UK tax authority HM Revenue and Customs is facing growing scrutiny over proposed powers that could force cryptoasset businesses to hand over customer identities, transaction records and wallet-related data, sparking fresh concerns about Bitcoin privacy and security. The consultation on the draft measures closed on September 7, 2026, but no ministerial decision had been made by October 8, 2026.
The proposed changes would extend Financial Institution Notices to cryptoasset service providers and update HMRC's access to computer records and software. Critics warn that once names, home addresses and tax identifiers are linked to a Bitcoin address, that information can remain associated with a public, permanent blockchain ledger. Unlike a bank statement, which stays inside a financial institution, Bitcoin transactions are visible to anyone inspecting the blockchain.
UK crypto tax software provider Recap has cautioned that the draft definition could capture firms that do not hold customer funds, including tax and wallet software developers, block explorers, data vendors and hardware-wallet makers. There is also unresolved debate over whether providers could be compelled to make hidden information readable, and HMRC declined to answer while analysing consultation responses.
These domestic proposals sit alongside the Reporting Cryptoasset Service Providers Regulations 2025, which took effect on January 1, 2026. That regime implements the OECD's Crypto-Asset Reporting Framework and requires due diligence and reporting, with the first data batch for the 2026 calendar year due by the end of May 2027. A further 15 jurisdictions, including Singapore, Switzerland and Gibraltar, are expected to join from 2028.
Security risks have also been highlighted. Reports cited a French tax official being charged with using government tax software to look up crypto investors' addresses and assets and selling the information to organised crime networks. Physical attacks linked to perceived crypto wealth, including incidents in the UK, add to concerns about identity being linked to self-custodied holdings.
The outcome will depend on which businesses can be compelled, what providers may be required to do, and how safeguards limit access. Once identity is tied to a Bitcoin address, privacy and security implications can outlast the original tax inquiry.
