The Cryptoasset Reporting Framework came into effect on 1 January 2026. UK cryptoasset service providers have been collecting user and transaction data since then, must register with HMRC by 31 January 2027, and file their first reports between 1 January and 31 May 2027. The UK went further than the international minimum: providers report on UK-resident users too, not just overseas ones.
What CARF is
CARF is an OECD framework giving tax authorities visibility over cryptoasset transactions. Reporting cryptoasset service providers collect information annually on in-scope transactions, including the activities and tax residency of their users, and information about users resident in other participating jurisdictions is exchanged with those jurisdictions.
It exists because cryptoassets sat outside the Common Reporting Standard, which covers financial accounts. HMRC's own framing is direct: the new requirements make it more difficult for taxpayers to avoid reporting under the CRS.
The dates
- 1 January 2026 — the measure comes into effect; the first reporting period runs to 31 December 2026;
- 31 January 2027 — deadline for providers to register with HMRC's online service and to tell their users their details will be reported;
- 1 January to 31 May 2027 — window for submitting the first report, covering calendar year 2026;
- 31 May annually thereafter;
- 2027 — first international data exchanges.
Anyone who has not been collecting since January 2026 has a data problem rather than a filing problem, because the reportable period is already running.
Who has to report
A reporting cryptoasset service provider is an entity or individual that either transacts cryptoassets on behalf of users, or provides a means for users to transact — exchanges, brokers and dealers. The framework explicitly catches individuals effectuating exchange transactions as a business, not only companies.
Providers must collect details of all their users, but report only on those tax resident in the UK or in another CARF-participating jurisdiction: their details and a summary of their transactions. The data points include name, address, tax residence and tax identification numbers.
The UK's domestic extension
This is the part that distinguishes the UK implementation. The international minimum requires reporting on users resident in other jurisdictions, for exchange. The UK also requires RCASPs to collect and report information on UK resident customers.
The stated effect is that HMRC will hold CARF data on all UK taxpayers using both UK-based and non-UK-based providers. For a UK individual, that means their exchange activity is visible to HMRC from a source other than their own return — which changes the risk calculus on unreported disposals considerably. Our crypto tax team deals with how those disposals are actually computed and reported.
Penalties: read the "£300" carefully
HMRC's guidance gives a headline of up to £300 per user for failing to report, reporting late, or providing inaccurate, incomplete or unverified reports. That is a ceiling, and the underlying regulations — SI 2025/744 — are more granular:
- Due diligence failure — £100 per reportable user, rising to £300 where the failure relates to an invalid self-certification;
- Record keeping — £5,000 for each calendar year in which there is one or more failure;
- Self-certification, deliberate or careless — £300;
- Late report — £5,000, plus £600 for each subsequent day after notice of assessment;
- Inaccurate or incomplete report — £100 for each cryptoasset user;
- Failure to notify users — £100 per reportable person, plus £100 for each subsequent day;
- Failure to provide information to HMRC — £5,000, plus £600 for each subsequent day;
- Failure to register — £1,000, plus £300 for each subsequent day.
Liability does not arise where the person has a reasonable excuse. Note the shape of these: the per-user amounts are modest, but the daily penalties on registration and filing failures compound quickly, and a provider with a large user base faces a per-user figure multiplied across the whole book.
CRS 2.0 alongside it
CARF and the CRS amendments were developed by the OECD as a complementary package, and the UK implemented both together. The amendments — CRS 2.0 — are in SI 2025/740 and also take effect from 1 January 2026, with first reports covering calendar year 2026 due by 31 May 2027.
The changes bring specified electronic money products and central bank digital currencies into CRS scope, exclude most charities, add reporting information, and require reporting financial institutions and trustee-documented trusts to register with HMRC. There is a new obligation on account holders and controlling persons to provide valid self-certifications, backed by a reformed penalty framework including an enhanced penalty for failing to obtain them. Around 6,000 institutions are affected, roughly 300 of them newly in scope.
What individual holders should do
Be careful with claims here, because the obligations sit on providers rather than on users. In practice an individual will be asked by their exchange for name, address, tax residence and a tax identification number or National Insurance number, and should expect that request to be genuine rather than a phishing attempt.
The one penalty that reaches an individual directly is the £300 for a deliberate or careless invalid self-certification. Beyond that, the sensible step is to make sure the self assessment position matches what the exchange will report — because from 2027 HMRC will be able to compare the two. Anyone with historic unreported disposals is better off using a voluntary disclosure before that comparison happens than after.
For providers
Three things need to be in place. Due diligence procedures that produce valid self-certifications, because the penalty escalates specifically where they are invalid. A registration diarised for 31 January 2027, with the user notification alongside it — that notification is a separate obligation with its own daily penalty. And a data extract that can produce the required fields for the whole of 2026, which is a systems question and the one most likely to be discovered late.
Acumon advises cryptoasset businesses and investors through crypto tax and tax compliance work, with HMRC investigation support where a disclosure is needed. If you run an exchange or brokerage and have not started collecting tax residence data, the 2026 reporting year is already underway.