CARF 2026: What UK Crypto Investors Need to Know

On 1 January 2026, the UK activated the Crypto-Asset Reporting Framework (CARF), an OECD-designed regime requiring in-scope cryptoasset service providers to report prescribed customer identity and annual transaction information to HMRC. Reports include aggregate amounts and units by cryptoasset and transaction type; they are not necessarily a line-by-line export of every account entry.

This is the single biggest change in UK crypto tax enforcement. Period.

In-scope UK crypto service providers are now collecting the information required by the regime. The first reports are due to HMRC by 31 May 2027, covering the 2026 calendar year. But if you think this only affects future activity, you're wrong. HMRC has been gathering exchange data under existing Finance Act powers for years. CARF just standardises what was already happening and automates it at scale.

HMRC's current delivery plan is to exchange information with participating jurisdictions by 30 September 2027. That is separate from the May deadline for providers to submit the first UK reports.

What exchanges are reporting

The regulations prescribe identity and transaction categories that providers must collect and report for reportable users:

• Full legal name, residential address, and date of birth
• Tax residency and National Insurance number (or UTR)
• Annual aggregate gross amounts, fair market values, and units by cryptoasset and transaction type
• Counts of relevant transactions and prescribed transfer information

This data feeds into HMRC's Connect system, the same algorithmic platform that already cross-references bank data, property records, and employer submissions against self-assessment returns. HMRC may compare CARF information with returns and other records when assessing compliance.

No human needs to review your file. The system does it.

This isn't a future problem

The temptation is to think of CARF as something that starts mattering in 2027. That misses what's already happened.

HMRC has sent over 100,000 CGT nudge letters to crypto investors since 2020, and they did that with incomplete, manually-gathered data. The acceleration is stark: 8,329 letters in 2021/22, rising to 64,982 in 2024/25 alone. That's a 680% increase in three years, and it happened before CARF went live.

Crypto investors have received 40 times more CGT warning letters than stock traders over the same period. HMRC isn't treating crypto as a niche concern. It's a priority enforcement area with dedicated resources.

For the full breakdown of what those letters mean and how to respond, see our guide to HMRC's 100,000 warning letters.

The DeFi gap

CARF can cover centralised exchanges and other businesses that effect reportable cryptoasset transactions. If your provider is in scope, HMRC may receive annual acquisition and disposal information linked to your identity.

But CARF has a blind spot.

Purely unmediated smart-contract activity may have no reporting service provider. That does not mean every product described as DeFi is outside CARF: a business with sufficient control or influence over a service may still be in scope.

That doesn't mean DeFi activity is invisible. It means the detection path is different.

HMRC can see tokens leaving your exchange account to a wallet address. They know you withdrew 10 ETH to 0x7a3... on 15 March 2025. What happened next, whether you swapped it, staked it, provided liquidity, or bridged it to Arbitrum, is recorded permanently on a public blockchain. HMRC contracts with blockchain analytics firms like Chainalysis to trace exactly these flows.

The practical reality: exchange activity will be cross-referenced automatically. DeFi activity requires more forensic work on HMRC's side, but the on-chain trail is permanent and they have the tools to follow it. The question isn't whether they can see your DeFi trades. It's when they look.

Why DeFi classification matters more than ever

The irony of CARF is that it makes the easy part easier and doesn't touch the hard part.

Exchange trades are straightforward: you sold 2 ETH for £4,800. Done. But DeFi transactions carry intent that raw blockchain data doesn't make obvious. A Uniswap V3 LP position involves multiple token transfers, NFT minting, and fee accumulation, all in a single transaction. A bridge from Ethereum to Arbitrum looks like a token burn on one chain and a mint on another. Aave deposits transfer tokens to a lending pool and return aTokens.

HMRC doesn't distinguish between these. A token leaving your wallet is a potential disposal. A token arriving is a potential acquisition. Without correct classification, every bridge becomes a phantom taxable event, every LP deposit gets double-counted, and every wrapping operation (ETH to WETH) generates a gain that doesn't exist.

An exchange-CSV-only workflow cannot see the intent of on-chain DeFi. A flow-only classifier can misclassify those transactions because it does not understand protocol-level intent. They just see token transfers.

The cost of getting it wrong

HMRC's penalty regime for crypto is the same as for any other asset, and it compounds fast:

• Careless errors: 0–30% of unpaid tax
• Deliberate understatement: 20–70% of unpaid tax
• Deliberate and concealed: 30–100% of unpaid tax

Add daily interest on outstanding balances, plus late payment surcharges at 30 days, 6 months, and 12 months. The investigation lookback window extends to 4 years for innocent errors, 6 years for careless errors, and 20 years for deliberate non-disclosure.

There is one meaningful escape valve: voluntary disclosure. If you come forward and correct your return before HMRC contacts you, penalties drop significantly, often to 0–15% for careless errors. Once HMRC writes to you first, that discount disappears. With CARF data landing in May 2027, the window for voluntary correction is closing.

If you receive a nudge letter

Use the response deadline printed on your letter. The letter may not be a formal enquiry, but ignoring it can lead to further compliance action. Review the relevant trading history, recalculate your gains using HMRC's matching rules (same-day, 30-day bed and breakfast, then Section 104 pool), and either confirm your return is correct or amend it. We've mapped the three response paths (self-serve, Concierge, accountant) on our HMRC letter response guide page.

The 64,982 letters sent in 2024/25 were based on pre-CARF data. The next wave may draw on identity-linked annual transaction information reported by service providers. The bar for "I didn't know" is about to get much higher.

What to do now

Whether you've received a letter or not, the calculation is simple: HMRC will have your exchange data. Your self-assessment return needs to match it. And if you have DeFi activity, you need every transaction correctly classified, not just the exchange trades.

Start with your exchange history, because that's what HMRC will check first. Then account for every on-chain transaction: swaps, LP positions, staking, bridges, wraps. Each one needs to be correctly classified as a disposal, an acquisition, income, or a non-taxable transfer. The gains need to be calculated under Section 104 pooling, not a simple buy/sell spreadsheet.

If you want a structured walkthrough of what to reconcile before May 2027, the CARF 2027 readiness page sets out the three paths (self-serve, Concierge, accountant) and the four practical steps. Or, if you want to see how a single transaction would be classified for UK tax purposes, paste any hash into our free transaction explainer.