The most common version of this question comes with an anxious edge: can HMRC actually see what I am doing with my crypto, or is it still largely invisible? The honest answer is that visibility has increased significantly and is about to increase again. But it is data-matching and investigation capability, not omniscience, and the tone of this page is accurate, not alarmist.
The short answer: yes, increasingly, and here is how
HMRC can see crypto activity through three overlapping channels: KYC data from exchanges, systematic reporting under the Cryptoasset Reporting Framework (CARF) from 2026, and commercial blockchain analytics tools. None of these channels gives HMRC a complete, real-time view of every wallet; collectively they give HMRC meaningful and growing data-matching capability. The key phrase is data-matching: HMRC uses data to flag discrepancies between what exchanges report and what appears (or does not appear) in your Self Assessment return, then decides whether to write to you or open an enquiry.
Three things HMRC cannot do automatically: it cannot see the private keys to your wallet, it cannot read your intentions from on-chain data, and data-matching alone does not produce a tax assessment. A discrepancy triggers a process. You are not assessed until the facts are established.
| What HMRC can and cannot see | Status | Notes |
|---|---|---|
| Your identity at a UK exchange (KYC) | Can see | Exchanges hold this under AML rules; HMRC can require disclosure |
| Your exchange transaction history (from 2026) | Can see (systematic from 2027 report) | CARF: platforms collect from 1 Jan 2026; first report 1 Jan to 31 May 2027 |
| On-chain flows on public blockchains | Publicly visible | Bitcoin, Ethereum and most chains are transparent ledgers |
| Linking on-chain addresses to your identity | Possible at the on/off-ramp | Harder for purely self-custodied activity with no exchange contact |
| Transactions on privacy chains or mixers | Harder to trace | Not invisible; HMRC treats the use of privacy-enhancing tools as a risk indicator that invites closer scrutiny |
| Your intentions or reasons for a trade | Cannot see directly | Established through correspondence and records in an enquiry |
Channel one: exchange data and KYC
Every UK-regulated crypto exchange and many major international ones operating in the UK must carry out Know Your Customer (KYC) checks under anti-money-laundering rules. This means the exchange holds your name, address, date of birth, and often a copy of your identity documents. It also holds a record of every trade, deposit, and withdrawal on your account.
HMRC has used its formal information powers under the Taxes Management Act 1970 to request bulk customer data from UK crypto exchanges for a number of years. This pre-dates CARF and is separate from it. If you used a UK exchange, HMRC may already hold data about your account. This is not new information, but it is underappreciated: many holders believe the crypto world is anonymous when the exchange they use has already linked their real identity to every transaction.
International exchanges present a more complex picture, but cross-border information exchange between HMRC and foreign tax authorities is routine, and CARF is designed to extend the systematic reporting obligation to overseas platforms serving UK users.
Channel two: CARF makes exchange reporting systematic
The Cryptoasset Reporting Framework (CARF) is an OECD-designed international standard that the UK has adopted. It moves exchange data reporting from ad-hoc HMRC requests to an annual systematic obligation. Under HMRC's CARF collection rules, UK cryptoasset platforms must collect user and transaction data from 1 January 2026. The first report to HMRC covers the 2026 calendar year (1 January to 31 December 2026) and must be submitted between 1 January 2027 and 31 May 2027. Annual reports follow by 31 May each year thereafter.
This is what the "HMRC cannot see my exchange" era ending means in practice: your 2026 exchange activity will land with HMRC in early 2027, automatically, without any individual request. If your Self Assessment return for 2025/26 (due January 2027) does not match what the exchange reports, that discrepancy is flagged through data-matching. CARF does not reach back to collect data from years before 2026 under this framework, though those years remain open to investigation under existing powers.
For the full CARF timeline, dates, and what platforms must report, see our dedicated explainer: CARF 2026: what HMRC's new crypto reporting rules mean for you.
Channel three: on-chain analytics
Public blockchains such as Bitcoin and Ethereum record every transaction on a transparent, permanent ledger. Anyone, including HMRC and the commercial analytics firms it works with, can see every address, every transaction amount, and every movement of funds. The blockchain does not know your name, but it knows every address that has ever held or moved those tokens.
What analytics tools do is cluster addresses into wallets, trace flows across chains and bridges, and flag addresses associated with known exchanges, mixers, or sanctioned entities. The critical link to your identity comes at the on/off-ramp: the point where your funds moved from or to a KYC exchange. At that point, the exchange's identity record connects to a cluster of on-chain addresses in the analytics tool's model.
There are real limits: clustering heuristics are not infallible, cross-chain bridges and wrapped tokens complicate tracing, and purely self-custodied activity with no exchange contact is harder to attribute to a named individual. But the capability is meaningfully better than most holders assume. HMRC has publicly confirmed it uses blockchain analytics tools in its compliance work.
The "self-custody wallet they cannot see" belief
A common assumption is that funds held in a self-custody wallet (a hardware wallet or a non-custodial software wallet) are invisible to HMRC because there is no exchange in the middle. This is weaker than it sounds for most people.
If you ever moved funds between a self-custody wallet and a KYC exchange, that on/off-ramp transaction is on the public blockchain. The exchange knows your identity. The analytics tool can see the on-chain flow between your exchange deposit address and your self-custody wallet. The connection exists; it takes effort to trace, not impossibility.
For someone who has never touched a KYC exchange and who bought crypto peer-to-peer in cash, the identity link is much weaker. That is a small minority of UK holders, and even then, disposing of crypto for value in the UK without a chain that eventually hits a payment system is difficult in practice.
The honest conclusion: self-custody is not invisibility. It reduces the directness of HMRC's data access, particularly for amounts that never touched an exchange. It does not eliminate it.
What HMRC can do with this data
HMRC uses exchange data and on-chain analytics for data-matching: comparing what platforms report about your activity against what appears in your Self Assessment return. Where there is a gap, a discrepancy, or no return at all for a year with apparent taxable activity, HMRC's compliance teams can decide to act.
The most common initial step is a nudge letter: a letter saying HMRC has information suggesting you may have crypto gains to declare, inviting you to review and correct your return. Nudge letters are not assessments and are not enquiries. They are a prompt. Responding is always the right move; ignoring a nudge letter is not.
If you receive a nudge letter, see our companion post on exactly what to do: HMRC crypto nudge letter: what to do when it arrives.
Where data-matching reveals more significant discrepancies, HMRC can open a formal enquiry under section 9A of the Taxes Management Act 1970, or make a discovery assessment. In serious cases involving deliberate concealment, HMRC can investigate back 20 years. For careless behaviour the window is 6 years; for cases where reasonable care was taken it is 4 years. These year counts are from HMRC's cryptoasset disclosure guidance. Penalties vary by behaviour and by whether the disclosure is unprompted or prompted; an unprompted voluntary disclosure before HMRC makes contact consistently produces the lowest penalty outcome.
What HMRC's data-matching cannot do automatically is produce a tax bill. Tax due on crypto must be calculated on the actual facts: which disposals were made, at what prices, with what allowable costs under the s104 pooling rules, applying the same-day and 30-day override rules. Data-matching flags the gap; an accountant or the taxpayer fills in the facts.
If your history is untidy: the window to act
The first CARF report reaches HMRC between 1 January and 31 May 2027. That is the most concrete near-term date in the timeline. Before that report lands, a voluntary disclosure made through HMRC's cryptoasset disclosure service is an unprompted disclosure, which carries the lowest penalty range available for your behaviour band. After HMRC contacts you, any disclosure becomes prompted, and the penalty range rises.
If you have unreported gains or income from crypto, whether from sales, crypto-to-crypto swaps, staking rewards, or mining, the practical window to get ahead of the data is now. The crypto disclosure estimator gives you a rough sense of what tax exposure and penalty exposure might look like based on the facts you input. It ends at an estimate, not a filing-ready figure; the actual calculation requires the full transaction history and correct application of the pooling and override rules.
For the wider picture of how many UK adults hold cryptoassets and when CARF data starts reaching HMRC, see the UK Crypto Tax Compliance Index. HMRC publishes no crypto-specific tax gap, so the index states none; it sets out the verified ownership and reporting timeline instead.
If you want to understand the scope of disclosure required and get the calculation right, the HMRC disclosure service is the right starting point. The goal is always the same: voluntary, accurate, before first contact, to minimise both the tax owed (by correctly claiming all allowable costs and losses) and the penalty exposure.