Can HMRC See Your Crypto? What CARF Means in 2026

It is the question every UK crypto investor eventually types into Google at 11pm: can HMRC actually see my crypto? The honest answer in 2026 is more nuanced than the panic headlines, and more important to understand than ever.

The short version: in-scope providers are collecting reportable data now, with first reports due in 2027. Under the new Crypto-Asset Reporting Framework (CARF), reporting providers began recording the required information from 1 January 2026. HMRC does not receive the first standardised reports until 31 May 2027. The exact operational cross-matching process is still developing, and CARF is not the only route through which HMRC can obtain exchange-side information.

This article answers the “can they see it” question straight, lays out the honest CARF timeline without the scaremongering, and shows you the one thing that genuinely protects you: a return that already matches what your exchange will report. For the full mechanics of CARF itself, we'll point you to the deep-dive rather than repeat it.

The honest answer: yes, increasingly, but not all at once

There are three separate ways HMRC sees crypto activity, and conflating them is what produces both false comfort and needless panic.

• Existing powers (already in force). HMRC has requested customer data directly from UK-serving exchanges for years under Finance Act information powers. This is how the wave of nudge letters happened before CARF existed.
• CARF (collecting now, matching from 2027). CARF automates and standardises that data flow at scale. Collection went live 1 January 2026; HMRC's first report arrives by 31 May 2027 covering the 2026 calendar year, with reconciliation against returns from 2027.
• Blockchain analytics (always on). Every on-chain transaction is public and permanent. HMRC contracts firms such as Chainalysis to trace flows and link wallet addresses to identified exchange accounts.

Put together: HMRC's visibility is real today and becomes comprehensive and automatic from 2027. The thing to internalise is not a single switch-on date but the direction of travel: the gap between what you declare and what HMRC can verify is closing fast.

The CARF timeline, without the scaremongering

A lot of crypto-tax content gets this wrong by implying HMRC already has your latest year matched and ready. It does not. Here is the accurate sequence:

So this season (filing your 2025/26 return), HMRC is not running an automated CARF cross-check against your exchange records yet. But the data underpinning that future check is being captured right now. The smart move is to file 2025/26 as if HMRC can already see everything, because by the time anyone looks closely, it will. For the full breakdown of what exchanges report and how Connect uses it, see our complete CARF 2026 explainer.

One thing CARF does not do: fine you directly

A common misreading of CARF is that it introduces new per-user fines for investors. It does not. The CARF penalties you may have seen quoted (figures like £300 per user) are aimed at the reporting exchanges for failing their own obligations: not collecting valid tax details, missing the filing deadline, or submitting incomplete data. Those are provider obligations, not your liability.

Your exposure as an individual is the ordinary one. If your return understates your gains, you face the standard Self Assessment penalty regime (careless or deliberate error penalties plus interest) whether or not CARF exists. What CARF changes is the detectability: a mismatch between your SA108 and your exchange's report becomes trivially easy for HMRC to flag. The defence has always been the same and still is: file a correct return.

Can HMRC see my DeFi and self-custody wallets?

This is the follow-up question, and it has a genuine nuance. CARF only reaches centralised exchanges and custodial services. DeFi protocols (Uniswap, Aave, Curve, Lido, 1inch) have no company filing data with HMRC, so they are not CARF reporting entities.

That is not the same as invisible. HMRC sees tokens leaving your exchange account to a wallet address: that withdrawal is reported. Everything you do next is recorded permanently on a public blockchain, and analytics firms can link a wallet back to the identified exchange account that funded it. The detection path is slower and more forensic, but the on-chain trail is permanent.

The practical implication runs the other way from what most people assume. The DeFi gap is not a reason to skip those transactions on your return; it is a reason to get them exactly right. If your return shows tokens leaving an exchange and then nothing, the gap between HMRC's withdrawal record and your declaration is precisely the kind of discrepancy an enquiry feeds on. And DeFi is where the classification gets hard: a bridge from Ethereum to Arbitrum is not a disposal, wrapping ETH to WETH is not a disposal, but a Uniswap swap is. Get the classification wrong and you either invent phantom gains or miss real ones; both look like errors to HMRC.

What “your return must match” actually means

The whole CARF era boils down to one principle: the numbers your exchange reports and the numbers on your Self Assessment have to tell the same story. Here is a deliberately simple example of where they diverge if you're not careful:

Real portfolios are messier than this: multiple exchanges, the Section 104 pool pooling the same token across every platform, same-day and 30-day matching, gas as an allowable cost, and staking rewards that go on SA100 as income rather than SA108 as a gain. But the core idea holds: reconcile every source so there is no unexplained gap.

When do I actually have to report?

Visibility and obligation are different things. Even with the £3,000 annual exempt amount (frozen across 2024/25, 2025/26 and 2026/27), these are the two capital-gains tests to check:

• If you are already registered for Self Assessment, you must include your disposals when total gross disposal proceeds exceed £50,000, even if your taxable gain is nil.
• If your chargeable gains exceed the £3,000 annual exempt amount, you must report the gain and pay any CGT due.

The £50,000 proceeds rule catches active traders who already file Self Assessment: you can be well inside your £3,000 allowance on net gain and still have to include the disposals because the gross value sold crossed the line. If you are not registered, that proceeds figure alone does not require a tax return. DeFi income (staking, lending and liquidity rewards) is separate again, taxed as miscellaneous income at 20%, 40% or 45% on its value at receipt. The full decision tree is in our do I need to report crypto to HMRC checklist.

What to do now, while it's still on your terms

The window where correcting your return is a voluntary act rather than a reply to HMRC is the window worth using. Coming forward before HMRC writes to you keeps any penalty at the lower end; once a letter lands, that goodwill discount shrinks.

HMRC has already sent over 100,000 crypto nudge letters, and that was on pre-CARF, manually-gathered data. The next wave will draw on comprehensive, identity-linked records. If you receive a nudge letter, use the response deadline printed on it. We've mapped the possible response paths on our HMRC letter response guide page.

Don't let the deadlines themselves become the problem either. A late return is an automatic £100 penalty, then £10 a day after three months (up to £900), with 5% surcharges at 30 days, 6 months and 12 months and interest at HMRC's prevailing rate. The online deadline for 2025/26 is 31 January 2027 (31 October 2026 on paper). If you owe enough, you may also fall into payments on account.

Practically: pull together every exchange and wallet, classify each transaction correctly (disposal, acquisition, income or non-taxable transfer) and calculate the gains under HMRC's matching rules, not a buy/sell spreadsheet. A CSV-only history can miss DeFi intent; a tool that reads on-chain transactions directly is what closes the gap CARF is about to expose. The complete UK crypto tax guide and our step-by-step filing walkthrough cover the end-to-end process.