The Reporting Cryptoasset Service Providers Regulations 2025 took effect on January 1, 2026, implementing due diligence and reporting rules based on the OECD's Crypto-Asset Reporting Framework (CARF). According to reports from 99Bitcoins, these regulations have been in force for over a year, establishing the baseline for UK crypto tax compliance. However, HMRC's proposed information powers remain undecided, with the consultation closing on September 7, 2026, and ministers having not made a decision by October 8, 2026.
HMRC is proposing to extend its information-gathering powers to cryptoasset businesses and change rules on access to computer records and software. As reported by 99Bitcoins, the proposals would extend Financial Institution Notices to cryptoasset service providers and update HMRC's powers over computer records and software. The draft definition could potentially reach firms that don't hold customer funds, including tax and wallet software developers, block explorers, data vendors, and hardware-wallet makers. Recap, a UK crypto tax software provider, warns that the draft definition could reach firms that don't hold customer funds, including tax and wallet software developers, block explorers, data vendors, and hardware-wallet makers.
Critics warn that linking names, home addresses, and tax identifiers to Bitcoin addresses could expose a lasting history of public blockchain activity. According to 99Bitcoins, once wallet addresses are tied to personal identity, their activity becomes much easier to trace. Records showing addresses and holdings can be checked against public data, revealing more than just disposal history needed for tax positions. The concern extends to security risks, as a database of names, addresses, and crypto holdings could be valuable to criminals. Recap notes that while its system is designed so the company cannot access customers' portfolio data, whether the rules could force a provider to change how its systems work remains an open question. HMRC was asked whether a provider could be required to make hidden information readable, whether requests could cover wallet addresses or current balances, and what safeguards would apply, but said it couldn't answer while consultation responses were still being analyzed.
Security concerns are supported by international incidents, including 19 verified crypto-related attacks in France in 2025 and 11 of 14 known globally tracked cases in the opening weeks of 2026, as reported by Forbes. A French tax official was charged with using government tax software to look up crypto investors' addresses and assets, then selling the information to organized crime networks. Physical attacks linked to perceived crypto wealth have also been reported in the UK, including a reported wrench attack in Solihull and cases involving threats against investor families. For self-custodied Bitcoin, the stakes are particularly sharp as holders control transactions directly, with no intermediary able to freeze or reverse transfers. The stakes are sharper for self-custodied Bitcoin, which a holder controls directly, with no intermediary able to freeze or reverse a transfer.
The outcome of HMRC's proposed powers will depend on which businesses can be compelled, what providers may be required to do, and how safeguards limit access. According to 99Bitcoins, once identity is linked to a Bitcoin address, the privacy and security implications can outlast the original tax inquiry. HMRC says the reforms would help collect the correct amount of tax with proportionate safeguards for taxpayers and third parties, though specific details remain undecided pending consultation analysis. The proposals would also remove the statutory annual report to Parliament on these notices, as government efforts to trace and recover digital assets develop. Together, the two measures mean more identifying and transactional data flowing into tax systems, which is the core of the UK crypto privacy debate.
