HMRC mandates FI registration by Dec. 31, 2025 and implements CARF, signaling new era of transparency

Effective Jan. 1, 2026, in a significant departure from previous practice, the UK will require all existing entities that fall within the definition of an RFI or Trustee Documented Trust (TDT) under CRS and/or FATCA, to be registered for HMRC’s AEOI service to be compliant with the rules, even if they are not required to actually report under these regimes. Importantly, the new rules apply to all RFIs and TDTs, including those that are generally treated as non-reporting entities and those that do not maintain reportable accounts or are otherwise exempt from reporting obligations.

For new entities, or ones that are not classified as RFIs or TDTs as of Dec. 31, 2025, they must be registered no later than Jan. 31 of the calendar year in which the entity first becomes an RFI or TDT under CRS and/or FATCA.

Each RFI or TDT must complete its own separate registration, even where multiple entities form part of the same group structure. This requirement extends to entities that may have previously been treated as non‑reporting institutions or believed they were outside the scope of filing obligations. HMRC’s intention is to maintain an accurate, complete register of all entities with potential responsibilities under CRS and FATCA—regardless of whether they ultimately have reportable accounts.

Entities already registered as RFIs in HMRC’s AEOI system do not need to take further action, provided their existing registration remains accurate and current.

HMRC also clarified how TDTs should register. According to the guidance, when registering a TDT, the trust itself must be listed as the RFI, not the trustee. The reporting trustee should instead be listed in the registration as a point of contact. Importantly, registration is single and dual‑purpose, covering both CRS and FATCA at once.

These updates significantly expand the administrative requirements for entities that fall within RFI/TDT definitions but historically had no reporting obligations, such as dormant entities, certain investment vehicles with no reportable investors or trust structures relying on trustee reporting. As a result, organizations across a broad range of industries must now confirm whether they meet CRS and/or FATCA RFI or TDT criteria and ensure timely registration to avoid penalties under HMRC’s strengthened enforcement framework.

Because registration requires accurate classification under the CRS and FATCA rules, organizations may face complexity in determining whether they qualify as RFIs or TDTs. Misclassification—either failing to register when required or registering incorrectly—can create compliance issues and exposure to penalties. RSM US can assist with the registration process by providing guidance on entity classification, ensuring accurate submissions and helping organizations meet all regulatory requirements efficiently.

The UK is among the first jurisdictions to implement the OECD’s CARF under The Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025 set forth in the House of Commons on June 25, 2025. These regulations, effective Jan. 1, 2026, embed CARF standards into UK law, creating a robust framework for the automatic exchange of tax information on crypto-asset transactions. This early adoption of CARF and implementation of governing regulations underscores the UK’s commitment to transparency and global tax compliance, setting a precedent for other jurisdictions. It is also consistent with the EU's landmark Markets in Crypto Assets (MiCA) regulations applicable in late 2024, which create a unified rulebook for crypto-assets and crypto-asset service providers across all 27 member states by requiring them to obtain licenses, follow strict rules for asset security, governance, anti-money laundering (AML/CFT) and transparency. With HMRC’s expanding compliance mandates, it is essential that organizations providing crypto-asset related services prepare now to meet these obligations.

The UK framework applies to Reporting Crypto-Asset Service Providers (RCASPs), including exchanges, wallet providers and other intermediaries. The definition of an RCASP is intentionally broad, designed to capture a wide range of businesses operating within the crypto-asset ecosystem.

Under the rules, RCASPs must register with HMRC by the later of May 31, 2027, or Jan. 31 following the first calendar year in which they meet the definition of a UK RCASP. They must also establish and maintain robust due diligence procedures in line with section III of the OECD rules, including implementing written policies, collecting valid self-certifications from individual and entity users and verifying this information using anti-money laundering and know-your-customer (AML/KYC) processes. Providers must also retain records of all due diligence steps and collected data for five years following the relevant calendar year. RCASPs must submit an annual report to HMRC by May 31 following the end of each calendar year. The report must include all information specified in section II(A)–(F) of the OECD CARF rules, covering user details and relevant transactions, including those processed through UK branches.

The UK CARF regulations impose strict penalties for non-compliance. Failures, such as not applying due diligence procedures, can result in fines of up to £100 per reportable user, increasing to £300 if valid self-certifications are not obtained. Inadequate recordkeeping may incur penalties of up to £5,000 per year, while late or inaccurate reports can attract fines of up to £5,000 plus daily penalties for continued non-compliance. Additional penalties apply for failing to register with HMRC, notify users or provide requested information, with amounts ranging from £100 per user to £1,000 per breach, and escalating daily charges for ongoing failures. These rules also extend liability to partners and trustees in certain structures, emphasizing the importance of timely and accurate compliance.

The UK is also introducing a new penalty regime for non-compliance with registration, due diligence and reporting obligations under AEOI frameworks, including FATCA and CRS. Penalties may apply for late registration, inaccurate or incomplete returns, insufficient recordkeeping and failures in due diligence processes. This regime is intended to be effective, proportionate and dissuasive - consistent with OECD and the European Union (EU) standards. FIs and RCASPs should implement strong internal controls and ensure timely compliance to avoid significant financial penalties and reputational risk. CARF penalties are closely aligned with existing AEOI penalty structures. Refer to Table 1 below for a breakdown of applicable penalties for each regime:

Table 1. HMRC penalty regime for AEOI non-compliance

HMRC is updating the technical schemas for electronic reporting to align with the latest OECD and EU standards. This includes revisions to the CRS and FATCA report schemas, as well as the introduction of new schemas for CARF. HMRC announced in September that the current combined CRS and FATCA schema will be discontinued after Dec. 31, 2026 and that starting Jan. 1, 2027, UK FIs will be required to use new schemas for all XML submissions to HMRC, including submissions for prior calendar years.

Specifically, UK CRS reporting will utilize the amended CRS XML schema published by the OECD in October 2024, while FATCA reports will use the FATCA XML schema published by the IRS in January 2017. These updates are intended to ensure that data collected and exchanged is consistent with international requirements and can be efficiently shared with other tax authorities.

FIs can submit their returns to HMRC using the UK Government Gateway Portal or manually by entering information in HMRC’s form-based reporting system for a small number of reportable accounts. FIs will need to invest in information technology system upgrades and staff training to meet the new technical specifications.