What are the HMRC crypto reporting rules?

Under the Cryptoasset Reporting Framework, in force since 1 January 2026, UK cryptoasset service providers must collect identifying details and transaction records for their users and report them to HMRC annually. The first reports, covering 2026, are due by 31 May 2027.

What information will crypto exchanges give HMRC?

For individuals: name, date of birth, home address, country of residence, and for UK residents a National Insurance number or Unique Taxpayer Reference. Plus transaction data, the value, type of cryptoasset, type of transaction and number of units.

When did crypto exchanges start collecting this data?

1 January 2026, when the Reporting Cryptoasset Service Providers Regulations 2025 came into force. If a UK platform has asked you to confirm tax details this year, this is why.

Will HMRC see my foreign exchange accounts?

That is the design. CARF is an OECD framework, and jurisdictions exchange the collected data with each other from 2027, so overseas platforms in participating countries report UK users back to HMRC.

Does this mean HMRC knows my gains automatically?

No. HMRC will know your identity, platforms and transaction volumes. Your actual gain or loss depends on pooling, matching and costs across your whole history, which only a full computation produces, and the numbers on your return still come from you.

Do the reporting rules change what tax I owe?

Not by a penny. The CGT and income tax rules are unchanged. What changes is visibility, undeclared disposals become easy for HMRC to see, which is why warning letters are already at record numbers.

HMRC crypto tax reporting, what exchanges must now hand over

Q: What happens to exchanges that do not comply?

The regulations set penalties including up to £100 per user for due diligence failures or inaccurate reports, up to £300 per user where a valid self-certification is missing, and up to £5,000 plus £600 per day for late reports.

On this page

Exactly what gets collected
The dates that matter
The enforcement teeth
What this does and does not change

Since 1 January 2026, every UK cryptoasset service provider has been legally required to collect identifying information and transaction records from its users, for annual reporting to HMRC. This is the Cryptoasset Reporting Framework, CARF, and it is not a proposal or a threat on the horizon. The regulations are in force now, the first reports covering 2026 are due to HMRC by 31 May 2027, and the collection is already happening, which is why UK exchanges have spent this year asking customers to confirm their tax details.

Exactly what gets collected

HMRC’s guidance for providers is specific. For an individual user:

name, date of birth, home address, country of residence
for UK residents, a National Insurance number or Unique Taxpayer Reference
for non-UK residents, a tax identification number and the country that issued it

For each transaction: the value, the type of cryptoasset, the type of transaction, and the number of units. Companies, partnerships and trusts are covered too, with registration numbers in place of NI numbers.

Read that list again with one question in mind, what would HMRC need to open a compliance check on a person? A verified identity, a tax reference to match against returns, and transaction volumes with values. The reporting file is that, per user, per year.

The dates that matter

Date	What happens
1 January 2026	Collection duty began, providers gather user and transaction data
31 May 2027	First reports due to HMRC, covering calendar year 2026
From 2027	International exchange, overseas platforms in CARF jurisdictions report UK users back to HMRC

The international leg deserves emphasis. CARF is an OECD framework adopted by dozens of jurisdictions, so the account you hold on a foreign platform is inside the design, not outside it. Reporting flows between tax authorities the way bank account data already does under the Common Reporting Standard.

The enforcement teeth

The regulations put numbers behind the duty. Providers face penalties of up to £100 for each user affected by due diligence failures or inaccurate reports, up to £300 per user where a valid self-certification is missing, and for late reporting an initial penalty of up to £5,000 plus up to £600 for each further day. Multiply the per-user amounts across an exchange’s book and compliance stops being optional. Platforms will report, thoroughly, because the alternative is priced to hurt.

This is the machinery behind a number that made headlines this month: HMRC sent 81,172 crypto warning letters in the last year, nearly triple two years earlier, and those letters were built on the old, request-based data. The CARF era makes the data routine.

What this does and does not change

It changes nothing about what you owe. Pooling, matching, allowances, rates, all identical to last year, and our UK guide walks through them. What it changes is the gap between what HMRC can see and what people have declared. An undeclared 2026 disposal is no longer hidden by obscurity, it is a row in a report with your National Insurance number on it, due at HMRC by the end of May 2027.

It also does not compute your position for you. HMRC will see volumes and values per platform. Your actual gain depends on your complete history across every platform and wallet, matched under the section 104, same day and 30-day rules. Which means the sensible response to the reporting era is to hold a computation at least as good as the data HMRC holds, and that is the thing gains.tax builds, from your own exports, entirely in your browser, with nothing uploaded anywhere. HMRC gets its copy of your identity from the exchanges either way. Nobody needs a copy of your full financial life just to tell you what you owe.

We track which platforms report what, request-based and CARF alike, in what exchanges report to HMRC. If years of your history need squaring before the first reports land, the disclosure route explainer covers the order of operations, and it is cheaper walked before a letter arrives than after.