The UK sorts undisclosed crypto years by one axis: behaviour. Take reasonable care and get it wrong anyway — the look-back is four years. Careless — six. Deliberate — up to twenty. Every other number on this page follows from where your facts sit on that line, and it is a legal characterisation you should not assign to yourself in either direction.
The three behaviours, and what they buy
Reasonable care. You tried to get it right and an error happened anyway. Four years of disclosure; penalties can be nil, particularly unprompted.
Careless. You did not take the care a reasonable person would — and HMRC treats "I didn't know crypto was taxable" as this, not as an excuse. Six years; penalties in a moderate band, lower when the disclosure is unprompted.
Deliberate. You knew and chose not to declare, or signed figures you knew were wrong. Up to twenty years, penalties in the serious band — and this is the territory where the disclosure route itself changes (see below), because criminal exposure is now part of the conversation.
The routes
The cryptoasset disclosure service
HMRC's dedicated digital facility for undeclared cryptoasset income and gains. You calculate the tax, interest and a self-assessed penalty for each year, submit, receive a payment reference within about 15 working days, and pay within 30 days of submission. One structural quirk deserves bold type: unlike the older facilities, there is no advance notification step — no way to register intent and lock in "unprompted" status while you prepare. Your status is judged at submission. Every week of preparation is a week in which a nudge letter can arrive and move you into the prompted band. Prepare fast, and quietly.
The Worldwide Disclosure Facility
Where the liability has an offshore dimension — and crypto held on non-UK platforms often does — the WDF may be the correct vehicle, with its own mechanics and its own, sometimes harsher, offshore penalty framework. Which facility fits is an adviser's call, not a menu choice.
The Contractual Disclosure Facility (CDF)
For deliberate conduct — fraud. It is the one route that offers protection from criminal prosecution in exchange for complete and honest disclosure, and it is emphatically not self-service. If the honest description of any year is "I knew", the first step is a tax-dispute specialist, before anything is typed into any portal — including a self-declared "deliberate" box on the crypto facility, which creates the admission without the CDF's protection.
The facility will happily let you tick "deliberate" yourself. That single tick is a confession made outside the one process designed to make confessions safe.
Unprompted vs prompted — the label that prices everything
A disclosure made before HMRC contacts you sits in the lowest penalty ranges — for careless behaviour, potentially zero. The same disclosure after a nudge letter is "prompted" and starts higher. With a letter wave running through March 2027 and the first CARF reports landing in May 2027, the unprompted window is not an abstraction — it is a period on a calendar, and it is closing at the speed of HMRC's data pipeline.
The sequence
- Reconstruct every year first. Pools, matching rules, income events, sterling values — the pooling page is why this cannot be estimated. The behaviour question can only be answered against real numbers.
- Characterise behaviour with an adviser, not a mirror. People self-assess to both extremes. The characterisation drives years, penalties, and route — it is the whole case.
- Choose the facility to fit the facts. Crypto service, WDF, or CDF. Offshore platforms, large sums, many years, or any deliberate element each push the answer around.
- Submit complete, once. Interest runs daily from each year's original due date regardless; a partial disclosure that needs reopening costs more than the week it saved.
- Pay within 30 days of submitting — or have agreed terms in advance. The facility expects payment with the confession, not after negotiation.
If a letter has already arrived
The unprompted discount is gone; nothing else changes. The reconstruction is identical, the behaviour question is identical, and a complete prompted disclosure still lands far below the outcome of a compliance check that finds the same facts without your help. The order still matters: decide the route before answering the letter, because the answer is a written statement and it fixes your story.
Behaviour is a legal characterisation made on facts this page does not have. It frames the decision; it does not make it, and reading it creates no professional relationship.