CARF Penalties: Users £300, Providers £100 to £5,000+

Updated 17 October 2026

General information only, not tax advice. We are not HMRC and are not affiliated with it. Check GOV.UK and your platform. Last checked against GOV.UK: 17 October 2026. Anything marked expected should be re-checked. Examples use made-up figures. Do not enter personal identifiers (National Insurance number, UTR, name, date of birth) on this site. This page contains no affiliate links.

Short answer: GOV.UK says that if you give inaccurate details, or no details, to a UK cryptoasset service provider you could get a penalty of up to £300, and that for non-UK providers the penalty could be higher. HMRC's internal manual (IEIM8000620) and the Regulations (SI 2025/744, regulation 13) limit a user's penalty to £300, and only where failing to provide a valid self-certificate is deliberate or due to a failure to take reasonable care. Providers (RCASPs) have separate penalties of different amounts.

GOV.UK's reporting page gives a headline of "up to £300 per user" for providers. The Regulations break this down: £300 per user applies to failing to obtain a valid self-certificate, £100 per user to failing to apply due diligence, to an inaccurate report or to failing to notify users, and a late report is a flat £5,000 plus up to £600 a day. We read the headline as the highest per-user cap, not a £300 charge for every failure. HMRC does not publish a reconciliation note, so this is our reading.

Penalties on you as a user

Situation Maximum (IEIM8000620)
Failure to provide a valid self-certificate, deliberately or without reasonable care £300

The GOV.UK page for users does not mention a daily amount. The £300 figure is a ceiling, not a fixed charge.

Penalties on providers (for context)

Failure Maximum
No due diligence procedures £100 per reportable user or person
No valid self-certificate collected £300 per reportable user or person
Record-keeping failure £5,000 per calendar year
Late report Up to £5,000, and if the failure continues after the penalty has been assessed, up to £600 for each later day
Inaccurate or incomplete report Up to £100 for each affected reportable user, where the error is deliberate, due to a failure to take reasonable care, or discovered later and not reported to HMRC within reasonable steps
Failure to notify users that data is reported Up to £100 per reportable person, then up to £100 a day if the failure continues after the penalty is assessed
Failure to provide information after an HMRC notice £5,000, then up to £600 a day
Failure to register £1,000, then up to £300 a day

The Regulations put the provider penalties on the provider (regulations 11 to 18). A user's own penalty is the separate £300 maximum in regulation 13. Where the user is a partnership or trust, the penalty falls on a partner or trustee (regulation 19).

Reasonable excuse. A penalty does not arise if there is a reasonable excuse. Not having enough money, or relying on someone else to do it, is not a reasonable excuse (regulation 20).

What to do

Give accurate details when asked (what exchanges ask; common mistakes). If you made an error, correct it with the provider.

Made-up example

A user ticks the wrong country of tax residence by mistake and corrects it when the exchange asks again. GOV.UK links a penalty to inaccurate details; the manual ties it to deliberate or careless failure. Correcting the mistake promptly may be relevant to whether it was careless, but HMRC decides.

Related

Key dates · Overseas exchanges · CARF guide

FAQ

Is £300 charged automatically? The sources describe a maximum for deliberate or careless failure, not an automatic charge.

Can a penalty be appealed? Yes: in writing to HMRC within 30 days of the notice of assessment, on the grounds that the penalty does not arise or that the amount is wrong (IEIM8000680).

Is unpaid tax a separate matter? Yes: GOV.UK says unpaid tax can bring a penalty of up to 100% of the tax due plus interest, which is distinct from CARF penalties.

Does CARF create a new tax? No; it is a reporting framework, and tax on gains is separate.

What we could not verify

Uncertain. These points were not confirmed on the pages read. A re-check of the GOV.UK pages is planned for 1 December 2026.

  • The amount of the 'higher' penalty for non-UK providers (GOV.UK says it 'could be higher'; no figure given).
  • How HMRC decides 'reasonable care' for a self-certification.
  • Regulations 21 to 25 (cumulation, assessment, time limits, appeal detail) were not read line by line; the regulations were read in their 'made' version.

Sources (official)