What HMRC already sees about a family’s offshore and UAE accounts

The letter is the last step, not the first

A nudge letter from HMRC reads as an opening move. A family receives a short, polite note saying the department has information suggesting they may have overseas income or gains that have not been fully declared, and inviting them to check their position. It feels like the start of something.

It is almost always the end of something. By the time that letter is printed, the overseas bank behind it has usually already reported the account to HMRC, automatically, as part of a bulk annual feed that no one asked for and no one can opt out of. The letter is not HMRC fishing. It is HMRC acting on data it already holds, and matching that data against what the family did or did not put on a tax return.

I spend a good deal of time with families who read the arrival of such a letter as the moment the clock starts. The useful clock started years earlier, when the account was opened and the structure was built. The real work is the reconciliation done calmly before any letter, not the scramble after one. This note sets out what HMRC can see, what changed from 1 January 2026, where the UAE sits in the picture, and what a composed answer actually looks like.

What automatic exchange actually sends to HMRC

The Common Reporting Standard has moved financial account information between tax authorities since 2016. A bank in a participating country identifies which of its account holders are tax resident elsewhere, and reports each one, once a year, to its own tax authority, which passes the file to the country of residence. The holder is not told each time it happens. For a UK-resident person with an overseas account, the account balance, the interest, the dividends and the sale proceeds arrive at HMRC without a single request being made.

From 1 January 2026 the standard is wider and sharper. The amended version, widely called CRS 2.0, is brought into UK law by The International Tax Compliance (Amendment) Regulations 2025. It extends reporting to electronic money institutions and certain e-money products, so the balances held on payment and e-money platforms now fall in alongside bank accounts.

It excludes most genuine charities, strengthens the due-diligence a financial institution must run on its account holders, makes registration mandatory, and reforms the penalties. From 1 January 2027 every submission to HMRC must use the amended schema, including data for earlier years. The first reports under the new rules cover calendar year 2026 and reach HMRC during 2027.

None of this is a new principle. It is the same architecture, pointed at more of the balance sheet and asking the reporting bank to be more certain about who the account really belongs to.

The crypto gap closes too

The one asset class that genuinely sat outside the net was crypto. A self-custodied wallet, or an account at a platform in a non-reporting country, was not a financial account the Common Reporting Standard could see. The Crypto-Asset Reporting Framework, CARF, closes that gap, and it closes it the same way: not by reporting the coin, but by reporting the person behind it.

In the UK, reporting cryptoasset service providers began collecting user and transaction data from 1 January 2026, and the first report, covering 2026, is due by 31 May 2027. The mechanics for a family holding crypto through a trust or a holding company, and the look-through to the people who control it, are the subject of the separate note on UK CARF crypto reporting for the family office. The point for the wider picture is only that the last obvious hiding place is being wired into the same feed as the bank accounts.

The UAE account was never invisible

The assumption I correct most often is that a UAE account is somehow outside all of this. It is not, and it has not been for years.

The UAE has exchanged financial account information with partner countries, including the United Kingdom, under the Common Reporting Standard since its first exchanges in 2018. A UAE bank reports an account held by a UK tax resident to the UAE authority, which passes it to HMRC, on the same annual cycle as every other participating country. On crypto, the UAE committed in November 2024, as one of sixty-one jurisdictions, to the Crypto-Asset Reporting Framework, and will begin its exchanges by 2028 in respect of calendar year 2027. The United Kingdom is in the earlier wave of forty-six jurisdictions exchanging from 2027.

So the practical position for a corridor family is plain. A personal UAE account held by a UK resident is reported. A UAE company or foundation that is a passive holding vehicle is looked through to its controlling persons, and a UK-resident settlor, beneficiary or owner behind it is reported as the person who controls it. Residence in the UAE for one family member does not take a different, UK-resident member out of the feed. The structure that was built to hold the wealth is often the very thing that names the family to HMRC.

Automatic is not the same as on request

A family office should hold two separate channels in its head, because they behave differently and the headlines blur them.

The first is automatic exchange, the bulk annual feed described above. It is vast and it is routine. In one recent year HMRC received information on about 5.67 million offshore accounts held by around 3 million UK residents, and over time it has drawn in roughly £821 million of compliance yield from the Common Reporting Standard and similar agreements. HMRC's own experimental statistics, published in October 2024, estimated that about 4% of UK residents covered by automatic exchange and matched to a record had under-declared tax on their foreign income in a sample year, worth in the order of £0.3 billion. That is the scale against which a single family's return is matched.

The second channel is exchange on request, where one authority asks another a specific question about a named taxpayer, usually because an enquiry is already live. Those requests are rising: foreign tax authorities made 1,772 requests to HMRC for information on taxpayers in 2025, a seven-year high, up from 1,693 in 2024 and 1,393 in 2020. A request on request means a person is already a subject. The automatic feed is the net; the request is the follow-up once something in the net has been pulled.

A nudge letter, an enquiry and a fraud investigation are three different things

The response a family makes should match what has actually arrived, and these are not the same instrument.

A nudge letter, in HMRC's own language a "One to Many" letter, is informal. It is sent to a group identified by data as worth prompting, it does not open a formal enquiry, and in strict terms it does not require a reply. It is pressure, not process. These letters have moved steadily upmarket through 2026, from broad populations toward wealthy and ultra-wealthy taxpayers, and a recent campaign targeted holders of crypto specifically. Ignoring one is a decision, and usually a poor one, because the data that generated it does not go away.

A formal enquiry is process. It is opened under statutory powers, it carries deadlines, and it narrows toward an assessment. A Code of Practice 9 investigation, offered through the Contractual Disclosure Facility, is the serious end, used where HMRC suspects deliberate behaviour and offers a route to disclose it in exchange for not pursuing a criminal prosecution. Treating a nudge letter as a Code of Practice 9 matter wastes money; treating a Code of Practice 9 letter as a nudge wastes something far more valuable. Reading the instrument correctly is the first professional act.

An anonymised case

Consider a composite, with the details changed so no family is identifiable, because the pattern matters more than the particulars.

A UK-resident adult, part of a family whose wealth is run from the UAE, receives a nudge letter saying HMRC holds information that they may have received overseas income. The family's instinct is that it is a mistake, because "the UAE has no tax". The reconciliation tells a more careful story.

There are two UAE accounts in view. One is the current account of a sibling who is UAE resident and not a UK taxpayer, correctly outside the UK net, reported but with nothing owed. The other is a deposit account in the UK-resident person's own name, carrying a few years of modest interest that was never large enough to feel like income and never made it onto a return.

The number is small, the behaviour is careless rather than deliberate, and the right route is a disclosure through the Worldwide Disclosure Facility before the position hardens into an enquiry. Because the family came forward and could evidence the source and the figures cleanly, the disclosure was accepted at the low end of the penalty range. The lesson is not that the sum was trivial. It is that the family could answer in weeks because the account was already understood. A family that could not explain the same account would have faced the same letter as the opening of a long and expensive conversation.

What the data already shows

It helps to see the channels and the dates side by side rather than in prose.

Read down the middle column and the message is the one families resist. Almost nothing in it depends on HMRC asking. The data arrives whether or not anyone is under suspicion, and the suspicion, when it comes, is built from the data.

How a family office answers

The composed response is not a clever letter. It is a standing discipline that makes the clever letter unnecessary.

It begins with a complete inventory of every account and vehicle the structure touches, in every country, mapped to who holds it, who controls it, and where each of those people is tax resident. Against each line sits the UK filing position: taxed here, not taxable because the holder is non-resident, within an exemption, or already disclosed. Where there is a gap, it is closed in calm conditions through the Worldwide Disclosure Facility, not under the time pressure of an open enquiry, because a prompted disclosure of a known gap is a far better place to stand than a discovered one.

The evidence that supports all of this is the same source-of-wealth architecture a bank or a buyer would demand, set out in the note on building the source-of-wealth file, and it belongs in the drawer before anyone asks for it.

This is governance work, and it sits beside the UAE side of the same obligation, the record-keeping and exchange duties under UAE Cabinet Decision 209 of 2025, and the residence questions that decide who is even in the UK net, including the inheritance tax tail examined in the note on the long-term resident IHT exposure. The family office that holds all of this current reads a nudge letter as confirmation of what it already knew, and answers it accordingly.

Frequently asked questions

What is CRS 2.0 and when does it start?

CRS 2.0 is the amended version of the Common Reporting Standard, the global system under which banks report account holders who are tax resident in another country to that country's tax authority. In the UK it is brought in by The International Tax Compliance (Amendment) Regulations 2025 and takes effect from 1 January 2026. It widens reporting to electronic money institutions and certain e-money products, excludes most charities, tightens the due diligence banks must run, makes registration mandatory and reforms the penalties. The first reports under the new rules cover calendar year 2026 and reach HMRC during 2027, and from 1 January 2027 all submissions move to the amended schema.

Does the UAE share bank account information with HMRC?

Yes. The UAE has exchanged financial account information with partner countries, including the United Kingdom, under the Common Reporting Standard since its first exchanges in 2018. A UAE bank reports an account held by a UK tax resident to the UAE authority, which passes it to HMRC on the standard annual cycle. If a UAE company or foundation is a passive holding vehicle, the bank looks through it and reports the controlling persons, so a UK-resident settlor, beneficiary or owner behind a UAE structure is reported even though the entity itself sits in the UAE. The common belief that a UAE account is outside HMRC's view has not been accurate for years.

When do the first CARF reports reach HMRC?

In the UK, reporting cryptoasset service providers began collecting user and transaction data from 1 January 2026, and the first report, covering calendar year 2026, is due by 31 May 2027. The Crypto-Asset Reporting Framework reports the person behind the crypto, not just the asset, so holdings through a trust or company are looked through to the controlling individuals. The UAE committed to the framework in November 2024 and will begin its own exchanges by 2028 in respect of calendar year 2027, which places a UAE-connected family holding crypto through UK or other reporting providers firmly inside the network.

What is an HMRC nudge letter and do I have to respond?

A nudge letter, which HMRC calls a "One to Many" letter, is an informal prompt sent to a group of taxpayers identified by data as worth checking. It does not open a formal enquiry and in strict terms it does not compel a reply. That does not make it safe to ignore. The letter exists because HMRC already holds information, usually from automatic exchange, that does not match what it expected, and that information does not disappear if the letter is binned. The right course is to reconcile the position the letter points at and respond on the facts, taking advice if the position is anything other than plainly in order.

What is the difference between automatic exchange and exchange on request?

Automatic exchange is the bulk annual feed: banks report every reportable account to HMRC each year without anyone asking, covering millions of accounts. Exchange on request is narrower and later, where HMRC or a foreign authority asks a specific question about a named person, almost always because an enquiry is already open. The automatic feed is how a family first appears on HMRC's radar; the request is what happens once something on the radar has already drawn attention. Requests between authorities reached a seven-year high in 2025, which signals that the automatic data is increasingly being turned into active enquiries.

We received a nudge letter about offshore income, what should we do?

Start by reading what has actually arrived, because a nudge letter is not an enquiry and not a Code of Practice 9 investigation, and the response differs for each. Then reconcile the account the letter points at: whose it is, where that person is tax resident, and how the income or gain was treated for UK tax. If the position is correct, you can say so with evidence. If there is a genuine gap, closing it through the Worldwide Disclosure Facility before the matter becomes a formal enquiry usually produces a far better outcome, because a prompted disclosure of a known gap sits better than one HMRC discovers. Do not reply with assertions you cannot evidence.

What are the penalties if a family has under-declared offshore income?

Penalties for offshore matters are higher than for domestic ones, under the offshore enhancement in the Finance Act 2016 to the inaccuracy regime in Schedule 24 to the Finance Act 2007. For older years that fell within the requirement to correct, the failure-to-correct penalty under section 67 and Schedule 18 to the Finance (No. 2) Act 2017 is severe: a standard 200% of the tax, reduced for the quality of disclosure but not below 100% for a voluntary disclosure or 150% for a non-voluntary one. The quality and timing of the disclosure drive the figure, which is why a reconciled position and an unprompted, well-evidenced disclosure are worth so much more than a defensive reply.

Can a UAE family structure keep accounts outside automatic exchange?

Not in any way a family office should rely on. The feed is built to look through passive holding structures to the real people who control them, so a trust, foundation or holding company does not sit between the account and HMRC; it is reported with its controlling persons named. The expansion of CRS 2.0 to e-money platforms and the arrival of the crypto framework are closing the remaining edges, and the UAE participates in both. The planning that works is not concealment, which fails and is penalised, but structuring the affairs so that what is reported is already correct and already declared where it needs to be.

---

Critical advisory. Automatic exchange has quietly inverted the compliance task. The question is no longer whether HMRC can see a family's offshore and UAE accounts, because from 1 January 2026 it sees more of them, more clearly, than ever.

The question is whether what it sees matches what the family has filed. I have sat with families on both sides of a nudge letter, and the difference between a paragraph in reply and a two-year enquiry is almost never the size of the account. It is whether the structure was reconciled to the data in calm conditions, with the evidence already assembled, before anyone wrote to ask.

We do that reconciliation work across the UAE and the UK as a standing discipline rather than a response to a letter. This note is general information and not advice on your own affairs, so take specific advice before you act or disclose.