Since 1 January 2026, the assumption that crypto activity stays private from HMRC has stopped being true. The Cryptoasset Reporting Framework, known as CARF, is now live in the UK, and it removes the last meaningful gap in HMRC's visibility into cryptoasset holdings.
CARF doesn't introduce a new tax. What it introduces is automatic, systematic reporting from every UK crypto exchange, custodial wallet provider, and broker directly to HMRC, without HMRC needing to ask. For anyone who has treated crypto-to-crypto swaps, overseas exchange accounts, or smaller platforms as effectively invisible, that assumption no longer holds.
This article explains exactly what changed, who is affected, and what to do about it before HMRC's first CARF-informed nudge letters start arriving.
CARF is an OECD framework, adopted by the UK alongside more than 40 other jurisdictions, requiring cryptoasset service providers to collect and report detailed user and transaction data. In the UK, this obligation now sits with every Reporting Cryptoasset Service Provider, or RCASP, whether it's a major exchange or a smaller UK-based platform. The framework was embedded into UK law through The Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025, giving it full legal force rather than sitting as guidance alone.
Providers must collect and report specific information about every user, including:
This is a significant step up from what existed before. HMRC has received some exchange data since around 2021 through existing agreements with major platforms, and Coinbase in particular has shared data on UK customers holding £5,000 or more in cryptoassets for several years already. But that earlier data-sharing was inconsistent, exchange-specific, and often reactive rather than systematic. CARF standardises the reporting format and extends it across every participating jurisdiction, giving HMRC a consistent, comprehensive data feed rather than fragments pieced together case by case.
The scope of who counts as an RCASP is also broader than many investors expect. HMRC guidance confirms the definition covers centralised exchanges, custodial wallet providers, and brokers and dealers in cryptoassets as standard, but it also extends to certain DeFi applications and protocols where a controlling entity can be identified. HMRC currently estimates that around 50 firms qualify as RCASPs under the UK regime, a number expected to grow as the market develops and as HMRC's own interpretation of "controlling entity" is tested against real platforms.
What a CARF report actually contains, in practice. It's worth being concrete about what this looks like for an ordinary investor rather than treating CARF as an abstract compliance concept. Say an investor holds accounts on a major UK exchange, a smaller UK-based trading platform, and an overseas exchange that also participates in CARF. From January 2026, each of those three providers is independently collecting that investor's identity details, tax residency, and a running log of every conversion, swap, and transfer. When the first reports are filed by 31 May 2027, HMRC doesn't receive three disconnected data points. It receives three reports that can be matched against the same individual using the same identifying information, effectively reconstructing the investor's full cross-platform trading history from HMRC's side of the table, independent of anything the investor has chosen to disclose. This is the practical difference between CARF and the earlier, exchange-by-exchange data requests HMRC relied on previously.
CARF applies to anyone using a Reporting Cryptoasset Service Provider, which in practice means the overwhelming majority of UK crypto investors and traders, regardless of portfolio size.
If you use a major UK-facing exchange: Your identification details and full transaction history are now being collected as standard, whether or not you've ever received a nudge letter before. This includes crypto-to-crypto swaps, which many investors incorrectly assume stay outside HMRC's view.
If you hold crypto on overseas exchanges: CARF is specifically designed for cross-border visibility. Non-UK users' data collected by UK providers is exchanged with their home tax authorities, and UK residents' data collected by overseas CARF-participating providers is exchanged back to HMRC. Moving activity offshore no longer reduces HMRC's visibility; it may increase it, because more than 40 jurisdictions are now feeding data into the same reciprocal framework.
If you've previously under-reported: This is the group with the most immediate exposure. HMRC's first full CARF dataset, covering the 2026 calendar year, becomes available in 2027, giving HMRC a direct comparison point against every Self Assessment return filed for that period. Discrepancies between what you've reported and what CARF data shows are the most likely trigger for HMRC's next wave of enquiries. HMRC itself has estimated that CARF-driven compliance activity will recover roughly £315 million in previously unpaid tax by April 2030, which gives some indication of how seriously the department expects to act on the data once it arrives.
If you're fully compliant already: CARF changes little in practice beyond confirming what you've already reported. The main implication is procedural: providers will request identification and tax residency information as part of standard onboarding and periodic review, and it's worth responding promptly to avoid account restrictions.
A further group worth naming specifically is active DeFi users. Because HMRC's RCASP definition can extend to DeFi protocols with an identifiable controlling entity, an investor who has treated decentralised platforms as sitting entirely outside exchange-style reporting may find that assumption tested as HMRC's interpretation of the rules matures over the next reporting cycle. Where a protocol has no controlling entity at all, it falls outside CARF's reach for now, but that is a narrower category than many DeFi users assume, and it says nothing about whether the underlying transactions were taxable in the first place.
The distinction HMRC draws is essentially about who exercises control over the platform's operation, not about whether the platform markets itself as decentralised. A protocol governed by a foundation, a development company, or a small group of identifiable individuals who can update contracts, set fees, or restrict access is more likely to be treated as having a controlling entity than a genuinely autonomous, immutable smart contract with no ongoing operator. Many platforms that describe themselves as DeFi sit somewhere between these two extremes, which means their CARF status is likely to be clarified over time rather than settled definitively from day one. Investors using such platforms shouldn't assume that ambiguity about reporting status translates into ambiguity about tax liability. Section 104 pooling, same-day matching, and the 30-day rule all still apply to DeFi swaps regardless of whether the platform itself is currently an RCASP.
Understanding the timeline matters because it tells you exactly how much runway remains before your data starts flowing through the system.
Two things follow from this timeline. First, activity from January 2026 onwards is already being captured, so there is no window remaining to adjust historic behaviour going forward. Second, HMRC's comparison capability doesn't fully activate until 2027, which means the period between now and then is the last practical opportunity to correct any historic gaps before automated cross-referencing begins.
It's also worth noting that CARF is arriving alongside a parallel update to the UK's existing Common Reporting Standard, often referred to as CRS 2.0, and a broader overhaul of HMRC's reporting schemas for financial institutions from January 2027. Together, these changes signal a wider shift in HMRC's approach, from data collection that historically relied on the department requesting information after the fact, to a system built around continuous, structured data flows across both crypto and traditional finance.
RCASPs also face direct penalties for non-compliance, and individuals can be penalised for providing false information during onboarding.
The right response to CARF depends on where your reporting position already stands, but the underlying task is the same for everyone: know what your transaction data actually shows before HMRC's dataset does.
Step 1: Reconstruct your full transaction history. Cover every exchange, wallet, and platform used since you first held crypto, not just your current primary exchange. CARF's cross-jurisdiction reach means overseas and historic accounts are now in scope too.
Step 2: Cross-check every disposal against what you've filed. This includes crypto-to-crypto swaps, crypto spent on goods or services, and any staking, mining, or airdrop income, all of which are commonly under-reported categories.
Step 3: Pay particular attention to activity on platforms you may have stopped using. A common gap emerges from accounts opened years ago on exchanges that have since been closed, migrated, or replaced by a newer platform. Those historic accounts are just as reportable under CARF as your current primary exchange, and gaps in that older history are exactly the kind of discrepancy an automated data match is designed to surface.
Step 4: Correct any historic gaps before 2027. The Digital Disclosure Service allows you to proactively correct previous tax years, and doing so before HMRC's CARF data arrives consistently produces a more favourable penalty outcome than waiting to be identified through automated cross-referencing.
Step 5: Respond promptly to provider identification requests. RCASPs are now required to verify your identity and tax residency status. Delaying or ignoring these requests can result in account restrictions independent of any tax question.
A further consideration for joint accounts and family arrangements. Some investors hold exchange accounts that were opened jointly, or that are used on behalf of a family member, often for practical rather than tax-planning reasons. CARF reporting is tied to the identity details registered against the account, so it's worth checking that the name and tax residency information a provider holds actually matches who has genuine beneficial ownership of the underlying crypto. A mismatch here doesn't just create an inconvenience; it can produce a CARF report that doesn't line up with anyone's actual Self Assessment position, which is precisely the kind of discrepancy that draws HMRC's attention once cross-referencing begins.
All our work is delivered by qualified specialists. We are not an automated software platform. Every review we conduct is built around your actual transaction history, cross-checked against exactly the categories CARF now captures.
Not sure where your position stands under CARF? Start with the free Crypto Tax Health Check, or book a consultation to talk through your transaction history with a specialist.
Our Crypto Tax Health Check reviews your trading pattern and flags whether your reported position is likely to match what CARF data will eventually show. It takes about two minutes and there's no obligation to proceed further.
CARF closes the window during which unreported crypto activity could reasonably go unnoticed. Correcting historic gaps proactively, before HMRC's first full dataset arrives in 2027, is treated far more favourably than waiting for an automated data match to trigger an enquiry.
Learn more about how we work on the HashTax homepage, or book your free consultation today. Your crypto tax compliance matters. Let's address it properly together.
Disclaimer: This article provides general information about the Cryptoasset Reporting Framework and its UK implementation, current as of mid-2026. CARF regulations, reporting timelines, and HMRC guidance are subject to change, and individual circumstances vary significantly. You should seek professional advice specific to your situation before making tax decisions. HashTax provides professional cryptocurrency tax services delivered by qualified specialists. We are not an automated software platform.
HashTax Specialists
Our team of ACCA-qualified accountants specializing in UK cryptocurrency taxation. We provide expert guidance on HMRC compliance, tax planning, and professional advisory services for crypto investors and businesses.
.svg)
.svg)
