HMRC sent 81,172 crypto warning contacts in 2025-26 — letters, emails and texts — up about 25% on the prior year and almost triple the 2023-24 total. The FOI figures, obtained by UHY Hacker Young and reported by the BBC and trade press including FinanceFeeds, are not assessments. They are the pre-enquiry pressure campaign before the first full Cryptoasset Reporting Framework (CARF) data lands in 2027.
Primary sources: HMRC’s Cryptoassets Manual, the disposal rules at CRYPTO22100, corporate chargeable-gains treatment at CRYPTO41200, the cryptoasset disclosure service, CARF provider guidance and the IEIM CARF chapter, plus the OECD’s tax transparency standards. If your board still treats crypto as a personal founder problem or a “no sterling, no tax” hobby, rewrite that assumption this week.
What the 81,172 contacts actually are
A nudge is HMRC saying it already has a signal — often from a UK platform, banking data or another third-party source — that a return may be missing or incomplete. It is an education and self-correction window, not a conviction. HMRC’s own line to the BBC was that the vast majority pay the right amount and that these contacts exist to “educate, remind or prompt.” That framing is deliberate. It also means ignoring the letter is the expensive choice.
UHY’s Neela Chauhan put the behavioural point bluntly: many younger holders assume HMRC cannot see the activity. That assumption is already weak. From 1 January 2026, UK reporting cryptoasset service providers have been collecting user and transaction data under CARF. Their first XML reports, covering the 2026 calendar year, must be filed between 1 January and 31 May 2027. Cross-border exchange then brings overseas platforms into the same matching game. The “offshore exchange = invisible” narrative dies on a timetable, not a theory.
The disposal traps boards still miss
HMRC’s individual guidance is clear. A disposal is not only a sale into pounds. It includes exchanging one token for another, spending tokens on goods or services, and most gifts (spouse/civil partner gifts aside). Moving tokens between wallets you still beneficially own is generally not a disposal. That distinction matters because platform CSVs often look noisy: internal transfers can resemble sales until beneficial ownership is reconstructed.
For companies the parallel rule sits in the business chapters. If exchange tokens are held as an investment, gains on disposal sit in the corporation tax chargeable-gains computation. Crypto is a chargeable asset where it is capable of ownership and has realisable value. Pooling and matching still apply; same-day and short-window rules still bite; allowable costs still need evidence. If activity is so organised it amounts to a financial trade, the answer is trading profits rather than chargeable gains — but HMRC still treats pure investment holding as the default for most non-financial businesses.
Income is a separate track. Staking rewards, airdrops, mining and some lending arrangements can create income before any later capital disposal. DeFi contracts that transfer beneficial ownership can crystallise a disposal even when the economics look like a temporary lock-up. Draft policy to give qualifying crypto lending and certain automated market-making no-gain/no-loss treatment from April 2027 does not erase historic years, and it does not remove the need for sterling valuations and complete ledgers now.
Why CFOs, not only private clients, own this
Four live board exposures sit behind the headline letter count.
1. Founder and director personal holdings. A founder who took tokens in a seed round, rotated between coins, or spent crypto on lifestyle purchases can trigger a personal CGT enquiry that collides with a PE process, bank KYC refresh or AIM/IPO readiness pack. The company is not the taxpayer — but the diligence questionnaire will still ask, and a live HMRC contact is a disclosure item.
2. Corporate treasury and balance-sheet crypto. Any UK company that held, swapped or paid with exchange tokens needs a chargeable-gains or trading analysis, sterling valuations at each disposal, and CT return support. “We never converted to cash” is not a defence under CRYPTO22100 / CRYPTO41200 logic.
3. Employee and contractor token pay. Tokens paid as remuneration are employment income first. Later disposals by the employee sit on the individual. Payroll, PAYE settlement and P11D/payrolling controls need a clean map before CARF data makes the employer’s platform footprint easier to match.
4. Providers and in-house platforms. If the group operates an exchange, broker, wallet custodian or other in-scope cryptoasset service in the UK, CARF is an operational compliance programme: due diligence on users, reportable jurisdiction tests, XML up to 250MB, and penalties of up to £300 per user for failure, lateness or inaccurate/incomplete reports. That is not a side letter for the crypto product team — it is a controls, data and audit-committee item for 2026 collection and 2027 filing.
Disclosure, penalties and the real calendar
HMRC runs a dedicated route to tell HMRC about unpaid tax on cryptoassets, alongside the basic check if you need to pay tax when you sell cryptoassets guidance and the pay tax on cryptoassets payment path. Current-year and prior-year amounts that belong on Self Assessment still belong on Self Assessment. The disclosure service is for underpaid historic crypto tax, with interest and inaccuracy/failure-to-notify penalties worked through HMRC’s standard ranges — not a single “30% if you go first” slogan. Unprompted careless errors sit lower than prompted deliberate and concealed failures; reasonable care can mean no inaccuracy penalty at all. After a nudge, you are already in the prompted world for practical purposes. Quality of disclosure, completeness of records and how fast you correct the current return all matter more than folklore percentages.
Two calendars now run in parallel. Taxpayer calendar: reconstruct 2022–2025 bull-run disposals where records are weakest, lock 2025-26 Self Assessment positions, and keep 2026 transaction data clean while platforms are already collecting under CARF. Payment and filing for 2025-26 still centre on the normal January 2027 Self Assessment deadline unless a specific notice says otherwise. Provider calendar: collect through 31 December 2026; file first CARF report by 31 May 2027. HMRC has already said the wider reporting package is expected to raise hundreds of millions by 2030. The compliance posture is permanent, not seasonal.
What to lock this week
Run a short board or audit-committee pack with five closed questions:
1. Do any directors, PDMR-equivalents or material shareholders have open HMRC crypto contacts, or unreported disposals that would fail a warranty schedule?
2. Does any UK company in the group hold or has it ever disposed of exchange tokens, NFTs or utility tokens — including paying suppliers or staff in crypto?
3. Are staking, lending, liquidity-pool and airdrop receipts classified as income or capital with contemporaneous sterling values?
4. If we are a reporting cryptoasset service provider, who owns CARF data quality, user due diligence, the May 2027 filing and the £300-per-user penalty risk?
5. Where records are incomplete, is the path Self Assessment correction, the crypto disclosure service, or both — with agent authority already in place?
Evidence beats narrative. Export every exchange history, wallet movement log, fee schedule and GBP FX source. Rebuild beneficial-ownership maps so internal transfers are not mis-scored as disposals. Keep the commercial calculator output and the assumptions file; HMRC’s disclosure form asks which calculator you used. If a letter has already arrived, diary the response window and do not let it sit behind “we’ll look after the next board.”
Bottom line
81,172 contacts are the warm-up. CARF turns crypto compliance from selective nudges into industrial matching across UK and participating overseas platforms. The technical law is not new — disposals, pooling, income vs capital and corporate chargeable gains are already in the Cryptoassets Manual. What is new is the volume of third-party data and the shrinking space for “HMRC can’t see it.” CFOs should treat founder wallets, treasury tokens, tokenised pay and any in-house platform as one control stack before the 2027 reporting window closes the gap for them.