HMRC tells an ordinary crypto holder to keep records for at least 22 months after the tax year ends. It can raise an assessment up to 20 years later. Those two numbers come from the same department, they do not meet, and the space between them is where most crypto tax problems live.
The list is short and sits at CRYPTO10400. For each transaction: the type of cryptoasset, the date, whether it was bought or sold, the number of units, the sterling value on the day, the cumulative total held, and bank statements and wallet addresses in case an enquiry needs them. HMRC’s reasoning is on the same page — exchanges may keep data only briefly or may no longer exist — so “the onus is therefore on the individual”.
The retention periods, and why they mislead
Someone not in business who files on time keeps records for at least 22 months after the tax year ends; file late and it is 15 months from filing. A sole trader keeps them five years after the 31 January deadline, a company six years from its accounting period end. All of these stretch if HMRC opens a check: section 12B of the Taxes Management Act 1970 runs the clock to the end of any enquiry.
The trap is treating those as expiry dates. The section 104 pool is cumulative, so a quiet year still produces acquisitions that set the cost of a disposal years later. The 22 months applies to the return; the pool does not care.
What CARF gives HMRC, and what it does not
From 1 January 2026 UK providers have been collecting customer and transaction data, with the first reports due to HMRC by 31 May 2027. What that contains is routinely overstated in both directions. Under IEIM8000530 providers report amounts paid on acquisitions as well as received on disposals, so it is wrong to say HMRC will see no cost data.
It is also wrong to think the report can produce your gain. The data starts in 2026, so nothing acquired earlier appears. It is per provider, so a holding split across two exchanges and a wallet is never reconstructed from one file. It runs on calendar years, not to 5 April. And it is aggregated, which is useless against pooling.
What that asymmetry is worth
Suppose you bought 2 BTC in 2017 for £4,000 all in and 1 BTC in 2024 for £48,000. The pool is 3 BTC at £52,000, an average of £17,333.33. Sell one for £62,000: the cost deducted is £17,333.33, the gain £44,666.67, and after the £3,000 allowance the tax at 24 per cent is £10,000.00.
Now lose the 2017 records. Nothing reports that purchase; it predates CARF and never touched an exchange that still exists. If the cost cannot be evidenced and is treated as nil, the gain is the full £62,000 and the tax £14,160.00. The receipts were worth £4,160.
| Not in business, filed on time | At least 22 months after the tax year ends |
| Return filed late | At least 15 months after filing |
| Sole trader or partner | 5 years after the 31 January deadline |
| Company | 6 years from the accounting period end |
| HMRC assessing window | Up to 20 years |
| Maximum record-keeping penalty | £3,000 per return or claim |
| Example: CGT with the 2017 receipts | £10,000.00 |
| Example: CGT with cost treated as nil | £14,160.00 |
| CARF collection / first report | 1 Jan 2026 / 31 May 2027 |
What this obligation is not
Keeping records is not filing: section 12B is a preservation duty, while the duty to file comes from a notice to file and from notifying chargeability. And the list is a minimum, not a safe harbour, because the statutory test is “all such records as may be requisite” for a correct and complete return. CRYPTO23000 adds an item it omits: where a trade has no sterling value you must reach a rate with reasonable care and a consistent method, and “details of the valuation methodology should be kept”.
That a manual is not the law has a live proof. CG10340 still gives the disposal reporting threshold as four times the annual exempt amount, and cites a repealed section to do it. Parliament replaced that with a flat £50,000 for 2023/24 onwards, in section 8C. On today’s figures the stale manual would have people reporting at £12,000.
An exchange’s CARF report discharges nothing you owe. The £3,000 penalty for poor records is rarely charged — EM4650 reserves it for deliberate destruction or a history of failures — but the same page notes those failures still set the level of any Schedule 24 inaccuracy penalty. That is where the money sits.
Sources, all retrieved 14 September 2026: HMRC Cryptoassets Manual CRYPTO10400, CRYPTO22200 and CRYPTO23000; TMA 1970 sections 8C and 12B and FA 1998 Schedule 18 paragraph 21, via legislation.gov.uk; GOV.UK “Keeping your pay and tax records” and “Business records if you’re self-employed”; Capital Gains Manual CG10340; Enquiry Manual EM4650; IEIM8000050, IEIM8000515 and IEIM8000530; GOV.UK “Reporting cryptoasset user and transaction data”. Figures: annual exempt amount £3,000 and CGT at 24 per cent for 2026/27; the pool, disposal and both outcomes were computed here and the prices are illustrative. Contested: GOV.UK gives the non-business retention period as 22 months after the tax year ends while the Self Assessment legal framework manual gives the same date as a year from the following 31 January; CRYPTO10400 makes wallet addresses mandatory where the public guidance calls them optional; and CG10340 contradicts section 8C, where the statute governs. HMRC’s service for receiving CARF reports was not live today. Not a recommendation to buy, sell or hold anything, and not tax advice.