The short answer: your exchange is asking because CARF rules now require in-scope providers to collect this information. Since 1 January 2026, UK-based reporting cryptoasset service providers have had to collect identifying information and transaction data from their customers under a set of rules called the Cryptoasset Reporting Framework, or CARF, and overseas providers in participating jurisdictions may ask for the same information under their local CARF rules. In practice that means confirming your name, address, date of birth, tax residence and a tax identification number, normally your National Insurance number or Unique Taxpayer Reference (UTR). The underlying requirement is genuine, though scammers may imitate these requests, and providing your details does not by itself mean you owe any tax.
If you have just had an email or an in-app prompt from Coinbase, Binance, Kraken, Revolut or any other platform asking you to confirm these details, this guide explains why it is happening, what you have to share, what happens if you refuse, and what HMRC does with the information once it has it. Everything here reflects the rules as they stand in July 2026.
Disclaimer
This guide is intended as a generic informative piece. This is not accounting or tax advice that can be relied upon for any UK individual's specific circumstances. Please speak to a qualified tax advisor about your specific circumstances before acting upon any of the information in this article.
Is this a scam, or is my exchange really required to ask?
The underlying requirement is real. From 1 January 2026, UK-based reporting cryptoasset service providers are legally obliged to collect identifying information from their customers and report to HMRC, and HMRC's own guidance for cryptoasset users confirms you need to provide these details. What that guidance cannot do is authenticate the particular email or text sitting in your inbox, and scammers do imitate exactly this kind of request.
So handle it the same way you would with any financial account. Do not click a link in an unexpected email or text. Instead, open your exchange's official app or website directly and provide the details there. A genuine platform will let you complete this inside your account settings, and it will never ask you to confirm your details by replying with a password or moving your funds somewhere "for safety". If something feels off, contact the exchange through its official support channel.
Requests for this information are expected in 2026, but always respond through the provider's official app or website rather than following a link in an unexpected message. What follows is why the rules changed and what you actually need to do.
Why is my exchange suddenly asking for this?
The reason is CARF, the Cryptoasset Reporting Framework. It is an international standard developed by the OECD so that tax authorities can exchange information about people's crypto activity, in much the same way they already share data on offshore bank accounts. The UK implemented CARF through The Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025, which came into force on 1 January 2026, and Finance Act 2026 extended the reporting duty to information about UK-resident users.
The rules bite on providers that are UK-based, which is judged on things like where the business is tax resident or incorporated, where it is managed, or whether it has a regular place of business in the UK. A UK-based provider has to do three things: identify who its users are, collect a confirmation of their tax details, and report that information to HMRC every year. Overseas providers in participating jurisdictions may ask you for the same information under their own local CARF rules, with reporting flowing to HMRC through their home tax authority. HMRC estimates that extending CARF reporting to UK-resident customers will affect around 50 businesses, which helps explain why so many users are receiving these requests at the same time. For background on the framework itself, see our earlier explainer on the OECD's release of CARF.
What personal details must I give my crypto exchange?
Your exchange has to obtain and hold a "self-certification" from you. In plain terms, that is you confirming who you are and where you are tax resident. For a UK user it usually means:
- Your full legal name
- Your date of birth
- Your home address
- Your country or countries of tax residence
- Your tax identification number, normally your National Insurance number or Unique Taxpayer Reference (UTR)
If you are not eligible for a tax identification number, you do not have to provide one. This is the same sort of information you hand over when you open a bank account or a stocks and shares account, and it exists for the same reason. Your tax identification number helps HMRC match your crypto activity to your tax record rather than to someone with a similar name. HMRC's guidance on the information you need to give to UK cryptoasset service providers sets out the full list, and makes clear you should provide it to every provider you use.
What crypto transaction information is reported to HMRC?
Separately from the details you provide, your exchange reports a summary of your transactions to HMRC each year: the types of activity, aggregate values, numbers of units and the cryptoassets involved. You do not have to compile any of that yourself; the platform builds it from your account history.
It is worth knowing what the report is not. It is not a tax calculation, and it is not a live snapshot of your portfolio. It is an aggregated summary of what happened on that platform during the year, which HMRC can compare against what you declare.
Do I have to give my exchange my National Insurance number, and what happens if I refuse?
If you have a National Insurance number or another tax identification number, you must provide it when your provider requests a valid self-certification. HMRC says you must give accurate identifying details to every cryptoasset service provider you use, including providers outside the UK. If you are not eligible for a TIN, you do not have to provide one. There is also a penalty for getting a self-certification wrong on purpose or through carelessness.
The exact rule sits in regulation 13 of the 2025 regulations. It says that a person who fails to provide a valid self-certification can face a penalty of up to £300 where the failure is deliberate, or where it is down to a failure to take reasonable care. In other words, if you simply refuse to confirm your details, or you knowingly give false ones, HMRC can charge you up to £300. If you provide accurate details when asked, there is nothing to pay and nothing to worry about on this front.
It is worth being clear that this £300 is a penalty for not identifying yourself properly. It is completely separate from any tax you might owe on your crypto, which is a different question we come to below.
Will my exchange be penalised too?
Yes. Your provider has separate and potentially substantial penalties, which is exactly why you are being chased for your details. If it fails to obtain a valid self-certification, it can be charged up to £300 for that user. Other due-diligence failures can attract up to £100 per relevant user, as can failing to tell users their data will be reported. A late annual report can mean a penalty of up to £5,000, followed by continuing penalties of up to £600 a day, while an inaccurate or incomplete report carries a separate penalty of up to £100 per relevant user.
So when you see it reported that providers face "£300 per user", that is accurate, but it is only half the story. The £300 figure turns up in two places. Your exchange can be charged up to £300 per user if it fails to obtain a valid self-certification from you, and you can be charged up to £300 if you deliberately or carelessly fail to provide one. You are both on the hook, which is the real reason your platform is asking so insistently.
What does HMRC do with the information?
HMRC uses it to check that crypto gains and income have been declared correctly. Providers began collecting information on 1 January 2026, and their first reports, covering the 2026 calendar year, are due to HMRC between 1 January and 31 May 2027. Once your exchange reports your identity and a summary of your transactions, HMRC can line that up against what you have (or have not) put on your Self Assessment return. International exchange between tax authorities is expected to follow, with the first exchanges due by 30 September 2027, so using an overseas exchange does not keep your activity out of view. We have looked at what this means platform by platform in our guides to whether Coinbase, Binance and Kraken report to HMRC.
This is the same approach that has applied to offshore bank accounts for years under the Common Reporting Standard. The crypto version simply closes a gap that used to exist.
HMRC has already been acting on the data it holds. It issued 64,982 crypto-related "nudge" letters during 2024/25, up 134% from 27,713 during 2023/24, according to a Freedom of Information request by UHY Hacker Young reported by the Financial Times in October 2025. CARF will give HMRC far more of this information, far more reliably, from 2027 onwards. If you have had a nudge letter, our guide on what to do if you receive a HMRC nudge letter about your crypto walks through the next steps.
The key thing to understand is that none of this changes what you owe. The rules on crypto tax are exactly the same as they were. What has changed is how clearly HMRC can see your activity.
Does giving my details mean I owe tax?
No, not in itself. Confirming your details just links your account to your tax record. Whether you actually owe anything depends on what you have done with your crypto.
In broad terms, you may have capital gains tax to pay if you sold, swapped or spent crypto and your total gains for the year are above the annual tax-free allowance (£3,000 for the 2026/27 tax year). You may have income tax to pay if you received crypto as income, for example from staking rewards, mining or being paid in crypto. Plenty of people who provide their details will find they owe nothing at all, because their gains sit within the allowance.
As a rough illustration, someone who bought crypto for £20,000 over a couple of years and later sold the lot for £26,000 has a £6,000 gain. After the £3,000 allowance, £3,000 of that is taxable. Assuming there are no allowable losses or fees and the entire taxable gain falls within the person's remaining basic-rate band, the CGT would be £540 at 18%. The exact figure depends on your other income and on HMRC's share-pooling rules, so the cleanest way to know your real position is to run the numbers. You can do that with our free capital gains tax calculator, and our comprehensive UK crypto tax guide explains how gains and income are worked out from start to finish.
What should I do now?
There are three sensible steps.
First, provide the details your exchange has asked for, through its official app or website. It is a legal requirement, the information is standard, and refusing only risks a penalty for you.
Second, check whether you actually have any tax to declare. Work out your gains and income for each year you have been active, using a calculator or with the help of an accountant. Many people find they are within their allowance and have nothing to pay.
Third, if you find you have gains or income you have not declared, put it right before HMRC contacts you. You can amend a recent Self Assessment return for up to 12 months after the filing deadline. For older years, HMRC's Cryptoasset Disclosure Facility, launched in November 2023, is the dedicated route for telling it about unpaid tax on crypto. Coming forward voluntarily can result in lower penalties than waiting for HMRC to begin an enquiry, depending on the circumstances. A qualified crypto accountant can help if your situation is complicated.
How Recap helps
If you want to know where you stand, the quickest way is to bring your transaction history together in one place. Recap connects to your exchanges and wallets, applies HMRC's share-pooling rules automatically, and produces a tax report you can use for your Self Assessment or hand to your accountant. Because it is built in the UK specifically for HMRC's rules, it handles the detail that matters here, including Section 104 pooling and the same-day and 30-day matching rules.
So when your exchange asks for your details, you can provide them knowing exactly what, if anything, you owe.
See where you stand with Recap →
Key takeaways
- The underlying requirement is genuine. Since 1 January 2026, UK-based reporting cryptoasset service providers must collect user details and report UK-resident user and transaction data to HMRC under the Cryptoasset Reporting Framework. Scammers may imitate these requests, so always respond through the official app or website rather than a link in a message.
- You have to provide accurate details. Deliberately or carelessly failing to give a valid self-certification can mean a penalty of up to £300 for you, under regulation 13 of the 2025 regulations.
- Your exchange has separate and potentially substantial penalties, including up to £300 per user if it fails to obtain your self-certification and up to £5,000 plus £600 a day for a late annual report. That is why the requests are arriving now.
- Providing your details does not create a tax bill. It links your account to your tax record. Whether you owe anything depends on your gains and income.
- HMRC's visibility is rising, the rules are not changing. Providers began collecting data on 1 January 2026 and their first reports are due by 31 May 2027. If you have undeclared crypto, coming forward before HMRC contacts you can mean lower penalties.
