UK crypto ATM operators have scrambled to keep up with new regulatory demands. Will it be enough?

What is the future of the crypto ATM industry in the United Kingdom?

Last week, my search for an answer took me not to the Square Mile or Canary Wharf, but to a vape shop in Southeast London.

There’s already plenty of uncertainty surrounding the future of the U.K.’s crypto industry as a whole, which is why many firms have developed backup plans in case they find themselves no longer able to operate in the country — typically involving a shift in operations to an overseas entity. The U.K.’s crypto ATMs face an especially precarious situation.

The operators of these machines do not have the luxury of upping sticks and leaving. The terminals they run, like the handful I visited between Greenwich and London Bridge — a heavily built-up area spanning about ten kilometers — are stuck to the walls of more than a hundred shops and eateries across the capital.

Most of the people manning these places seemed to know very little about the machines. Indeed, some seemed positively surprised when I asked whether their bitcoin ATM was working, as if they had never heard of such a device.

The person manning the till of the vape shop was more divulgatory. Does the machine get much use? “Not as much as it used to,” he said.

Its operator had introduced a series of checks on customers, the shopkeeper explained, including the installation of hardware that could photograph would-be crypto buyers. These changes were put in place in May, just as the first U.K. lockdown was easing. Prior to that, it was common to see people depositing thousands of pounds at a time.

The encounter at the vape shop offers a glimpse of the kins of pressure crypto ATMs in the U.K., which are concentrated in London, came under in 2020.

Their operators have had to do battle not only with a series of unprecedented lockdowns that have confined people to their homes and shut shops, but with a recently-updated anti-money-laundering regulatory regime that has placed new pressures on British crypto businesses.

Double trouble

Last January, the U.K. Financial Conduct Authority took over as the anti-money laundering and counter-terrorist financing supervisor of crypto companies in the country and announced that all crypto firms had to register with the agency by January 10, 2021, or cease trading.

But delays and uncertainty regarding the FCA’s register have caused considerable consternation among U.K. crypto businesses. Three firms spoken that spoke with The Block before the establishment of the temporary regime said they had backup plans involving shifting resources to overseas entities.

Last week, the regulator unveiled a temporary registration regime, giving some 90 firms permission to continue trading until July 9. The news was a welcome reprieve for many in the sector, but hundreds of businesses must still convince regulators that they are worthy of operating past that date.

People who have worked closely with crypto ATM businesses believe that these firms, in particular, face an uphill battle getting fully registered because of concerns about their KYC and AML processes.

There is certainly anecdotal evidence to explain why. Stories of shady behavior involving crypto ATMs abound in London’s fintech scene. One founder, speaking on condition of anonymity, told me that his former employer – a bank-backed fintech firm – used to have a crypto ATM in its offices but had to remove it because strangers kept arriving unannounced and asking to use the machine to deposit tens of thousands of pounds at a time.

More recently, many crypto ATM operators have been doing their level best to bring their operations into line with the regulator’s expectations.

“All of these businesses have been, since early 2020, taking steps to try and ensure that they have the most robust anti-money laundering measures in place,” said Henry Burrows, co-founder of Alaco Analytics, a due diligence firm that works closely with crypto ATM firms. “And that’s from a standing start, so it does take some time to go out there and find the vendors and the services that you need.”

Alaco developed a due diligence tool called EDDie specifically to help virtual asset services providers (VASPs) meet their obligations under the Fifth Anti-Money Laundering Directive, which was first introduced in the EU in July 2018. The directive is supposed to be transposed into the national law member states by January 10, 2020.

EDDie has been a hit with crypto ATM operators. Using the tool, crypto ATM firms can run sanctions checks, political exposure checks and law enforcement checks, as well as checks on the source of incoming funds.

In order to carry out this due diligence, EDDie needs to be fed by customer information collected by the machines themselves.

“To carry out customer AML checks, EDDie runs searches using KYC information collected by the vendor at the point of registration. EDDie's Know-Your-Address feature allows vendors to run automated checks on the source, destination and probity of a customer’s bitcoin funds by screening their bitcoin address on the platform,” said Burrows.

This may help explain why traffic is down at the vape shop’s ATM.

Identification, please

Despite belonging to different operators, each of the five crypto ATMs I visited in Southeast London shared certain aspects of the same user experience.

Most noticeable was that the machines appeared to allow users to buy a certain amount of cryptocurrency – including bitcoin, litecoin and bitcoin cash – without submitting much in the way of identifying information. If, however, a customer wants to exchange more than, say, £2,000 in cash, certain checks were necessary. Both the thresholds and the nature of those checks varied between operators.

One machine located near Southwark Park and operated by a firm called General Bytes requires customers to scan a fingerprint if they want to deposit £2,000, and for larger amounts still a customer must register at the terminal. “Anti-money laundering laws require us to collect some of your personal identifiable information,” says a message on the machine.

Another machine in Bermondsey, operated by Kernel Bitcoin ATM, sought a mobile phone number to which it promised to send a “one-time password" rather than asking for a fingerprint. It also requires the first and last name of the customer.

All of the machines present users with disclaimers or terms and conditions, some more extensive than others. Big Sea Bitcoins, which runs the machine in Deptford, asked me to agree to terms and conditions which state that it will “not be liable for any fraudulent and unsolicited activities resulting from the purchase of Big Sea Bitcoins”.

It continues: “We insist you are familiar with the recipient of the bitcoin wallet you are sending bitcoins too [sic] to avoid being at the risk of fraud.”

Neither General Bytes nor Big Sea Bitcoins appear to have made it onto the FCA’s temporary register, but Kernel Bitcoin ATM has. It should be noted, however, that some companies on the temporary register were not immediately recognisable by the listed trading names.

The temporary register also includes crypto ATM operators Marshall ATM, Cashin Technologies Ltd, BCB ATM Limited, KV ATMs, Satoshi ATM U.K., AlphaVend and DBS Coins Limited. All of these firms, as well as half a dozen operators not included on the register but still seemingly running machines in London, were contacted by The Block via their websites or by email. Few of them responded by the time of publication.

Companies that are not on the register and continue to run machines past January 10 will, in theory, be committing a criminal offense. But a well-connected regulatory source said they wouldn’t be surprised if said operators are unaware of the deadline, and guessed many will continue in business until somebody intervenes.

Those who have made it onto the FCA’s register will stay in business for at least another six months. Beyond that, crypto ATM firms seeking full registration will have to convince regulators that the new checks they introduced in 2020 are robust enough to prevent financial crime. Of course, if they achieve that, then there will be a question mark over exactly how much identifying information their customers are willing to part with.

Strangely, amid all this turbulence, a deal has been struck that could make exchanging bitcoin for cash far more ubiquitous in the U.K. On December 23, London-based crypto firm BitcoinPoint announced a partnership with ATM firm Cashzone that will allow Brits to exchange cryptocurrency for cash at over 16,000 Cashzone machines across the U.K.

To do so, customers must fill out a registration form and upload a selfie. Then, whenever they try to withdraw cash in exchange for crypto at a Cashzone ATM, customers will receive an email asking them to take another selfie using their phone. This selfie will be compared to the one stored on the app, and if it’s a match they may withdraw cash.

And it doesn’t stop there. If a customer tries to withdraw £100 or more, they will have to produce a utility bill. At £250 or more, BitcoinPoint will make them fill out a form to ascertain the source of the funds they are exchanging.

“You can’t buy even £1 of bitcoin with my service if you don’t provide your ID, and your ID is checked and verified,” said Benoit Marzouk, chief executive of BitcoinPoint.

Perhaps it is no surprise, then, that BitcoinPoint — also known as Cashin Technologies Ltd —has earned a spot in the temporary register.