HMRC's knowledge of your crypto activity is almost certainly greater than you assume.

Since at least 2019, HMRC has issued bulk data requests to centralised exchanges including Coinbase, Binance, and Kraken. These requests return customer names, transaction histories, and wallet addresses. HMRC has also contracted with on-chain analytics firms such as Chainalysis and Elliptic, which can trace transactions across decentralised exchanges and through mixers. The Crypto-Asset Reporting Framework (CARF), developed by the OECD and adopted by the UK, will require crypto platforms to automatically report user transaction data—including transaction amounts, wallet addresses, and taxpayer identification numbers—to tax authorities. First automatic exchanges of information are expected in 2026/2027. The EU's DAC8 directive went live for EU member states on 1 January 2026; the UK will receive this data about UK-resident users through reciprocal agreements. Under the existing Common Reporting Standard (CRS), financial institutions including some crypto-adjacent businesses already share account information automatically.

HMRC has used this data to send nudge letters to taxpayers it suspects have unreported gains. These letters are not accusations—they're invitations to check your tax position and correct any errors voluntarily. But they signal that HMRC has already linked your exchange activity to your identity. Ignoring a nudge letter dramatically increases your risk if HMRC escalates to a formal enquiry.

Penalty Structure

Filing your self-assessment late triggers the following penalties:

›Immediate £100 penalty for missing the 31 January deadline, even if you owe no tax.
›£10 per day for up to 90 days (maximum £900) if the return is still outstanding after three months.
›At six months: the greater of 5% of the tax due or £300.
›At twelve months: a further penalty of the greater of 5% of the tax due or £300. In cases of deliberate concealment, the twelve-month penalty can be up to 100% of the tax due.

Interest on unpaid tax is calculated at the Bank of England base rate plus 2.5%. As of mid-2025, with the base rate at 4.5%, this is 7.0% per annum. This rate changes automatically when the base rate moves, so check the current rate at the time you're reading this.

HMRC's statutory time limits for assessing additional tax are:

›4 years from the end of the tax year for simple errors.
›6 years for errors due to carelessness or negligence.
›20 years for deliberate non-disclosure or concealment, under TMA 1970 s.36. This is the maximum statutory assessment window—not the standard one—and it means gains from as far back as the 2005/06 tax year could theoretically still be in scope if HMRC can demonstrate deliberate behaviour.

HMRC can also invoke Code of Practice 9 (COP9) for suspected serious tax fraud, which carries the possibility of criminal prosecution.

Record-Keeping Requirements

HMRC requires you to retain records supporting your self-assessment return. For non-business taxpayers, the minimum retention period is 22 months after the end of the tax year (i.e., until the standard enquiry window closes on 31 January, roughly 22 months after the 5 April year-end). However, given HMRC's extended assessment windows of 6 years for carelessness and 20 years for deliberate non-disclosure, keeping records for at least five to six years is strongly advisable. Many advisers recommend keeping crypto records indefinitely, since your Section 104 pool carries forward and historical data is needed to calculate current gains.

What HMRC expects you to retain:

›Dates of every acquisition and disposal.
›GBP values at the time of each transaction (not just the crypto amount).
›Wallet addresses and exchange account details involved.
›Exchange transaction records, including CSVs or API exports.
›Records of income events: staking rewards, mining income, airdrops, with GBP values at receipt.
›Records of transfers between your own wallets, with evidence demonstrating they were not disposals.
›Details of any claims made (negligible value, losses, etc.).

What this means practically: assume HMRC can see your centralised exchange activity today, and that DEX activity will become visible within the next one to two years. File proactively. Report losses. Keep everything.