CARF Explained: What UK Crypto Holders Need to Know in 2026

Every factual statement below is drawn from HMRC's published guidance on gov.uk and cited to it. The sources are listed in full at the end.

The first period the Cryptoasset Reporting Framework covers is the 2026 calendar year, beginning 1 January 2026. HMRC states that UK reporting cryptoasset service providers must "submit your first report between 1 January 2027 and 31 May 2027, giving details for 1 January 2026 to 31 December 2026". In later years, providers "need to submit a report by 31 May, giving details for the previous calendar year" (Reporting cryptoasset user and transaction data).

What CARF Requires

CARF requires UK reporting cryptoasset service providers to collect details of their users and a summary of those users' transactions, and to report them to HMRC once a year (Reporting cryptoasset user and transaction data).

On scope, HMRC states that providers "need to collect details of all of your users", but "only need to report on users who are tax resident in the UK or another country that is signed up to CARF rules". Reports cover "these users' details and a summary of their transactions" (Reporting cryptoasset user and transaction data).

What a Service Provider Must Obtain

HMRC's guidance for users lists the information a UK cryptoasset service provider must obtain from an individual:

"your full name"
"your date of birth"
"the address and country where you normally live"
"your tax identification number", which in the UK "could be your National Insurance number or Unique Taxpayer Reference (UTR)"

What This Means in Practice

The first reporting period runs for the calendar year 2026, and the first reports reach HMRC by 31 May 2027 at the latest. From that point HMRC holds a summary of the in-scope transactions of every reported user alongside the returns those users have filed.

Reporting reaches beyond UK providers. Because reports cover users "tax resident in the UK or another country that is signed up to CARF rules", a UK resident using a service provider in another participating country is within the framework's design.

Need help with your crypto taxes?

We introduce you to an ICAEW-regulated firm of chartered accountants. Whether the firm takes on your matter is its decision alone.

Start your enquiry

Free to enquire · No obligation.

Three Positions People Are In

Where Gains Have Already Been Declared

Where crypto gains have been declared, CARF changes nothing about the tax due. What people in this position generally do is check that their own records match what a provider would report. HMRC is clear that the record-keeping obligation sits with the taxpayer: "You must keep your own records of your transactions", because provider reports do not track pooled costs (Check if you need to pay tax when you sell cryptoassets).

Where Gains from Earlier Years Are Undeclared

HMRC runs a dedicated route for this. Its Cryptoasset Disclosure Service is for making "a voluntary disclosure of any unpaid tax if you have income or gains from cryptoassets, including exchange tokens, NFTs and utility tokens" (Tell HMRC about unpaid tax on cryptoassets).

How far back a disclosure reaches depends on behaviour. HMRC states you "will only have to pay us what you owe for 4 years" if you took care but still did not pay enough, "a maximum of 6 years" if you did not take enough care, and "a maximum of 20 years" if you deliberately did not pay enough.

A disclosure through that route sets out the years, the figures and the penalty the person is applying to their own conduct, and the behaviour band chosen determines the percentage charged (CC/FS7A). That is why people in this position ordinarily take advice before filing one rather than after.

The penalty consequences of disclosing before rather than after HMRC makes contact are set out in the table below.

Where Gains Are Below the £3,000 Allowance

HMRC gives the annual exempt amount for individuals as "£3,000" for the 2025 to 2026 tax year (Capital Gains Tax rates and annual tax-free allowances), and states that you must report and pay Capital Gains Tax when "your total gain for the tax year (6 April to 5 April) is above the Capital Gains Tax tax-free allowance" (Check if you need to pay tax when you sell cryptoassets).

A separate rule catches people who are already in the system: "If you're registered for Self Assessment, you need to report your gains in your tax return if the total amount you sold the assets for was more than: £50,000 - for the tax year 2023 to 2024 onwards" (Work out if you need to pay Capital Gains Tax). Where someone is already filing a return and their disposal proceeds cross £50,000, the gains go in the return even where they sit below the allowance.

Penalties for Undeclared Tax

Penalties are charged as a percentage of the unpaid tax, not of the gain. The percentage depends on the behaviour behind the error and on whether you told HMRC before they approached you (an unprompted disclosure) or afterwards (a prompted disclosure).

HMRC's factsheet is explicit that care is a complete defence: "If you took reasonable care to get things right but your return or document still contained an inaccuracy, we won't charge you a penalty."

Behaviour	Unprompted disclosure	Prompted disclosure
Reasonable care taken	No penalty	No penalty
Careless	0% to 30%	15% to 30%
Deliberate	20% to 70%	35% to 70%
Deliberate and concealed	30% to 100%	50% to 100%

Every figure in that table is quoted from HMRC factsheet CC/FS7A, and the same maximums and minimums appear in the Compliance Handbook at CH82470.

Where you never told HMRC you needed to file at all, the failure to notify rules apply instead. The deliberate rows are the same. The non-deliberate row turns on timing: "0% to 30%" for an unprompted disclosure within 12 months of the tax being due, "10% to 30%" for an unprompted disclosure after 12 months or a prompted disclosure within 12 months, and "20% to 30%" for a prompted disclosure more than 12 months late. HMRC will not charge a failure to notify penalty where "you have a reasonable excuse for the failure" and "the failure wasn't deliberate" (CC/FS11).

Where the unpaid tax involves an offshore matter, the maximum rises with how readily the territory shares information with HMRC. HMRC's offshore factsheet gives the maximums by territory category: category 1, "The maximum penalty is 100% of the tax"; category 2, "The maximum penalty is 150% of the tax"; category 3, "The maximum penalty is 200% of the tax" (CC/FS17).

Interest also accrues on unpaid tax from the original due date, separately from any penalty.

The practical point is the gap between the two columns. Once HMRC has written, a disclosure is prompted by definition, and the minimum in every behaviour row goes up. That gap is what makes the timing of advice matter more than its cost.

How Long HMRC Can Look Back

CARF data does not change the assessment windows, but it makes it likelier that HMRC has a reason to use them. The Compliance Handbook gives the ordinary limit as "4 years from the end of the relevant tax period", extended to "6 years" where the loss of tax was careless, a "12 year time limit" where income tax or capital gains tax has been lost and the lost tax involves an offshore matter, and a "20 year time limit" where the loss of tax was deliberate (CH51300).

For a full overview of how crypto disposals are taxed and reported, see our main UK crypto tax guide. For the Self Assessment process and deadlines, see our guide to Bitcoin CGT and Self Assessment. For what to do if a letter has already arrived, see HMRC crypto compliance letters.

This guide is for general information only and does not constitute tax advice. Tax rules change and individual circumstances vary. Always consult a qualified tax adviser before making decisions about your tax position. Nothing on this website creates a professional relationship.

Sources

Last reviewed: 30 July 2026.

Quoted HMRC material contains public sector information licensed under the Open Government Licence v3.0.

Ready to speak to a professional?

Free to enquire · No obligation.

Start your enquiry