HMRC Publishes Reporting Guidance For Cryptoasset Services Users and Providers

On 14 May 2025, HMRC published guidance on reporting obligations for providers and users of cryptoasset services, in light of the introduction to the U.K. of the Organisation for Economic Development’s Cryptoasset Reporting Framework (CARF) from 1 January 2026.

Background

In November 2023, the U.K. committed to introducing CARF as part of a joint effort by several countries to ensure that  recent gains in global tax transparency will not be gradually eroded by the rapid development and growth of the cryptoasset market (which is noted for its privacy and often presents difficulties for authorities looking to trace transactions). Since then, HMRC proceeded to introduce a voluntary disclosure facility specifically for cryptoassets and the self-assessment tax return was amended in order to push taxpayers to identify amounts arising from cryptoassets.

Enter CARF

CARF is intended to address issues of tax non-compliance by imposing a requirement on UK-based reporting cryptoasset services providers (RCASPs) to collect information about users and their transactions such as identification details, the type of cryptoasset, the type of transaction, number of units and value. 

A business will be an RCASP if it transacts cryptoassets on behalf of users or provides a means for users to transact cryptoassets. RCASPs will include crypto exchanges (e.g. Kraken, Coinbase etc.), crypto brokers and crypto dealers.

Businesses will only need to report to HMRC if they are UK-based. It should be noted though that CARF is an OECD policy due to be implemented in many countries – with information being shared between countries – so UK users of non-UK-based exchanges will still find their data being passed to HMRC. 

CARF has already been implemented in Germany, Brazil and Canada. France, Italy, Japan, Spain, Switzerland, United States of America, Cayman, Guernsey, Jersey and Gibraltar (to name but a few countries) have all pledged to implement CARF, 

Importantly, for a cryptoasset to fall within CARF, it must be used for payment or investment purposes. RCASPs will need to cover both UK and non-UK resident investors in their reporting to HMRC.

RCASPs will also need to verify that the information they collect is accurate by carrying out due diligence – guidance on how to do this will be published by HMRC in due course. There will be penalties of up to £300 per user for inaccurate, incomplete or unverified reports.

Reporting to HMRC for the year 2026 is due by 31 May 2027; by 31 January 2027, RCASPs will have to register with an online service (due to be introduced) and inform users that they are reporting their details.

Implications

CARF will add to the regulatory burden faced by businesses at a time when the U.K. tries to balance the need to attract the crypto industry with the need for robust regulation. At the very least, data provided under CARF is expected to generate revenue for the U.K. government by revealing missing tax. This should also streamline existing processes, for example the use by HMRC of financial institution notices to collect data from crypto exchanges. 

For exchanges specifically, it is critical to note that HMRC could also look to use its enforcement powers to pursue corporates under the “failure to prevent” offences available to HMRC in respect of tax evasion. Broadly, if an “associated” person (which includes employees, agents, and third parties that perform services for/on behalf of the company) facilitates tax evasion by a third party, then the exchange could be liable (irrespective of whether it is UK-tax resident or not).

Therefore, all RCASPs should (to the extent they have not already) prepare for CARF both in terms of collecting the information needed but also in terms of putting in place procedures that will prevent and detect tax evasion by users.

Brown Rudnick’s digital commerce and tax controversy teams are well placed to assist cryptoasset providers and users affected by CARF.