Received an HMRC Crypto Letter? Here is What to Do

Every tax figure below is drawn from HMRC's published guidance on gov.uk and cited to it. Where a statistic is not published by HMRC on gov.uk, its source is named. The sources are listed in full at the end.

Why HMRC Is Writing to Crypto Holders

The volume of correspondence is not an HMRC published statistic. The figure widely reported comes from Freedom of Information data obtained by the accountancy firm UHY Hacker Young, which reported that HMRC sent almost 65,000 nudge letters to crypto traders in the 2024/25 tax year, up from 27,700 the year before (UHY Hacker Young).

What HMRC does publish is that its information position is about to get considerably better. The first period the Cryptoasset Reporting Framework covers is the 2026 calendar year, beginning 1 January 2026, and UK reporting cryptoasset service providers must "submit your first report between 1 January 2027 and 31 May 2027, giving details for 1 January 2026 to 31 December 2026" (Reporting cryptoasset user and transaction data). Our CARF guide covers what that reporting contains.

The Two Main Letter Types

Nudge letters are the more common. HMRC sends these where it holds information suggesting a taxpayer may have undeclared gains or income, and asks the recipient to review their tax affairs and correct anything that is wrong. A nudge letter is not a finding that tax has been underpaid. Each letter sets its own response period, so recipients work to the date printed on the letter rather than to a general rule.

Formal enquiry and investigation letters are a different matter. HMRC's power to enquire into a Self Assessment return sits in section 9A of the Taxes Management Act 1970, and where a return was delivered on or before the filing date, notice can be given "up to 12 months from the date the return is delivered" (SALF403).

At the serious end, HMRC issues Code of Practice 9 where it suspects tax fraud, offering the Contractual Disclosure Facility. Under that contract you must make "a complete, accurate, open and honest disclosure of all your deliberate behaviour" and "fully cooperate with us to put your tax affairs in order", and in return "the Commissioner's for HMRC undertake not to commence a criminal investigation into the suspected frauds related to the deliberate behaviour you disclose". You have "60 days from the date you receive the offer of the CDF to tell us whether you accept the offer, or reject the offer" (Code of Practice 9). Because acceptance is contractual and the window is 60 days either way, recipients of a COP9 offer ordinarily take professional advice before replying to it.

Need help with your crypto taxes?

We introduce you to an ICAEW-regulated firm of chartered accountants. Whether the firm takes on your matter is its decision alone.

Start your enquiry

Free to enquire · No obligation.

What Ignoring It Costs

It also costs the better of the two penalty columns below. Once HMRC has made contact, any disclosure that follows is a prompted one, and the minimum penalty in every behaviour band rises.

Where a recipient's affairs are already in order, the usual course is to respond saying so, provide whatever HMRC has asked for, and keep a copy of what was sent.

What People Usually Do First

Records are gathered first. HMRC is explicit that the record-keeping duty sits with the taxpayer: "You must keep your own records of your transactions", because exchange reports do not track pooled costs (Check if you need to pay tax when you sell cryptoassets). HMRC's list covers the type of token, the date of disposal, the number of tokens disposed of, the number remaining, the pound sterling value, bank statements, and the pooled costs before and after the disposal.

The position is then worked out, not estimated. That means a computation of gains and income for each year in question. HMRC's guidance ties the calculation to the pooled costs exchange reports do not hold, which is the same reason the record-keeping duty sits with the taxpayer (Check if you need to pay tax when you sell cryptoassets). The pooling rules that govern it are in our main UK crypto tax guide.

Advice is taken before the reply goes back. How a response is framed determines which behaviour band and which disclosure column apply, and HMRC sets those bands out in its own factsheet (CC/FS7A). The reply is the point at which the column is fixed, which is why it comes after the advice rather than before it.

The Two Routes: Voluntary Disclosure or Waiting

HMRC operates a dedicated route for crypto. Its Cryptoasset Disclosure Service is for making "a voluntary disclosure of any unpaid tax if you have income or gains from cryptoassets, including exchange tokens, NFTs and utility tokens" (Tell HMRC about unpaid tax on cryptoassets).

How many years a disclosure must cover depends on behaviour. HMRC states you "will only have to pay us what you owe for 4 years" if you took care to get your tax affairs right but still did not pay enough, "a maximum of 6 years" if you did not take enough care, and "a maximum of 20 years" if you deliberately did not pay enough. The service also requires the person disclosing to calculate interest and the penalty themselves, and HMRC then reviews whether the penalty applied is fair.

Waiting instead means HMRC sets the timetable, requests the documents, and produces the first assessment, which the taxpayer then has to respond to.

Penalties for Undeclared Tax

Penalties are charged as a percentage of the unpaid tax, not of the gain. The percentage depends on the behaviour behind the error and on whether you told HMRC before they approached you (an unprompted disclosure) or afterwards (a prompted disclosure).

HMRC's factsheet is explicit that care is a complete defence: "If you took reasonable care to get things right but your return or document still contained an inaccuracy, we won't charge you a penalty."

Behaviour	Unprompted disclosure	Prompted disclosure
Reasonable care taken	No penalty	No penalty
Careless	0% to 30%	15% to 30%
Deliberate	20% to 70%	35% to 70%
Deliberate and concealed	30% to 100%	50% to 100%

Every figure in that table is quoted from HMRC factsheet CC/FS7A, and the same maximums and minimums appear in the Compliance Handbook at CH82470.

Where you never told HMRC you needed to file at all, the failure to notify rules apply instead. The deliberate rows are the same. The non-deliberate row turns on timing: "0% to 30%" for an unprompted disclosure within 12 months of the tax being due, "10% to 30%" for an unprompted disclosure after 12 months or a prompted disclosure within 12 months, and "20% to 30%" for a prompted disclosure more than 12 months late. HMRC will not charge a failure to notify penalty where "you have a reasonable excuse for the failure" and "the failure wasn't deliberate" (CC/FS11).

Where the unpaid tax involves an offshore matter, the maximum rises with how readily the territory shares information with HMRC. HMRC's offshore factsheet gives the maximums by territory category: category 1, "The maximum penalty is 100% of the tax"; category 2, "The maximum penalty is 150% of the tax"; category 3, "The maximum penalty is 200% of the tax" (CC/FS17).

Interest also accrues on unpaid tax from the original due date, separately from any penalty.

How Far Back HMRC Can Go

The Compliance Handbook gives the ordinary assessment limit as "4 years from the end of the relevant tax period", extended to "6 years" where the loss of tax was brought about carelessly, a "12 year time limit" where income tax or capital gains tax has been lost and the lost tax involves an offshore matter, and a "20 year time limit" where the loss of tax was deliberate (CH51300).

The Worldwide Disclosure Facility

Where the non-compliance has an offshore element, there is a separate route. HMRC states: "Use the Worldwide Disclosure Facility (WDF) to disclose a UK tax liability that relates wholly or in part to an offshore issue", and that "Anyone who wants to disclose a UK tax liability that relates wholly or partly to an offshore issue can use the facility" (Worldwide Disclosure Facility: make a disclosure).

HMRC defines an offshore issue as including unpaid or omitted tax connected to "income arising from a source in a territory outside the UK", "assets situated or held in a territory outside the UK", and "activities carried on wholly or mainly in a territory outside the UK".

Which route fits a given set of facts, and how the years and figures are calculated, is a question people ordinarily put to an adviser before submitting anything.

Why the Computation Matters

A disclosure is only as good as the figures behind it. Getting the pooling, the same day and 30 day matching, or the treatment of staking and DeFi income wrong produces a disclosure HMRC then queries, and the reasonable care defence in the table above depends on the care actually taken.

Work of this kind involves reconstructing transaction histories from incomplete records, applying the rules for each activity type, assessing which years are in scope under the time limits above, and corresponding with HMRC.

Where a letter has arrived and the next step is unclear, taking advice before responding is what keeps the unprompted column above in reach.

This guide is for general information only and does not constitute tax advice. Tax rules change and individual circumstances vary. Always consult a qualified tax adviser before making decisions about your tax position. Nothing on this website creates a professional relationship.

Sources

Last reviewed: 30 July 2026.

Non-HMRC source, used only for the letter volume figure:

UHY Hacker Young: nudge letters sent to crypto traders more than double to 65,000

Quoted HMRC material contains public sector information licensed under the Open Government Licence v3.0.

Ready to speak to a professional?

Free to enquire · No obligation.

Start your enquiry