Collecting cryptoasset user and transaction data
Find out what information you'll need to collect under the Cryptoasset Reporting Framework (CARF).
From 1 January 2026 if provide cryptoasset services in the UK, you’ll need to start collecting certain user and transaction data.
This is because the UK is introducing the Organisation for Economic Development (OECD) Cryptoasset Reporting Framework (CARF), and extending it to include domestic reporting.
You may want to start collecting information earlier to prepare for the new rules.
We’ll be updating this guidance with more information.
You can subscribe to get emails about updates to CARF guidance.
Before you start
Check whether you’ll need to report to HMRC.
What you’ll need to collect
You’ll need to collect information about:
- all individual users
- all entity users, which for CARF includes companies, partnerships, trusts and charities
- cryptoasset transactions, for users in the UK and other CARF countries
For individual users
You’ll need to collect their:
- name
- date of birth
- home address
- country of residence
- for UK residents, their National Insurance number or Unique Taxpayer Reference
- for non-UK residents, their tax identification number (TIN) and the country where it was issued
If a user cannot be issued a TIN (for example, because their country does not issue TINs), you do not need to provide one.
For entity users, including companies, partnerships, trusts and charities
You’ll need to collect their:
- legal business name
- main business address
- for UK companies, their company registration number
- for non-UK companies, their tax identification number and the country where it was issued
For some entities, you’ll also need to collect information about their controlling person.
Transactions
For each transaction, you must collect the:
- value
- type of cryptoasset
- type of transaction
- number of units
When to start
You must collect all data from 1 January 2026 onwards.
You may want to start collecting information earlier, so that you are ready when the new rules come into force.
Due diligence
You’ll need to verify that the information you collect is accurate by carrying out due diligence. We’ll update the guidance with information about how to do this in due course.
There will be penalties of up to £300 per user for inaccurate, incomplete or unverified reports.
Reporting to HMRC
Depending on the information you collect, you may need to submit a report to HMRC each year. Find out what you’ll need to report to HMRC.
If you need support
If you have questions about the information you’ll need to collect, you can contact the Automatic Exchange of Information (AEOI) helpline.