The UK Cryptoasset Regime and CARF: What Boards and Family Offices Should Know

Editorial note (reviewed June 2026). The UK cryptoasset regime and the tax-transparency rules described below are being phased in over 2026–2027, and dates and detail can move. This article links to primary sources and is reviewed periodically — always check the linked legislation.gov.uk, FCA, HMRC, and OECD pages for the current position. Nothing here is legal, tax, or investment advice; take specialist advice on your own circumstances.

Why this matters to UK boards and family offices now

The headline for any board, treasury committee, or family office holding — or considering — Bitcoin is simple: the direction of travel is more regulation and more information-sharing, not prohibition. Two distinct workstreams are arriving at once, and they are often conflated:

1. Conduct regulation — the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring cryptoasset services (running an exchange, dealing, arranging, custody, stablecoin issuance) inside the FCA’s perimeter.
2. Tax transparency — the OECD’s Crypto-Asset Reporting Framework (CARF), now implemented in UK law, makes the platforms you use report account and transaction data to HMRC, which then exchanges it with other tax authorities.

Neither rule bans holding Bitcoin. But both change who must be authorised to serve you and what HMRC will already know about your holdings — which is exactly the kind of operational and governance detail a board is expected to have considered. The practical task is not to react to a ban that isn’t coming; it is to confirm your providers are inside the new perimeter and your reporting is in order before the rules bite.

1. The FSMA 2026 cryptoasset regime — what actually changes

The UK has now made the FSMA 2000 (Cryptoassets) Regulations 2026 (SI 2026/102, made 4 February 2026). They bring a defined set of cryptoasset activities into the regulatory perimeter, so that carrying them on by way of business in the UK will require FCA authorisation. The activities in scope include:

• Operating a cryptoasset trading platform (exchanges and venues)
• Dealing in cryptoassets as principal or agent
• Arranging deals in qualifying cryptoassets (including introductions to dealers or custodians)
• Custody (safeguarding and administering cryptoassets)
• Stablecoin issuance and related payment activities

What this means for a corporate holder or family office: the obligations fall primarily on the service providers you use, not on you as a holder. Owning Bitcoin on your own balance sheet, or in a properly structured custody arrangement, is not itself a regulated activity. The change is that the exchange, broker, or custodian you rely on will increasingly need to be FCA-authorised — and “arranging deals” being in scope is the reason any introduction to a dealer or OTC desk must come from, or be approved by, an authorised firm. (This is also why a genuinely independent research publisher stays education-only: it does not arrange deals or make personal recommendations. See our editorial standards.)

Always confirm the current scope against the FCA’s cryptoasset pages, as the detailed rules are being consulted on and finalised through 2026–2027.

2. The authorisation gateway — the dates that matter

The regime is being phased in, not switched on overnight. The sequence announced is:

• Authorisation gateway opens — 30 September 2026. Firms intending to carry on the newly regulated activities can apply to the FCA for authorisation.
• Application window — through to 28 February 2027. Existing firms are expected to apply within this window to continue operating as the regime commences.
• Full commencement — expected around 25 October 2027. From commencement, carrying on an in-scope activity by way of business without authorisation (or the benefit of an approved arrangement) is a breach.

For a board, the gateway timeline creates one concrete, near-term diligence question: is every provider you depend on — exchange, custodian, OTC desk — preparing to enter, or already inside, the gateway? A provider that does not apply within the window may have to run off its UK cryptoasset business, which is a continuity risk for your holdings and your reporting. This is a procurement and counterparty-risk conversation to have in 2026, not 2027.

Monitor the FCA cryptoassets hub for the authorisation rules and the firm-readiness materials as they are published.

3. CARF — your platforms will report your holdings to HMRC

The second workstream is tax transparency, and it is the one most boards have not yet absorbed. The Crypto-Asset Reporting Framework (CARF) is the OECD’s global standard for the automatic exchange of cryptoasset information between tax authorities — the crypto equivalent of the Common Reporting Standard (CRS) that already covers bank accounts — and HMRC has published guidance on reporting cryptoasset user and transaction data under it.

How it works in the UK:

• Reporting cryptoasset service providers (exchanges, brokers, certain wallet and custody providers) must collect identity and tax-residence information on their users and report transaction and balance data.
• The UK began collecting CARF data from 1 January 2026, with the first reports due to HMRC, and the first international exchanges of that data, from 2027.
• HMRC then automatically exchanges the data with the tax authorities of partner jurisdictions where users are resident.

What this means in practice: if your company, trust, or family office holds Bitcoin through a reporting platform, HMRC will increasingly receive that information directly — and so will overseas authorities for any non-UK-resident connected parties. The era in which cryptoasset holdings were effectively invisible to tax authorities is closing. The governance response is straightforward and unglamorous: ensure your record-keeping, tax filings, and any disclosures are accurate and consistent with what the platforms will report, because mismatches are exactly what automatic exchange is designed to surface. For the underlying UK tax treatment of disposals, income, and inheritance, see our guide to tax implications for Bitcoin investors and HMRC’s Cryptoassets Manual.

4. The financial promotion regime — what you receive, not what you hold

A third rule frequently confused with the two above is the cryptoasset financial promotion regime, in force since 8 October 2023. Under it, the FCA requires cryptoasset promotions to UK consumers to carry clear risk warnings, to ban incentives to invest, and to be communicated or approved by an authorised person.

For a board, the relevant point is that this regime governs the marketing you receive, not the Bitcoin you hold. A legitimate promotion will be risk-warned and traceable to an authorised firm; an aggressive, warning-free “opportunity” is a red flag of a firm operating outside the rules. Treat the presence — or absence — of a compliant risk warning as a basic counterparty-quality signal.

5. A practical board / family-office checklist

This is education, not advice — but these are the questions a well-run treasury or investment committee can reasonably work through, with professional input:

1. Map your providers. List every exchange, broker, OTC desk, and custodian you use. For each, confirm whether they intend to enter the FCA authorisation gateway (open from 30 September 2026) — and what their plan is if they do not.
2. Confirm custody arrangements. Understand whether custody is in scope of the new perimeter for your provider, and what protections apply to your assets if a provider exits the UK market.
3. Reconcile records to CARF. Ensure your transaction records, cost basis, and tax filings are accurate and will reconcile with the data your platforms report to HMRC from 2027.
4. Identify cross-border exposure. Where the entity, its beneficial owners, or connected parties are non-UK resident, map which jurisdictions will receive exchanged data and confirm filings there.
5. Vet inbound promotions. Treat any cryptoasset promotion without an FCA-aligned risk warning, or not traceable to an authorised firm, as a counterparty red flag.
6. Take specialist advice. The points above are starting questions; the application of the regime and of CARF to a specific entity, structure, or holding requires qualified legal and tax advice.

Frequently Asked Questions

Does the FSMA 2026 regime make holding Bitcoin illegal?

No. The regime regulates cryptoasset services — operating platforms, dealing, arranging, custody, and stablecoin issuance — carried on by way of business. Holding Bitcoin on a balance sheet or in a properly structured custody arrangement is not itself a regulated activity. The change is that the firms providing services around your Bitcoin will need FCA authorisation.

What is CARF, and does it apply to my company or family office?

CARF is the OECD’s global framework for the automatic exchange of cryptoasset information between tax authorities. It places the reporting obligation on cryptoasset service providers, not on holders directly — but the practical effect is that the platforms you use report your holdings and transactions to HMRC (from 2027 in the UK), which then exchanges that data with other jurisdictions. If you hold Bitcoin through a reporting platform, your information is in scope.

When do the new rules take effect?

They are phased. CARF data collection began on 1 January 2026, with first reports from 2027. The FCA authorisation gateway opens on 30 September 2026, with applications expected through to 28 February 2027, and full commencement of the conduct regime is expected around 25 October 2027. Always confirm current dates against the FCA and legislation.gov.uk.

What is the single most important step to take now?

Confirm that the exchanges, brokers, and custodians you rely on are preparing to enter the FCA authorisation gateway, and that your records will reconcile with what those providers report to HMRC under CARF. Both are diligence tasks best started in 2026.

Does this affect self-custody?

Self-custody of your own Bitcoin remains lawful and is not a regulated service. However, the moment you transact through a regulated platform, that platform’s CARF reporting and AML obligations apply to the transaction. Self-custody does not exempt you from accurate tax reporting.

Key UK and international resources

Primary sources

• The regime — FSMA 2000 (Cryptoassets) Regulations 2026 (SI 2026/102), legislation.gov.uk
• The regulator — FCA cryptoassets
• Tax treatment — HMRC Cryptoassets Manual
• Tax transparency (CARF) — Reporting to HMRC if you provide cryptoasset services in the UK and Reporting cryptoasset user and transaction data, GOV.UK — the UK implementation of the OECD’s Crypto-Asset Reporting Framework

Related reading on this site

• Regulatory changes impacting crypto in the UK
• Tax implications for Bitcoin investors
• Bitcoin mining in the UK