Crypto Data Wave: What to Fix Before HMRC Gets Its First CARF Report

A Compliance Wave That Is Not About Quarterly Updates

Ask a UK practice owner what has consumed 2026 and the answer will almost certainly involve quarterly updates, AML supervision or Companies House reform. Meanwhile, a different data-led change has already switched on quietly in the background, and it will start producing consequences in your client base long before your team has recovered from the January filing season.

Since the 1st of January 2026, UK reporting crypto asset service providers have been legally required to collect and verify identity and transaction data on their users. That obligation comes from the Reporting Crypto asset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025, the UK's implementation of the OECD Crypto asset Reporting Framework, better known as CARF. The first reports cover the 2026 calendar year and must reach HMRC between the 1st of January and 31st of May 2027.

In other words, the data is being gathered right now. Your clients simply have not felt it yet.

What CARF Actually Gives HMRC

CARF is often described as crypto reporting, but that is slightly misleading. It reports the people behind the wallets. Providers within scope must gather and pass on a package that typically includes:

• Name, address, date of birth and jurisdiction of tax residence
• Taxpayer identification number, which for UK individuals means the National Insurance number or Unique Taxpayer Reference
• Aggregated transaction data, including acquisitions, disposals, transfers and exchanges of one cryptoasset for another

Providers report on UK users and on users resident in participating partner jurisdictions, with data then exchanged between tax authorities. Non-compliance carries a penalty of up to £300 per reportable user for the provider, and a user who deliberately or carelessly fails to give a valid self certification can be charged up to £300 in their own right. That last point matters for client communication: the awkward emails your clients have been getting from exchanges asking for personal details are not a scam, they are a statutory requirement.

HMRC Is Not Waiting for the Data

Here is the part practices most often miss. HMRC has not paused compliance activity while it waits for the first CARF file to arrive.

A One To Many campaign aimed at individuals suspected of underpaying Income Tax or Capital Gains Tax on cryptoasset transactions has been running since July 2026 and is expected to continue to March 2027. It is being led by HMRC's Wealthy and Mid-sized Business Compliance team. Recipients may be contacted by letter, email or text message, and HMRC has been considering messages through the HMRC app. Crucially, agents should receive copies of letters sent to their clients, so your practice inbox is part of this campaign whether you planned for it or not.

The trend line is clear. HMRC issued nearly 65,000 crypto nudge letters in 2024/25, up from fewer than 28,000 the year before. HMRC already holds substantial data obtained through information powers and shared by overseas counterparts. CARF widens that flow, it does not create it.

Where Clients Genuinely Go Wrong

Most crypto non-compliance in a typical practice is not evasion. It is misunderstanding. The recurring problems are worth putting in front of clients in plain language:

• Crypto to crypto swaps are disposals. Clients who never converted anything back to sterling often believe nothing is taxable. They are wrong, and the number of disposals in an active year can run into the hundreds.
• Spending crypto is a disposal. Using tokens to buy goods or services triggers a capital gains computation.
• Staking, lending, mining and airdrops can produce taxable income, not gains, with different rules and different reporting boxes.
• Employment rewards paid in tokens are earnings and belong in the payroll conversation, not the capital gains one.
• Losses are not automatic. Many clients hold significant realised losses but have never claimed them, and a claim must be notified within four years of the end of the tax year in which the loss arose. Lost keys or worthless tokens may need a negligible value claim.
• Records vanish. Exchanges close, apps are deleted and export histories disappear. A client who cannot evidence their acquisition costs will end up taxed on proceeds rather than gains.

The Autumn Window You Should Be Using

The 2025/26 return is due by the 31st of January 2027, and that is also the last date to amend a 2024/25 return. Both facts make this autumn the moment to act, because an unprompted disclosure attracts materially better treatment than a prompted one. Penalties can reach 100 per cent of the additional tax, or more where offshore matters are involved, and late payment interest currently runs at base rate plus four per cent.

A workable plan for a busy practice:

• Segment your client list. Flag anyone who has ever disclosed a crypto holding, received an exchange verification request, or works in a sector where token pay is common.
• Add a direct crypto question to your tax return questionnaire. Not a general catch all, but a specific question covering holdings, disposals, swaps, staking rewards and wallets held outside exchanges.
• Ask for exports now. Full transaction histories from every platform, requested in September, are far easier to obtain than the same request made in the third week of January.
• Decide your position on scope and fees. Reconstructing pooled costs across hundreds of transactions is specialist work. It should sit in your engagement letter and in your pricing, not in a fixed fee agreed before anyone mentioned crypto.
• Build a nudge letter protocol. Agree in advance who reviews incoming One To Many letters, what your standard client email says, and when a disclosure specialist is brought in. Ignoring a letter is the one response that reliably makes things worse.
• Do not forget estates. HMRC has written to agents acting for executors asking them to check whether the deceased held cryptoassets omitted from Inheritance Tax accounts, with corrective accounts to follow where they did.

One Useful Clarification for Clients

Expect to be asked whether crypto activity pulls someone into Making Tax Digital. In most cases it does not. Qualifying income for MTD for Income Tax is measured on gross income from self employment and property, so investment gains on tokens sit outside the quarterly update cycle and are dealt with through the annual return. The exception is the unusual client whose activity genuinely amounts to a trade. Saying this clearly, and early, saves a good deal of confused correspondence.

The Practice Opportunity Hiding in the Risk

There is a commercial reading of all this. Crypto clients are, almost by definition, clients who have never had a proper conversation about record keeping, loss planning, disposal timing or the interaction with pensions and other allowances. A firm that raises the subject before HMRC does is not delivering bad news, it is demonstrating exactly the kind of proactive value that justifies an advisory fee and keeps a client from drifting to a competitor.

The first CARF report will not land until 2027. The clients affected by it are sitting in your practice management system today. Everything useful your firm can do happens in the months before that data arrives, not after.