Crypto Is Now a Compliance Line Item: What CARF Means for Your January

The Risk That Is Not on Your Compliance Calendar

Ask a UK practice owner what has dominated 2026 and the answer will be quarterly updates, AML supervision or Companies House reform. Cryptoassets rarely make the list. Yet a quiet but significant change took effect on the 1st of January 2026, and it will land squarely in the middle of the busiest quarter of your year.

The Cryptoasset Reporting Framework, known as CARF, is now live in the UK. Exchanges, custodians and other providers began collecting standardised identity and transaction data on their users at the start of the year. HMRC receives the first reports by the 31st of May 2027, covering the whole of the 2026 calendar year, and expects to begin exchanging that data internationally in 2027.

In other words, the visibility gap that made crypto feel like somebody else's problem is closing. Your clients may not have mentioned their tokens. HMRC will soon know about them anyway.

What Changed on the 1st of January 2026

CARF is an OECD standard for the automatic exchange of tax relevant cryptoasset information between tax authorities. The UK implemented it through the Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025, which came into force on the 1st of January 2026. The practical effects are straightforward:

• Data collection has already started. UK reporting cryptoasset service providers have been gathering user and transaction data since January 2026.
• The first reporting window is January 1st to May 31st 2027, covering the 2026 calendar year, and it captures UK resident users as well as users in other participating jurisdictions.
• Providers must register with HMRC by the 31st of January 2027. If any of your clients operate an exchange, a custodial wallet service or a brokerage, this is their deadline, not somebody else's.
• Clients are being asked to self certify. Platforms are requesting names, addresses and tax identification numbers such as a National Insurance number or UTR. A user who deliberately or carelessly fails to provide a valid self certification can face a penalty of up to £300.

Note what the reports contain and, just as importantly, what they do not. Providers report proceeds and volumes. They do not report acquisition cost, pooled base cost or the resulting gain. HMRC therefore receives a large number, not a correct one. That distinction is exactly where your firm adds value, and it is also why unrepresented taxpayers panic when a letter arrives.

The Nudge Letters Are Already Here

CARF is the future. HMRC's data matching is the present. Figures released under a Freedom of Information request show HMRC sent 81,172 crypto related letters, emails and text messages to taxpayers in the 2025/26 tax year. That follows 64,982 in 2024/25 and 27,714 in 2023/24, so volumes have roughly tripled in three years.

HMRC also published data in August 2026 showing that 17,600 individuals declared £1.38 billion of taxable crypto gains for 2024/25. Set that against the millions of UK adults estimated to hold cryptoassets and the compliance gap becomes obvious.

These are one to many letters, not enquiries. They are a prompt to review a return rather than an accusation. Two points matter for your firm:

• A letter changes the penalty position. A disclosure that follows an HMRC prompt attracts a higher penalty range than an unprompted one, so speed of response has a direct financial value to the client.
• Letters are not random. They are generated by comparing platform data against what has been declared. If a client receives one, assume HMRC already holds a figure.

The New Crypto Boxes on the 2025/26 Return

The change most likely to surprise your team is on the form itself. The capital gains summary now asks for cryptoasset disposals to be identified separately, alongside new entries for other items such as business asset disposal relief and carried interest. For returns for 2025/26, due by the 31st of January 2027, crypto is no longer buried inside a general "other assets" total.

That has three consequences for practices:

• Silence is no longer neutral. A blank crypto box on a return where HMRC data suggests activity is a visible mismatch.
• You need the question in writing. Your annual information request should ask about cryptoassets explicitly, and the answer should be recorded on file.
• Working papers need to stand up. Separate disclosure invites separate scrutiny, so pooled computations must be reviewable rather than a single figure typed in from a client spreadsheet.

Where the Real Work Sits

Crypto is rarely difficult in principle. It is time consuming in practice, because clients underestimate how many disposals they have made. Points to brief your team on:

• A disposal is broader than a sale for cash. Swapping one token for another, spending crypto on goods or services, and gifting to anyone other than a spouse or civil partner are all disposals.
• Share identification rules apply. Same day and 30 day matching come first, then the section 104 pool. Clients who calculate gains transaction by transaction almost always get this wrong.
• Capital or income needs deciding, not assumed. Most individual activity is within the capital gains regime. Staking rewards, mining and certain airdrops can be income. A client calling themselves a trader does not make it trading.
• Small numbers still need computations. With the annual exempt amount at £3,000, more clients cross the threshold than they expect, and those who do not still need a calculation to prove it.
• Losses are an opportunity. Unclaimed losses, including negligible value claims on failed tokens or lost access, are frequently missed and must be claimed to be useful.

Turn It Into a Service, Not a Favour

The temptation is to absorb crypto work inside an existing Self Assessment fee. Do not. Reconstructing a multi platform trading history is a distinct piece of work with a distinct risk profile, and it should be scoped, priced and documented as such.

• Add a defined cryptoasset service to your engagement terms, with a clear boundary between reviewing client prepared data and reconstructing it from scratch.
• Set a cut off date after which crypto cases cannot be guaranteed for the 31st of January, and communicate it now rather than in December.
• Insist on complete exports from every exchange and wallet, not just the platform HMRC has named in a letter.
• Record your crypto conversations, questions and client responses in your practice management system so the audit trail is centralised rather than sitting in individual inboxes.

There is an AML dimension too. Cryptoasset wealth affects source of funds assessments and client risk ratings, so a client whose crypto holdings only came to light in January should prompt a review of their risk assessment as well as their return.

Your Next 30 Days

• Screen your client base. Identify anyone whose records, bank statements or previous returns suggest crypto activity, plus any client operating as a crypto asset service provider who faces the 31st of January 2027 registration deadline.
• Update your information request. Add an explicit cryptoasset question, including exchanges used, wallets held, staking or mining activity and any transfers between the client's own wallets.
• Brief the team. One hour on pooling, matching rules, income versus capital and the new return boxes will save days in January.
• Prepare a nudge letter response pack. Standard wording, a records checklist and a decision tree covering review, correction and voluntary disclosure.
• Write to clients now. A short proactive note explaining CARF, the separate reporting boxes and the value of coming forward early is a genuine advisory touchpoint, and it is far cheaper than a rushed reconstruction under deadline pressure.

The Bigger Picture

CARF sits alongside e-invoicing, digital platform reporting and MTD for Income Tax as part of the same direction of travel. HMRC is steadily acquiring third party data and comparing it with what taxpayers declare. Every one of those regimes rewards the same behaviour from a practice: complete records, a documented process and a client conversation that happens before HMRC starts one.

Crypto is simply the next area where that gap becomes visible. The firms that handle it well in the 2026/27 season will be the ones that treated it as a defined service in September, rather than a surprise in January.

TaxCalc helps practices keep compliance work, client records and deadlines in one place, so your team can spot the cases that need attention long before the deadline arrives.