CARF Is Live: What UK Crypto Investors Need to Know About HMRC's New Reporting Regime

On 1 January 2026, the UK activated the Crypto-Asset Reporting Framework (CARF) — an OECD-designed regime that forces crypto exchanges to report your full transaction history directly to HMRC. Not summaries. Not estimates. Every purchase, every sale, every swap, with your name, address, date of birth, and National Insurance number attached.

This is the single biggest change in UK crypto tax enforcement. Period.

Around 50 UK crypto service providers are now collecting and transmitting this data. The first reports land on HMRC's desk by 31 May 2027, covering the 2026 calendar year. But if you think this only affects future activity, you're wrong — HMRC has been gathering exchange data under existing Finance Act powers for years. CARF just standardises what was already happening and automates it at scale.

What exchanges are reporting

CARF isn't vague. The regulations specify exactly what crypto service providers must collect and transmit to HMRC for every UK-resident user:

• Full legal name, residential address, and date of birth
• Tax residency and National Insurance number (or UTR)
• Complete transaction records — every buy, sell, swap, and transfer
• Purchase prices and sale prices for each transaction
• Aggregated annual summaries per crypto asset

This data feeds into HMRC's Connect system — the same algorithmic platform that already cross-references bank data, property records, and employer submissions against self-assessment returns. Once CARF data enters Connect, discrepancies between what you declared and what your exchange reported will be flagged automatically.

No human needs to review your file. The system does it.

This isn't a future problem

The temptation is to think of CARF as something that starts mattering in 2027. That misses what's already happened.

HMRC has sent over 100,000 CGT nudge letters to crypto investors since 2020 — and they did that with incomplete, manually-gathered data. The acceleration is stark: 8,329 letters in 2021/22, rising to 64,982 in 2024/25 alone. That's a 680% increase in three years, and it happened before CARF went live.

Crypto investors have received 40 times more CGT warning letters than stock traders over the same period. HMRC isn't treating crypto as a niche concern. It's a priority enforcement area with dedicated resources.

For the full breakdown of what those letters mean and how to respond, see our guide to HMRC's 100,000 warning letters.

The DeFi gap

CARF covers centralised exchanges — Coinbase, Kraken, Binance, Gemini, and dozens more. If you bought ETH on an exchange and sold it on the same exchange, HMRC will have both sides of the transaction with your identity attached. Your return needs to match.

But CARF has a blind spot.

DeFi protocols — Uniswap, Aave, Curve, Lido, 1inch — have no reporting entity. There's no company filing data with HMRC when you swap tokens on Uniswap or deposit into an Aave lending pool. These are smart contracts, not businesses. CARF doesn't reach them.

That doesn't mean DeFi activity is invisible. It means the detection path is different.

HMRC can see tokens leaving your exchange account to a wallet address. They know you withdrew 10 ETH to 0x7a3... on 15 March 2025. What happened next — whether you swapped it, staked it, provided liquidity, or bridged it to Arbitrum — is recorded permanently on a public blockchain. HMRC contracts with blockchain analytics firms like Chainalysis to trace exactly these flows.

The practical reality: exchange activity will be cross-referenced automatically. DeFi activity requires more forensic work on HMRC's side, but the on-chain trail is permanent and they have the tools to follow it. The question isn't whether they can see your DeFi trades. It's when they look.

Why DeFi classification matters more than ever

The irony of CARF is that it makes the easy part easier and doesn't touch the hard part.

Exchange trades are straightforward: you sold 2 ETH for £4,800. Done. But DeFi transactions carry intent that raw blockchain data doesn't make obvious. A Uniswap V3 LP position involves multiple token transfers, NFT minting, and fee accumulation — all in a single transaction. A bridge from Ethereum to Arbitrum looks like a token burn on one chain and a mint on another. Aave deposits transfer tokens to a lending pool and return aTokens.

HMRC doesn't distinguish between these. A token leaving your wallet is a potential disposal. A token arriving is a potential acquisition. Without correct classification, every bridge becomes a phantom taxable event, every LP deposit gets double-counted, and every wrapping operation (ETH to WETH) generates a gain that doesn't exist.

Generic tax tools that rely on exchange CSVs weren't built for this. They misclassify DeFi transactions because they don't understand protocol-level intent — they just see token transfers.

The cost of getting it wrong

HMRC's penalty regime for crypto is the same as for any other asset, and it compounds fast:

• Careless errors: 0–30% of unpaid tax
• Deliberate understatement: 20–70% of unpaid tax
• Deliberate and concealed: 30–100% of unpaid tax

Add daily interest on outstanding balances, plus late payment surcharges at 30 days, 6 months, and 12 months. The investigation lookback window extends to 6 years for careless errors and 20 years for deliberate non-disclosure.

There is one meaningful escape valve: voluntary disclosure. If you come forward and correct your return before HMRC contacts you, penalties drop significantly — often to 0–15% for careless errors. Once HMRC writes to you first, that discount disappears. With CARF data landing in May 2027, the window for voluntary correction is closing.

If you receive a nudge letter

You have 60 days to respond. The letter isn't a formal enquiry — HMRC frames it as "encouraging voluntary compliance" — but ignoring it escalates the matter. You need to review your trading history, recalculate your gains using HMRC's matching rules (same-day, 30-day bed and breakfast, then Section 104 pool), and either confirm your return is correct or amend it.

The 64,982 letters sent in 2024/25 were based on pre-CARF data. The next wave will be based on comprehensive, identity-linked transaction records reported directly by exchanges. The bar for "I didn't know" is about to get much higher.

What to do now

Whether you've received a letter or not, the calculation is simple: HMRC will have your exchange data. Your self-assessment return needs to match it. And if you have DeFi activity, you need every transaction correctly classified — not just the exchange trades.

Start with your exchange history — that's what HMRC will check first. Then account for every on-chain transaction: swaps, LP positions, staking, bridges, wraps. Each one needs to be correctly classified as a disposal, an acquisition, income, or a non-taxable transfer. The gains need to be calculated under Section 104 pooling, not a simple buy/sell spreadsheet.

If you want to see where you stand, try our free transaction explainer — paste any transaction hash and see exactly how it would be classified for UK tax purposes.