Crypto Regulation 2026: The Complete UK and Global Legal Landscape

This article is a complete map of the legal rules that apply to anyone buying, holding, trading, staking, or building with crypto — with a UK-first perspective and global context. It covers how assets are classified, which regulators have jurisdiction over which activities, what you owe in tax (and when), how the UK's framework diverges from the EU and US, and where genuine legal grey areas remain. If you interact with crypto in any capacity, the regulatory landscape in March 2026 creates obligations you didn't have three years ago — and penalties for ignorance that can include criminal liability.

The trajectory from 2017 to today has been dramatic. In 2017, the FCA published a discussion paper cautiously observing crypto. By 2020, it required crypto firms to register for anti-money laundering (AML) purposes. In October 2023, strict financial promotion rules went live. The Financial Services and Markets Act 2023 (FSMA 2023) formally brought crypto-assets inside the UK's regulatory perimeter — the legal boundary that determines which financial activities the FCA oversees. By 2026, we're inside a phased rollout of full authorisation requirements for crypto firms, stablecoin regulation is being implemented, and HMRC has sent over 13,000 nudge letters to suspected crypto holders.

The paradox of regulation is real: it simultaneously protects consumers from fraud and restricts the permissionless ethos that made crypto appealing. But understanding it isn't optional. Using an unregistered exchange doesn't make you a criminal — but the exchange is committing an offence by marketing to you. Failing to report a crypto-to-crypto swap doesn't make you a tax evader — until HMRC decides it does. The consequences range from financial penalties to prison time under existing legislation.

What this means practically: Regulatory literacy is now as essential as understanding private keys or blockchain consensus. This guide gives you that literacy.

Every regulatory obligation you'll encounter — from tax treatment to exchange licensing to promotional restrictions — flows from a single upstream question: what type of asset are you dealing with? Classification isn't academic. It's the load-bearing wall of the entire regulatory structure. Get it wrong, and you're applying the wrong rules.

The UK's taxonomy, set out in HM Treasury and FCA guidance, divides crypto into four broad categories:

• ›Exchange tokens function primarily as a means of exchange or store of value, with no central issuer providing rights. Bitcoin is the clearest example. These are subject to capital gains and income tax rules, FCA AML registration requirements, and financial promotion rules — but are not currently treated as specified investments requiring full FCA authorisation (though this is changing).
• ›Utility tokens provide access to a current or prospective service or product. They fall outside most financial regulation unless they also exhibit characteristics of securities or e-money.
• ›Security tokens provide rights such as ownership, repayment of a specific sum, or entitlement to a share in future profits. These are already regulated as specified investments under existing UK financial services law (the Financial Services and Markets Act 2000's Regulated Activities Order). If you issue or trade security tokens, the full weight of securities regulation applies.
• ›Stablecoins — specifically fiat-backed stablecoins pegged to currencies like the pound or dollar — are being brought into payments regulation under a phased approach. Algorithmic stablecoins (which maintain their peg through code-driven supply adjustments rather than reserves) remain largely outside the regulated stablecoin framework and are treated as unbacked crypto.

The US approaches classification differently, relying heavily on the Howey Test — a 1946 Supreme Court precedent that defines a security as an investment of money in a common enterprise with the expectation of profits from the efforts of others. The SEC has used Howey aggressively, arguing that many tokens (including, controversially, tokens with significant utility) are securities. Under the EU's Markets in Crypto-Assets Regulation (MiCA), the categories are asset-referenced tokens (ARTs), e-money tokens (EMTs), and a catch-all of "other crypto-assets" — each with distinct regulatory requirements.

This is where most explanations go wrong: they present classification as static. In practice, a token can change category over time. A utility token that introduces governance voting rights and revenue-sharing mechanisms may acquire the characteristics of a security token. Both the FCA and SEC have stated they look at economic substance, not labels. If your protocol's tokenomics change after a governance upgrade, the regulatory classification can shift with them — and compliance obligations shift accordingly.

NFTs (non-fungible tokens — unique digital tokens typically representing art, collectibles, or other distinct items) illustrate this fluidity perfectly. A one-of-a-kind digital artwork sold as an NFT is generally a collectible, not a financial instrument. But fractionalise that NFT into 10,000 fungible units that trade on secondary markets, and you've likely created a security. Issue a large collection where every NFT is functionally interchangeable, and MiCA may treat it as a crypto-asset requiring compliance.

What this means practically: Before asking "what are the rules?", ask "what type of asset is this?" The answer determines which rules apply, which regulators have jurisdiction, and what tax treatment you face.

Five bodies share responsibility for crypto regulation in the UK. Understanding which body does what prevents the most common source of confusion: assuming "regulation" is a single thing applied by a single entity.

• ›The Financial Conduct Authority (FCA) oversees conduct and consumer protection. It runs the AML registration regime for crypto firms, enforces the financial promotion rules, and is building the full authorisation framework for crypto exchanges and custodians under FSMA. The FCA maintains a public register of approved firms and a warning list of unauthorised ones. As of late 2025, only ~44 firms held FCA crypto registration — out of hundreds of original applicants. The FCA rejected or prompted the withdrawal of the vast majority.
• ›HM Revenue & Customs (HMRC) handles all tax matters. HMRC's Cryptoasset Manual (the CRYPTO series, especially CRYPTO40000 onwards) is the definitive source for how crypto is taxed in the UK. HMRC has been actively pursuing crypto tax compliance since at least 2021, using data-sharing agreements with exchanges and on-chain analytics firms like Chainalysis.
• ›HM Treasury sets the policy direction and drafts primary legislation. The phased approach to crypto regulation — stablecoins first, then broader exchange and custody rules — originates from Treasury consultations and statutory instruments.
• ›The Bank of England has a narrower role focused on financial stability. It becomes relevant when stablecoins reach systemic significance — the scenario where a stablecoin becomes so widely used in payments that its failure could disrupt the financial system.
• ›The Payment Systems Regulator (PSR) oversees stablecoins specifically used as payment instruments, ensuring interoperability and access standards.

These bodies interact but don't perfectly overlap. A crypto exchange operating in the UK currently needs FCA AML registration, must comply with FCA financial promotion rules, is subject to HMRC tax reporting expectations, and will eventually need full FCA authorisation under the expanded FSMA regime. That's three different regulatory layers from the FCA alone, plus tax obligations — each with different thresholds, requirements, and timelines.

What this means practically: "Is this regulated?" is the wrong question. The right question is: "Which of my activities are within which regulator's perimeter, and what does each require?"

The FCA's role in crypto has expanded in three distinct phases, and confusing them is one of the most common mistakes both firms and consumers make.

Phase 1: AML Registration (2020–present). Since January 2020, any firm carrying on crypto-asset activity in the UK must be registered with the FCA under the Money Laundering Regulations 2017 (as amended). This requires firms to have adequate AML and know-your-customer (KYC) procedures. Registration is not the same as authorisation — registered firms are checked for AML compliance but aren't subject to the FCA's full conduct-of-business rules, capital requirements, or consumer duty obligations.

Phase 2: Financial Promotions (October 2023–present). Since 8 October 2023, anyone marketing crypto to UK consumers must comply with the Financial Promotion Order — the regime that governs how financial products can be advertised. This means crypto promotions must include specific risk warnings, firms must categorise clients (and apply a 24-hour cooling-off period for first-time investors), and only FCA-authorised persons (or firms communicating promotions approved by an authorised person through the s.21 FSMA gateway) can issue promotions. The FCA has issued over ~900 crypto promotion alerts between October 2023 and the end of 2025, including forcing apps off UK app stores and taking down non-compliant social media advertisements.

Phase 3: Full Authorisation (in progress, 2025–2027). The FSMA 2023 amendments gave HM Treasury the power to bring crypto into the full Part 4A FSMA authorisation regime. When fully implemented, crypto exchanges, custodians, and other service providers will need authorisation comparable to what traditional financial services firms hold — including capital adequacy requirements, custody and safeguarding rules, operational resilience standards, and compliance with the FCA's Consumer Duty (the principle, effective since July 2023, requiring firms to deliver "good outcomes" for consumers). This is the single biggest regulatory shift for UK crypto firms.

A critical distinction that most people miss: the term "FCA-registered" and "FCA-authorised" mean different things. Registered firms have passed AML checks. Authorised firms are subject to the full suite of conduct regulation. Most crypto firms in the UK are currently only registered. The transition to full authorisation will thin the herd further.

For UK consumers using overseas exchanges that aren't FCA-registered: using them isn't illegal. You face no criminal liability for buying Bitcoin on an offshore platform. But the exchange is potentially committing an offence by marketing to UK persons without approval, and you have zero regulatory protection if things go wrong — no access to the Financial Ombudsman Service, no Financial Services Compensation Scheme coverage.

What this means practically: Check the FCA register before using any platform. Understand that "registered" means AML-checked, not fully regulated. And recognise that if an exchange is aggressively marketing to you from offshore without FCA standing, that's a red flag about their compliance posture generally.

HMRC's treatment of crypto is more developed than most people realise, and the penalties for getting it wrong are standard tax penalties — which means they range from surcharges to criminal prosecution for deliberate evasion.

Capital Gains Tax applies to every disposal of a crypto-asset. A disposal isn't just selling for pounds. It includes swapping one token for another (trading ETH for SOL is a taxable event), spending crypto to buy goods or services, gifting tokens to someone other than your spouse or civil partner, and receiving something in exchange for your tokens. The only thing that is not a disposal is transferring the same token between your own wallets — moving Bitcoin from a hardware wallet like Ledger to your exchange account, for example.

The CGT Annual Exempt Amount for the 2025–26 tax year is £3,000. This has been cut sharply — from £12,300 in 2022–23 to £6,000 in 2023–24 to the current £3,000. Even modest portfolios can generate gains exceeding this. CGT rates on crypto are 18% for basic-rate taxpayers and 24% for higher-rate taxpayers (following the Autumn Budget 2024 changes).

Cost basis calculation in the UK uses a Section 104 pooling method, similar to how shares are handled. You maintain a single average cost basis for each type of token. If you bought 1 ETH at £1,000 and another at £2,000, your pooled cost basis is £1,500 per ETH. However, two override rules apply before pooling:

1. The same-day rule: if you sell and buy the same token on the same day, the buy is matched to the sale.

2. The 30-day bed-and-breakfasting rule: if you sell a token and rebuy the same token within 30 days, the rebuy cost is matched to the sale — preventing you from selling to crystallise a loss and immediately rebuying.

Income Tax applies separately to staking rewards, mining income, and certain airdrops. HMRC treats staking and mining rewards as income, taxed at your marginal rate (20%, 40%, or 45%) at the market value on the date of receipt. That market value then becomes your cost basis for CGT purposes. This creates what practitioners sometimes call a "dual taxation event": income tax when you receive the reward, then CGT on any growth above that value when you eventually dispose of it. Tracking this correctly is essential — and where tools like Koinly become genuinely valuable, not as a nice-to-have but as the practical way to maintain the records HMRC expects.

Allowable deductions include transaction fees (gas fees, exchange fees) directly associated with acquiring or disposing of an asset. They reduce your gain or increase your loss.

Reporting obligations are stricter than many realise. You must report via Self Assessment if your total disposal proceeds exceed four times the Annual Exempt Amount — that's £12,000 for 2025–26 — even if your net gain is below £3,000. The deadline for the 2025–26 tax year is 31 January 2027.

DeFi taxation remains a genuine grey area. HMRC's 2022 guidance (updated 2025) established that DeFi lending — where you lend tokens and receive the same tokens back — is not treated as a disposal. That's helpful but narrow. Liquidity provision on automated market makers (AMMs — protocols that use algorithms and pooled liquidity rather than order books for trading) is less clear. When you deposit tokens into a liquidity pool and receive LP tokens in return, is that a disposal? HMRC hasn't provided definitive guidance. Experienced practitioners tend to take a conservative position — treating it as a disposal — and document their reasoning thoroughly in case HMRC queries it later.

What this means practically: Track every transaction from day one. Use our free CGT calculator or a dedicated tool to maintain records. The cost of retrospectively reconstructing your transaction history is always higher than tracking it in real time.

Stablecoins and the Travel Rule are two areas where UK regulation has moved from announcement to enforcement, and where the practical impact on everyday users is most immediately felt.

Fiat-backed stablecoin regulation has been a UK priority since HM Treasury's 2023 consultations, with implementation phased across 2025–2026. The key elements: issuers of fiat-backed stablecoins used in the UK will need FCA authorisation; backing assets must be held in a statutory trust (a legal structure ensuring the assets are ringfenced from the issuer's own finances and available to token holders if the issuer fails); and holders must be able to redeem at par — meaning one stablecoin pegged to £1 must be redeemable for exactly £1. Algorithmic stablecoins, which maintain their peg through supply-adjustment code rather than reserves, fall outside this framework and are treated as standard unbacked crypto-assets — carrying the full volatility risk that implies, as the 2022 collapse of TerraUSD demonstrated.

The Travel Rule — the UK's transposition of FATF Recommendation 16 (the Financial Action Task Force is the global standard-setter for anti-money-laundering policy) — has been in effect since 1 September 2023. It requires crypto-asset businesses to collect, verify, and transmit information about the originator and beneficiary of crypto transfers. In the UK, this applies with no minimum threshold — every transfer, regardless of size, is covered.

The information required includes the originator's name, account number (or wallet address), and either address, date of birth, or a national identity number. When you withdraw crypto from a UK-registered exchange to an external wallet, the exchange must collect information about the receiving party. For transfers to unhosted wallets (wallets not held by a regulated service — your personal Ledger device, for instance), UK firms must still collect beneficiary information and may conduct additional checks. This is why you may experience transfer delays or extra verification steps when withdrawing to self-custody.

The FATF has signalled further guidance on unhosted wallets, and the political conversation around restricting self-custody continues — though no UK ban on self-custody is in effect or proposed as of March 2026.

What this means practically: Expect additional verification steps on every UK exchange withdrawal. These aren't bugs — they're regulatory compliance. And if you use stablecoins regularly, understand that the regulatory framework around them is tightening to the standards applied to electronic money.

The Markets in Crypto-Assets Regulation (MiCA) is the EU's single regulatory framework for crypto, and it's the most comprehensive piece of crypto-specific legislation anywhere in the world. Full application began 30 December 2024 (with stablecoin provisions effective from 30 June 2024). If you use EU-based exchanges or interact with EU-based crypto services, MiCA directly affects you — even as a UK resident.

MiCA is structured around four main pillars:

• ›Title II requires issuers of crypto-assets (other than ARTs and EMTs) to publish a white paper — a standardised disclosure document — and comply with marketing rules.
• ›Title III regulates asset-referenced tokens (ARTs) — tokens that reference multiple assets, commodities, or currencies to stabilise their value. Issuers need authorisation, must maintain reserves, and face restrictions on the scale of issuance.
• ›Title IV regulates e-money tokens (EMTs) — tokens pegged to a single fiat currency. Issuers must be authorised as either credit institutions or electronic money institutions, with at least 30% of reserves held at credit institutions (60% for "significant" EMTs).
• ›Title V establishes the Crypto-Asset Service Provider (CASP) licensing regime, covering exchanges, custodians, advisors, portfolio managers, and transfer service providers. CASPs must obtain authorisation in an EU member state and can then passport across all 27 member states.

The impact on stablecoins has been the most visible change. Tether (USDT), the world's largest stablecoin, did not obtain MiCA authorisation. Several EU-regulated exchanges delisted USDT for EU users in late 2024 and early 2025. If you're a UK resident using an EU exchange, this affects which stablecoins are available to you on that platform.

This is where most explanations go wrong about MiCA: they present it as covering everything. It doesn't. MiCA explicitly excludes NFTs (unless fractionalised or functioning as fungible tokens in practice), DeFi protocols deemed "fully decentralised" (though the bar for qualifying is extremely high — having identifiable governance token holders likely disqualifies you), and crypto-assets that already qualify as financial instruments under MiFID II (the EU's existing securities framework). It also doesn't address crypto lending and borrowing in depth. A separate DeFi-focused regulation has been signalled by the European Commission for 2027.

For UK residents, the critical point is this: there is no equivalence arrangement between UK and EU crypto regimes as of March 2026. A firm authorised by the FCA cannot passport into the EU. A MiCA-licensed CASP cannot passport into the UK. Post-Brexit, these are separate regulatory universes. If you use platforms in both jurisdictions, you're subject to two distinct sets of rules.

Some offshore exchanges have assumed they can serve EU (or UK) customers under a "reverse solicitation" exemption — the idea that if the customer initiates contact, the firm doesn't need local authorisation. ESMA published guidance in 2024 making clear that having a website in EU languages, running EU-targeted social media, or maintaining EU-focused marketing effectively destroys any reverse solicitation claim. The FCA is expected to take the same view.

What this means practically: If you use EU-based exchanges, check their MiCA licensing status. If you hold USDT on an EU platform, verify it's still supported. And don't assume UK and EU rules are aligned — they are deliberately diverging.

The US and the Asia-Pacific region represent two very different regulatory philosophies, and both affect UK residents who use platforms or hold assets that interact with those jurisdictions.

The United States remains the world's most fragmented crypto regulatory landscape. The Securities and Exchange Commission (SEC) has pursued an enforcement-first approach, filing over ~100 crypto-related enforcement actions between 2020 and the end of 2025. The Commodity Futures Trading Commission (CFTC) claims jurisdiction over crypto-assets it deems commodities (primarily Bitcoin). The FIT21 Act (Financial Innovation and Technology for the 21st Century Act) passed the House in May 2024 with a bipartisan 279–136 vote, attempting to clarify which agency regulates which assets, but Senate progress has been slow. Meanwhile, each US state maintains its own money transmitter licensing requirements. The approval of spot Bitcoin ETFs in January 2024 (11 approved simultaneously, with cumulative net inflows exceeding ~$35 billion by end of 2024) and spot Ethereum ETFs in July 2024 represented a watershed — institutional access to crypto through traditional regulated products.

Asia-Pacific has produced some of the most structured licensing frameworks globally:

• ›Hong Kong launched its mandatory Virtual Asset Service Provider (VASP) licensing regime on 1 June 2023, requiring crypto exchanges to hold Type 1 and/or Type 7 SFC licences. Hong Kong has positioned itself as a regulated crypto hub, contrasting with mainland China's ban.
• ›Singapore regulates crypto under the Payment Services Act, requiring licensing for digital payment token services. The Monetary Authority of Singapore (MAS) has taken a measured approach — permissive on institutional activity, restrictive on retail marketing.
• ›Japan was an early mover with its revised FSA framework, requiring exchange registration since 2017 and maintaining strict custody and reserve requirements after the Mt. Gox and Coincheck incidents.
• ›South Korea implemented the Virtual Asset Users Protection Act in July 2024, introducing mandatory exchange registration, user deposit protection, and market manipulation prohibitions.

In the offshore and emerging category, Dubai's VARA (Virtual Assets Regulatory Authority) has attracted significant industry attention with a bespoke licensing framework. El Salvador adopted Bitcoin as legal tender in June 2021 but scaled back the mandatory acceptance provision as part of an IMF agreement in late 2024/early 2025.

What this means practically: If you trade on platforms headquartered outside the UK, understand which jurisdiction's rules apply to them — because those rules affect what services you can access, how your assets are custodied, and what protections exist if things go wrong.

The regulatory treatment of decentralised finance (DeFi — financial services built on smart contracts that execute automatically on a blockchain, theoretically without intermediaries) is the most contested and unresolved area in global crypto regulation.

The common claim is that DeFi protocols "can't be regulated because there's no central entity." Regulators have spent three years systematically dismantling this argument. The FCA's approach focuses on the activity being performed — providing exchange services, custody, or lending — regardless of whether the underlying technology uses smart contracts. If an identifiable entity operates the front-end website, controls the upgrade keys, collects fees, or governs the protocol through a token-voting mechanism, regulators have leverage.

The SEC has brought enforcement actions against projects claiming to be "sufficiently decentralised," arguing that having a founding team, a corporate entity, or a foundation that controls protocol upgrades contradicts decentralisation claims. The term "decentralisation theatre" has entered regulatory vocabulary — describing protocols that present themselves as decentralised while retaining meaningful centralised control.

MiCA includes an exemption for "fully decentralised" protocols, but the bar is extraordinarily high. A protocol with a DAO (decentralised autonomous organisation — a governance structure where token holders vote on decisions) likely doesn't qualify if those token holders are identifiable or if the protocol has a recognisable development team. ESMA has signalled that this exemption will be interpreted narrowly.

The practical frontier is front-end regulation: even if a smart contract on Ethereum cannot be taken down, the website that provides a user interface for interacting with it can be blocked, the domain can be seized, and the developers who maintain it can be subject to regulatory action. Several DeFi front-ends have already geo-blocked US and UK IP addresses in response to regulatory pressure.

What this means practically: Using DeFi protocols does not place you outside the law. Tax obligations apply regardless. And if you're building or governing a DeFi protocol with any UK nexus, assume the FCA is watching the activity, not the label.

The single most important development for individual crypto holders in the next 18 months isn't a new regulation — it's the OECD Crypto-Asset Reporting Framework (CARF). Finalised in 2023, with ~50 jurisdictions (including the UK) committed to implementation from 2027, CARF will create automatic exchange of crypto transaction information between tax authorities worldwide.

This is the crypto equivalent of the Common Reporting Standard (CRS) that transformed offshore banking transparency. Under CARF, crypto platforms will be required to report their UK-resident customers' transactions — purchases, sales, swaps, and transfers — directly to HMRC. HMRC will receive this data and cross-reference it with Self Assessment filings.

Even before CARF, the walls have been closing. HMRC has data-sharing agreements with major exchanges. It has contracted on-chain analytics firms (Chainalysis, Elliptic) to trace transactions across blockchains. The ~13,000+ nudge letters sent between 2021 and 2024 were generated from exactly this kind of data matching. Platforms like ChangeNOW that offer swaps with lighter verification may appeal for privacy reasons, but on-chain transactions remain permanently visible and traceable.

The interaction between UK regulation and overseas platforms creates specific compliance friction. The Travel Rule has different thresholds globally: the UK applies it with no minimum, the EU removed the €1,000 threshold, the US applies it at $3,000+, Singapore at S$1,500+. A transfer from a UK exchange to a Singapore exchange triggers different information requirements at each end. This friction creates transfer delays and occasional blocked transactions when the two platforms' compliance systems don't interoperate.

For UK users specifically: using an exchange in another jurisdiction to avoid UK reporting doesn't work once CARF is live. The exchange will report your activity to its local tax authority, which will share it with HMRC. The strategy of regulatory arbitrage — exploiting differences between jurisdictions — is getting harder by design.

What this means practically: Assume every crypto transaction you make will eventually be visible to HMRC. Build your record-keeping practices now, before CARF enforcement begins.

Self-custody — holding your own private keys rather than leaving assets on an exchange — is a foundational principle of crypto. It removes counterparty risk (the risk of an exchange failing, being hacked, or freezing your account). But it does not remove legal risk.

Under the Regulation of Investigatory Powers Act 2000 (RIPA), Section 49, UK law enforcement can obtain a court order requiring you to disclose encryption keys or decrypt protected information. Failure to comply is a criminal offence carrying up to 2 years imprisonment — or 5 years in national security cases. A hardware wallet doesn't make you immune to a court order.

Self-custody also doesn't affect your tax obligations. Every disposal is reportable regardless of whether it originates from an exchange account or a personal wallet. And while the Travel Rule currently doesn't apply to truly unhosted wallets in the same way it applies to transfers between regulated entities, UK exchanges are required to collect beneficiary information for withdrawals to unhosted wallets and may conduct enhanced due diligence.

The broader political conversation about restricting self-custody continues globally. The EU's Transfer of Funds Regulation (recast) introduced requirements for verifying the identity of unhosted wallet holders for transactions above €1,000. The FATF has signalled further guidance. No UK ban on self-custody is proposed, but the regulatory environment around it is tightening.

Privacy coins — tokens designed to obscure transaction details, such as Monero and Zcash — face increasing hostility from regulators. Several UK-registered exchanges have delisted privacy coins to simplify compliance. While holding them is legal, the practical ability to buy, sell, and use them through regulated channels is shrinking.

What this means practically: Self-custody is a risk management tool, not a legal shield. Use it for what it's good at — removing exchange counterparty risk — but don't confuse it with regulatory immunity.

Regulatory compliance isn't a one-time action — it's a set of ongoing practices. Here's the process, in order, because each step depends on the one before it.

1. Classify your assets. Before anything else, determine whether each token you hold is an exchange token, utility token, security token, or stablecoin. This determines every subsequent obligation.

2. Identify your activities. Trading, staking, lending, providing liquidity, and simply holding each carry different obligations. Map each activity to its regulatory and tax treatment.

3. Track every transaction from the point of execution. Use portfolio tracking software or a tool like Koinly to maintain a contemporaneous record. Reconstructing history later is exponentially harder.

4. Maintain your Section 104 cost pools. For each token type, calculate your pooled average cost basis, applying the same-day rule and 30-day rule where they override.

5. Separate income events from capital events. Staking rewards, mining income, and certain airdrops are income (taxed at receipt). Disposals of those same tokens later are capital events. Track both.

6. File Self Assessment by 31 January following the tax year. Report disposals if proceeds exceed £12,000, even if no net gain. Report all gains above the £3,000 Annual Exempt Amount. Report all crypto income regardless of amount.

7. Monitor regulatory changes. The transition from FCA registration to full authorisation, CARF implementation in 2027, and further DeFi guidance are all in motion. The regulatory landscape in 2027 will differ from today.

What this means practically: Compliance is a system, not a moment. Build the tracking habit now.

• ›Classification is the foundation: whether a token is an exchange token, security token, utility token, or stablecoin determines every rule that applies — from FCA requirements to tax treatment to whether MiCA, MiFID II, or another framework governs it.
• ›Every crypto-to-crypto swap is a taxable disposal in the UK: the £3,000 CGT annual exemption means even modest portfolios can trigger obligations, and staking rewards are taxed as income from the first pound.
• ›The UK has three layers of FCA crypto regulation: AML registration (live since 2020), financial promotion rules (live since October 2023), and full authorisation (being phased in 2025–2027) — each with different requirements and protections.
• ›The UK and EU are deliberately diverging: no passporting exists between UK and MiCA regimes, the stablecoin frameworks differ, and UK residents using EU platforms face both sets of rules.
• ›Global automatic reporting (CARF) arrives in 2027: assume every transaction will be visible to HMRC, whether it happens on a UK exchange, an offshore platform, or a DeFi protocol with an identifiable front-end.