From 1 January 2026, crypto exchanges, brokers and other cryptoasset service providers with a UK connection must collect a self certificate from every customer and report each reportable customer’s identity and yearly transaction totals to HMRC. The first reports, covering the 2026 calendar year, are due by 31 May 2027. Customers must give their name, address, tax residence, tax identification number (usually the National Insurance number for UK individuals) and date of birth, and can face a penalty of up to £300 for failing to provide a valid self certificate.
Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.
What is the Cryptoasset Reporting Framework?
The Cryptoasset Reporting Framework (CARF) is an OECD standard for the automatic exchange of tax information on cryptoasset transactions, developed on a G20 mandate and first published in 2022. It sits alongside the Common Reporting Standard, which covers bank and investment accounts but had limited reach into crypto (IEIM8000040). In the UK it is given effect by the Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025, which refer to the OECD rules and commentary for the detail (IEIM8000060).
The UK has gone further than the international standard by adding domestic reporting. UK reporting cryptoasset service providers (RCASPs) must report not only on customers resident in other CARF countries but on UK tax residents as well, and HMRC will also receive data on UK residents from providers in other implementing jurisdictions (IEIM8000030, IEIM8000730). Due diligence, record keeping and other duties started on 1 January 2026 (IEIM8000050).
Which businesses have to report?
An RCASP is any individual or entity that, as a business, provides a service effectuating exchange transactions in relevant cryptoassets for or on behalf of customers, whether as a counterparty, an intermediary or by making a trading platform available. This covers exchanges, brokers and dealers, operators of crypto ATMs and, in line with FATF guidance, some people and entities involved in decentralised exchanges (IEIM8000110).
An RCASP has a UK nexus if it is UK tax resident, is incorporated or organised under UK law, is managed and controlled in the UK, or has a regular place of business here including a branch (IEIM8000320). Where it has a nexus in more than one country it reports in the one highest in that hierarchy, with tax residence at the top (IEIM8000330).
Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.
From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.
See my price in 2 questions or call 01795 841 310.
★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews
Which cryptoassets are covered?
All cryptoassets are relevant cryptoassets unless they are central bank digital currencies, specified electronic money products, or assets the provider has determined cannot be used for payment or investment (IEIM8000240). Central bank digital currencies and electronic money products are reported under the CRS instead (IEIM8000250, IEIM8000260).
Non fungible tokens traded on marketplaces are relevant cryptoassets. A provider may treat an NFT as outside scope only if it does not represent financial assets, is not marketed as an investment, is not a virtual asset under FATF rules, and has low value and trading volume, for example never traded above USD 200 and not more than 10 times since creation (IEIM8000280). Shares issued in crypto form are reported under the CARF rather than the CRS, while indirect exposure through derivatives or investment funds stays within the CRS (IEIM8000295).
What information do customers have to give?
Every customer must give the provider a self certificate. HMRC does not prescribe its format, but it must be signed or positively affirmed and dated, and contain (IEIM8000440):
| Customer | Information required |
|---|---|
| Individual | First and last name, residence address, every jurisdiction of tax residence, tax identification number for each reportable jurisdiction, date of birth |
| Entity | Legal name, address, jurisdictions of tax residence, tax identification number, and where relevant information showing it is an active entity or excluded person |
| Controlling person of an entity | Name, residence address, jurisdictions of tax residence, tax identification number, date of birth and controlling role |
For a UK individual the tax identification number will usually be the National Insurance number, and someone without one will need to apply. For a UK company it is normally the company registration number, for a partnership the partnership UTR, for an LLP its registration number and for a trust the trust UTR (IEIM8000445). Where an entity is not an active entity, the provider must look through it to its controlling persons, so a personal holding company does not keep the owner out of the report (IEIM8000440).
When must the self certificate be given?
A new customer must provide it when the relationship begins and before the provider carries out any transaction. If a valid certificate is not obtained, the provider should stop effectuating transactions. Customers who already had an account on 1 January 2026 have until 31 December 2026, and providers are told to start chasing early because continuing to trade for an unverified customer after that date can put the provider in a penalty position (IEIM8000470, IEIM8000475).
Customers must also tell the provider about changes, such as moving country. A certificate stops being reliable once the provider knows or has reason to know circumstances have changed, and the provider then needs a new certificate or a reasonable explanation, with up to 90 days in which it may keep treating the customer as before (IEIM8000460).
What is reported to HMRC?
Two sets of data go to HMRC for each calendar year (IEIM8000515):
- Identification: the customer details above and the provider’s own name, address and identifying number.
- Transactions, aggregated per customer and per cryptoasset: purchases and sales for fiat currency, net of fees; exchanges of one cryptoasset for another, with the fair market value of both sides; transfers in and out, broken down by type such as staking income, mining income, airdrops or loans; transfers to external wallets not known to belong to a service provider; and retail payments above USD 50,000 (IEIM8000530 to IEIM8000585).
Values are reported in a single fiat currency using a consistent method (IEIM8000530, IEIM8000590). Wallet addresses for external transfers are not reported but must be kept for at least five years so HMRC can ask for them (IEIM8000585). Reports are due by 31 May after the end of the calendar year (IEIM8000050), and providers must tell each reportable customer, by 31 January after the first reporting year, that their information will go to HMRC and may be shared abroad (IEIM8000480).
What penalties apply?
Most penalties fall on providers: up to £100 per customer for failing to apply due diligence, up to £300 per customer for failing to collect a valid self certificate, up to £5,000 per year for record keeping failures, up to £5,000 plus up to £600 a day for late reports, and up to £100 per customer for deliberate or careless inaccuracies. Customers are also exposed: a person who fails to provide a valid self certificate is liable to a penalty of up to £300 where the failure is deliberate or due to a failure to take reasonable care (IEIM8000620). The provider may also refuse to provide further services (CRYPTO10410).
What does this change for your own tax?
The CARF does not change how cryptoassets are taxed; it changes what HMRC knows. The figures are aggregated totals of proceeds, costs and transfers, not taxable gains, so they will rarely match a Capital Gains Tax computation line by line. But they will show HMRC who has been trading and roughly how much. For how disposals and pooling work, see cryptoasset tax.
Illustration only. A UK resident sells tokens for £30,000 during 2026 on an exchange based in another CARF country and moves the rest to a private wallet. That exchange reports the sales total and the external wallet transfer to its own tax authority, which passes them to HMRC, while a UK platform would report direct to HMRC by 31 May 2027. If gains from earlier years were never declared, correcting them before HMRC acts on the data is usually better than waiting; see the Digital Disclosure Service and prompted and unprompted disclosure.
If HMRC opens a check into your return, tax investigation insurance pays your accountant’s fees. Solar Protect cover pays up to £100,000 with no excess; it never pays tax, interest or penalties. Read how our cover works or get a quote.
Related Accountapedia entries
- How HMRC Taxes Crypto
- AML risks with clients holding cryptoassets
- The threats and safeguards framework
- FRS 101: the reduced disclosure framework
- Reduced disclosures for qualifying entities
Sources
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
- GOV.UK: www.gov.uk
Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 24 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.