If HMRC has written to you about cryptoassets, do not reply in a hurry and do not sign anything that certifies your tax position. Establish first which of six very different letters you have received, because a nudge letter, a section 9A enquiry, a Schedule 36 information notice, a COP8 investigation, a COP9 fraud investigation and a discovery assessment carry completely different rights, deadlines and penalty exposure. Getting that identification wrong is the single most expensive mistake taxpayers make.
We are chartered certified accountants who deal with HMRC crypto enquiries, voluntary disclosures and cryptoasset tax investigations for UK residents and non-residents. This page sets out the process as HMRC actually runs it, with the statutory references, so that you can see where you stand before you speak to anybody.
Which letter have you actually had?
Read the letter's reference and its opening paragraph against this table before you do anything else. The differences are not cosmetic.
| What arrived | What it legally is | Your deadline | Penalty exposure |
|---|---|---|---|
| “We have information that you may have disposed of cryptoassets”, often with a certificate of tax position | A nudge letter. No statutory force. Not an enquiry. HMRC is prompting you to review your own position | None in law. The 30 or 60 days stated is HMRC's preference, not a statutory deadline | Nil at this stage, but it converts a later disclosure from unprompted to prompted, which roughly doubles the minimum penalty |
| “Notice of enquiry into your Self Assessment return for the year ended 5 April 20XX” | A formal enquiry under s.9A TMA 1970 into one specific return | Must have been opened within 12 months of the date the return was actually delivered. Runs until a closure notice under s.28A | Schedule 24 FA 2007 inaccuracy penalties on any additional tax |
| A numbered list of documents and information demanded, citing Schedule 36 | A Schedule 36 FA 2008 information notice. Legally binding | Usually 30 days. Appealable in part, unless approved by the tribunal | £300 initial penalty plus up to £60 per day for continued failure |
| Booklet headed Code of Practice 8 | A COP8 investigation by HMRC's Fraud Investigation Service. Serious, but fraud is not alleged | Set by correspondence | Civil penalties. Can be escalated to COP9 if HMRC later suspects fraud |
| Booklet headed Code of Practice 9 with a Contractual Disclosure Facility offer | A COP9 investigation. HMRC suspects deliberate conduct, in other words tax fraud | 60 days to accept and submit an outline disclosure. This deadline is real | Civil penalties up to 100% of the tax, but immunity from criminal prosecution for the conduct disclosed |
| An assessment for a year HMRC never enquired into | A discovery assessment under s.29 TMA 1970 | 30 days to appeal | Depends on the behaviour HMRC alleges, which also sets how far back it can go |
Why the certificate of tax position is the trap
Most crypto nudge letters enclose a certificate of tax position and invite you to tick one of three boxes and sign. There is no legal obligation to complete or return it. It is not a statutory return and HMRC cannot penalise you for declining to sign it.
What it does do is create a signed statement that can later be used against you. If you tick “my tax affairs are up to date” and HMRC subsequently receives exchange data showing they are not, you have handed HMRC contemporaneous written evidence of deliberate behaviour. That single word moves the assessing window from four years to twenty and the penalty band from a maximum of 30% to a maximum of 100%. The correct response to a nudge letter is a substantive letter setting out your actual position, or a disclosure, not a ticked box.
How an HMRC crypto enquiry runs, step by step
1. Risk identification
HMRC's Risk and Intelligence Service matches exchange data, bank credits from crypto on-ramps, and Companies House and Land Registry records against filed returns. From 1 January 2026 UK exchanges and custodians collect and report user and transaction data on UK residents under the OECD Cryptoasset Reporting Framework, with the first exchange of data due in 2027.
2. The opening letter
Either a nudge letter, or a formal notice of enquiry under s.9A TMA 1970 for a specific year, or a COP8 or COP9 booklet.
3. Information gathering
An informal request first. If it is not met, a Schedule 36 FA 2008 information notice, which is legally enforceable. HMRC can also issue third-party notices to exchanges and banks, in most cases with tribunal approval.
4. Scoping the years
HMRC will state which years it considers to be in time. This is the argument worth having early, because the behaviour it alleges controls the window.
5. Meeting or written correspondence
Attendance at a meeting is voluntary in a civil enquiry. Notes should be agreed in writing. In a COP9 case the opening meeting is materially different and should never be attended unrepresented.
6. Computation and reconstruction
This is where crypto cases are won or lost. HMRC will usually work from exchange exports and treat unmatched inflows as taxable receipts. A properly reconstructed section 104 pool with the same-day and 30-day matching rules applied correctly almost always produces a lower figure.
7. HMRC's view of the tax
A schedule of additional tax, plus interest, plus a penalty proposal.
8. Behaviour and penalty negotiation
The behaviour band, and your disclosure, telling, helping and giving access, together determine the penalty. This stage is worth more in cash terms than the tax computation itself.
9. Closure notice or contract settlement
A closure notice under s.28A TMA 1970 amends the return. Alternatively HMRC offers a contract settlement covering several years in one binding agreement.
10. Appeal, if needed
You have 30 days to appeal. You may request an HMRC internal review, and you may take the matter to the First-tier Tribunal (Tax Chamber). Alternative dispute resolution is available at most stages.
How far back can HMRC go?
The assessing window is set by the behaviour HMRC establishes, not by how much tax is at stake. This is why the word used to describe your conduct matters more than any other word in the file.
| Behaviour | Years HMRC can assess | Statute |
|---|---|---|
| Reasonable care taken, but an error was made | 4 years from the end of the tax year | s.34 TMA 1970 |
| Careless | 6 years | s.36(1) TMA 1970 |
| Careless, where the lost tax involves an offshore matter or offshore transfer | 12 years | s.36A TMA 1970 |
| Deliberate | 20 years | s.36(1A) TMA 1970 |
| Failure to notify chargeability | 20 years | s.36(1A) TMA 1970 |
For a taxpayer who bought bitcoin in 2016, swapped through several tokens and never filed, the difference between careless and deliberate is the difference between six years of exposure and twenty.
The 12-year offshore limit in s.36A is the one most often overlooked, and it interacts directly with the situs point below. If cryptoassets held by a UK resident are not an offshore matter, as HMRC’s own guidance indicates, then careless behaviour should attract the six-year limit rather than twelve. Where an HMRC letter asserts the longer window on the basis that the exchange is overseas, that assertion should be tested rather than accepted.
What are the penalties?
Inaccuracy penalties sit in Schedule 24 FA 2007 and are expressed as a percentage of the potential lost revenue. Within each band, the actual percentage is set by the quality of your disclosure, measured across telling, helping and giving access to records.
| Behaviour | Unprompted disclosure | Prompted disclosure |
|---|---|---|
| Careless | 0% to 30% | 15% to 30% |
| Deliberate but not concealed | 20% to 70% | 35% to 70% |
| Deliberate and concealed | 30% to 100% | 50% to 100% |
Read that table alongside the nudge letter point above. A disclosure made before HMRC writes to you is unprompted and can carry a nil penalty for careless behaviour. The same disclosure made after the letter lands has a floor of 15%. On £80,000 of tax, that is £12,000 that existed only because of the delay. Interest under s.101 FA 2009 runs on the tax regardless of the penalty outcome.
Is crypto an offshore matter? Usually not, and it matters a great deal
Offshore non-compliance attracts substantially higher penalties, up to 200% in the worst territory category, and HMRC letters sometimes assert that crypto held on a non-UK exchange is an offshore matter. In most cases it is not.
HMRC's own published view, at CRYPTO22600 of the Cryptoassets Manual, is that an exchange token is located where its beneficial owner is resident. For a UK resident holder, the asset is therefore UK situated, whatever the domicile of the exchange, and the offshore penalty uplifts and the offshore asset moves provisions do not bite in the ordinary case. Where an enquiry letter assumes otherwise, that assumption is worth challenging on day one rather than at settlement.
Voluntary disclosure: which route?
If HMRC has not yet written to you, or has only sent a nudge letter, you can still disclose on your own initiative. There are two routes and they are not interchangeable.
| Digital Disclosure Service | Contractual Disclosure Facility (COP9) | |
|---|---|---|
| Use it when | Behaviour is at worst careless, or deliberate but you want the standard civil route | Conduct was deliberate and you want certainty against criminal prosecution |
| How it starts | You notify HMRC, then you have 90 days to calculate, disclose and pay | You request CDF, or accept HMRC's offer within 60 days, then file an outline disclosure |
| Criminal protection | None as such | Yes, for the conduct fully and accurately disclosed |
| Penalty effect | Unprompted rates available if HMRC has not contacted you | Civil penalties only, negotiated |
Full detail on the disclosure routes, nudge letters and the CARF timetable is on our HMRC crypto disclosure and CARF page.
A worked example
A UK resident bought £40,000 of crypto between 2018 and 2021, traded actively across four exchanges and two self-custody wallets, and never filed a return for any of it. HMRC issues a nudge letter, then a discovery assessment for eight years, alleging deliberate behaviour, based on exchange data showing gross disposal proceeds of £1.2m.
- HMRC's opening position. Proceeds of £1.2m treated as largely untaxed gain, twenty-year window, deliberate and concealed, prompted, penalty at 70%.
- What the reconstruction showed. Of the £1.2m, £930,000 was internal churn between the client's own wallets and repeated round trips through stablecoins. The true aggregate chargeable gain across all years was £186,000, not £1.2m.
- Behaviour. The client had used tax software, had misread the transfer rules and had a contemporaneous record of the mistake. That evidences careless, not deliberate. Window falls from twenty years to six.
- Penalty. Careless, prompted, with full telling, helping and giving access: 15%, the bottom of the band.
The tax at stake changed by an order of magnitude, and none of it turned on a clever argument. It turned on rebuilding the transaction history properly and on characterising the behaviour with evidence.
How we handle a crypto enquiry
- Identify the letter and stop the clock. We confirm what has actually been opened, hold any deadline that can be held, and take over correspondence under a 64-8 authority.
- Rebuild the transaction history. Exchange exports, on-chain data, dead and delisted exchanges, missing cost basis and unlabelled transfers, reconciled into a defensible ledger. This is the same work described on our exchange and wallet transaction analysis page.
- Compute it properly. Section 104 pooling, same-day and 30-day matching, allowable costs, income versus capital characterisation for staking, mining, airdrops and DeFi, and relief for stolen or worthless tokens.
- Argue the behaviour and the window. With evidence, not assertion.
- Negotiate the settlement and, where appropriate, time to pay.
Frequently asked questions
Do I have to sign the certificate of tax position HMRC sent me?
No. There is no statutory obligation to complete or return a certificate of tax position, and HMRC cannot penalise you for not signing it. Signing one that later proves inaccurate is, however, strong evidence of deliberate behaviour, which extends HMRC's assessing window to twenty years and raises the penalty ceiling to 100%. Reply substantively instead.
Does HMRC know about my crypto?
Increasingly, yes. HMRC has for several years obtained data from UK-facing exchanges using its information powers, principally third-party information notices under Schedule 36 FA 2008 and bulk data-gathering powers under Schedule 23 FA 2011, and has run successive nudge-letter campaigns off the back of it. Separately, from 1 January 2026 UK cryptoasset service providers must collect and report identifying and transaction data on their users under the Cryptoasset Reporting Framework, with the first international exchange of that data due in 2027. Assume the data exists.
How far back can HMRC go on undeclared crypto gains?
Four years if you took reasonable care, six years if you were careless, twelve years where careless behaviour involves an offshore matter or offshore transfer under s.36A TMA 1970, and twenty years if the behaviour was deliberate or you failed to notify chargeability. HMRC decides which it is alleging, and that allegation is contestable. It is usually the most valuable point in the whole case.
What is the difference between COP8 and COP9?
COP8 is a serious civil investigation where HMRC does not suspect fraud. COP9 is issued where HMRC suspects deliberate conduct amounting to tax fraud, and it comes with an offer of the Contractual Disclosure Facility: if you accept within 60 days and make a full and accurate disclosure, HMRC will not pursue a criminal investigation into the conduct disclosed. Never respond to a COP9 letter unrepresented.
Can I go to prison for not declaring crypto?
Criminal prosecution is possible for deliberate evasion, but HMRC's stated policy is that it deals with the overwhelming majority of cases civilly. The Contractual Disclosure Facility exists precisely to provide a civil route with immunity from prosecution for the disclosed conduct. Making a complete, unprompted disclosure before HMRC contacts you is the strongest protection available.
What if my crypto records are incomplete or the exchange no longer exists?
That is normal and it is not fatal. HMRC accepts computations built on a just and reasonable basis where records are genuinely unavailable, provided the methodology is documented and consistently applied. We reconstruct from on-chain data, surviving exports, bank records and counterparty evidence, and we document the assumptions so they can be defended rather than discovered.
Is crypto on a foreign exchange treated as an offshore matter?
Generally not. HMRC's published view at CRYPTO22600 is that an exchange token is situated where its beneficial owner is resident. A UK resident's tokens are therefore UK situated regardless of where the exchange is incorporated, so the higher offshore penalty categories should not apply in the ordinary case. Where HMRC asserts otherwise, challenge it early.
Should I just amend my old returns instead of disclosing?
Only the immediately preceding year can normally be amended, and only within twelve months of the filing deadline. Anything older has to go through the Digital Disclosure Service or the Contractual Disclosure Facility. Filing an amendment for a year you cannot amend achieves nothing and may look like an attempt to obscure the position.
Will using Koinly or another tax tool protect me?
It helps, but it is not a defence in itself. Tax software is only as good as the transfer labelling and cost basis fed into it, and the most common cause of an inflated HMRC figure is unmatched internal transfers being read as disposals. Where the software output was wrong through no fault of your own, the audit trail can support a reasonable care or careless finding rather than a deliberate one.
How much does defending an HMRC crypto enquiry cost?
It depends almost entirely on transaction volume, the number of exchanges and wallets involved, how many years are in scope and whether records survive. We scope the reconstruction first and agree a fixed fee before any substantive work begins, so the cost is known in advance rather than accruing hourly.
This page is general guidance on UK tax law as at 10 August 2026 and is not advice for any particular case. HMRC's internal manuals, including the Cryptoassets Manual, are guidance for HMRC staff, are not law, and do not bind HMRC in an individual case. Reviewed by the TaxDigit crypto tax team. Updated August 2026.
Get crypto clarity
Book a free, no-obligation consultation with a chartered certified accountant today.
Book a Consultation