UK crypto firms must report user data or face fines under new HMRC rules

Digital assets service providers in the UK may need to start reporting user data to His Majesty’s Revenue and Customs (HMRC) by 2027. The regulator disclosed this in a recent announcement, stating that it is due to a new regulatory framework.

According to the HMRC , which is responsible for tax collection, the country is adopting the Organisation for Economic Development (OECD) Crypto Asset Reporting Framework (CARF) and will extend it to domestic reporting.

Under the new framework, the regulator expects all companies categorized as reporting crypto asset service providers (RCASPs) based in the UK to collect and report user data. Thus, data collection is expected to start by January 1, 2026, while the first report will be in May 2027.

The statement said:

“If you’re a UK-based RCASP, you need to start collecting information about your users and their transactions from January 1, 2026. You may want to start collecting information earlier to prepare for the new rules.”

Crypto entities considered to be RCASPs include exchanges, dealers, and brokers. For the based-in-UK criteria, the company either needs to be incorporated in the UK, pay taxes in the country, manage its business there, or have a place of business in the country. Any of these four conditions will be sufficient.

However, crypto entities operating in multiple countries where CARF applies only need to report in one country where they are tax resident. When they are tax residents in multiple countries, they can report to any of the countries.

Crypto entities to submit KYC information and transaction data to authorities

Meanwhile, the framework means crypto service providers have to collect the personal data of their users. Most centralized exchanges already collect this data, which includes name, date of birth, address, and country of residence.

Additionally, crypto firms must get national insurance or unique taxpayer references for UK residents and tax identification numbers for non-UK residents. Companies may also be required to give information about a controlling person.

Additionally, crypto entities also need to collect data about transactions, including their value, the crypto asset, and the type of transaction.  With all this information, the regulator can connect each taxpayer to an account.

Entities are expected to conduct due diligence on the information they obtain and could face up to £300 in penalties per user when they submit inaccurate, unverified, or incomplete data.  Failure to report or late reporting could also attract similar sanctions.

Interestingly, Crypto UK, the country’s leading trade association for crypto assets, has praised the move. In a post, it stated that HMRC developed the guidance based on industry input, and it is a step towards a regulated ecosystem.

Surveillance of crypto transactions is increasing globally

Meanwhile, the new framework is not peculiar to the UK. In fact, more than 60 countries, including the US, Australia, Canada, South Africa, and many of the major European countries, have all committed to implementing the CARF domestically. The framework is expected to enable international cooperation between countries on crypto transactions.

While a key reason for the reporting is to tackle the use of crypto for illicit purposes and allow proper taxation of crypto assets, it also highlights increasing surveillance of crypto activity globally.

The EU recently announced plans to introduce new anti-money laundering measures prohibiting crypto entities from dealing with anonymous wallets and privacy coins.  The new rules require verification for transactions over €1,000.

While privacy coins have long faced scrutiny, the proposal to ban anonymous crypto accounts has been questioned, given that all crypto addresses are anonymous by default.  However, many believe the rules will only apply to centralized exchanges and that non-custodial wallets will not be impacted.

Still, the increase in crypto transaction surveillance remains a concern for privacy experts and crypto stakeholders who believe it could hinder innovation.

Cryptopolitan Academy: Want to grow your money in 2025? Learn how to do it with DeFi in our upcoming webclass. Save Your Spot