Two HMRC guidance notes released on 14 May 2025 confirm how the UK will implement the OECD’s Crypto-Asset Reporting Framework (CARF). From 1 January 2026, every “reporting cryptoasset service provider” (RCASP) operating in the UK must begin collecting specified details about their customers and their transactions. An RCASP is any UK-based exchange, broker, dealer or other business that enables users to buy, sell or transfer crypto-assets.
The data gathering phase runs for the whole of calendar 2026, after which providers must file their first annual report with HMRC by 31 May 2027. By 31 January 2027, each RCASP must also register on a forthcoming HMRC portal and notify users that reporting will take place. Failure to report, late submission or inaccurate data can trigger a penalty of up to £300 per affected user, followed in severe cases by daily default fines.
Information users must supply
The companion guidance for crypto-asset holders sets out the personal information that must be given to every service provider they use. Individuals will need to provide their full name, date of birth, residential address (including country) and a tax-identification number such as a National Insurance number or UTR. Corporate, partnership, trust and charity users must disclose their legal name, principal address, company number (if UK-incorporated) and overseas tax number; some entities must also identify controlling persons.
HMRC stresses that the details must be accurate; supplying nothing – or supplying incorrect data – may lead to a £300 fixed penalty. The rules apply even if the provider is outside the UK, provided the jurisdiction concerned has adopted CARF and exchanges data with HMRC.
Compliance timelines for accountants
CARF is designed to give tax authorities an annual, multilateral view of offshore crypto activity. It dovetails with domestic measures already underway: the 2024/25 self assessment return contains new boxes for crypto gains and losses, and HMRC is expanding its nudge-letter programme aimed at undeclared disposals.
“The information you give means we’ll be able to link your cryptoasset activity to your tax record,” noted the HMRC guidance.
Practitioners advising RCASPs should review client take-on procedures, KYC systems, and record-keeping to ensure all mandatory fields can be captured by the start of 2026. Time is short for smaller providers that have not previously been within the scope of automatic exchange regulations.
Where historic activity has not been reported, HMRC’s disclosure service remains available, but voluntary admissions should be made well before the department begins matching CARF data to self-assessment accounts.
Although much of the administrative burden falls on the exchanges, it is anticipated that there will be increased queries from those worried about privacy, double-reporting across multiple jurisdictions and the mechanics of determining residency status for CARF purposes. Early engagement and clear documentation will be essential to efficiently manage these concerns.
Overall, the guidance confirms a two-year window to get ready. Taking steps now, such as updating personal information with providers, keeping accurate records of crypto transactions, and understanding future reporting requirements, can help reduce the risk of penalties and ensure you stay compliant as the rules tighten.
Talk to us about your finances.
