The UK wants more crypto user data so trust in KYC takes a new hit

The new UK rules could mean more data from crypto users, as shown how dangerous recent leaks are.

Just as the leading crypto platforms acknowledged that contractors leaked user information, the UK has issued strict new rules requiring detailed personal data to be collected and reported on all crypto transactions.

Starting January 1, 2026, crypto companies operating in the UK are expected to monitor all their customers, all transactions and all crypto moves. It is part of the UK’s efforts to bring transparency and accountability to spaces that are accused of being a bit shadowy for its own benefit.

HM Revenue and Customs removed the news in a May 14 statement, saying that encryption companies should collect the full name, home address, date of birth and tax identification numbers of all individual users. Entities such as businesses, partnerships, charities and other entities are also in the spotlight, with legal business name, address and company registration number requirements.

This includes all transactions. You also just need to move the code between your wallet. The rules follow international standards, but go further by applying them within the UK, not across borders. Companies are expected to file reports each year, while shortages can face fines of up to £300 (approximately $398) per user.

Protecting consumers

Officials say the move is to protect consumers and create a more robust regulatory environment. However, it clearly aims to close tax loopholes and meet broader global standards, including European MICA regulations. As HMRC said, businesses should start preparing now, not 2026.

Mark Aruliah, head of EMEA policy at Blockchain Analytics firm Elliptic, said in a commentary on Crypto.News that the move is a “expected next step” for an industry that matures towards parity with traditional finance.

“Reporting personal transaction data has historically been a challenge for the industry and consumers. This clarity regarding legal obligations to reporting will also help grow new reporting services.”

Mark Aliya

Aruliah acknowledged the potential burden of small startups, but said that a push for transparency is not only necessary, but will be postponed.

“Regulations are generally considered an additional cost burden to the industry, but they must be balanced with the benefits they provide. Therefore, small businesses are affected purely based on costs (i.e. for size and profit), but these obligations are still the next expected step, and simply become consistent with the general reporting obligation.”

Mark Aliya

But for many critics, the bigger problem is not collecting data. It’s about keeping it safe.

Great responsibility

The concerns have been focused as Cryptocurrency Exchange Coinbase recently confirmed a violation that includes customer data. According to US-based Crypto Exchange, contractors working at Coinbase overseas have been fed bribed by attackers who have access to sensitive customer information.

It included a name, email, phone number, address and, in some cases, partial Social Security numbers. Some users even reported that ID documents such as passports and driver licenses have been published.

Coinbase said the violations affect less than 1% of its user base, but even its slivers represent a significant population, even with 9 million active users per month. Worse, it’s exactly the kind of personal data the UK wants businesses to collect and verify. And the violation raises urgent questions about whether crypto companies are equipped to handle such liability.

You might like it too: DOJ opens probes to Coinbase violations that include foreign staff, including bribery: Report

Coinbase claims its internal systems were breached quickly, but blockchain investigator Zachxbt said the signs of trouble appear much faster. In February, he flagged a series of scams tied to Coinbase’s infrastructure. This includes one victim who lost $850,000 after being duped by a fake Coinbase support agent.

If rules tailored to the UK CARF were already in effect, the company could be staring at millions. Yet juxtaposition is difficult to ignore. The UK has instructed crypto companies to store personal data, as it acknowledges that one of the world’s largest exchanges has failed to keep such data safe.

read more: Policy Head of Circle’s MICA Spreading Cryptody Regulations