HMRC plans wider crypto user data powers

TLDR

HMRC is exploring expanded powers to compel crypto businesses to share more detailed user data, but the proposals are still being considered and are not yet law.

1. Draft measures would widen information-gathering powers over cryptoasset service providers, potentially covering more than just exchanges and custodians.
2. Separate international rules under CARF already require UK-linked platforms to collect and report detailed crypto user data on 2026 activity.
3. Privacy and security advocates warn that linking identities to public blockchain addresses, combined with past data leaks, could increase targeting risks for crypto users.

Deep Dive

1. What HMRC Is Proposing

HMRC has consulted on expanding its information-gathering powers so Financial Institution Notices could be sent to a broad range of cryptoasset service providers, including exchanges, custodians and potentially non-custodial businesses such as tax software, wallet apps, hardware-wallet makers and data vendors, depending on the final definition. The proposals would also update powers over computer records and software and remove the statutory requirement for an annual report to Parliament on how these notices are used, according to a recent explainer on the proposed expansion.

These domestic powers are at consultation stage: the public consultation closed on 7 September 2026, and ministers have not yet decided whether to enact, narrow or restrict the measures. A UK crypto tax firm, Recap, argues the draft goes beyond what is needed for tax, warning that it could cover businesses that do not hold customer funds and urging tighter scope and tribunal oversight in a Finance Bill analysis.

2. How CARF Reporting Changes The Picture

Separately from the domestic powers, the UK is implementing the OECDs Crypto-Asset Reporting Framework (CARF). Reporting Cryptoasset Service Provider Regulations that took effect on 1 January 2026 require exchanges and other covered platforms to perform due diligence and collect customer data, including identities and tax IDs, for calendar-year 2026 activity. The first CARF reports are due by late May 2027, and information will be automatically exchanged between tax authorities in at least 52 jurisdictions, expanding HMRCs visibility of UK residents overseas holdings, as outlined in a CARF overview.

CARF changes enforcement reach rather than domestic tax rates and should not be conflated with the separate proposal on Financial Institution Notices. Whether all wallet providers or explorers fall under the domestic powers will depend on how ministers define cryptoasset service provider in the final legislation.

3. Privacy And Security Risks

Critics worry that linking names, home addresses and tax identifiers to specific Bitcoin or other blockchain addresses could expose past and future transaction histories on public ledgers beyond what is needed to calculate tax. That link can persist after any one inquiry and may increase phishing and physical robbery risks, especially for self-custodied assets that cannot be frozen, as highlighted in the privacy-focused critique.

Real-world incidents show why large, centralised datasets of crypto users are sensitive. A recent article documents multiple data breaches and wrench attacks, including kidnappings and home invasions targeting known crypto holders in France and the UK, and tax software leaks that exposed tens of thousands of users balances and gains, in its Finance Bill context. Recap and others urge excluding wallet addresses and current holdings from compulsory disclosure and requiring independent review of HMRC notices to reduce these risks.

Confidence: moderate because the proposals are well-documented, but final scope and safeguards remain undecided.

Conclusion

HMRC is moving toward greater visibility of UK crypto activity through both international CARF reporting and potential domestic information powers, but the key decisions on scope and safeguards are still ahead. For crypto users, the impact will depend on which businesses can be compelled, what data they must provide and how securely that data is stored, making the final wording of the Finance Bill and any oversight mechanisms the most important things to watch next.