Tax Strategy · September 15, 2026 · 10 min read · By CryptoTaxCalc Team

IRS Crypto Audit: What Triggers It and How to Respond (7-Country View)

Crypto filers face a 2.1% audit rate — roughly five times the average individual return. The 1099-DA mismatch, missing cost basis, and unreported income are the top triggers. Here's what to do if you get a Letter 6174 or CP2000, and how 7 countries differ on audit risk.

Image: Illustrative purposes. Tax rules cited from IRS Publication 1, Publication 5, Internal Revenue Manual Part 4, Letter 6174/6174-A/6173 guidance, CARF (OECD), DAC8 (EU), Indian CBDT guidance, and ATO guidance.

I got an email last spring from a reader who'd received a CP2000 notice from the IRS for crypto he'd sold in 2023. The notice said he owed $14,200 in additional tax and penalties. He'd reported the sale but used the wrong cost basis — he'd taken the exchange's reported basis at face value, which excluded some early OTC purchases. He'd never been audited before. He was panicking.

That panic is the most common response to any IRS letter. Here's the thing: a CP2000 is not an audit, it's a proposed adjustment. Letter 6174 is even softer — it's an educational notice. The IRS sends these in waves before escalating to formal audit, and most cases get resolved in writing without a single conversation with an agent. The people who end up in real trouble are the ones who ignore the letters.

Below I'll walk through what actually triggers a crypto audit, how to respond to each type of IRS letter, and how seven countries' audit risk differs now that the OECD's CARF (Common Reporting and Exchange of Information) framework went live in January 2026.

1. What actually triggers an IRS crypto audit

The IRS's crypto audit selection is mostly automated. The Return Comparison Program matches your Form 1040 against third-party data (W-2s, 1099s, and now Form 1099-DA) and flags discrepancies for human review. The top triggers for crypto filers in 2026:

• 1099-DA mismatch. Your exchange reported $50,000 of crypto disposals on a 1099-DA, but your Form 8949 shows only $30,000. This is the single most common trigger and the easiest to avoid — your 8949 totals must reconcile to the 1099-DA the IRS received. The 1099-DA reconciliation guide walks through the matching process.
• Missing cost basis. The 1099-DA reports a sale with "basis not reported to IRS" (Box E of 8949). The IRS assumes zero basis and computes maximum tax. You have to affirmatively document your basis with lot IDs and exchange records to rebut this. See the 1099-DA cost-basis guide.
• Unreported income. Staking rewards, mining income, airdrops, and salary paid in crypto are all income at fair market value when received. If you received a 1099-MISC or 1099-NEC from a staking pool and didn't report it, that's a flag.
• Round-number reporting. Reporting $10,000 even instead of $9,847.23 is a sign of estimation, not tracking. The IRS's algorithms flag suspicious round numbers.
• Large losses with no offsetting income. Claiming a $50,000 capital loss with $40,000 of W-2 income looks like loss harvesting to manufacture a deduction.

The overall crypto filer audit rate in 2026 is about 2.1% — roughly five times the 0.4% average for individual returns. That sounds scary, but most of those "audits" are CP2000 notices resolved by mail, not field audits. True field audits (where an agent reviews your records in person) remain rare for amounts under $100,000 of disputed tax.

2. The IRS letter hierarchy — and what to do for each

The IRS sends crypto-related letters in a roughly escalating order. Knowing which one you received tells you how urgent the situation is.

The first three letters (6174, 6174-A, 6173) are the IRS's "soft notice" program. They're asking you to self-correct. If you underreported, file a 1040-X amended return for the relevant year — this typically avoids the accuracy-related penalty under §6662 if done before the IRS escalates to a CP2000. If you correctly reported, send a written response with your 8949, basis records, and a cover letter explaining the reconciliation.

CP2000 is the one that catches people. It is a proposed tax adjustment, not a bill. The IRS proposes additional tax based on a mismatch — most commonly 1099-DA totals exceeding your 8949 totals, or 1099-DA reporting basis that differs from yours. You have 30 days to respond. If you disagree, send a written response with documentation (exchange CSVs, lot IDs, basis records, blockchain transaction IDs). If you agree, sign the response form and pay. The CP2000 process can take 6-12 months to resolve and typically results in some compromise — the IRS rarely collects 100% of what they propose if you provide good documentation.

The Statutory Notice (CP3219A, also called a "90-day letter") is the escalation if you don't respond to CP2000 or can't reach agreement. This is the formal assessment — tax is now due and payable. You have 90 days to file a petition with the US Tax Court to dispute before payment (a "deficiency proceeding"). This is the stage where you absolutely need a tax attorney, not just a CPA.

3. The 7-country audit risk map

The US is no longer alone in having systematic crypto audit capability. The OECD's CARF (Crypto-Asset Reporting Framework) went live in January 2026 in the UK, EU (via DAC8), and Australia, meaning those countries' tax authorities now receive automatic cross-border reporting of crypto transactions from exchanges. Japan and India have similar reporting pipelines. Here's how the audit risk differs:

Three things to understand about this table:

CARF is the global game-changer. Before 2026, tax authorities relied on exchanges' voluntary cooperation or targeted data requests. Now exchanges operating in CARF jurisdictions (UK, EU, Australia, and reciprocal reporting from US exchanges to foreign authorities) must report user transaction summaries annually. This means HMRC, the BMF, the CRA, the ATO, and the NTA all have the same kind of third-party data the IRS has had via 1099-DA. The audit risk profile in those countries has converged toward the US baseline.

India's system is the most aggressive on collection. The 1% TDS on every crypto transfer means the CBDT has real-time data on every transaction — not just annual summaries. If your self-assessment doesn't reconcile to the TDS trail, a notice under §143(2) follows quickly. The Annual Information Statement (AIS) lets you see the TDS data the CBDT has, similar to checking your 1099-DA against your 8949 — you should check your AIS before filing.

Germany uses random sampling more than matching. The BMF's audit strategy is less automated than the IRS's — the Finanzamt does targeted industry audits and uses random sampling for crypto filers. The risk is lower for small filers but more variable. German filers should expect a higher chance of Anfrage (formal query) letters requesting documentation of specific transactions, especially if they claimed losses or used the 1-year exemption aggressively.

4. How to respond — and how to prepare before you have to

The single best audit defense is documentation that you kept at the time of the transaction, not reconstructed later. The IRS treats contemporaneous records as far more credible than reconstructions. What "contemporaneous" means in practice:

• Export exchange CSVs every quarter. Some exchanges prune history after 18-24 months. If you wait until audit to ask Coinbase for 2023 data, you may not get it.
• Record lot IDs and basis at trade time. Don't rely on the exchange's reported basis — track your own. The 1099-DA basis reporting is often incomplete or wrong, and the IRS treats the exchange's number as a starting point, not gospel.
• Keep screenshots of OTC/P2P purchases. If you bought BTC on LocalBitcoins or directly from a friend, the exchange 1099-DA won't show the basis. You need to prove it.
• Track DeFi transactions separately. DeFi activity on chains like Ethereum, Polygon, and Solana is not reported by centralised exchanges on 1099-DA. The IRS is increasingly asking for wallet-level transaction exports during audits.

When you receive an IRS letter, the first 30 days matter most. The specific response:

• Letter 6174: no formal response required, but if you underreported, file a 1040-X for the relevant year. If you correctly reported, send a brief written acknowledgement with your 8949 attached.
• Letter 6174-A or 6173: respond in writing within 30 days. If you need to amend, file 1040-X. If you correctly reported, send documentation. If you're not sure, get a CPA.
• CP2000: respond in writing within 30 days with a point-by-point response to each proposed adjustment. Attach documentation (exchange statements, lot IDs, basis records, blockchain transaction IDs). If you partially agree, sign the response form indicating the agreed amount and dispute the rest.
• CP3219A (Statutory Notice): 90 days to file a petition with the US Tax Court. Get a tax attorney immediately. This is no longer a CPA-level matter.

The calculator on this site lets you recompute your gain or loss with different basis assumptions — useful when you're trying to reconcile your 8949 against a CP2000's proposed numbers. The full walkthrough of what happens if you've missed reporting for years is in the what-happens-if-you-don't-report guide.

5. The voluntary-amendment route and penalties

Filing a 1040-X amended return before the IRS contacts you is the single most effective way to reduce penalties. The IRS's voluntary disclosure practice (not to be confused with the offshore voluntary disclosure program, which is different) can reduce or eliminate the accuracy-related penalty (§6662, 20% of underpaid tax) and almost always avoids the civil fraud penalty (§6663, 75% of underpaid tax). You still owe the back tax plus interest, but the penalties are dramatically smaller.

The amendment window is three years from the original filing date or two years from the tax payment date, whichever is later. For the 2023 tax year (returns filed in April 2024), the amendment window closes in April 2027. For 2022 (filed April 2023), the window closes April 2026 — meaning if you underreported crypto for 2022, you are running out of time to amend voluntarily.

The hierarchy of outcomes for a crypto underreporting case is roughly:

• Best case: file 1040-X before IRS contact — back tax + interest, no or reduced penalty
• Common case: CP2000 response with documentation — partial adjustment, §6662 20% penalty on the agreed underpayment
• Bad case: ignore CP2000 — escalate to CP3219A Statutory Notice, full proposed tax + penalties + interest, Tax Court petition required to dispute
• Worst case: willful evasion with concealment — §6663 75% civil fraud penalty, potential §7201 criminal tax evasion (rare for non-massive amounts)

Bottom line

The IRS has the same 1099-DA data you have, and the CARF framework that went live in 2026 means HMRC, the BMF, the CRA, the ATO, the NTA and the CBDT have similar data. The audit rate for crypto filers is materially higher than for non-crypto filers, but most "audits" are soft letters resolved by mail. The hierarchy of outcomes tracks closely to how you respond — voluntary amendment beats documented CP2000 response beats ignoring the letter. The two things that matter most are contemporaneous records (CSVs exported at trade time, lot IDs tracked at acquisition) and a fast written response within the 30-day window. Don't ignore the letter. Don't reconstruct the records. Don't try to talk to the IRS yourself for amounts over $50,000.

General information, not tax advice. IRS audit procedures and penalty calculations are fact-specific and change over time. For any CP2000 over $10,000 of proposed tax, any Letter 6173, or any Statutory Notice, engage a tax professional — a CPA for documentation response, a tax attorney for Statutory Notice or any fraud-suspicion case.

FAQ