describe it, ready, willing and organised. Have you done your planning? Have you thought about what is important in the regulation? Have you got the right people in place who are able to work with us? Are you organised with your plans for the point at which the regime goes live next year? If you are to be authorised from October next year, we need to be confident that you can operate as we would expect from that point. But we also accept that there's some time to go between now and October next year, and we recognise that setting yourself up and doing these things can cost money.

So we want to make sure there is a balance between people being ready and people being able to run their business and manage their funding in the most appropriate way. When you submit your application, I am going to expect a lot of things to be final in terms of how you will do things, but some things you may build through to October next year. The key thing for me is that I want to understand the plan. Have you got a credible plan that shows how you will meet the standards next year?

For example, lots of firms in other sectors work through their authorisation and show us that they've done all their thinking and have their policies and procedures in place, but they might build their systems through the year or recruit some of their people during the period. That helps them manage their costs, and they don't necessarily need all of it until they're actually doing the business. Again, I just want to understand that you've thought about all of that. You might have a plan to get your capital in place closer to the point of authorisation, because that's a much more efficient use of your funding. You just need to show me how that's going to work.

Then I can be confident that, come the point of authorisation, you'll be ready. What I do expect is that you have thought about it, that you have signed off internally and agreed what your model, governance, policies and procedures will look like, and that you have a plan to address any gaps successfully by October next year. So really, it's about whether you can show me that you're going to be ready.

I should just say there is a small difference. Some firms are already doing this business, so I would expect it to be more straightforward for them to show us that things are working now. Some new firms aren't doing the business yet and don't have that evidence, so they need to tell me how it will happen. So there's a slight difference between new firms and existing firms in the market.

What has the FCA learned from its pre-application support service (PASS)? (18:16)

[18:16] Delphine Forma: That's a very pragmatic approach, and it reflects the approach I think the FCA has taken over the past couple of years. I'm really curious about something you mentioned at the beginning of the podcast: the pre-application support service, which I think opened earlier this year. What have you learned from your discussions with firms so far, and are there any recurring mistakes or areas where firms are still not sufficiently prepared?

[18:53] Val Smith: Yes. In July, we opened our pre-application support service, or PASS as we call it, and we've probably seen getting on for 100 firms. It's a bit of a mixed picture. What's great is that there's a lot of interest and enthusiasm for being in the UK market. Some firms are very well prepared when they come to speak to us. They have a clear understanding of their business model, they know how they're going to operate, and they just want to check some things with us. Others, perhaps not surprisingly given where they are in their evolution, still have some gaps in their thinking, particularly around how they are setting themselves up. Governance is a really important piece for us.

Or they don't quite know where all their resources are coming from yet. So there's quite a lot to think about. We don't need you to have thought about absolutely everything when you come to the pre-application support meeting; that's not the point of it. But when you're preparing to come and speak to us, really hone in on a few things. One is the business you're going to be doing and how you think that business fits into the regulatory framework. There's lots of information out there about the new regulated activities. Think about what your business looks like in those terms, because that's the key to working out what else you need to do within the regulatory framework.

Understanding that and being clear about your activities drives the standards you have to meet. The firms that are making a lot of progress, and we've heard back from some, are already identifying some of their gaps and being transparent with us about them, so we can have a conversation about what else they might need to do. They're also thinking about their plan to address those gaps. Not all of them will be addressed immediately, but they have a plan to get there and can demonstrate how they will do it. So you don't have to have all the answers, but do some thinking before you come and talk to us.

We're not legal advisers, for example. We will listen and offer our thoughts, but you own your business, and you remain responsible for understanding and meeting the requirements that will apply.

How long does FCA crypto authorisation take, and how can firms navigate the guidance? (21:22)

[21:22] Delphine Forma: Indeed. Another question I guess everyone is thinking about: how long should firms realistically expect the authorisation process to take, and what could slow it down?

[21:36] Val Smith: Sure. We generally work on the basis that applications take between four and ten months. Given that this is a new regime, there will probably be a few more questions and more understanding needed on both sides: for us as regulators, as we see how the market develops under the new regulations, and for you as firms, as you think about what it means for your business. So I would expect it to take a bit longer at the start, and we'll all become more proficient at working in this regime.

As for what can slow it down: not getting all the information, or people not really having thought something through. Those are the things that slow us down, along with not telling us about things that we then find out later. I always say it's better to disclose everything and then we can work out what is relevant. Some things might not be relevant to us, but it's not a very happy conversation if we find out something later that it would have been really helpful to know at the beginning. I would also say don't rush to apply. Make sure you've got a good-quality application, that you've thought about the extent of what you need to do, and that your information is up to date.

Sometimes people give us information and say it's a draft. It's quite hard for me to work with a draft framework or policy, because I'm not sure whether it's what is actually going to happen. The firms that take time to understand the requirements, identify any gaps and think about how they're going to demonstrate they can meet the standards are the ones that go through much more smoothly. We have said that if you apply to us before the end of February, our expectation is that we will have made our decision before the regime commences in October next year.

Firms that are existing firms or already doing business in the UK need to understand how it works for them in terms of their ability to carry on doing business from October. There's lots of information on our website about the transitional arrangements for existing business, so go and have a look at it and really think about what it means for you. Not everything will be perfect on day one, but I want to make sure you understand what's expected, know what work you've got to do and have a plan in place.

[24:20] Delphine Forma: Thank you, this is very clear. You've mentioned several times that there's a lot of information on your website. You publish so many guidelines for the industry, but it can get very complex. I have to say, I've read everything, and sometimes I get a little lost, because, as you mentioned, there are also some moving parts. Do you have any tips for businesses to navigate all that and come to your door prepared?

[24:54] Val Smith: I would encourage you to make use of the pre-application support meetings, the PASS meetings, and we will continue to run them all the way through. They will be as useful to new firms coming along this time next year as they are today. Be really clear on your own operating model and how you are setting yourselves up, then use that to understand the regulated activities and let them guide you through what is needed. We do have a lot of resources on our website. We have been running webinars, as you mention; they're all available, and we publish questions and answers afterwards. We are also out and about in the industry. It's been really important, as we've designed this regime, to be out talking to people a lot, and that will continue.

Over the next couple of weeks, I will be doing events in Scotland, so if you happen to be in Edinburgh, do come and look us up. We'll be out and about, and you can expect that to carry on. I would also say be really clear about your implementation plan and what you're going to be doing when. Those are the things I would really recommend. And don't be put off. It is a lot, but it's important. The regulation is really important, and we think it will add to your business as well as to the market and to what people using cryptoassets get from it.

What will the FCA expect from crypto firms on market abuse surveillance? (26:33)

[26:33] Delphine Forma: Very true. Now let's talk about something closer to what I do every day: market abuse in crypto regulation. From an authorisation perspective, what would you expect firms to demonstrate around market abuse prevention and detection, and how will you assess whether their surveillance is actually effective?

[27:02] Val Smith: It's a really important part of the market and the new regime. When we have the conversation with you about what your firm does, we'd also like you to think about it from the perspective of the MARC requirements. How will you operate day to day in a way that gives you, as the senior leaders in your firm, confidence that you'll be able to meet these requirements? Have you understood how your business might be impacted by, or susceptible to, the market abuse risks that arise from the business and activities you're doing?

Again, it's no different from the other things I've talked about: do you understand the business and where the risks come from, but particularly here. How are you controlling it yourself? How have you set yourself up? What are your surveillance arrangements? What do your governance and escalation look like, so that if you do spot something, you can respond appropriately and in the right time frame? Who is responsible for identifying, investigating and responding to any suspicious activity you might see? It's about how you set yourselves up so that you have what you need and we can understand that it can be effective. There is always a tension for new firms that haven't done the business before, because they don't have anything to demonstrate to us.

We can't test effectiveness, but we will want to understand how you have assured yourselves that it will work. For existing firms, we expect you'll be able to show us some of the things you use in practice to prevent and detect market abuse, and the things your leadership team, your board or your governance structures use to know it's working. We would expect effective surveillance to consider activity both on and off chain, and to monitor the orders, the transaction flows and the communications happening on the platform. That's really no different from the traditional finance world, but it's quite a critical part of this.

If you're an existing firm, you should have evidence you can show us of how you do your testing, your audits or your own internal reviews of monitoring and surveillance. For a new firm that isn't operating much or at all yet, show me how you intend to do it. What will it look like? What would I see happening? What we want with any regulation is that your arrangements are proportionate to the risk and that, particularly here, you can prevent, detect and disrupt market abuse and take action where you see abusive activity happening. Many areas of the regime are covered by different policy statements, and there's a very particular policy statement on admissions and disclosures.

And on MARC, please do take some time to read that. There's also a very specific webinar on this area, and we have webinars on different parts of the policy. Go and check them out.

Do international crypto firms need a UK legal entity to be authorised? (30:32)

[30:32] Delphine Forma: Indeed, that's really good advice. MARC is really important for preserving market integrity, and equally important for customer protection, especially in crypto, along with customers' best interests, liquidity, best price and best practices. This brings me to international firms with global technology, global liquidity and a global order book. What do you expect their UK presence and operating model to look like, and which activities and controls need to sit in the UK?

[31:18] Val Smith: Thank you. This is a question that comes up quite a lot in our PASS meetings too. Our starting point will always be that firms serving UK customers and markets need arrangements that allow us to supervise them effectively, so that we can see they are delivering to UK regulatory standards and hold them accountable for that. Accountability is a really important part of how we regulate, and I would say it should be a very important part of how you run your business. It's really important for cryptoasset activity as well, where the question is how we supervise effectively after authorisation.

Once you're in our regulated market, we need to think about how we can supervise effectively, and that might look a bit different from traditional financial services, given the way the cryptoasset market works. In most cases, our starting point is that we expect firms doing crypto activities in the UK to have a UK presence, through a UK legal entity. That means an entity in the UK fully subject to UK regulation, with governance, senior management and operational arrangements through that entity that enable it to meet our standards on an ongoing basis.

That's really key, because authorisation is not a one-off thing. You get authorised, but then you also have to stay at the same level and keep delivering to those standards all the way through. That is key for us when we think about how firms are setting themselves up and the arrangements they create, so that we feel we can supervise them effectively. Where firms have more complex international structures, we will look at them on a case-by-case basis. We know that quite a lot of the firms in this market are global groups with a presence all over the place, and we're going to want to understand how that will work in the UK.

But the starting point is not whether you can be based somewhere other than the UK. Your starting point should be whether you can demonstrate to us that you can meet all of the standards in the way you have set yourself up. From my experience, particularly when it comes to firms' financial resilience and operational resilience, it's really important that they have a UK base with UK people who understand what is happening in the firm and in the market it operates in.

Where is the crypto industry best prepared, and where is there still work to do? (34:12)

[34:12] Delphine Forma: Very interesting. That brings me to the future, because you mentioned something absolutely key, and I could not agree more: authorisation is not a one-off, and you always need to maintain the same standards all along the way. As a compliance officer, I think this is the most important and the most difficult part of the job: making sure you comply at all times.

[34:39] Val Smith: Yes.

[34:41] Delphine Forma: Looking to the future, based on the firms you have engaged with so far, where do you think the industry is best prepared, and where is there still the most work to do?

[34:58] Val Smith: If I'm honest, it varies across firms. That's partly to do with their history, how long they have been operating, and where they want to go in the future. One of the things I perceive here, and honestly it's not so different from other parts of the market, is that markets continue to evolve. On the rate of innovation we're seeing, there's a saying that the pace of change has never been so fast, but will never be as slow again. Regulation needs to keep up, and firms need to keep up with the regulation.

Looking across the market now, lots of people are putting effort into getting ready. For me, the key is the mindset shift: this is a much broader, bigger piece of regulation that will go across many more aspects of my business. Am I looking right across my business at all of it and thinking about how it delivers as a whole what we want to have in the UK and UK markets? My advice is to keep yourself up to date about what's going on. There are lots of great industry groups and forums; get engaged with them, and make sure you're keeping up to date with us. Use the support we're offering, too. Take us up on our offer. We are open.

Please do come and talk to us. But really think about where this market is going and how the regulation will help get us to a fully functioning and effective market, with great outcomes for the people who want to use cryptoassets.

[36:58] Delphine Forma: Such a good sentence to end the podcast; I really like it. It's so nice to see a regulator so open-minded. Thank you so much. But before we finish, I have one more question, and no one can escape it: are you following any fashion trends? And I'm talking about clothes, not the crypto market or innovation.

[37:26] Val Smith: I'm not sure people would look at my wardrobe for fashion trends, because I'm an old goth at heart, so you'll see a lot of black and purple in my wardrobe. That's about as trendy as it gets.

[37:41] Delphine Forma: Well, at least you're following some trends, and you can never go wrong with black. Thank you so much for your insights today; I really appreciate it. The industry will be very thankful for them. Thank you so much.

[37:59] Val Smith: And thank you for asking. I love what we do, and I think there are great developments happening in the market. I appreciate you asking me and giving me the opportunity to talk about it. Thank you.

[38:15] Delphine Forma: Thank you.