IEIM8000620 - Overview of penalties

The Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025 (the Regulations) introduce a number of penalties for instances where a RCASP or self-certification provider has not met their obligations.  

The penalties are: 

Penalties for failure to apply due diligence procedures 

Regulation 11 sets out the penalties due for a failure to apply due diligence procedures.  

A RCASP is liable to a penalty under this regulation if the RCASP; 

  • Fails to apply due diligence procedures required by Regulation 4(1). Regulation 4(1) requires a an RCASP to undertake due diligence procedures on cryptoasset users. More information on the due diligence required under the CARF can be found at IEIM8000400 - Due Diligence guidance. A penalty not exceeding £100 for each reportable user or reportable person in respect of which the failure to apply due diligence applies.  
  • Fails to collect a valid self-certificate from a reportable user or reportable person. A penalty of not exceeding £300 will be due for each reportable user or reportable person.  

 

Penalties for failure to comply with record keeping requirements 

Regulation 12 sets out the penalty for failing to comply with the record keeping requirements.  Where an RCASP fails to comply with the requirements of Regulation 4(2), the RCASP is liable to a penalty not exceeding £5,000 for each calendar year in which the failure applies will be due. 

Penalties for failure to provide a valid self-certificate 

Regulation 13 sets out the penalty due if a self-certification provider fails to provide a valid self-certificate to the RCASP as required by Regulation 5. In such cases, the self-certification provider is liable to a penalty not exceeding £300, where the failure to provide a valid self-certificate is deliberate or due to a failure to take reasonable care.  

Penalties for late reports 

Regulation 14 sets out the penalty due where an RCASP fails to comply with regulation 6, by filing a report late. Where a report is filed late, the RCASP will be liable to a penalty not exceeding £5,000. If the failure continues after the penalty has been assessed, the RCASP is liable to a further penalty not exceeding £600 for each subsequent day that the failure continues.  

Penalties for inaccurate or incomplete reports 

Regulation 15 sets out the penalty due if a RCASP files a report required under Regulation 6, that is inaccurate or incomplete. The RCASP is liable to a penalty not exceeding £100 for each cryptoasset user that is a reportable user or has controlling persons that are reportable persons.  

The RCASP will be liable where; 

  • The inaccuracy or incompleteness is deliberate 
  • The inaccuracy or incompleteness is as a result of a failure to take reasonable care 
  • The RCASP discovers the inaccuracy or incompleteness sometime later and fails to take reasonable steps to inform HMRC.  

Penalties for failure to provide notification to reportable users and reportable persons 

Regulation 16 sets out the penalty due if an RCASP fails to notify reportable users or reportable persons that information will be reported to HMRC and may be transferred to partner jurisdictions under CARF. The RCASP is liable to a penalty not exceeding £100 for each reportable user or reportable person for which the failure occurs. If the failure to notify continues, the RCASP is liable to a penalty not exceeding £100 per day for which the failure continues. 

Penalties for failure to provide information to HMRC 

Regulation 17 sets out the penalty due if a RCASP fails to provide information to HMRC following a notice under Regulation 9. The RCASP is liable to a penalty not exceeding £5,000. If the failure continues the RCASP is liable to a penalty not exceeding £600 for each day on which the failure occurs.  

Penalties for failure to register with HMRC 

 Regulation 18 sets out the penalty due if an RCASP fails to register with HMRC as required by Regulation 10. The RCASP is liable to a penalty not exceeding £1,000. If the failure continues the RCASP is liable to a penalty not exceeding £300 per day for which the failure continues.