No UK crypto exchange sends HMRC anything about a British customer unless HMRC asks for it. That is still true today, 12 October 2026. It stops being true by 31 May 2027, and the year already being recorded started on 1 January 2026.
Two powers, neither written for crypto
Schedule 23 of the Finance Act 2011 is the bulk power. An officer "may by notice in writing require a relevant data-holder to provide relevant data", and that data "may be general data or data relating to particular persons or matters", including names and addresses. It is exercisable "whether involving a particular taxpayer or taxpayers generally" — no suspicion about you is needed for your details to sit in a dataset.
Neither schedule contains the word crypto. An exchange is caught, if at all, by categories written for other industries: electronic stored-value payment services, business intermediaries, or money service businesses, that last reaching anyone transmitting "any representation of monetary value". HMRC has not said which it uses. Two limits matter: a notice given today cannot reach periods ending before 13 October 2022, and the appeal belongs to the exchange, not to you.
The power with no gatekeeper
Schedule 36 of the Finance Act 2008 covers notices aimed at a named person. A third party notice needs either your agreement or tribunal approval. A financial institution notice, inserted in 2021, needs neither: only an authorised officer's sign-off, provided the material "would not be onerous" to produce. HMRC can apply without notice to remove the requirement to name you, copy you in and give reasons.
Whether an exchange is a "financial institution" for this is unsettled, and cuts both ways. The statute defines the term by reference to the OECD common reporting standard "as that standard has effect from time to time", and that standard was widened in 2023 — but cryptoassets themselves were put into the separate reporting framework rather than into the standard, which argues against. On the words, a custodial exchange still looks like a custodial institution and no exclusion covers one. HMRC's own manual states the exclusion more widely than Parliament enacted it, and where guidance and statute differ the statute governs. HMRC has published nothing applying any of this to crypto firms, so read it as our view rather than settled law.
The power readers fear most — "give us all your UK customers" — is the one with the most gates. It needs tribunal approval, serious prejudice to the collection of tax, and proof the data is not readily available elsewhere.
What changes in 2027
The Cryptoasset Reporting Framework regulations came into force on 1 January 2026. UK providers have collected since then and must report between 1 January and 31 May 2027 for the 2026 calendar year. The common reporting standard only ever obliged a UK institution to report holders resident elsewhere; this has a domestic extension, so UK providers report UK residents to HMRC directly.
What it costs, and what it lets you do
Take 2025/26 disposals of £61,400 against a pooled cost of £38,900. The gain is £22,500, and after the £3,000 annual exempt amount £19,500 is taxable. On taxable income of £31,500 there is £6,200 of basic rate band left, so £6,200 is charged at 18 per cent and £13,300 at 24 per cent: £4,308 of capital gains tax.
The tax falls due on 31 January 2027. Prompted by a letter after that — a non-deliberate failure to notify more than twelve months late, so from February 2028 — the range is 20 to 30 per cent. A full 70 per cent reduction for telling, helping and giving access takes it to 23 per cent, or £990.84, plus £333.87 of interest at 7.75 per cent for the year. Prompted inside twelve months the floor is 10 per cent; volunteer it unprompted and the range starts at nil.
One trap and one concession. The trap: the capital gains pages are mandatory once proceeds exceed £50,000, even on a loss, and HMRC's manual still states the repealed four-times-the-allowance test, which would read £12,000. The statute says £50,000. The concession: below that, with gains inside the allowance, a short statement is sufficient compliance.
| Automatic UK-provider reporting today | none |
| CARF collection began | 1 January 2026 |
| First CARF report due | 31 May 2027, for 2026 |
| Schedule 23 notice lookback | four years, to 13 October 2022 |
| Financial institution notice | no tribunal, no consent |
| Identity-unknown notice | tribunal approval required |
| Annual exempt amount | £3,000, both tax years |
| CGT rates and switch point | 18% and 24% at £37,700 |
| Proceeds reporting threshold | £50,000, not £12,000 |
| Failure to notify, prompted, 12m+ | 20% to 30% of the tax |
| Late payment interest | 7.75% from 9 January 2026 |
Sources, all retrieved 12 October 2026. Statute from legislation.gov.uk: Schedule 23 Finance Act 2011, Schedule 36 Finance Act 2008 including paragraphs 4A, 5 and 61ZA, section 8C Taxes Management Act 1970, and the Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025. GOV.UK for rates, deadlines and penalties: Capital Gains Tax rates and allowances, Income Tax rates and Personal Allowances, Self Assessment deadlines and penalties, factsheets CC/FS11 and CC/FS7A, HMRC interest rates, and the cryptoasset reporting guidance. HMRC manuals CH23110, CH28030, CG10340 and IEIM8000040. Arithmetic worked here in Python. Contested: CG10340 still states the repealed proceeds test and CH23110 states the financial institution exclusion more widely than paragraph 61ZA enacts it; the statute governs in both cases. Income tax bands are for England and Northern Ireland; Scotland differs. This is information, not tax advice — speak to an accountant about your own position. Not a recommendation to buy, sell or hold anything.