HMRC said the reforms are intended to ensure it continues to have access to the information needed to collect the correct amount of tax. It said any changes would be subject to proportionate safeguards protecting taxpayers and third parties, while balancing those protections against the department’s need to obtain information for compliance work.
The consultation closed on September 7 and HMRC said ministers have not yet made decisions on the proposed reforms. HMRC was also asked whether a software provider could be required to alter its systems to make previously inaccessible information readable, and whether wallet addresses or current cryptoasset balances could fall within the scope of a request. It was also asked what safeguards would apply to that information. HMRC said it was not able to answer while consultation responses were still being analyzed.
Crypto records are not always comparable with bank records. A bank statement shows what a bank holds for a customer. Some crypto records can reveal holdings and wallet addresses, which can then be read against a public blockchain to build a more detailed picture of activity than the historic disposal data needed to establish a tax position.
The UK is also introducing routine cryptoasset reporting under the OECD’s Crypto Asset Reporting Framework, while DAC8 is bringing similar tax reporting requirements across the EU. These regimes are separate from HMRC’s proposed information powers, but together they mean more identifying and transactional data about cryptoasset users is moving into tax systems.
When Data Becomes A Security Risk
The security concern around Bitcoin is not limited to fraud, phishing or account theft. Unlike money held in a bank, Bitcoin can be held directly by an individual and transferred without an intermediary able to freeze or reverse the transaction. If someone is identified as holding a significant amount, information about their identity, home address and holdings can therefore have consequences beyond financial privacy.
Physical attacks linked to crypto holdings have risen sharply in Europe. Forbes reported that France recorded 19 verified attacks in 2025, more than any other country, with 11 of 14 known cases tracked globally in the opening weeks of 2026 also occurring there. Forbes also reported on the case of a French tax official charged with using government tax software to look up crypto investors’ addresses and assets and selling the information to organized crime networks.
Gart maintains a database of physical attacks involving cryptocurrency, including cases of physical violence and attempts to extract crypto wealth worldwide.
Recap says its own system was deliberately built so the company cannot access customers’ portfolio data. CEO Dan Howitt said that if HMRC requested information the company does not hold, there would be nothing for it to provide. “Since Recap is built so that portfolio data is encrypted end-to-end and we never hold or can read that data, there’s simply nothing on our systems to hand over.”
Howitt said Recap would also challenge any attempt to require it to alter its software to make that information accessible, arguing that weakening encryption or creating a new route into customer data would undermine the security model the company has built.
The privacy and security concerns are also being debated across the EU. DAC8 requires cryptoasset service providers to report information including tax residence, tax identification numbers and annual transaction data.
Michal Nydrle, a partner at European crypto platform Invity, said regulated crypto businesses are already accustomed to collecting customer information under the Markets in Crypto-Assets Regulation. He described additional tax reporting as part of the sector’s move into the regulated financial system. His concern is less about whether reporting exists than about the amount of information being concentrated in one place. Nydrle said: “The real problem is risk, not reporting.”
He said databases connecting names, addresses and Bitcoin holdings can become attractive targets and argued that authorities should collect only information required by law, use aggregated data where possible and impose clear limits on retention, access and onward sharing.
The European Challenge
Bull Bitcoin, a non-custodial Bitcoin exchange, challenged France’s implementation of DAC8 in February 2026. It argues that the regime requires cryptoasset service providers to collect and transmit sensitive customer and transaction data on a scale it considers disproportionate, particularly when that information can be linked to a public blockchain. An attempt to suspend the implementing decree was rejected in September, but the Conseil d’État did not rule on the underlying legality of the regime.
Back in the UK, tax advisors are raising similar concerns about how broadly the proposed powers could operate in practice. Laura Knight, director of Knightbridge Tax, said she supports proportionate compliance measures but warned that the proposed definition of a cryptoasset service provider could bring tax software developers and professional advisors into a regime built around financial institutions.
Knight also raised concerns about how the proposed changes to the rules governing computer records and software could operate in practice. “Requiring access to live systems, proprietary source code, API keys or wallet controls would expose taxpayers to significant data security, intellectual property and physical safety risks that simply do not arise with traditional banking or securities data,” she said.
The Risk Does Not End With The Request
HMRC already has powers to obtain information, but cryptoasset records can reveal more once they are linked to a public blockchain. This is especially relevant for self-custodied Bitcoin, where an address can remain visible long after the original information request has been satisfied.
Linking identity data to that address can expose a persistent record of previous transactions and potentially make later movements easier to trace.
The final rules will need to set out what information HMRC can require, which businesses can be compelled to provide it and what safeguards apply when personal information is linked to blockchain data.
Once identity data is tied to a Bitcoin address, the risk can outlast the tax inquiry.
