A new UK tax reporting rule that came into force in January requires crypto exchanges to hand over detailed user data to HMRC and to tax authorities in over 70 countries. Industry experts are now warning that the framework may be putting ordinary crypto holders in physical danger.
The concern is not unprecedented. In France, a nearly identical>
What CARF Actually Requires
The Crypto-Asset Reporting Framework, known as CARF, is an OECD-designed global standard that the UK formally embedded into law two months ago.
The law legally requires any UK-based crypto exchange or custodial wallet provider to collect and annually report a standardised set of user data to HMRC, the UK’s tax authority.
That data includes full name, address, date of birth, tax residency, taxpayer identification number, and a comprehensive record of every purchase, sale, exchange, and transfer a user makes.
So far, 76 countries have committed to the framework, with that number still growing. From 2027, HMRC will begin sharing that information automatically with tax authorities in jurisdictions that have also implemented CARF.
Major platforms like Binance and Kraken operating in the UK are among those now obligated to report.
Regulators argue the framework closes a gap that has long enabled crypto tax evasion. Exchanges must also notify users that their data may be shared with foreign governments.
The France Precedent
Freddie New, chief policy officer at Bitcoin Policy UK, argued that CARF creates something far more dangerous than a tax database. In his view, it creates a target list.
Security researchers have a term for what happens next.
A wrench attack is when criminals use physical violence to force a crypto holder to hand over their assets. Once criminals threaten a person or their family, the technology offers no protection. Unlike a hacked bank account, nobody can freeze, reverse, or recover a coerced crypto transfer.
“A bad actor that got hold of that data would immediately be able to sort it very quickly by softness of target and by amount of money,” New said during a recent legal and regulatory panel hosted by BeInCrypto. “And then they can merely pack their bags and go off and physically harm people.”
He pointed to France as a country that has already lived this scenario. France operates a similar crypto reporting regime, and it has recorded a sharp rise in violent crimes targeting crypto holders in recent years.
The attacks have included kidnappings, finger amputations, and torture. Investigations also identified at least one corrupt employee at the French tax authority who allegedly sold the personal data of crypto holders to criminal networks.
The core promise of self-custody crypto is that no bank can touch your money. The core risk of self-custody crypto is that no bank can touch your money. Between 2024 and 2026, France recorded a wave of violent attacks on crypto holders: kidnappings, home invasions, a woman held… pic.twitter.com/pT1h4eDw1s
— Lukasz Olejnik (@lukOlejnik) March 19, 2026
The problem is not confined to France.
A July 2025 report by blockchain analytics firm Chainalysis found that 2025 was on track to record potentially twice as many physical attacks on crypto holders as any previous year.
Analysts noted a clear correlation between rising Bitcoin prices and the frequency of violent incidents. The firm also cautioned that many attacks go unreported, suggesting the true figures are likely higher.
What makes the situation particularly difficult to resolve is that CARF was never a British policy design to begin with.
A Global Framework, A Local Vulnerability
CARF is not a uniquely British invention, and that is precisely what makes it so difficult to challenge. All 27 EU member states adopted it through a parallel directive, known as DAC8, which also came into force in January.
Dion Seymour, crypto tax director at Andersen and a former HMRC crypto policy lead, noted during the same panel that the constraints are structural.
“The problem is now CARF has already been created by the OECD,” Seymour said. “It’s been ratified by the G20 around the world.”
That ratification, he explained, limits how much any single country can unilaterally change.
For now, the framework is live, data collection is underway, and exchanges have started reporting. The question of whether that data stays in the right hands remains to be seen in the UK.
The post France’s Crypto Crime Wave Started With a Tax Database. Is the UK Building the Same One? appeared first on BeInCrypto.