What crypto exchanges report to HMRC, the 2026 rules

Yes, crypto exchanges report to HMRC, and since 1 January 2026 it is no longer piecemeal. Under the Cryptoasset Reporting Framework, CARF, every UK cryptoasset service provider must collect its users’ verified identity and tax residence and report them, with transaction data, to HMRC every year. The first reports, covering the whole of 2026, are due by 31 May 2027, and participating countries exchange their files internationally from 2027. If your working assumption is that HMRC cannot really see crypto, that assumption is now a year out of date, and this page covers what changed, exchange by exchange, field by field, date by date.

What is the Cryptoasset Reporting Framework?

CARF is a global reporting standard written at the OECD, the same body behind the Common Reporting Standard that ended bank secrecy for offshore accounts, and it is deliberately the same idea applied to crypto. The UK enacted it through regulations made in 2025, in force from 1 January 2026. HMRC’s own policy paper estimates around fifty UK businesses carry the obligation, and ICAEW reports the framework is expected to raise £315 million by 2030, which tells you how seriously the yield is taken.

Which exchanges report to HMRC?

Any platform serving UK users that exchanges, brokers or deals in cryptoassets, a reporting cryptoasset service provider in the regulations’ language. Named plainly, because these are the questions people type:

Coinbase has reported UK customer data since before CARF existed. In 2021 it notified UK users that details of accounts receiving more than £5,000 in crypto had been passed to HMRC under an information notice. CARF replaces that case-by-case disclosure with systematic annual reporting.

Kraken falls within CARF from January 2026 for its UK users, collecting verified identity and transaction data for annual reporting, and exchange data has reached tax authorities through legal process before the framework existed.

Binance and every other platform with UK users sit in the same net, either as UK reporters or through the international leg, a report filed about a UK resident in any participating jurisdiction reaches HMRC through the exchange of information.

The practical translation, the platform re-verifying your details and asking for your national insurance number this year is not being nosy. Providers face penalties, reported at up to £300 per user, for incomplete or unverified records, so they verify.

What information goes in the file?

Verified identity and tax-relevant details, the regulations specify the fields and the OECD framework shapes them: name, address, date of birth, tax residence, and taxpayer identification, for UK individuals the national insurance number, together with annual transaction data by category and value, acquisitions, disposals, and transfers, including transfers toward self-custody at the platform’s edge. Not your browsing, not your reasons, the file is who you are for tax purposes and what moved.

The dates that matter

Does CARF cover foreign exchanges?

Covering them is the point. The OECD framework has been adopted by dozens of jurisdictions on the same timetable, and the overseas platform that felt out of reach is, if it operates from a participating country, filing about its UK-resident users to its own authority, which passes the file to HMRC. Residence decides where reports about you converge, not the platform’s flag.

Can HMRC see my private wallet?

Not through CARF, the framework binds service providers, and wallet software is not one. Three honest caveats before self-custody sounds like a strategy. The edges are visible, moving crypto between a platform and your own wallet appears in the platform’s records. The chain itself is public, and HMRC analyses it. And unreported is not untaxed, the disposals you make from self-custody carry exactly the same tax treatment, what changes is only who else knows. The full network picture of what this app itself does and does not touch is on the security page, the short version being that computation happens on your machine and nothing is uploaded to us either.

What about DeFi and decentralised exchanges?

Genuinely decentralised protocols with no service provider to bind sit outside CARF’s reporting mechanics, which is not the same as outside tax. The disposals still happen and the chain still records them. Where a front-end business intermediates, the analysis gets closer to the framework, and this edge of the rules is one to watch rather than to rely on.

What happens when returns and reports disagree?

Data matching is the whole design. HMRC has sent nudge letters for years off patchy, case-by-case exchange data, and from May 2027 it holds systematic annual files. A return that does not match the file is how enquiries start, and the look-back reaches four, six or twenty years depending on whether the gap looks careless or deliberate. The dangerous position was never owing tax, it is being visibly wrong about it.

What to do before May 2027, in order

First, compute your real position, every year, not just the last one, the app runs all years at once on your machine, free up to 1,000 transactions, every disposal citing the matching rule behind it. Second, if past years need correcting, HMRC’s cryptoasset disclosure route works better before a letter than after, the letter guide covers the order of operations. Third, keep your own records, the platform’s file describes you, yours defends you. The people who do well out of transparency are the ones whose own numbers were already better than the file.