UK CARF Enters Operational Phase: How Will Service Providers Report and What Impact Will It Have on Investors?

For service providers, CARF is a year-round ongoing data and compliance requirement.

Written by: Fintax

Introduction

The UK CARF has entered its first data collection year. UK Reporting Crypto-Asset Service Providers (RCASP) must submit user identity and transaction data collected in 2026 to HMRC by May 31, 2027, with the first round of information exchange planned to start by September 30 of the same year.

On the surface, the first report will not be submitted until 2027, but the real work that service providers need to complete has already begun in 2026: obtaining tax self-certifications during account opening, identifying users' tax residency status, organizing transactions according to CARF standards, recording external wallet transfers, and retaining complete data for subsequent registration, notification, and XML submission. CARF is not a one-time form filled out at the end of the year, but a reporting mechanism that operates throughout the year.

As of June 23, 2026, the OECD Global Forum has published a formal commitment list of 76 jurisdictions, of which 46 (including the UK) have committed to conducting the first exchange in 2027. The term "commitment to the first exchange" refers to the implementation timeline and does not mean that all data will be exchanged among the 46 jurisdictions in the first round; the specific exchange relationships still depend on local legislation coming into effect, notifications from competent authorities, and activation of partnerships.

This article will break down the rules from four levels: first, determining which entities that conduct or facilitate crypto-asset transactions in a business manner and have connections to the UK qualify as RCASP; second, explaining what user identity information and transaction data platforms need to collect; third, outlining how HMRC will use this data domestically in the UK and send it to other jurisdictions once the exchange relationships are in effect; and finally, introducing the risks of penalties associated with due diligence, self-certification, record-keeping, registration, user notifications, and annual submissions.

1 What is CARF? How Does It Allow Tax Authorities to See Cross-Border Crypto Transactions

CARF stands for Crypto-Asset Reporting Framework, a global standard for the automatic exchange of tax information on crypto assets introduced by the Organisation for Economic Co-operation and Development (OECD) in 2022.

Its core mechanism is that reporting crypto-asset service providers (RCASP) collect information about customers and related transactions and submit it to their local tax authorities, which then exchange the data across borders. This is similar to the CRS in traditional finance, but CARF primarily covers exchanges between crypto assets and fiat currencies, exchanges between different crypto assets, and related crypto asset transfers.

CARF reports "who conducted what crypto asset transactions" and does not directly calculate taxes for users. After obtaining the information, tax authorities still need to determine based on their national tax laws whether the transactions are taxable, what the costs are, and how much taxable income is ultimately generated.

For example, if a UK tax resident uses an overseas crypto platform that is obligated to report under CARF, that platform will report data to its local tax authority, which will then share the data with HMRC, allowing HMRC to understand the crypto transaction situation of UK tax residents on overseas platforms; conversely, data on non-UK residents on UK crypto platforms may also be exchanged to other jurisdictions via HMRC.

2 Specific Implementation of UK CARF

2.1 Legal Basis and Key Timeline

The foundational rules for UK CARF are contained in the "2025 Regulations on Reporting Crypto-Asset Service Providers (Due Diligence and Reporting Requirements)" (SI 2025/744). This regulation will come into effect on January 1, 2026, stipulating obligations for due diligence, record-keeping, annual reporting, user notifications, registration, and penalties.

The first task on the timeline is to collect valid user self-certifications. New users must submit valid self-certifications when establishing a relationship with RCASP, which must obtain this certification before executing transactions for them; existing users prior to January 1, 2026, must complete this by December 31, 2026, at the latest. UK service providers must also complete registration with HMRC by January 31, 2027, and inform relevant users that their information will be reported to HMRC and may be exchanged with partner jurisdictions.

The first report will cover the period from January 1 to December 31, 2026, and must be submitted between January 1 and May 31, 2027. Subsequently, annual data must be reported by May 31 each year. Reports will be submitted via dedicated XML files, and as of now, the online portal for submitting reports has not yet been launched.

2.2 Who Needs to Report: First Look at Business, Then at UK Connection

Determining whether an entity qualifies as a UK RCASP involves two steps: first, examining whether it conducts or facilitates crypto-asset transactions in a business manner; second, assessing whether it has the specified tax connection to the UK.

HMRC assesses connections in the order of UK tax residency status, establishment in the UK, management in the UK, and having a permanent establishment or branch in the UK; when the same entity has equivalent connections in multiple CARF jurisdictions, it may choose one jurisdiction to complete due diligence and international reporting under CARF Section I(H) to avoid duplicating reporting obligations. However, this choice does not affect the domestic CARF reporting requirements in the UK: if the relevant entity qualifies as a UK RCASP, it must still fulfill the corresponding due diligence and reporting obligations to HMRC for UK tax resident users, even if it chooses to complete CARF due diligence and reporting in another CARF jurisdiction. Additionally, third parties may submit XML files on behalf of RCASP, but RCASP remains responsible for the accuracy and completeness of the reports.

2.3 Information to be Reported: Identity Information and Transaction Information

UK RCASP must conduct due diligence procedures for individual and entity users and related parties. The reporting subjects include UK tax residents and tax residents of CARF-reportable jurisdictions specified by the UK. UK RCASP will report the identity information of the collected reporting subjects and the related crypto asset transaction information to HMRC. Specific reporting content is shown in the image below:

According to HMRC rules, transaction information is reported on a per-user basis and further summarized annually by "related crypto asset---transaction type." This means that different crypto assets involved by the same user need to be categorized separately, and transactions under the same crypto asset, such as fiat purchases and sales, crypto-to-crypto exchanges, transfers in and out, and external wallet transfers, must also be summarized according to their respective transaction categories.

Each transaction type follows specific reporting rules: fiat purchases and sales primarily report the net fiat amount paid or received for that type of crypto asset throughout the year; crypto-to-crypto exchanges must report the fair market value at both the disposal and acquisition ends; other transfers in and out typically summarize the total fair market value, total unit quantity, and transaction count, and further distinguish types such as airdrops, staking income, mining income, crypto asset loans, and collateral when the transaction nature is known to RCASP. For assets transferred to external wallets that cannot be confirmed as associated with VASP or financial institutions, the total fair market value and total unit quantity of the related crypto assets must be reported separately.

2.4 Where Information Flows After HMRC Receives Data

The OECD's CARF framework primarily serves cross-border exchanges, but the UK has extended it to domestic reporting through local legislation. CARF information in the UK flows along three paths:

1. Domestic Use: UK RCASP submits data on UK resident users to HMRC, which can be used directly for domestic tax verification.

2. External Exchange: UK RCASP submits data on non-UK resident users to HMRC, which will send the data to the corresponding tax resident jurisdictions once the exchange relationships are in effect.

3. Incoming Exchange: Data generated by UK tax residents at overseas RCASP may first be reported to local tax authorities and then exchanged with HMRC by the counterpart.

Therefore, the submission of data to HMRC by platforms and the exchange of data with overseas jurisdictions are not the same action. The former is the submission of data by RCASP to HMRC under UK domestic law, while the latter is a cross-border exchange between tax authorities that must meet conditions such as partner jurisdictions and exchange relationships.

2.5 Penalty Mechanism

The penalties under UK CARF are not limited to the failure to report annual documents. Independent penalties are set for due diligence, self-certification, record-keeping, user notifications, report submissions, and registration. The table below lists the statutory maximum amounts, and HMRC will decide whether to impose penalties and the specific amounts based on the nature of the behavior, reasonable grounds, and rectification status.

3 What CARF Means for Service Providers and Investors

3.1 For Service Providers: Existing KYC Is Not Enough, Tax Information and Transaction Standards Must Be Supplemented

The most direct change brought by CARF is the integration of tax due diligence and transaction reporting into the daily operations of service providers. Service providers can reuse some KYC data, but cannot simply replace CARF self-certifications with anti-money laundering identity information. The jurisdiction in which the user is a tax resident, whether the tax identification number (TIN) information meets requirements, how entities are classified, and whether beneficial owners need to be identified all need to be handled separately.

Although the first report is due in 2027, service providers cannot wait until the reporting service goes live to organize historical data. If self-certifications, external wallet records, and annual transaction information are missing at the source, it will be difficult to produce complete reports later.

For Investors: Platform Report Totals Differ from Taxable Income

CARF will not change existing tax types and tax calculation rules, and the data reported by platforms is not a tax calculation sheet. Platforms may report aggregated data on fiat purchases and sales, crypto-to-crypto exchanges, and external wallet transfers, but individuals must still determine the nature of transactions, calculate costs, and assess gains according to UK tax law. Transfers between self-owned wallets where the user retains beneficial ownership typically do not constitute disposals for capital gains tax purposes, even if such transfers are included in CARF data by the platform.

HMRC has stated that CARF information will be used to link crypto asset activities with taxpayers' tax records. Investors should retain records of asset types, transaction times, asset quantities, transaction values in GBP on transaction days, buy and sell records, bank statements, and wallet addresses, as well as supporting documentation for cost, expense, and valuation calculations.

3.3 Overseas Platforms and External Wallets Do Not Equal Information Blind Spots

When UK tax residents use overseas RCASP participating in CARF, relevant data may enter HMRC through cross-border exchanges; transfers from UK RCASP to external wallets that cannot be confirmed as belonging to VASP or financial institutions may also be aggregated and reported by the platform as external wallet transfers. For investors, the focus should not only be on whether a particular transaction will be visible to the platform but also on ensuring that tax residency status, self-certifications, transaction records, and personal declarations can mutually explain each other. CARF reports "what transactions occurred," while tax law determines "how much taxable income was generated by this transaction."

Conclusion

The first report under UK CARF is not due until May 2027, but the quality of the report is determined by the user and transaction data that service providers generate in 2026. Scope determination, tax self-certification, transaction classification, external wallet identification, and evidence retention all need to be completed before the reporting window opens.

For service providers, CARF is a year-round ongoing data and compliance requirement; for investors, CARF itself will not change existing tax burden rules but will create a more direct verification relationship between platform data, cross-border exchanges, and personal tax declarations. The purposes and calculation standards of service providers' CARF reports and individual tax declarations are not the same, and specific tax treatments still need to be determined based on transaction facts and applicable tax laws.