Audit & Enforcement · October 14, 2026 · 13 min read · By CryptoTaxCalc Team

The Taxman Asked About Trades From Six Years Ago. Here's How Long They Can Actually Reach.

I pulled my 2019 Coinbase CSVs out of an old Drive folder last month, half expecting to laugh at how little was in there. What I actually did was work out how many of those old years were still open. The answer turns on three things that have nothing to do with the size of the gain: whether a return was filed, whether the omission would be called careless or deliberate, and whether the evidence to rebuild the trade still exists. So this is an article about windows — the assessment clock, the longer clock, and the files that outlive both.

Image: Illustrative purposes. Rules cited from IRC §6501 and 31 U.S.C. §5321(b)(1), TMA 1970 ss.34–36, §§169/371/376/147 AO, ITA s.152(4) and s.230, TAA 1953 Schedule 1 s.170, 国税通則法 §70, and s.149 Income-tax Act 1961 / Income-tax Act 2025.

The number most people carry in their heads is three years. It is close to right for a clean, filed, ordinary year in the US and Canada, and it is why a lot of long-time holders stopped worrying about anything older than 2021. It falls apart the moment a year is not clean. And "how long can they assess me" is a different question from "how long must I keep the paperwork" — different statutes, different lengths, and they do not expire together. I found that out the boring way: by reading the actual limitation provisions instead of trusting the folk version.

This is the companion to the piece on what happens if you don't report crypto — that one is about the penalties; this one is about time, evidence, and the moment a closed year quietly reopens. If you just want the filing dates rather than the enforcement windows, the seven-country deadlines guide has them.

Why the clock is not the number you think it is

Almost any quiet year is three or four years, then closed. That is the whole intuition, and it is correct often enough to be dangerous. The exceptions are the ones that bite:

1. You never filed. Not filed late — never filed. In that case most systems simply have no clock. US IRC §6501(c)(3) sets no limitation at all. The UK's failure to notify under s.7 lands you in the deliberate lane, not the ordinary one, as I'll show below.
2. The return was fraudulent, or you willfully tried to evade. IRC §6501(c)(1) and (c)(2) again leave no time limit. This is the clause that turns "old and forgotten" into "open indefinitely."
3. You crossed a threshold of omission. IRC §6501(e) stretches the US window from three years to six where more than 25% of gross income was left off. A couple of unreported disposals can cross that line in a year when your other income was thin.

Notice what unites the three: none of them is about the size of the trade. They turn on the character of the filing — absent, dishonest, or short by a margin. Which means the useful question about 2019 is not "how big was my gain" but "did I file, and does the return match what the exchange reported." Get those two right and the window really does close. Get them wrong and it does not.

Two clocks, and almost everybody merges them

There are two separate time limits in this story and they run on different logic.

The assessment window is how long the authority can issue or change an assessment. The retention window is how long you must keep records. People assume the second follows from the first — keep records for as long as they can assess, then shred. In practice the retention duty is often a fixed statutory number (six years, seven years, five years) while the assessment window can be extended for carelessness, doubled for a threshold omission, or removed outright for fraud. So you can have a year where the assessment window is twenty years but your stated retention rule says six.

The retention figure is a floor, not a licence. If an extended or unlimited assessment window is still open on an old year, the obligation to be able to evidence that year survives with it. The record-keeping spreadsheet system I use was built for exactly this reason, and it is the only reason I could reconstruct 2019 at all. Here is the one-line version of the retention cheat-sheet, ahead of the detail: keep US records 7+ years (effectively forever where no return was filed), UK 6, Germany 8/10, Canada 6, Australia 5, Japan 7, and India 8.

The seven-country comparison

Read the "unlimited" column before the "standard" column. The standard window is the marketing number; the exceptions are where the actual risk lives.

United States: three, six, or never

IRC §6501(a) gives the IRS three years from the later of the return due date or the filing date. That is the baseline, and for a straightforward crypto year with everything reported it is real. The IRS crypto audit risk in a normal year is low, and most CP2000 notices for 1099-DA mismatches land inside that three-year window — which cuts both ways. It means the IRS is fast, not that it is finished.

Section 6501(e) is where a quiet year becomes a six-year one. Omit more than 25% of gross income and the window doubles. In a year where your salary was modest and you disposed of a chunk of a position, an unreported 1099-DA can be most of your gross income on paper, and the 25% test passes without anyone deciding you were dishonest. Then §6501(c): no return filed, a false or fraudulent return, or a willful attempt to evade — no time limit at all.

The wrinkle people miss is FBAR. It is not an income-tax window and it does not follow §6501. Under 31 U.S.C. §5321(b)(1) the government has six years to assess civil penalties, and the penalty maths — per-account, per-year, willful versus non-willful — can dwarf the tax on the gain that started the enquiry. So a crypto year can be income-tax-closed and foreign-account-open at the same time. The US page has the rates that tell you what the tax actually is; the limitation rules tell you how long it can wait.

United Kingdom: four, six, or twenty

TMA 1970 s.34 gives HMRC four years from the end of the tax year to raise a discovery assessment. Section 36(1) extends that to six years where the loss of tax was brought about carelessly. And s.36(2) — the one to actually remember — extends it to twenty years where it was brought about deliberately. A failure to notify chargeability under s.7 sits in that harsher lane rather than the careless one, which is a nasty asymmetry: staying quiet can be treated more harshly than being late.

HMRC's own crypto guidance and its "nudge letters" make this more than theory. If you receive a nudge, answer it precisely. A vague reply, or an amendment that discloses gains incompletely, is the classic way to move yourself from careless (six years) to deliberate (twenty). The difference between those two lanes is not the money; it is whether your conduct reads as an honest miss or a decision to hide. I would rather over-disclose in the amendment than have a reviewer infer intent from a gap.

Germany: four, five, ten — and a Selbstanzeige that must be complete

Section §169(2) AO sets the regular assessment period at four years. It goes to five years where the tax was leichtfertig verkürzt (reduced through gross negligence) and to ten years where it was hinterzogen (evaded) under §370 AO. The criminal windows in §376 AO run five years for leichtfertige Steuerverkürzung and ten years for Steuerhinterziehung — so the assessment window and the criminal window are not the same thing, and both matter.

The voluntary disclosure under §371 AO is the German fix, and its condition is unforgiving: it only protects you if it is complete and timely. An incomplete Selbstanzeige can be worse than none at all, because it hands the authority a partial admission without the immunity. Retention is its own tangle: §147 AO requires six years for other documents, and the bookkeeping-voucher retention period was shortened from ten years to eight by the 2025 bureaucracy-relief reform. Retention rules have moved lately, so verify the current figure rather than trusting a blog — including this one.

Canada: three or six, and a records rule that spans years

ITA §152(3) gives three years from the date of the notice of assessment for a normal reassessment. Section 152(4) extends that to six years where the taxpayer was negligent or careless, and there is effectively no limit where there is a misrepresentation attributable to neglect, carelessness or fraud. The threshold matters more than it sounds: "careless" is a lower bar than "fraudulent," and an incomplete T5008 match with no explanation can read as careless.

Section 230 is the record rule I keep coming back to. It requires records for six years from the end of the last tax year to which they relate. The trap is a coin bought in 2017 and sold in 2021: the acquisition year and the disposition year are both part of the story, and both need to be documented. If the 2017 buy is in a wallet you no longer control and the exchange is defunct, you have a cost-basis problem and a records problem at once.

Australia: the shortest window, and the data that defeats it

TAA 1953 Schedule 1 s.170 gives most individuals only two years from the notice of assessment to amend, four years in other cases. Section 170(2) removes the time limit entirely for fraud or evasion. Records must be kept five years from the date you prepare your tax return — the shortest retention requirement in this group. On paper Australia looks like the safest place to have an old, sloppy year.

It is not, and the reason is data. The ATO's crypto data-matching program compares exchange data against returns, and a mismatch on an old year is what triggers the review. The review is not the same as an amendment, and the two-year window does not bar it — the ATO simply checks the data it already holds and asks you to explain. So the shortest limitation period coexists with aggressive matching: the window is short, but the evidence arrives anyway. That is the pattern to internalise, because CARF is about to apply it everywhere.

Japan: five years, seven if improper, and an expensive reconstruction

国税通則法 §70 sets the assessment exclusion period at five years, extended to seven where tax was evaded by 偽りその他不正の行為 (fraudulent or other improper means). A 青色申告 (blue-return) filer's records should be kept for that period. Japan's treatment of crypto gains as 雑所得 (miscellaneous income), at a marginal rate that can reach roughly 55% once local inhabitant tax is included, is what makes this more than a procedural note.

Reconstructing an old year is where the cost really sits. If you cannot produce cost basis for a 2018 disposal, the default assumption tends to be a high basis-to-proceeds mismatch that favours the tax office less than you would like, and the 55% marginal rate multiplies whatever error survives. Five years is a short window in absolute terms, but the penalty for a bad reconstruction inside it is the steepest here.

India: three, ten, and a parallel Black Money window

Section 149 of the Income-tax Act 1961 lets the department reopen normally within three years from the end of the relevant assessment year, and up to ten years where escaped income is ₹50 lakh or more and the prescribed sanction is obtained. The numbering is in flux: the Income-tax Act 2025 comes into force on 1 April 2026 and restructures the sections, so cite both when you are looking things up — the substance carries over but the references move.

Separately, an undisclosed foreign asset can attract a ₹10 lakh penalty under the Black Money Act 2015, which runs on its own windows rather than the income-tax reassessment clock. That is the Indian version of the FBAR point: an income-tax year can close while a disclosure-based exposure stays open. Records should be kept six to eight years under s.44AA. If you reported foreign holdings on Schedule FA, you have a head start; if you did not, that gap is the one to fix first.

The CARF effect: from 2027, old years get discovered

Everything above assumes the authority has to go looking. From 2027 the Crypto-Asset Reporting Framework changes that for participating jurisdictions: crypto service providers will report to tax authorities at the exchange level, in a common format, and that data will be exchanged between countries automatically. The practical consequence is that old-year exposure stops being something you assume away and becomes something the system surfaces for you.

Do the arithmetic on a clean three-year window and a data file that lands in 2030. The 2030 file can still reach 2026 — and a six-year or unlimited extension reaches further back still. That is the whole point: a short limitation period is only protective while the evidence stays hidden, and CARF exists to remove the hiding. I would treat CARF's adoption as staggered rather than simultaneous — not every jurisdiction will switch on in the same year, and not every exchange will report perfectly on day one — so the honest hedge is that the direction is certain and the exact first data drop is not. Plan for the direction.

What actually triggers a review, and what the request looks like

Almost nothing here starts with a human deciding to audit you. It starts with a computer matching two files. The CP2000 in the US, an HMRC nudge letter, a CRA pre-assessment review of unreported dispositions, the ATO's exchange-data match, a Japanese 税務署 request under お尋ね — these are automated or semi-automated comparisons, and they are set off by a disagreement between what a third party reported and what you filed. Cross-border information exchange under CRS feeds the same machinery.

The request that follows is almost insultingly mundane: exchange transaction statements, wallet addresses, CSV exports, bank records showing on-ramps and off-ramps. That is exactly why it is dangerous. If your CSV is a mess or your basis is unfindable, the reviewer does not conclude "this person was careful and unlucky" — the reviewer reconstructs the year from the exchange's numbers, which are the numbers you did not use. The one thing you control is the quality of that file. Wallets you no longer use still have addresses; a labelled export of what you can find is worth more than a perfect memory of what you cannot.

The one thing you can still fix: closing the year yourself

If a year is open and you know it is wrong, the voluntary-disclosure route is almost always cheaper than the discovery route — it changes the narrative from "we found it" to "we told you," and that is often worth more than the tax. The mechanics differ by country: a US 1040-X, an HMRC amendment or disclosure, the German §371 Selbstanzeige, the CRA Voluntary Disclosures Program, the ATO voluntary disclosure, Japan's 更正の請求 for a correction you are entitled to or 修正申告 for one you are not, and India's updated return.

I am deliberately not re-explaining all seven procedures here, because they are detailed and get amended — the amending crypto tax returns guide walks through each one with the current forms and deadlines. The point for this article is narrower: the same carelessness question that shortens or lengthens the window also governs how a voluntary disclosure is received. Get it in early, make it complete, and document why the original was wrong. A partial correction can move you toward the deliberate lane you were trying to avoid.

So when I finally pulled those 2019 CSVs, what I was really doing was proving a closed year closed cleanly. The trades were small, the return matched, and the file exists — three out of three, which is the only version of "safe" on offer. Anyone relying on the folk three-year rule without those three facts is guessing.

General information, not tax advice. Limitation periods depend on whether a return was filed and on how your conduct would be characterised, and the fraudulent or deliberate lanes are fact-specific. Germany's retention rules and India's reassessment numbering are both changing — verify the current text. CARF adoption timing varies by jurisdiction. Where a year is open and the amount is material, pay for a local adviser's opinion before you contact anyone.

FAQ