UK Crypto Businesses: CARF Report by 31 May 2027

Updated 17 October 2026

General information only, not tax advice. We are not HMRC and are not affiliated with it. Check GOV.UK and your platform. Last checked against GOV.UK: 17 October 2026. Anything marked expected should be re-checked. Examples use made-up figures. Do not enter personal identifiers (National Insurance number, UTR, name, date of birth) on this site. This page contains no affiliate links.

Short answer: GOV.UK's guidance for providers says that if you provide cryptoasset services in the UK you must collect data and report it to HMRC under the Cryptoasset Reporting Framework (CARF). You collect details of all users but only report users who are tax resident in the UK or another CARF country. The first report covers 1 January 2026 to 31 December 2026 and is due between 1 January 2027 and 31 May 2027; later reports are due by 31 May for the previous calendar year. This page is for people who run or work in a crypto business, not for ordinary users; users should read the user guide.

What the GOV.UK guidance says (read 17 October 2026)

• If you have no information to report in a year, you do not need to submit a report.
• Reports are submitted on an HMRC online service; when we checked, the guidance said it was not live yet and would be updated when it is. Reports are XML files up to 250MB.
• GOV.UK's summary says you may be charged "up to £300 per user". The Regulations set the amounts failure by failure: a late report is up to £5,000 plus up to £600 a day, an inaccurate or incomplete report up to £100 per affected user, and failing to obtain a valid self-certificate up to £300 per user (see the penalties page).
• Detailed rules are in HMRC's International Exchange of Information manual and the OECD rules and commentary.

What the Regulations say (SI 2025/744, made version, read 17 October 2026)

• Due diligence procedures and records kept for five years beginning with the day after the end of the calendar year to which they relate (regulation 4(3)).
• Users and controlling persons must give a self-certification when requested.
• A report to HMRC is due on or before 31 May following each calendar year.
• Providers must notify each reportable user or reportable person that the information is to be reported to HMRC and may be sent to another jurisdiction, on or before 31 January following the first calendar year for which they must report on that person (regulation 8), so by 31 January 2027 for 2026 data.
• Registration (regulation 10): a UK reporting cryptoasset service provider must register with HMRC on or before the later of 31 May 2027 and 31 January following the first calendar year in which it falls within the definition. A non-UK provider that relies on the notification route in regulation 3(2) must notify HMRC by 31 May 2027 for 2026, and by 31 January following the year for 2027 onwards.

Made-up example

A small UK exchange collects self-certifications from all users from 1 January 2026. For 2026, it reports only its users resident in the UK or a CARF partner country, by 31 May 2027, once HMRC's online service is open.

Related

Key dates · What HMRC receives · Entities and controlling persons

FAQ

Do I report every user? Collect from all, report only UK or CARF-resident users, per the guidance.

Is the reporting service open? Not when we checked; verify on GOV.UK.

What we could not verify