The United Kingdom is preparing to slap crypto investors and service-providers with fixed financial penalties if they fail to hand over key user data to the tax office. A draft regulation published by HM Treasury confirms that anyone who withholds required personal details—such as name, address and tax ID—could face an immediate £300 fine (about US $408) and additional daily charges until the information is supplied. The measure implements the Crypto-Asset Reporting Framework (CARF) drawn up by the OECD and is scheduled to take effect on 1 January 2026.
“These regulations will close a critical transparency gap and give HMRC the tools to detect and deter offshore tax evasion involving cryptoassets,” the Treasury said in the explanatory note to Parliament.
What the rules require
- Personal data collection. UK-based cryptoasset service providers—exchanges, brokers, custodial wallets—must collect and keep verified user information: full legal name, date of birth, residential address, country of residence and tax identification numbers.
- Annual reporting. Beginning in 2027, firms must file an XML report to HMRC covering all customer transactions made in the prior year.
- 30-day window. Users have one month to comply with any request from their provider; failure triggers the £300 penalty plus a £10 daily surcharge after notice is given.
- Scope. The draft law applies to both individuals and companies, regardless of whether the crypto is held onshore or abroad.
Why now?
The UK committed to adopting CARF at the G20 meetings in 2023. Revenue officials estimate unreported crypto gains cost the Exchequer £180 million a year and expect the new framework to claw back £315 million by April 2030.
How CARF differs from existing rules
| Feature | Current “Know-Your-Customer” | New CARF Requirement |
| Applies to | Anti-money-laundering obliged entities | Any UK crypto service provider |
| Data shared with | Internal compliance only | HMRC & partner tax agencies |
| Reporting frequency | On request | Annually, by 31 January |
| Penalties | Warning or account freeze | £300 fine + £10/day |
Unlike the Common Reporting Standard (CRS) for bank accounts, CARF specifically targets crypto wallets, NFTs and even certain DeFi protocols if they offer custody or broker services.
Reaction from industry and tax experts
- Coinbase UK said in a statement that it “welcomes clear, globally aligned standards” and has begun upgrading onboarding flows to capture tax IDs at sign-up.
- Gemini told CoinDesk it would extend its existing FATCA/CRS process to cover CARF data elements.
- Tax barrister Rachel de Souza warned in the Financial Times that retail users who store coins on overseas exchanges “may get a nasty surprise” if their platform fails to collect the data in time.
What counts as “concealment”?
HMRC defines concealment broadly: providing a fake address, failing to update a change of residence, or refusing to submit a national-insurance number all qualify. Even if the underlying crypto gains are correctly declared on a Self-Assessment return, not furnishing the data to your exchange can still trigger the fine.
Enforcement timeline
| Date | Milestone |
| Oct 2025 | HMRC publishes final technical guidance after industry consultation. |
| 1 Jan 2026 | Rules enter force; exchanges must begin collecting data. |
| 31 Jan 2027 | First XML reports due to HMRC covering 2026 activity. |
| Q1 2027 | HMRC begins issuing £300 penalties for non-compliant users. |
How to stay compliant
- Verify your details – Log into each UK-licensed exchange you use and ensure name, address and tax ID match your official documents.
- Check overseas platforms – If you trade on a non-UK exchange, ask whether it will implement CARF; otherwise be prepared for additional self-reporting.
- Download transaction history – HMRC recommends keeping CSV exports for six years.
- Use professional software – Tools like Koinly or CoinTracker already map CARF fields and can generate HMRC-ready reports.
- Respond promptly – Should your platform request updated data, supply it within the 30-day window to avoid the £300 penalty.
Penalty mechanics: examples
- Scenario 1: Missing address
Alice opens a trading account in 2026 but omits her address.- Exchange issues notice on 5 February.
- 6 March: £300 fine levied.
- Daily £10 accrues until Alice submits proof of address on 10 March (total £350).
- Scenario 2: Refusing tax ID
Bob refuses to provide a National Insurance number.- After 30 days he owes £300 + £10 per extra day.
- 25 days later the bill is £550. The exchange may freeze withdrawals until paid.
Critics say fines are too low
Some industry lawyers argue the £300 fixed fine is “a rounding error” for whales moving six-figure sums and may not deter deliberate evaders. Treasury officials counter that penalties can escalate: deliberate concealment could invoke existing tax-evasion statutes with fines up to 200 % of undeclared liability and potential criminal charges.
Comparison with EU and U.S. moves
| Jurisdiction | Status | Penalties |
| EU DAC8 | Council adopted in 2023; member states transposing by 2026 | Minimum €200 per reporting failure |
| United States | IRS broker-reporting rule finalised; effective 2026 | $250 per form plus gross-proceeds understatements |
| UK CARF | Draft regs before Parliament; in force 2026 | £300 + £10/day |
The converging timelines mean global exchanges face a three-continent compliance sprint over the next 18 months.
Impact on everyday users
For casual investors—the person who dollar-cost averages £100 a month—the main change is administrative: expect prompts to upload a utility bill or enter a tax number. The bigger headache lies with DeFi power users who route trades through multiple wallets: if any platform you touch falls under UK jurisdiction, be ready to provide full identity details.
Outlook
Parliament is expected to pass the regulations before its summer recess, giving HMRC and crypto businesses roughly 15 months to build reporting pipelines. Exchange operators say the deadline is tight but doable, provided final specs arrive by October. Users who treat crypto wallets like anonymous bank accounts, however, should mark 1 January 2026 as a hard stop: fail to disclose, and you may wake up to a £300 bill—and counting.