Cryptoassets & HMRC Investigations: 2025–26 Practitioner Guide

HMRC’s enforcement programme targeting undeclared cryptoasset gains and income is accelerating. The Cryptoasset Reporting Framework (CARF) brings systematic international data exchange from 2026. HMRC already holds exchange data obtained directly from UK platforms and is deploying blockchain analytics. This guide equips advisers to advise clients on tax treatment, disclosure options and the management of HMRC investigations into cryptoasset portfolios.

How HMRC Gathers Cryptoasset Data

HMRC’s ability to identify undeclared cryptoasset gains has grown substantially since 2019. Advisers should not assume that clients’ cryptoasset activity is hidden simply because the assets are held in digital form. HMRC employs multiple data-gathering mechanisms.

Direct Information Requirements from UK Exchanges

Since 2019, HMRC has issued formal information notices under s18A Taxes Management Act 1970 to UK-based cryptoasset exchanges (including Coinbase, Binance UK, Kraken and others) requiring disclosure of customer identity and transaction data. These notices have produced extensive datasets of UK residents’ holdings, disposal proceeds and fiat withdrawals. If your client used a UK-regulated exchange at any point, HMRC likely has data about them.

Blockchain Analytics

HMRC has procured blockchain analytics tools from specialist providers (including, in prior years, Chainalysis) that permit analysis of on-chain transactions across public blockchains. These tools can trace transfers between addresses, identify exchange deposits and link pseudonymous blockchain addresses to real-world identities where a client has, at any point, deposited to or withdrawn from a known entity (exchange, custodian or identified wallet). The fact that a client used a hardware wallet or a non-custodial wallet does not necessarily protect them from identification if those wallets interacted with identifiable entities.

Overseas Exchange Data via CRS and CARF

The Common Reporting Standard (CRS) obliges financial institutions in over 100 jurisdictions to report account holder data to HMRC for UK residents. Traditional financial assets held overseas have been reportable since 2017. Cryptoassets held on centralised exchanges are increasingly being treated as within scope of existing CRS obligations where the exchange is classified as a “financial institution” under local law, and CARF (see below) will formalise comprehensive crypto-specific reporting from 2026.

The Cryptoasset Reporting Framework (CARF) from 2026

The Cryptoasset Reporting Framework is an OECD-led data exchange standard, modelled on the CRS, that will require Crypto Asset Service Providers (CASPs) to collect and report user identity data and transaction information to their domestic tax authority, which will then exchange it with the tax authorities of each user’s tax residence.

What CARF Covers

CARF applies to centralised exchanges, brokers and other platforms that provide services to transfer, exchange or custody cryptoassets on behalf of clients. The reportable data includes:

• Customer identifying information (name, address, date of birth, tax identification number);
• Gross proceeds from disposals (fiat and crypto-to-crypto);
• Volume of cryptoassets transferred;
• Transfers to non-participating blockchain addresses (flagging potential evasion).

Implementation Timeline

The UK committed to implementing CARF from reporting year 2026, with first exchange of data in 2027. Legislation will be introduced to give effect to CARF obligations. Exchanges registered or operating in participating jurisdictions (which include all major OECD economies) will be required to collect CARF data from 1 January 2026 and report it to their local authority by 31 May 2027.

The practical consequence is that any client who holds cryptoassets on a centralised exchange in a CARF-participating jurisdiction at any point from 1 January 2026 onwards will, by mid-2027, have their transaction history reported to HMRC. Where they have undeclared gains from prior years, HMRC will have a complete data picture of disposals and proceeds, enabling reconstruction of the CGT liability even where the client has not maintained records.

Tax Treatment of Cryptoassets: The Framework

HMRC’s published policy on the taxation of cryptoassets is set out in its Cryptoassets Manual (CRYPTO). The fundamental position is that cryptoassets are not currency for UK tax purposes and are treated as a form of property. The tax consequences depend on the nature of the activity and the capacity in which the individual holds or deals in cryptoassets.

The Capital vs Income Question

The majority of individuals who hold cryptoassets will hold them as investments, such that gains on disposal attract CGT. Where an individual’s activity is so frequent, organised and commercially motivated as to constitute a trading activity, profits may instead be subject to income tax. HMRC’s view is that genuinely “trading” in cryptoassets is relatively rare for individuals and most retail investors will be within the CGT regime. However, HMRC has brought income tax assessments against active traders and the boundary is fact-specific.

CGT on Disposal of Cryptoassets

A disposal of a cryptoasset for CGT purposes includes any of the following events:

• Sale of cryptoassets for fiat currency (Sterling or foreign currency);
• Exchange of one cryptoasset for another (a crypto-to-crypto exchange is a disposal of the first asset and an acquisition of the second at market value);
• Using cryptoassets to pay for goods or services (a disposal at market value);
• Gifting cryptoassets to anyone other than a spouse or civil partner (deemed disposal at market value).

Pooling Rules

HMRC’s CRYPTO Manual confirms that the s104 TCGA 1992 pooling rules apply to cryptoassets of the same type. Each type of cryptoasset (Bitcoin, Ethereum, etc.) is a separate pool. The cost of each pool is the aggregate allowable expenditure on acquisitions, divided by the number of coins in the pool to give an average cost per unit. On disposal, the proportion of pooled cost attributable to the disposed coins is deducted from the proceeds. The same-day rule and the 30-day “bed-and-breakfast” rule in ss105–107 TCGA apply in the same way as for shares.

Record-Keeping Obligations

The practical challenge in computing crypto CGT liability is record-keeping. Clients are required to maintain records of every acquisition (date, amount, cost in Sterling) and every disposal (date, proceeds in Sterling). For clients who traded frequently across multiple platforms and wallets over a period of years, reconstructing a complete transaction history can be a substantial exercise. Third-party crypto tax calculation tools (Koinly, CoinTracker, TaxBit) can assist but the adviser must review their output carefully, as automated tools can misclassify DeFi transactions, hard forks and transfers between the client’s own wallets.

Income Tax: Mining, Staking and DeFi

Several categories of cryptoasset receipt attract income tax rather than (or as well as) CGT.

Mining

Income received from mining cryptoassets is taxable as income from a trade where the mining activity is carried out with a view to profit on a commercial basis. Where the activity is not commercial, for example, a hobbyist running a small mining rig, the coins received are treated as miscellaneous income under Chapter 8 ITTOIA 2005, assessed at the market value of the coins on the date of receipt. A subsequent disposal of coins originally taxed as income gives rise to a CGT computation with the base cost equal to the value on which income tax was charged.

Staking Rewards

HMRC’s current published position is that staking rewards are income taxable under the miscellaneous income provisions at the market value of the rewards on the date of receipt. This treatment has been subject to challenge in the United States (see Jarrett v United States) but HMRC has not adopted the “creation of new property” analysis advanced in that litigation. UK advisers should follow HMRC’s published guidance while noting that the position may develop.

DeFi Lending and Liquidity Provision

Income received from DeFi lending protocols (e.g., Compound, Aave) is treated by HMRC as income from a loan relationship or as miscellaneous income, depending on the analysis of the relevant protocol. Where the taxpayer provides assets to a liquidity pool and receives a return, HMRC considers the return to be income in the tax year in which it is received. The receipt of liquidity pool tokens in exchange for deposited assets raises a separate CGT analysis as to whether a disposal of the underlying assets has occurred.

NFTs, Airdrops and Hard Forks

Non-Fungible Tokens (NFTs)

HMRC treats NFTs as cryptoassets for tax purposes. Gains on disposal of NFTs are subject to CGT in the same way as fungible cryptoassets, with the acquisition cost being the price paid (in fiat or crypto equivalent). Where an NFT is created by the taxpayer (minting) and then sold, the receipts may be income rather than capital, depending on whether the activity amounts to a trade. For artists or creators minting and selling NFTs on a commercial basis, the receipts will typically be trading income.

Airdrops

HMRC treats airdropped tokens as income at the time of receipt where they are received in return for a service (such as using a platform or providing referrals). Where airdropped tokens are received without any service or consideration (a “pure” airdrop), they are treated as having a nil cost for CGT purposes and are not income at the point of receipt. The distinction between an airdrop in exchange for services and a gratuitous airdrop can be difficult to apply in practice and requires case-by-case analysis.

Hard Forks

Where a hard fork produces new coins for existing holders, HMRC treats the new coins as having a nil cost for CGT purposes. Income tax is not charged at the point of receipt. On disposal of the new coins, the full proceeds are a capital gain (subject to the annual exempt amount for the relevant year).

HMRC Nudge Letters and Compliance Campaigns

HMRC’s cryptoasset compliance campaign has deployed a series of “nudge” letters (also referred to as “one-to-many” letters) to individuals identified through exchange data and third-party information as having crypto holdings that may not have been declared. These letters are not formal enquiry notices; they invite the recipient to review their tax position and make a voluntary disclosure if necessary.

Types of Nudge Letters

• Letters to exchange customers: Sent to individuals identified from exchange data as having sold cryptoassets. The letter advises the recipient that HMRC has information about their holdings and invites them to check whether they have correctly declared CGT or income.
• Letters to non-filers: Where HMRC’s data suggests that an individual who has not filed a self-assessment return may have crypto gains exceeding the CGT annual exempt amount.
• Letters following CARF data receipt: Expected to increase significantly from 2027 as CARF data is processed and matched against self-assessment records.

How to Respond to a Nudge Letter

Receipt of a cryptoasset nudge letter requires a prompt and structured response. The letter is not a formal investigation notice, but ignoring it substantially increases the risk of a formal enquiry or discovery assessment. The appropriate response is:

1. Engage the adviser to review the client’s complete cryptoasset transaction history;
2. Identify all taxable events (disposals, income receipts) across all years open under applicable time limits;
3. Compute the tax liability with full supporting calculations;
4. Make a voluntary disclosure via the Digital Disclosure Service (DDS) if there is outstanding liability or respond to the nudge letter confirming compliance if the review establishes no liability.

Disclosure Options

Advisers have several routes for managing voluntary disclosure of undeclared crypto tax liabilities.

Amended Self-Assessment Returns

Where the tax year in question is within the amendment window (12 months from the filing deadline, so for 2024–25, until 31 January 2027), the client can amend their return directly. This is the simplest route for recent years where the disclosure is relatively straightforward.

The Digital Disclosure Service (DDS)

HMRC’s DDS allows taxpayers to make voluntary disclosures of undeclared liabilities for prior years outside the amendment window. The DDS covers CGT on cryptoassets and can accommodate multi-year disclosures. It requires the client to:

• Register online and obtain a disclosure reference number;
• Calculate the total tax, interest and penalty due;
• Make payment within 90 days of notification.

Penalties under an unprompted DDS disclosure are typically at the minimum for the relevant behaviour category. For careless under-declaration of domestic liabilities, the minimum prompted penalty is 15% (and unprompted 0–15%). For deliberate behaviour, the range is higher. The DDS does not provide the contractual immunity available under the COP9 Contractual Disclosure Facility.

COP9 and the Contractual Disclosure Facility

Where HMRC has already initiated a COP9 investigation into a client’s affairs (which can happen in crypto cases involving suspected deliberate evasion over multiple years), the appropriate route is the Contractual Disclosure Facility. This provides immunity from criminal prosecution in exchange for a complete and accurate disclosure of all deliberate tax irregularities. Given the scale of some clients’ undeclared crypto gains, COP9 may be relevant where the total underpayment is substantial and HMRC’s data evidence is strong.

The Let Property Campaign and Campaign Equivalents

There is currently no HMRC-designated cryptoasset disclosure campaign equivalent to the Let Property Campaign. Disclosures are made through the DDS for prior years or via amended returns for years within the amendment window. Advisers should monitor HMRC’s published guidance for any forthcoming dedicated campaign.

Managing an HMRC Cryptoasset Investigation

Where HMRC opens a formal enquiry (under s9A TMA 1970) or issues a discovery assessment targeting undeclared crypto gains, the management of the investigation requires specific expertise in both tax investigation procedure and cryptoasset transaction analysis.

Reconstruction of the Transaction History

The first priority is to reconstruct the complete transaction history across all platforms, wallets and exchanges used by the client. This typically requires:

• Export of all historical transaction records from centralised exchanges (CSV or API export);
• On-chain transaction history for all identified wallet addresses (using public blockchain explorers or analytics tools);
• Bank statements for all periods, to cross-reference fiat in/out flows with crypto activity;
• Historical price data (Sterling equivalent at date of each transaction) from recognised price providers.

Where historical exchange records are unavailable (because accounts were closed or data deleted), blockchain analytics may permit partial reconstruction. Advisers should inform clients at the earliest stage that the quality of record reconstruction directly affects the quality of the disclosure and the risk of an HMRC estimate exceeding the true liability.

Contesting HMRC’s Assessment Methodology

In crypto investigation cases, HMRC sometimes uses a simplified methodology that treats all exchange withdrawals as proceeds, without accounting for inter-wallet transfers (which are not disposals) or the correct cost base of assets disposed. Advisers should scrutinise HMRC’s assessment workings carefully and challenge any methodology that:

• Treats transfers between the client’s own wallets as disposals;
• Fails to apply the s104 pooling rules correctly, resulting in a higher assessed gain than the correct computation;
• Uses incorrect or inconsistent price data for Sterling equivalents;
• Double-counts disposals through both the income tax and CGT routes.

Time Limits and the Deliberate Behaviour Question

The applicable time limits for HMRC crypto assessments mirror the general discovery assessment rules under s29 TMA 1970.

• 4 years: The ordinary window, applies where no fault is alleged;
• 6 years: For careless under-declaration (failure to take reasonable care);
• 20 years: For deliberate inaccuracy.

HMRC has been increasingly willing to assert “deliberate” behaviour in crypto cases, relying on the argument that the client knew or ought to have known that CGT applied to cryptoassets and nonetheless failed to declare gains. The Supreme Court’s decision in HMRC v Tooth [2021] UKSC 17 (see the Staleness and Deliberate Inaccuracy guide) confirms that deliberate inaccuracy requires an intention to mislead HMRC, not merely a knowing omission. A client who genuinely misunderstood the CGT treatment of crypto, which is an area of genuine public confusion, is not a deliberate inaccuracy case under the Tooth standard and HMRC’s assertion of the 20-year window should be challenged.

Practitioner Checklist: Cryptoasset Tax Review and Disclosure

1. Identify all platforms and wallets used. Obtain a complete list from the client of every exchange, wallet, DeFi protocol and platform used, across all years for which the time limit is open. Do not rely on the client’s recollection alone, cross-reference against bank statement entries and email records from exchange notifications.
2. Export complete transaction histories. For each centralised exchange, download full CSV transaction exports. For on-chain wallets, use a blockchain explorer or analytics tool to extract a complete transaction history. Note: some exchanges delete historical data; act promptly.
3. Classify each transaction type. Separate disposals (fiat sale, crypto-to-crypto exchange, gifts, payments) from non-disposal transfers (wallet-to-wallet, exchange deposits/withdrawals). Non-disposal transfers have no immediate CGT consequence but affect the pool.
4. Apply the s104 pooling rules correctly. Compute the pool for each cryptoasset type separately. Apply same-day and 30-day matching rules. Do not use FIFO or specific identification, these are not the correct UK CGT methodology for cryptoassets.
5. Identify all income tax receipts. Flag staking rewards, mining income, DeFi returns, airdrops in exchange for services and hard fork receipts. Ensure the base cost for CGT purposes is correctly set to the income-taxed value for assets originally taxed as income.
6. Quantify the total liability by year. Compute tax, Class 4 NIC (if applicable for trading income), interest on late payment and the applicable penalty range for each tax year in scope.
7. Assess the disclosure route. For years within the amendment window, use amended returns. For prior years, use the DDS. Where HMRC has already contacted the client, consider whether a structured pre-COP9 disclosure is preferable to unilateral DDS use.
8. Apply the penalty mitigators correctly. Establish whether the disclosure is “prompted” (made after a nudge letter) or “unprompted.” Unprompted disclosures attract minimum penalties. Document the quality of cooperation and the completeness of disclosure to support maximum reduction from the HMRC benchmark.
9. Challenge deliberate behaviour assertions. If HMRC asserts that omissions were deliberate (invoking the 20-year window and higher penalty rates), assess whether the Tooth standard is met. A client who held crypto before HMRC published clear guidance or who had a genuine (if mistaken) view that transfers between own wallets were not disposals, is not necessarily a deliberate behaviour case.
10. Advise on future compliance. Ensure the client understands CGT real-time reporting obligations (CGT must now be reported and paid within 60 days of disposal for non-UK property; cryptoassets are reported through self-assessment). From 2026, CARF will mean exchange transaction data flows automatically to HMRC, impeccable record-keeping from this point is essential.

Frequently Asked Questions