HMRC Publishes Penalty Factsheet for Digital Platform Operators

HMRC published factsheet CC/FS98 on 16 October 2026, setting out the penalties it may charge digital platform operators that fail to meet their UK reporting obligations. For accounting firms, auditors, and CFOs whose clients operate or use digital platforms, including crypto exchanges, NFT marketplaces, and gig-economy apps, this is a concrete signal that the compliance window is closing and enforcement is live.

What CC/FS98 Is and Why It Matters Now

The factsheet sits within HMRC's long-running Compliance Checks series. Each factsheet in that series explains a specific penalty or power HMRC holds, written in plain terms so that taxpayers and their advisers understand what is at stake during a compliance check. CC/FS98 is notable because it is the first in the series dedicated specifically to digital platform operators, a category that became formally regulated for reporting purposes under the UK's implementation of the OECD's Model Rules for Reporting by Platform Operators (commonly known as DAC7 in the EU context, and adopted into UK domestic law post-Brexit).

The UK rules require qualifying platforms to collect and verify information about sellers using their services, and to report that data to HMRC annually. The obligation has been in force since January 2024 for most in-scope platforms, with the first reports due in January 2025. Publishing a dedicated penalty factsheet in October 2026 is a clear procedural step: HMRC has had time to receive initial filings, identify gaps, and is now arming its compliance teams with a published, accessible explanation of the consequences of non-compliance.

Who Counts as a Digital Platform Operator

The rules catch a wider population than many firms initially assume. A qualifying platform is broadly any software-based interface that allows sellers to connect with buyers of services or goods, or to earn income from property rentals or the provision of personal services. Crypto exchanges and peer-to-peer trading platforms that facilitate transactions between users are within scope if they meet the residency or registration thresholds. So are marketplaces for tokenised assets where income is generated. Platforms that are purely payment processors, or that only list but do not facilitate the underlying transaction, may be excluded, but the boundary requires careful analysis on a case-by-case basis.

The Reporting Obligations That Trigger Penalties

Before penalties can arise, a platform must have breached one or more of its core duties. These include: collecting prescribed due diligence information from sellers, verifying that information against reliable sources, submitting an annual report to HMRC by the statutory deadline, and correcting or supplementing reports when errors are identified. Failure at any of these stages can give HMRC grounds to open a compliance check and, following CC/FS98, to charge penalties.

Penalty Mechanics: What the Factsheet Covers

CC/FS98 follows the standard structure HMRC uses across its Compliance Checks series. It explains the types of penalties available, how they are calculated, the process HMRC follows before charging them, and the routes available for challenge or appeal. The factsheet does not introduce new law; it consolidates and communicates the existing penalty provisions in a format HMRC compliance officers can reference during a check and share with the platform or its advisers.

Categories of Penalty the Factsheet Addresses

While the source document provides a summary overview rather than a full statutory citation of every penalty band, the CC/FS98 framework is anchored in the penalty provisions that accompany the UK's platform reporting regulations. These cover:

• Failure to register or notify. Platforms that are in scope but have not registered with HMRC face penalties for the period of non-registration.
• Late or missing annual reports. Platforms that miss the filing deadline or submit no report at all are liable to fixed and daily penalties that accrue until the report is received.
• Inaccurate reports. Where a report contains errors, penalties depend on whether the inaccuracy was careless, deliberate, or deliberate and concealed, mirroring the behaviour-based penalty framework familiar from Self Assessment and corporate tax compliance.
• Failure to carry out due diligence. Collecting and verifying seller data is a prerequisite to accurate reporting. Failing the due diligence step is itself a separate ground for penalty, independent of the reporting outcome.

The factsheet also outlines HMRC's expectation that platforms co-operate during a compliance check, and notes that co-operation, or the absence of it, will influence how penalties are calculated and whether reductions apply.

Penalty Reductions and Disclosure

As with most HMRC penalty regimes, CC/FS98 explains that unprompted disclosure attracts a greater reduction than a prompted one. A platform that identifies an error, self-reports, and takes corrective action before HMRC opens a check will generally face a lower penalty than one that waits for HMRC to make contact. This mirrors the well-established principle across UK tax compliance and makes early internal review commercially significant, not just technically prudent.

Accounting and Tax Implications for Firms and CFOs

For accounting firms advising platforms, and for in-house finance teams at those platforms, CC/FS98 has several practical dimensions that go beyond a simple read of the penalty rates.

Financial Statement Exposure

Penalties that have been charged, or that are probable and estimable, require recognition as provisions or contingent liabilities under both IFRS (IAS 37) and UK GAAP (FRS 102 Section 21). A compliance check that is open at a balance sheet date triggers disclosure obligations even if the final penalty has not yet been quantified. Auditors reviewing platforms with any open DAC7 or equivalent reporting gaps should treat this as a disclosure area requiring specific management representation.

The availability of reliable crypto compliance reporting infrastructure is directly relevant here. Platforms relying on manual or fragmented data pipelines to produce their seller reports face a higher risk of inaccuracy penalties. Finance teams should assess whether their current crypto bookkeeping software or data management processes can produce an audit trail that would satisfy an HMRC compliance officer examining the due diligence steps taken for each reportable seller.

Tax Risk Registers and Internal Controls

For CFOs of platforms within scope, CC/FS98 is a prompt to revisit the tax risk register. The platform reporting obligation should be documented with an owner, a deadline calendar, a sign-off process, and an evidence trail showing that due diligence was performed. If that documentation does not exist or is incomplete, the firm is exposed not only to the underlying penalty but to the absence-of-co-operation aggravation that HMRC can apply during a check.

This matters particularly for groups that operate platforms across multiple jurisdictions. A UK-registered entity within a broader international group may be the reporting entity for UK seller data even if the group's primary operations are elsewhere. Firms should confirm with clients that the UK entity has its own standalone compliance process and is not relying on a group-level process designed for a different regulatory framework.

Advisory Obligations and Professional Liability

Accounting firms advising platform clients have their own exposure to consider. If a firm was engaged to assist with platform reporting and the client subsequently faces penalties for late or inaccurate filings, the engagement scope and the advice given will come under scrutiny. Firms should review engagement letters for platform clients to confirm that reporting obligations are explicitly addressed, that deadlines are calendared, and that responsibility for data input is clearly allocated between the client and the firm. Understanding the emerging global pattern of AML licensing enforcement patterns across jurisdictions helps contextualise why regulators, including HMRC, are now investing in penalty infrastructure for platform operators specifically.

Practical Steps for Advisory Firms

Given that CC/FS98 is now published and HMRC's compliance teams can reference it formally, the following actions are relevant for any firm with platform operator clients in the UK.

Immediate Client Review

Identify all clients that could qualify as digital platform operators. The threshold analysis should not be limited to obviously large tech platforms. Smaller crypto peer-to-peer platforms, NFT marketplaces, and property rental portals may all be in scope. For each, confirm whether they have registered with HMRC, submitted their first annual report (due January 2025 for the 2024 reporting period), and retained their due diligence documentation.

Due Diligence Documentation Audit

The penalty for failing to carry out due diligence is independent of the reporting penalty. That means a platform could face penalties even if it submitted a report on time, if it cannot demonstrate that it verified seller information through a reliable process. Firms should ask clients to produce their due diligence procedures and spot-check a sample of seller records to confirm the process was actually followed, not just documented in a policy that was never implemented.

Disclosure Assessment

Where gaps are identified, assess whether an unprompted disclosure to HMRC is appropriate. The penalty reduction available for unprompted, full disclosure is meaningful. Given that HMRC is now actively publishing penalty guidance for this population of taxpayers, the window for acting before a check is opened is narrowing. Waiting is unlikely to improve the outcome.

The growing focus on digital asset audit quality, including the IAASB adding crypto assets to the audit agenda, reinforces that regulators and standard-setters internationally are bringing digital platform and crypto activity into mainstream compliance frameworks. HMRC's CC/FS98 is the UK's contribution to that pattern.

Systems and Software Review

Firms advising platform clients should assess whether the client's digital asset accounting software or data management tools are capable of producing the seller data reports HMRC requires to the required standard. Fragmented records, data held in separate systems, or manual workarounds all increase the risk of inaccuracy penalties. Where deficiencies are identified, recommending remediation now is preferable to addressing them under the pressure of an open compliance check.

Frequently Asked Questions

Does CC/FS98 apply to crypto exchanges specifically?

The factsheet applies to any entity that qualifies as a digital platform operator under the UK's platform reporting rules. Whether a specific crypto exchange is in scope depends on whether it facilitates transactions between sellers and buyers in a way that meets the regulatory definition, and whether it meets the residency or registration threshold. This requires a fact-specific analysis for each platform.

What is the deadline for the UK platform operator annual report?

For the 2024 reporting period (the first year of the obligation), reports were due by 31 January 2025. Subsequent annual reports follow the same January 31 deadline for the preceding calendar year. Platforms that missed the first deadline are already potentially exposed to late filing penalties.

Can penalties be reduced if a platform discloses errors voluntarily?

Yes. HMRC's penalty framework across most taxes provides for reductions where a person makes an unprompted, full, and accurate disclosure. CC/FS98 applies the same principle to platform reporting penalties. The reduction is greater for unprompted disclosure than for disclosure made after HMRC has already made contact, so early action has real financial value.

Does the due diligence penalty apply even if the annual report was filed on time?

The failure-to-carry-out-due-diligence penalty is a separate head of liability from the late or missing report penalty. A platform that filed a report on time but cannot demonstrate it verified seller information through a compliant process could face penalties on the due diligence ground regardless of its filing record.

How should an accounting firm treat an open HMRC compliance check in a client's financial statements?

Under IAS 37 and FRS 102 Section 21, a provision is required where an obligation is probable and the amount can be reliably estimated. Where a check is open but the outcome is uncertain, a contingent liability disclosure may be appropriate. Auditors should obtain management representations on open compliance checks and assess whether the disclosures in the financial statements are adequate.

Source: HMRC / GOV.UK, CC/FS98