The United Kingdom's crypto rules are entering a new phase. HM Revenue and Customs (HMRC) is proposing to extend its information-gathering powers to cryptoasset businesses and to change the rules governing access to computer records and software. Critics warn that linking names, home addresses, and tax identifiers to Bitcoin addresses could expose a lasting history of public blockchain activity, with risks that reach well beyond tax compliance.

These broader powers remain proposals. The consultation, Reforming Information Powers and Modernising Computer Records Law, closed on September 7, 2026, and ministers had not announced a decision as of October 8.

HMRC wants more power over financial data. The problem is that Bitcoin is not a bank account. Once names, home addresses and tax IDs are to a Bitcoin address, that information can stay connected to a public ledger indefinitely. Europe is already seeing the consequences… pic.twitter.com/bh5Qrl8LWf

— Decentra Suze (@DecentraSuze) October 8, 2026

The observation points to a structural difference between traditional finance and public blockchains, one that sits at the center of the debate over HMRC's proposed powers.

Why a Blockchain Record Can Reveal More Than a Bank Statement

A bank statement stays inside a financial institution's records. Bitcoin transactions sit on a public blockchain that anyone can inspect. Once a wallet address is tied to a person's identity, their activity becomes much easier to trace.

Records showing addresses and holdings can be checked against public data, which can reveal more than the disposal history needed to work out a tax position. An address also stays visible after an information request ends, meaning it can help link later movements to earlier ones.

A separate regime is already in force. The Reporting Cryptoasset Service Providers Regulations 2025 took effect on January 1, 2026, placing due diligence and reporting rules based on the OECD's Crypto-Asset Reporting Framework (CARF), an international standard for exchanging cryptoasset tax information across borders, into UK law. HMRC's proposed information powers are not in force. Together, the two measures point to more identifying and transactional data flowing into tax systems — the core of the UK crypto privacy debate.

What Could HMRC Ask For, and What Remains Unresolved?

The proposals would extend Financial Institution Notices, an existing HMRC information power used to obtain customer data from banks and other financial institutions, to cryptoasset service providers, and update HMRC's powers over computer records and software. Recap, a UK crypto tax software provider, warns that the draft definition could reach firms that do not hold customer funds. That could include tax and wallet software developers, block explorers, data vendors, and hardware-wallet makers.

Recap also says its system is designed so the company cannot access customers' portfolio data. A business that cannot read information may have nothing to hand over, but whether the rules could force a provider to change how its systems work is an open question.

HMRC was asked whether a provider could be required to make hidden information readable, whether requests could cover wallet addresses or current balances, and what safeguards would apply. It said it could not answer while consultation responses were still being analyzed.

HMRC says the reforms would help it collect the correct amount of tax, with proportionate safeguards for taxpayers and third parties. The draft would also remove the statutory annual report to Parliament on these notices, the regular account that currently keeps Parliament informed about the use of these powers.

As government efforts to trace and recover digital assets develop, the use of crypto tracing and recovery tools illustrates why clear boundaries around information access matter.

Is the Security Risk Bigger Than Tax Compliance?

Linking identity to a wallet address can become a security risk if the data is misused or exposed. The concern is not that every system will be breached, but that a database of names, addresses, and crypto holdings is valuable to criminals. The stakes are sharper for self-custodied Bitcoin, which a holder controls directly, with no intermediary able to freeze or reverse a transfer.

Forbes reported 19 verified crypto-related attacks in France in 2025, and that 11 of 14 known globally tracked cases in the opening weeks of 2026 occurred there. It further reported that a French tax official was charged with using government tax software to look up crypto investors' addresses and assets, then selling the information to organized crime networks. That is a warning about misuse, not evidence of similar conduct in the UK.

Physical attacks linked to perceived crypto wealth have also been reported in the UK, including a reported wrench attack in Solihull and a case involving threats against an investor's family.

For UK crypto, the reporting rules have been in force since January 1, 2026, while the proposed expansion of HMRC's powers remains undecided. The next thing to watch is the government's response to the consultation, which will determine which businesses can be compelled, what providers may be required to do, and how safeguards limit access. Once identity is linked to a Bitcoin address, the privacy and security implications can outlast the original tax inquiry.