HM Revenue and Customs sent 81,172 warning letters, emails and text messages to suspected under-declaring cryptocurrency holders during the 2025–26 financial year, according to a Freedom of Information request submitted by the accountancy firm UHY Hacker Young and seen by the BBC. That is almost triple the 27,714 nudges the tax authority issued in 2023–24. The escalation is not a rounding error or a seasonal blip — it is a deliberate widening of the net, and it lands two years into a period in which a great many UK taxpayers, including company directors and sole traders, made large realised and unrealised gains on digital assets without ever recording them in a form a tax inspector would accept.
For UK businesses the story is not really about cryptocurrency at all. It is about the quality of financial record-keeping, and about what happens when a tax authority acquires better data than the taxpayer has. From March 2027, cryptocurrency platforms in dozens of countries outside the UK will be legally obliged to hand customer data to tax authorities under new international reporting rules, and HMRC expects those powers to raise up to £315m by April 2030. On 24 August 2026, with the FOI figures in the public domain, the position is clear enough: the asymmetry that allowed casual record-keeping to survive is closing, and it is closing on a fixed date. This article sets out what HMRC has actually done, what changes in March 2027, and why the operational answer for a UK SME is a reporting system rather than another spreadsheet.
What HMRC actually sent, and what it means
The 81,172 figure covers what HMRC calls nudge letters — correspondence sent by post, email and text message to individuals the department believes may have under-declared tax on cryptocurrency holdings. A nudge letter is not an assessment and it is not the opening of a formal enquiry. It is a prompt: HMRC states that it holds information suggesting the recipient has held or disposed of crypto assets, and invites them to review their tax position and correct it voluntarily. An HMRC spokesperson described the exercise as routine activity intended to “educate, remind or prompt customers to review their tax affairs”, aimed at helping the majority of taxpayers get their returns right.
That framing is accurate as far as it goes, and it is worth taking at face value rather than reading conspiracy into it. HMRC issues nudge campaigns across many areas of the tax code, and the volume of letters in any given year reflects the volume of third-party data the department has been able to match against filed returns. But the framing also reveals the mechanism, and the mechanism is the point. HMRC does not send 81,172 letters on a hunch. It sends them because it has acquired data — from UK-based exchanges under existing information powers, from international exchange-of-information arrangements, from payment records, from its own analytics — and has run that data against self-assessment filings to find people whose declared position does not match what the department can see. The letter volume is therefore a direct proxy for HMRC’s data reach. Tripling the letters in two years means the reach has roughly tripled too.
The consequences of ignoring a nudge letter are not theoretical. Investors can face financial penalties or, in serious cases, prosecution for failing to declare capital gains tax on crypto profits. Critically — and this is the single most widely misunderstood point in the whole area — a chargeable disposal for capital gains purposes includes exchanging one cryptocurrency for another. You do not have to cash out to pounds sterling to create a taxable event. A holder who moved between tokens repeatedly during a rising market, never once withdrawing to a bank account and never once feeling wealthier in cash terms, may nonetheless have generated a long series of chargeable disposals, each with its own acquisition cost, disposal proceeds and gain or loss to compute. The absence of a bank transaction is exactly why so many people believe nothing happened, and exactly why their records are inadequate when HMRC asks.
Neela Chauhan, a partner at UHY Hacker Young, put the coming shift bluntly. Once HMRC has the data the new international rules will deliver, she warned, “tax investigations into cryptocurrency investors will be like shooting fish in a barrel”. She added that many younger traders in particular wrongly assume HMRC has limited visibility over their activity — an assumption that has been becoming less true every year and will stop being true altogether in March 2027.
If your company holds crypto assets on its balance sheet, accepts crypto in payment, pays contractors in tokens, or has directors whose personal holdings interact with company funds, the record-keeping burden falls on you and not on the exchange. HMRC’s nudge campaign is aimed at individuals today, but the same data-matching machinery reads corporation tax returns. The operational risk is not that you deliberately concealed a gain — it is that you cannot now reconstruct, to an auditable standard, the acquisition cost, disposal date and sterling value of a transaction you made three years ago on a platform you no longer use. From March 2027 HMRC will be able to reconstruct it. If your own records cannot, the difference between the two accounts is where penalties are assessed.
How we got here: the escalation in sequence
The current crackdown did not begin with a single announcement. It is the product of a rising asset market, a slow accumulation of information powers, and a tax authority that has spent several years building the analytical capacity to use them. Reading the sequence in order makes the direction of travel obvious, and makes the March 2027 date look less like a threshold and more like the point at which an existing trend becomes fully automated.
Where crypto record-keeping actually breaks down
It is tempting to read this story as a compliance problem for a niche group of speculative investors. In practice the failure modes are ordinary bookkeeping failures, and they will be familiar to anyone who has tried to close a set of accounts using data pulled from several disconnected systems. The chart below ranks the record-keeping requirements that create the most difficulty in practice, based on the demands the capital gains rules place on a taxpayer who is reconstructing several years of activity after the fact. The bars are indicative rather than survey data — they reflect the relative difficulty of each requirement, not a measured percentage of taxpayers.
Read the chart from the bottom up and the pattern is clear. The one scenario that spreadsheets handle adequately — a single platform, sterling in and sterling out, a handful of trades — is the scenario almost nobody is actually in. Everything above it involves joining data across sources, applying a rule consistently over a long period, and pricing an event that never touched a bank account. Those are database problems. They are solved by structured storage, a defined schema, referential integrity between transactions and the assets they move, and a reporting layer that can produce the same answer twice. They are not solved by a workbook with a tab per year and a column someone added in a hurry.
The specific trap in a rising-then-falling market deserves its own paragraph, because it catches people who believe they have nothing to declare. Bitcoin’s move from roughly £14,000 in December 2022 to roughly £90,000 in October 2025 was a gain of around 543% for anyone holding across that period. The subsequent fall to around £48,000 is a decline of roughly 47% from the peak — painful, but it does not reach back through time and cancel disposals already made. If a holder swapped tokens near the peak, the gain crystallised at peak prices. The tax follows the disposal, not the current portfolio value. A taxpayer sitting on a portfolio worth less than it was a year ago can still owe capital gains tax calculated on considerably higher numbers, and that liability is payable in sterling regardless of what the wallet is worth today.
The reach HMRC has today versus the reach it acquires
The clearest way to understand what changes in March 2027 is to look at the ratio between the two letter volumes. The 27,714 letters HMRC sent in 2023–24 amount to just 34% of the 81,172 it sent in 2025–26. That single ratio captures two financial years of expanding data reach — and it was achieved largely with domestic information powers and existing exchange-of-information arrangements, before the new international rules take effect at all.
Consider what the remaining 66% represents. Those are taxpayers HMRC could not see two years ago and can see now. No new legislation created them; better matching of data the department was already entitled to receive did. The March 2027 change is of a different order again, because it does not improve the matching of existing data — it adds an entirely new supply of it, from platforms in dozens of jurisdictions that previously sat outside the reporting perimeter. Offshore platform usage has historically been the single largest blind spot in this area. After March 2027 it is a reporting stream.
This is why Chauhan’s “shooting fish in a barrel” description is a reasonable characterisation rather than rhetoric. An investigation is expensive when the authority has to establish what happened. It is cheap when the authority already knows what happened and merely needs the taxpayer to explain a discrepancy. The economics of enforcement change completely at the point where the data arrives automatically, and enforcement activity tends to expand to fill whatever the economics permit. HMRC’s own £315m estimate by April 2030 is a statement about how much additional yield the department believes cheap enforcement will produce.
There is a second-order effect that matters more to a business than to an individual investor. When a tax authority holds better records than a taxpayer, the burden of proof shifts in practice even where it has not shifted in law. If HMRC presents a schedule of transactions derived from platform data and the taxpayer cannot produce their own schedule to compare it against, there is no argument to have — only a number to accept or a penalty position to negotiate. Good records are not merely a compliance formality. They are the only mechanism by which a business retains the ability to disagree.
Where UK SME financial record-keeping fails today
The nudge campaign is a useful diagnostic because it exposes a weakness that has nothing to do with digital assets. Most UK small and medium-sized businesses run their financial reporting on a combination of an accounting package, a bank feed, several spreadsheets and a quantity of institutional memory held by one or two people. That arrangement works well enough while every transaction has a bank line to anchor it. It fails as soon as a material event happens somewhere the bank feed cannot see — a crypto swap, a foreign platform, a marketplace payout, a payment processor holding balances, an intercompany transfer settled off-ledger. The grid below sets out where the exposure typically sits.
The rows marked high are the ones that turn a routine HMRC letter into an expensive problem. Each of them describes a situation in which the business cannot answer a factual question about its own past without a research project. That is a manageable annoyance when the question comes from a curious director. It is a materially different situation when the question comes with a statutory deadline attached and an assumption of the worst if it is not answered.
Note the row at the bottom. Bank reconciliation is the one control almost every business does have, and it is rated low precisely because it works. That is the useful lesson: the problem is not that UK SMEs are incapable of disciplined record-keeping. It is that the discipline was built around the bank statement, and a growing share of economically significant activity no longer passes through one. Extending the same discipline to everything else is a systems exercise, not a cultural one.
What getting this right costs a UK business
The question every finance director asks at this point is what remediation costs, and whether it can wait. The table below sets out indicative UK cost bands for putting proper transaction-level financial reporting in place, alongside the exposure that sits behind doing nothing. The figures are indicative planning ranges for scoping purposes, not quotations, and the exposure column reflects the general structure of capital gains liabilities and penalties rather than any prediction about a particular business.
| Business size | Typical data sources to consolidate | Indicative one-off reporting build | Indicative annual running cost | Exposure if records cannot be reconstructed |
|---|---|---|---|---|
| Sole trader / 1–4 staff | Bank, accounting package, one or two platforms | £1,500 – £4,000 | £600 – £1,800 | Tax on undeclared disposals plus penalties, assessed on HMRC’s figures rather than yours |
| 5–20 staff | Bank, accounting, payroll, payment processor, marketplace payouts | £4,000 – £12,000 | £1,800 – £5,000 | The above, plus director time lost to reconstruction and professional fees to defend a position you cannot evidence |
| 21–50 staff | Multi-entity ledger, several processors, FX, treasury or digital-asset balances | £12,000 – £30,000 | £5,000 – £14,000 | The above, plus audit qualification risk and delayed statutory filings |
| 51–150 staff | Group consolidation, multiple jurisdictions, automated data feeds | £30,000 – £75,000 | £14,000 – £35,000 | The above, plus disclosure obligations to lenders, investors and acquirers during diligence |
| Any size, after an HMRC enquiry opens | Whatever can still be recovered, under time pressure | Substantially higher — reconstruction is the expensive part | Unchanged once built | Highest — you are now paying for the system and the investigation at the same time |
The bottom row is the one worth dwelling on. Building a reporting system before you need it is a project with a scope, a budget and a timeline. Building one during an enquiry is the same work performed at speed, by people who are simultaneously answering correspondence, with an inspector setting the deadlines. The technical task is identical. The cost is not, and neither is the outcome, because a system assembled under pressure is optimised to answer this year’s question rather than to prevent next year’s.
There is a straightforward planning point in the March 2027 date. It is roughly eighteen months away as of August 2026. That is comfortably enough time to scope a reporting build, migrate historic data into it, reconcile the results against whatever records do exist, and identify any disclosure that needs making voluntarily rather than under prompt. It is not enough time if the work starts in 2027. Voluntary correction before a prompt is materially better than correction afterwards, and correction afterwards is materially better than an inspector arriving with a schedule you have never seen.
Reactive versus proactive financial reporting
Most businesses recognise themselves in one of the two columns below. The distinction is not about spending more — several of the reactive behaviours are expensive in aggregate, they are just expensive in small instalments that never appear as a line item. The distinction is about whether the business can answer questions about its own numbers on demand.
Reactive posture
What most SMEs do today
- Financial data lives across an accounting package, several spreadsheets and a handful of platform logins
- Reports are rebuilt by hand each quarter, and two people produce slightly different numbers
- Historic transactions are reconstructed only when someone asks — usually an accountant, at year end
- Nobody owns the question of where a given figure came from
- An HMRC letter triggers a fortnight of unplanned work and an unbudgeted professional fee
- Data on a platform the business stops using is simply lost
- The March 2027 deadline is noted, then deferred until it becomes urgent
Proactive posture
Where Cloudswitched Database Reporting takes you
- One structured database holds every transaction with its source, date, sterling value and supporting reference
- Reports are generated from that database, so the same question always returns the same answer
- Historic data is ingested once, reconciled once, and available thereafter without a research project
- Every figure has a lineage — you can show an inspector where it came from
- An HMRC letter triggers a query, not a fortnight
- Platform exports run on a schedule, so leaving a provider does not destroy the record
- The March 2027 change is a date in a plan rather than a deadline you are behind
The right-hand column is deliberately unglamorous. There is no analytics dashboard in it, no machine learning and no predictive modelling. Those things are worth having once the foundation exists, but they are downstream of it, and a business that builds them first has built a very sophisticated way of restating unreliable data. The foundation is a schema, a single source of truth, an ingestion routine for each external source, and a reporting layer that reads from the database rather than from somebody’s working copy. Everything else is elaboration.
The score above is an indicative assessment rather than a measured statistic, and it is constructed from the gaps in the grid earlier in this article. A business scores well on the components it has always had — a reconciled ledger, a filed set of accounts, a bank trail — and poorly on the components the last few years have made necessary: transaction-level records for activity that never touched the bank, consistent sterling valuation at the point of each event, and retained data from platforms the business no longer uses. Most of the shortfall is recoverable. Almost none of it recovers on its own.
Before commissioning anything, run one exercise: pick a single month from two years ago and try to produce a complete, evidenced list of every financial event in it — every source, every counterparty, every value in sterling at the date it happened. Give the task to one person and time it. If it takes an afternoon, your records are in reasonable shape and the work ahead is incremental. If it takes days, involves emailing former staff, or ends with a figure nobody is willing to sign, you have found your scope. That one test tells you more about your exposure to the March 2027 change than any amount of general assessment, and it costs nothing but the afternoon.
What this means for company accounts and for directors personally
HMRC’s 81,172 letters were directed at individuals, and it would be easy for a limited company to read the story as somebody else’s problem. That reading is too comfortable for three reasons, each of which has a direct operational consequence.
The first is that the same data-matching infrastructure serves the whole department. Information arriving under the March 2027 rules identifies account holders, and where an account holder is a company, the resulting mismatch is a corporation tax question rather than a capital gains one. The nudge-letter mechanism is not tied to any particular tax; it is tied to the availability of third-party data. A business that holds digital assets on its balance sheet, accepts them in payment, or settles supplier invoices in tokens has created exactly the kind of record HMRC will begin receiving automatically, and the accounting treatment of those transactions needs to be evidenced to the same transaction-level standard as anything else in the ledger.
The second is the boundary between director and company, which in a small business is often more porous in practice than it is on paper. Where a director has used personal holdings to fund company activity, or the company has reimbursed a director for an asset purchase, or a token payment has been received into a personal wallet and passed on, the transaction sits in both worlds and needs to be documented in both. These are precisely the arrangements that are never written down at the time, because at the time they are obvious to everyone involved. Two years later they are obvious to nobody, including the people who made them.
The third is diligence. A business being sold, raising investment, or applying for lending will be asked to evidence its financial history by a party with every incentive to look carefully. An unresolved tax position around digital assets is the sort of finding that does not necessarily kill a transaction but reliably slows it and costs money in warranties and indemnities. The March 2027 change increases the likelihood that such a position is identified by HMRC first, which is the worst order in which to discover it.
None of this requires a business to have taken a view on cryptocurrency as an asset class. The point is narrower and more durable: the tax authority is acquiring transaction-level visibility into economic activity that does not pass through a UK bank, and the reasonable response is to acquire the same visibility into your own affairs first. Whatever the asset, a business that can produce a complete, dated, sterling-valued and evidenced record of its transactions is in a fundamentally different position from one that cannot.
At a glance
| Item | Detail |
|---|---|
| Letters sent in 2025–26 | 81,172 warning letters, emails and text messages to suspected under-declaring crypto holders |
| Letters sent in 2023–24 | 27,714 — almost a third of the current-year figure |
| Increase over two financial years | Almost triple; the earlier figure is 34% of the later one |
| How the figures became public | Freedom of Information request by accountancy firm UHY Hacker Young, reported by the BBC |
| What a nudge letter is | A prompt to review and correct your tax position voluntarily — not a formal enquiry or assessment |
| HMRC’s stated purpose | To “educate, remind or prompt customers to review their tax affairs”; described as routine activity |
| Penalty for non-declaration | Fines, or prosecution in serious cases, for failing to declare capital gains tax on crypto profits |
| Most misunderstood rule | Swapping one cryptocurrency for another is a chargeable disposal — cashing out to sterling is not required |
| What changes in March 2027 | Crypto platforms in dozens of countries outside the UK must share customer data with tax authorities |
| Expected revenue from the new powers | Up to £315m by April 2030 — equivalent, HMRC noted, to funding more than 10,000 newly qualified nurses for a year |
| Industry view | Neela Chauhan, UHY Hacker Young: investigations will be “like shooting fish in a barrel” once HMRC has the data |
| Price context | Bitcoin around £14,000 in December 2022, roughly £90,000 in October 2025, around £48,000 more recently |
| Why the fall does not help | Tax follows the disposal, not the current portfolio value — historic gains remain chargeable after a price fall |
| Business relevance | Record-keeping quality, not asset choice: transaction-level, dated, sterling-valued and evidenced |
| Time remaining as of 24 August 2026 | Roughly eighteen months to build and reconcile before the data-sharing rules begin |
Related coverage
This story sits alongside several themes we have covered recently. The reporting-quality argument is the same one that applies to any system a business depends on but does not control — a point that came up starkly in our coverage of the maximum-severity Entra ID flaw Microsoft fixed silently, where the vendor closed the hole but published nothing customers could use to check their own logs. On the governance side, the NCSC’s guidance on agentic AI safety makes a related case about evidencing what automated systems have actually done rather than assuming it. For the commercial planning angle, our analysis of the Harvest SaaS price increase and its effect on UK budgets looked at how fixed future dates should be handled in a budget rather than absorbed as a surprise. And on infrastructure, the Gamma Communications takeover and what it means for UK VoIP and the Openreach XGS-PON 10Gbps rollout both deal with the same underlying question: what happens to your operations when a provider you depend on changes the terms.
Can you evidence three years of transactions?
Cloudswitched Database Reporting builds the structured foundation underneath your financial data — one source of truth, scheduled ingestion from every platform you use, and reports generated from the database rather than rebuilt by hand. If the March 2027 deadline has put a date on work you have been deferring, this is where it starts.
Talk to us about Database ReportingFrequently asked questions
Make March 2027 a date in a plan, not a deadline you are behind
HMRC has almost tripled its crypto nudge campaign in two years and is about to receive overseas platform data automatically. Cloudswitched Database Reporting gives UK businesses a single structured source of truth for financial data, scheduled ingestion from every platform in use, and reporting that produces the same answer every time it is asked.
Talk to us about Database Reporting
CloudSwitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
