Crypto Law Profile
UK CARF rules requiring reporting cryptoasset service providers to collect user and transaction data, report to HMRC, register, notify users, keep records, and face penalties for non-compliance.
The Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025 are a United Kingdom statutory instrument implementing the OECD Cryptoasset Reporting Framework, or CARF, through domestic tax-transparency rules for cryptoasset service providers. The instrument was made on 24 June 2025, laid before the House of Commons on 25 June 2025, and came into force on 1 January 2026. For CryptoSlate reference purposes, the regulation is treated as in force as of 6 June 2026.
The regulations create due diligence, reporting, registration, notification, record-keeping, and penalty rules for UK reporting cryptoasset service providers, commonly referred to as RCASPs. HMRC describes the regime as part of CARF, a framework designed to give tax authorities visibility over cryptoasset users and transactions. The regime is not a consumer-protection licensing framework and should be read separately from the UK financial-services regime for regulated cryptoasset activities.
HMRC guidance says UK-based RCASPs include businesses that transact cryptoassets on behalf of users or provide a means for users to transact cryptoassets, with examples including cryptoasset exchanges, brokers, and dealers. The regulations therefore sit at the intersection of cryptoasset market infrastructure and tax reporting, rather than investment regulation.
HMRC’s collection guidance states that providers must collect information about all individual users, all entity users, and cryptoasset transactions for users in the UK and other CARF countries. For individuals, the collected data includes name, date of birth, home address, country of residence, and either UK tax identifiers or non-UK tax identification information. For entities, the data includes legal name, address, company or tax identifier information, and in some cases controlling-person information.
The first reporting window runs from 1 January 2027 to 31 May 2027 and covers the 2026 calendar year. HMRC guidance states that later annual reports are due by 31 May for the previous calendar year. As of the latest HMRC reporting guidance reviewed for this draft, the online reporting service was not yet live and reports must be submitted as XML files.
The regulation implements the OECD CARF, which was designed to support automatic exchange of tax-relevant information on cryptoassets between tax authorities. The UK’s 2024 consultation response said the UK intended CARF reporting, including domestic reporting on UK customers, to apply from 1 January 2026, with first reports due by 31 May 2027. Finance Act 2026 later amended regulation 6 of S.I. 2025/744 so the duty to report also applies to information relating to cryptoasset users resident in the United Kingdom, or users with UK-resident controlling persons. This profile therefore records S.I. 2025/744 as the main regulation and treats Finance Act 2026 as a related amendment.
As of 6 June 2026, the regulation is in force and HMRC guidance has been updated for the 2026 reporting period. Editors should review this profile again before 31 January 2027, when providers are expected to register and notify users, and before 31 May 2027, when the first CARF reports are due. This profile is a legal-reference summary only and is not legal, tax, investment, or compliance advice.
Applies to UK reporting cryptoasset service providers with a UK nexus, including businesses that transact or enable cryptoasset transactions for users.
Requires collection and verification of information for individual users, entity users, and, where relevant, controlling persons.
Requires annual reporting to HMRC on reportable users and transaction summaries; first reports cover 2026 and are due by May 31, 2027.
HMRC guidance states RCASPs must register through the online service and notify users that their details will be reported.
Penalties may apply for failures involving due diligence, recordkeeping, reporting, user notices, HMRC information requests, and registration.
UK government confirmed CARF implementation plan and intention to include domestic reporting on UK customers.
S.I. 2025/744 was made as a UK statutory instrument.
The instrument was laid under the made negative procedure.
The objection period ended and the House of Commons procedure concluded.
The instrument came into force and the first CARF reporting period began.
Finance Act 2026 amended regulation 6 to cover UK-resident users and UK-resident controlling persons.
HM Revenue & Customs, HM Treasury, OECD, UK Parliament
Cryptoassets
Profile covers S.I. 2025/744 as the core CARF implementing regulation. Finance Act 2026 amended regulation 6 for UK-resident user reporting; monitor HMRC guidance before the first 2027 reporting window.
