On 1 January 2026 UK cryptoasset firms began collecting information about their customers under the Cryptoasset Reporting Framework. The first reports go to HMRC by 31 May 2027, covering the 2026 calendar year, and the first exchanges of data between tax authorities follow in the same year. The rules are in the Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025, SI 2025/744, which came into force on that January date.
The obligation falls on the firm, not on you. A reporting cryptoasset service provider is broadly anyone who, as a business, effects exchange transactions for customers or runs a trading platform. HMRC's guidance states that the software itself is never the reporting entity: for decentralised applications it is the people or firms behind them who may be caught, not the code. It follows that a wallet you control with no business standing behind it has nobody to do the reporting, though HMRC has not published a statement to that effect.
What is in the report
Two halves. The identity half is your name, address, date of birth, jurisdictions of tax residence and tax reference — for a UK resident, a National Insurance number or Unique Taxpayer Reference. The transaction half is annual aggregates, per cryptoasset: gross amounts paid on acquisitions and received on disposals against fiat, the fair market value of crypto-to-crypto trades on both sides, and transfers in and out with the value, the number of units and the number of transactions.
Two details are worth knowing. Payments for goods or services above $50,000 are reported separately as retail payment transactions — a threshold set in US dollars, not sterling. And when you withdraw to an external wallet the provider reports the type, units and value, but not the wallet address itself; the firm keeps that for five years in case HMRC asks.
CARF reports turnover, not profit. Nothing in the file is a gain, and nothing in it deducts what you paid.
Gross is not gain, and the gap is enormous
This is the point most coverage misses. Suppose you put £2,000 into a coin and traded round twelve times over the year, each round trip netting 2%. The gross acquisitions reported come to £26,824 and the gross disposals to £27,361. Your actual gain is £536.48. The reported disposal figure is 51 times the profit, and the gain sits comfortably inside the £3,000 annual exempt amount, so the tax due is nothing at all.
A large CARF number therefore does not mean HMRC thinks you made that much. It cannot: the regime aggregates turnover per asset with no cost basis, no section 104 pooling, no allowable costs and no netting of losses. Whether the reported figure implies anything is a matter for the existing capital gains and income tax rules, which CARF leaves entirely alone. HMRC's own policy paper says the measure “doesn't change tax obligations”.
The bull case for an ordinary holder is that this is genuinely nothing new to comply with. If your return was right, it stays right. The bear case is that HMRC will be holding gross figures that look alarming without context, and the burden of explaining the gap between £27,361 and £536 will sit with you, years after the trades, from records you may not have kept.
| Legislation | SI 2025/744 |
| Data collection began | 1 January 2026 |
| First reportable period | 1 Jan to 31 Dec 2026 |
| First report due to HMRC | 31 May 2027 |
| Retail payment reporting threshold | $50,000 |
| Wallet address retention by the firm | 5 years |
| Penalty for not self-certifying | up to £300 |
| Provider penalty, late report | up to £5,000, then £600 a day |
| Worked example, gross disposals reported | £27,361 |
| Worked example, actual gain | £536 |
The one thing that is on you
Your exchange will ask you to confirm your tax residence and tax reference. Under regulation 13 of SI 2025/744, failing to give a valid self-certification carries a penalty of up to £300 where the failure is deliberate or the result of not taking reasonable care, and HMRC's guidance for users says the same in plain terms. Firms may also simply stop serving customers who do not answer. It is a small obligation with a disproportionate nuisance attached.
Note also that HMRC did not merely implement the international framework. CARF as the OECD designed it is about telling other countries about their residents; the UK added a domestic layer so that UK firms report on UK customers to HMRC directly. Separately, the FCA's authorisation regime applies to permissions granted on or after 25 October 2027, with the application gateway expected to open on 30 September 2026 — a different regime on a different timetable, easily confused with this one.
Legislation, commencement, reporting deadline and penalties from the Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025, SI 2025/744, and from HMRC's International Exchange of Information Manual at IEIM8000050, IEIM8000515 to IEIM8000585 and IEIM8000620; scope and decentralised applications from IEIM8000110 to IEIM8000160; the “doesn't change tax obligations” quotation from HMRC's policy paper on domestic reporting of UK resident cryptoasset users; the user's self-certification duty from GOV.UK guidance on information you need to give to UK cryptoasset service providers; FCA dates from fca.org.uk. All retrieved 31 August 2026. The £2,000 example was computed for this article and is illustrative, not a forecast of any asset's return. HMRC's manual does not address validators, miners or self-custody wallets directly, so the sentence above draws an inference and is marked as one. We found no published soft-landing or grace period on penalties, but the absence of an announcement is not proof one will not be offered. Nothing here is tax advice.