.svg)
One of the enduring myths about cryptocurrency is that it is anonymous – but it is not, and in reality, never has been. While wallet addresses may not display a person's name, transactions have always left a trail.
As crypto has moved from the financial fringes into the mainstream, transparency has grown alongside it. The introduction of the Crypto-Asset Reporting Framework (CARF) creates new reporting obligations for cryptoasset service providers, bringing greater visibility around transactions and holdings, and raising important questions about privacy and data security.
We talk to Mark Tibbs, Partner in Schillings’ Investigations, Security and Diplomacy team, and Dion Seymour, Crypto Tax Director at Andersen, about what CARF means in practice, the implications for privacy and security, and the steps investors can take to remain compliant while being protected.
Dion, one of the biggest developments in the cryptocurrency world this year has been the Crypto-Asset Reporting Framework, or CARF, which was introduced in the UK in January. What is it, and who does it apply to?
Dion: CARF, the Crypto-Asset Reporting Framework, is effectively the crypto equivalent of the Common Reporting Standard (CRS), which was designed to improve tax transparency around bank accounts and other financial assets.
The framework requires participating cryptoasset service providers, such as exchanges, to collect information about their users and report it to their local tax authority. That information can then be shared with tax authorities in other participating jurisdictions.
Whether CARF applies will often depend on where the cryptoasset service provider is based – around 70 jurisdictions have committed to implementing it, and they are doing so in waves. That means someone using an exchange in one jurisdiction may already be subject to CARF reporting, while an exchange elsewhere may not come within scope for several years.
In the UK, reporting cryptoasset service providers had to start collecting data from 1 January 2026, and the first reports to HMRC are due by 31 May 2027. This will include, for example, your name, tax number, and the aggregate totals of disposals and acquisitions by each cryptocurrency.
Is CARF effectively the end of anonymity in crypto?
Mark: I would say it's another step in a journey that has been happening for years. When crypto first started, part of the appeal was that people thought it was anonymous. It's always been described as pseudonymous rather than anonymous, but there are increasingly ways to identify who sent what, and which wallet belongs to whom. Now CARF is creating more opportunities to connect digital activity to real-world identities.
Dion: That's right. Transactions have always left a trail and there have always been ways, given enough information, to connect wallets to individuals. CARF doesn't suddenly remove the pseudonymity that previously existed. What it does do is increase the amount of information being collected and shared through legitimate channels.
Mark: From a privacy perspective, that's where the conversation becomes important. As the links between individuals and their crypto holdings become easier to establish, people need to think more carefully about their personal security, digital footprint and the information that is already available about them online.
So, it sounds like CARF is bringing crypto much more in line with other finances. Does this framework signal crypto's move into the mainstream?
Mark: It feels like a sign of the times. Crypto used to belong to a relatively small group of people. It doesn't anymore. If crypto wants to engage with the traditional financial system, there has to be information sharing and there has to be a tax approach, and CARF is part of bringing crypto into that world.
Dion: I wouldn't quite call it the legitimisation, but CARF definitely signals the mainstreaming of crypto.
For years, crypto was characterised as the "Wild West" of finance and that reputation stuck for a long time. But the landscape looks very different today. Reputable exchanges are increasingly regulated and crypto markets are responding to many of the same economic and geopolitical developments as traditional asset classes. It's not so divorced from the international system anymore - it's interconnected with it. Thanks to CARF and other factors, it's definitely much less Wild West than it once was.
Why are some investors concerned about privacy?
Mark: The concern isn't necessarily that tax authorities hold information about individuals. The concern is what happens if sensitive information falls into the wrong hands.
Many crypto founders and early adopters have accumulated significant wealth. Information linking those individuals to substantial crypto holdings can be extremely valuable to criminals. What is often quite amazing is the amount of information that can be drawn up about someone's life from disparate little data points.
Individually, they may not seem particularly sensitive. But if you're committed and you know where to look, you can build up quite a detailed picture. That's where the risk emerges. It's not usually one piece of information. It's lots of pieces put together, and AI is supercharging that process.
Do you think privacy concerns feel particularly acute in crypto compared with other assets?
Dion: I do think so. If somebody knows you have money in a bank account, that's one thing. Crypto creates a different set of concerns because of the nature of the asset.
If a traditional bank account is compromised, there may be opportunities to stop or reverse transactions. With crypto, once a transaction has been authorised and recorded on the blockchain, it's generally much harder to unwind. That's one reason we've seen growing concerns around so-called "wrench attacks", where individuals are targeted directly rather than their systems being hacked.
It must be noted that CARF impacts cryptoasset service providers, not self-hosted wallets directly. However, transfers to external wallets are reported, so moving assets off an exchange doesn’t take them out of view.
But there must be benefits of greater transparency?
Dion: Absolutely. While much of the discussion focuses on privacy concerns, greater transparency can also make it easier to investigate fraud and trace stolen assets. We've seen examples where criminals believed they were operating anonymously, only for investigators and exchanges to follow funds in real time and identify those involved once they attempted to move money through legitimate channels.
Combined with stronger reporting requirements and know-your-customer obligations, that can make it harder for criminals to move or cash out stolen funds. CARF should make it more difficult still for bad actors to operate through legitimate exchanges without leaving a trail.
Ultimately, the same transparency that creates privacy considerations can also help law enforcement, investigators and victims recover assets and identify those responsible. But CARF means more personal data held by more exchanges and tax authorities, which means more places it could leak.
What should crypto investors do now to stay compliant and protect their privacy?
Dion: First, get the tax fundamentals right. Investors should keep accurate records and reconcile activity across exchanges, wallets and decentralised finance protocols. One of the biggest mistakes people make is assuming they can reconstruct years of transactions later.
In practice, that can be extremely difficult. Compliance and privacy should not be viewed as opposing objectives - you can meet your reporting obligations while still taking sensible steps to manage how sensitive information is stored and accessed.
Mark: From a privacy and security perspective, the starting point is understanding your exposure. What information is already publicly available about you, your family, your business interests and your assets? Could someone identify where you live, where you spend your time, or where your children go to school?
Cybersecurity is equally important here. Aspects like strong passwords, multi-factor authentication, account monitoring and good security practices remain fundamental protections.
Beyond security, there is also a reputational dimension. Many entrepreneurs need a public profile, but that profile should be intentional. The information people find about you should support your business and personal objectives rather than reveal unnecessary details about your private life.
The goal is not to disappear from public view. It is to ensure that the information available about you is the information you want people to find, while reducing opportunities for others to exploit it.
