Starting 1 January 2026, crypto exchanges operating in the UK will need to know where their customers live. Not roughly. Their actual home address.
The requirement comes from HMRC’s adoption of the OECD’s Crypto-Asset Reporting Framework, known as CARF. Privacy advocates are uneasy, because Bitcoin’s ledger is public and permanent, and they say pairing it with a street address creates a risk that is hard to undo.
What the new rules actually require
CARF applies to UK-based cryptoasset service providers. That category covers exchanges and wallet providers.
These firms must gather a detailed profile for each user. The list includes full name, date of birth, home address and tax identification number.
The scope is wide. Exchanges must collect this data for all individual users, not only those who carry out reportable activity.
The timeline is already fixed. Data collection begins in January 2026, and the first annual reports covering 2026 activity are due to HMRC by 31 May 2027.
International data sharing among CARF jurisdictions is expected to start around that same point. So the information may not stay inside the UK.
HMRC’s stated aim is tax compliance. The agency estimates the framework will help recover at least £300 million in unpaid tax over five years.
Why critics are worried about Bitcoin specifically
The concern is what that address gets attached to. Bitcoin transactions sit on a public blockchain that anyone can browse.
HMRC has been building toward this for a while. The agency has used blockchain analytics tools since 2020, which let it connect user identities to on-chain transactions.
Those tools allow HMRC to trace activity back to identifiable people. The new reporting rules give the agency a much richer dataset to match against.
Critics argue this pairing raises the stakes. Once a public Bitcoin address is linked to a name and a home address, anyone who gets hold of that mapping could see a person’s holdings and where they sleep at night.
Background: a global framework, a local rollout
CARF is not a UK invention. It is an OECD framework built for multiple jurisdictions to adopt and then exchange information with one another.
The UK is also looking beyond exchanges. A separate consultation on extending HMRC’s information-gathering powers to a broader range of crypto businesses closed on 7 September 2026.
What this means for users, exchanges and the market
For UK crypto users, the practical shift is simple. Using a domestic exchange will increasingly mean that your on-chain activity can be tied to you, and that link may be shared with other CARF jurisdictions.
The key dates are clear. Collection starts on 1 January 2026, the first reports land by 31 May 2027, and cross-border sharing is expected to begin around then.
The open question is whether HMRC’s projected £300 million in recovered tax will be judged worth the privacy trade-off. That debate will likely hinge on how well exchanges and governments protect the data, because a leak would turn a theoretical risk into a very real one.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.