Collecting cryptoasset user and transaction data

From 1 January 2026 if you provide cryptoasset services in the UK, you’ll need to start collecting certain user and transaction data.

This is because the UK is introducing the Organisation for Economic Development (OECD) Cryptoasset Reporting Framework (CARF), and extending it to include domestic reporting.

You may want to start collecting information earlier to prepare for the new rules.

Before you start

Check whether you’ll need to report to HMRC.

What you’ll need to collect

You’ll need to collect information about:

• all individual users
• all entity users, which for CARF includes companies, partnerships, trusts and charities
• cryptoasset transactions, for users in the UK and other CARF countries

For individual users

You’ll need to collect their:

• name
• date of birth
• home address
• country of residence
• for UK residents, their National Insurance number or Unique Taxpayer Reference
• for non-UK residents, their tax identification number (TIN) and the country where it was issued

If a user cannot be issued a TIN (for example, because their country does not issue TINs), you do not need to provide one.

For entity users, including companies, partnerships, trusts and charities

You’ll need to collect their:

• legal business name
• main business address 
• for UK companies, their company registration number
• for non-UK companies, their tax identification number and the country where it was issued

For some entities, you’ll also need to collect information about their controlling person.

Transactions

For each transaction, you must collect the:

• value
• type of cryptoasset
• type of transaction
• number of units

When to start

You must collect all data from 1 January 2026 onwards.

You may want to start collecting information earlier, so that you are ready when the new rules come into force.

Due diligence

You’ll need to verify that the information you collect is accurate by carrying out due diligence. We’ll update the guidance with information about how to do this in due course.

There will be penalties of up to £300 per user for inaccurate, incomplete or unverified reports.

Reporting to HMRC

Depending on the information you collect, you may need to submit a report to HMRC each year. Find out what you’ll need to report to HMRC.

More information

You can find detailed information about theabout the Cryptoasset Reporting FrameworkFramework:

• in the International Exchange of Information technical manual
• in the the rules and commentary on the the OECD’s website.

You can also find out about about international tax transparency standards on the the OECD’s website.

If you have questions about the Cryptoasset Reporting Framework, you can email eoi.policy@hmrc.gov.uk.