CARF: Crypto-Asset Reporting and First Exchanges in 2027

By 2027 tax administrations will have something they have never had before: an annual picture of an individual's crypto-asset activity, arriving down a routine automatic-exchange channel. The mechanics will feel familiar from CRS, but the object is fundamentally different: a year's worth of transaction flow instead of an account balance. And the inspector will read that flow sitting next to the person's return for the same period.

We covered the general theory of automatic exchange separately, in the CRS overview; the infrastructure context, from custody to stablecoins, is set out in our piece on crypto for private wealth. What follows is purely operational: who exactly reports, which fields go into the file, which fields are missing from it, when this happens across the jurisdictional waves, and what a capital holder should do with the time that is left. The reporting picture as a whole — the amended CRS, Form 1099-DA, the Spanish returns and the holder's own filing duties — is drawn together in crypto-asset tax reporting; this page stays on the CARF mechanism itself.

CARF is engineered differently from CRS, and the engineering determines what the tax authority will see — and what it will have to reconstruct for itself.

Key parameters of the CARF regime:

Who reports: the RCASP and its jurisdictional nexus

The obliged party under CARF is called a Reporting Crypto-Asset Service Provider, and it is defined by function, regardless of licensing: any individual or entity that, as a business, provides a service effectuating exchange transactions in crypto-assets. The itemised breakdown of who this catches comes from the OECD commentary on CARF: exchanges and intermediaries, brokers and dealers, crypto ATM operators, and participants in decentralised venues wherever there is an identifiable operator, following the FATF logic for VASPs. A pure software or hardware provider falls outside the definition. Establish a given venue's status from the rules of its own jurisdiction.

The link to a jurisdiction works as a cascade: the provider's tax residence, then incorporation or other legal personality carrying tax obligations, then place of management, then regular place of business, and finally the branch through which the transaction was effected. The hierarchy exists precisely so that one venue does not report twice in two countries. The practical takeaway for a client: what matters is where the provider is incorporated and from where it is managed — that country will be the sender of the client's file.

A person becomes a Reportable Person if they are a tax resident of a jurisdiction with which the provider's country has activated exchange. This is established through self-certification at onboarding and a cross-check of that form against the KYC file — the procedure is identical to CRS. If the client is a company or a fund, both the entity and its controlling persons go into the report: the look-through optics of CRS carry over into CARF unchanged.

What goes into the exchange — and what does not

The report is aggregate: individual transactions do not go into the file. For each calendar year, for each type of crypto-asset and each category of transaction, the provider passes on three numbers: the gross amount, the number of units, and the number of transactions. One exception: for outbound transfers to addresses not known to be associated with a VASP or a financial institution, only two numbers travel — value and number of units, with no transaction count (DAC8, Annex VI, Section II B(3)(c)(ix)). There are four categories: crypto-to-fiat exchanges (acquisitions and disposals reported separately), crypto-to-crypto exchanges (both legs at fair market value at the time of the transaction), transfers (inbound, outbound, and, on a separate line, outbound to a self-hosted wallet), and reportable retail payment transactions — payments for goods and services processed through the provider above USD 50,000. Plus client identification: name, address, every jurisdiction of tax residence, TIN, date and place of birth.

Now for what the report leaves out. CARF does not transmit wallet balances. This is a structural departure from CRS, where the year-end account balance is the core of the report. CARF looks at movement, and that architecture has a side benefit for administrations: it cannot be defeated by clearing an account down to zero on 31 December. Wallet addresses do not make it into the exchange file either — the provider is required to retain them internally (five years under the UK implementation), but they do not travel outward.

Hence the asymmetry: the tax authority will see how much the client sold and bought over the year, but not how much is left. It reconstructs the position from a chain of annual reports and the client's own returns — which is why the working signal becomes the mismatch between the aggregate and the declaration.

The calendar: three waves and moving dates

The first wave collects data from 1 January 2026 and exchanges in 2027 for the 2026 year — it holds most CARF participants. The second wave starts a year later: collection from 2027, exchange in 2028.

In Hong Kong the second wave still rests on a bill: the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 was gazetted on 22 May 2026 and introduced into the Legislative Council on 3 June 2026, and the IRD states that the CARF rules will apply from 1 January 2027 with the first exchange in 2028 subject to the passage of the bill. The UAE has stated exchange by 2028 on 2027 data; Singapore (IRAS) confirms that exchanges commence in 2028.

In total, 77 jurisdictions have committed to implementing CARF: on the Global Forum list in its edition of 14 September 2026, 46 undertake first exchanges by 2027, 27 by 2028, and four by 2029 — Argentina, Azerbaijan, Mexico and the United States. The OECD revises the named composition of the waves as jurisdictions shift their dates, and jurisdictions move between years from one edition of the list to the next. Correspondence and calculations therefore cite the edition date the figure was taken from rather than the figure alone.

A wave, however, is not a guarantee. Switzerland supplied the live example: the legislative framework entered into force on 1 January 2026, but on 26 November 2025 the Federal Council decided that the crypto-asset provisions of the AEOIA and its ordinance would not apply in 2026. The reason is procedural: on 3 November 2025 the National Council's Economic Affairs and Taxation Committee (WAK-N) suspended its deliberations on the list of partner states, and without parliamentary approval of that list the Federal Council cannot ratify the CARF MCAA. On the Global Forum's list the country has since moved into the second wave: data collection from 2027, first exchange in 2028. SIF puts it more cautiously — CARF will apply from 1 January 2027 at the earliest, with Parliament to set the activation date, so even the second wave is not fixed for Switzerland. Switzerland is not an isolated case: the OECD revisits the composition of the waves every time another jurisdiction shifts its dates. Hence the working rule: check the specific jurisdiction of each venue on a specific date.

What switches the exchange on: agreement and activation

Two separate steps stand between a political commitment and a file that has actually travelled, and conversations about the perimeter routinely run them together. The commitment is recorded by the Global Forum on its list. The legal frame comes from the CARF-MCAA, the multilateral competent authority agreement built on Article 6 of the Convention on Mutual Administrative Assistance in Tax Matters; as at 3 March 2026 it had 56 signatories, and the United States is not among them.

A signature creates no flow of data by itself. Under the construction of Article 6 the exchange runs bilaterally, and each relationship is activated by separate notifications. The multilateral route is not the only one: the standard treats as equivalent a bilateral competent authority agreement based on a tax treaty or an information exchange agreement, the Convention itself, a standalone intergovernmental agreement, and regional legislation covering both the reporting obligations and the modalities of exchange. The EU took the last of these. Hence the working rule: check the specific pair of provider jurisdiction and client residence jurisdiction on a specific date, rather than the number of jurisdictions that have committed. A jurisdiction can sit in the 2027 wave, hold a signature under the agreement, and still have no activated relationship with the country that matters.

The negative list is shorter than the positive one and more useful for mapping a perimeter. Four jurisdictions the Global Forum has identified as relevant have not committed: El Salvador, Georgia, India and Viet Nam, with a footnote recording that India is in the process of making the political commitment and expects to make it in due course. No commitment does not mean no visibility: the banking corridor for fiat in and out stays inside the CRS perimeter, and a holder's own filing duties do not depend on anyone else's commitment.

The EU and the US: two different machines

In the EU, CARF is implemented by Directive 2023/2226 (DAC8): transposition by 31 December 2025, application from 1 January 2026, and the first exchange between member states within nine months of the reporting year, that is by 30 September 2027. The link with MiCA is direct: an authorised CASP automatically falls inside the DAC8 perimeter in its country of authorisation, while a non-EU provider serving European clients must register and report in one of the member states. The alignment of calendars is no coincidence — the MiCA transitional period closed on 1 July 2026 (Article 143(3) of the Regulation; individual member states could shorten it), and the market serving Europeans has narrowed to licensed players, meaning to those already wired into the reporting machine.

The US runs on its own track. Brokers file Form 1099-DA: gross proceeds for transactions from 1 January 2025, and cost basis for certain transactions from 1 January 2026. But this is domestic reporting to the IRS, without international exchange: the US has not signed the CARF multilateral agreement, and its accession to exchanges is announced for 2029. The asymmetry is exactly the one seen with FATCA against CRS: the US takes information in and sends nothing out. For a non-US person, an American venue temporarily remains the least transparent node as far as their home tax authority is concerned; for a US citizen or resident the picture is mirrored — the IRS sees everything, and sooner than anyone else.

National implementation: deadlines, penalties, delay

The OECD rules bind no one on their own: the obligation arises only from a domestic measure, and domestic measures inside a single wave have diverged.

The five lower rows show why a wave is a planning date and not a legal one. Only the United Kingdom, Singapore and the EU have a measure that already obliges a provider; Switzerland and Hong Kong carry a date conditional on Parliament or LegCo, the UAE a stated intention, and the United States a domestic form that sends nothing abroad until 2029. For each venue the working question is therefore the one set out above: which jurisdiction's instrument applies to it, and whether that jurisdiction has an activated relationship with the client's country of residence. The residence-side view — what each country's administration receives and in which year — is set out on tax transparency.

The Union row needs a caveat. On 30 January 2026 the European Commission sent letters of formal notice to twelve member states that had failed to transpose DAC8 on time — Belgium, Bulgaria, Cyprus, Czechia, Estonia, Greece, Luxembourg, Malta, the Netherlands, Poland, Portugal and Spain — with two months to reply. That removes nothing from a provider's obligations, but the statement "the rules have applied across the EU since 1 January 2026" has to be read for those countries with an allowance for the fact that the set of fields actually collected in the first year differs between them.

The UK instrument stands out on penalties, because part of the liability sits with the client. Under regulation 13 a penalty of up to £300 falls on the user or controlling person who fails to provide a self-certification, where the failure is deliberate or due to a failure to take reasonable care. The provider pays up to £300 for each reportable user for the same form (reg. 11(2)) and up to £100 for other due diligence failures; a late report costs up to £5,000 plus up to £600 for each subsequent day after a notice of assessment (reg. 14); failure to register, up to £1,000 plus up to £300 a day (reg. 18); failure to notify the client that the data goes to HMRC and may be passed on, up to £100 per person plus up to £100 a day (reg. 16).

The retention period is fixed hard: records of the due diligence performed and the information collected are kept for five years beginning with the day after the end of the calendar year to which they relate (reg. 4(3)), and a breach costs up to £5,000 for each such year (reg. 12). An officer of HMRC may require information and documents from any provider the officer reasonably suspects of being subject to the obligations, allowing no less than 14 days to respond (reg. 9). Reasonable excuse relieves the penalty, but two arguments are excluded by the express words of regulation 20(2): an insufficiency of funds, and reliance on another person to do something.

Regulation 26 closes the instrument with an anti-avoidance rule: where a person enters into arrangements the main purpose, or one of the main purposes, of which is to avoid any obligation under the Regulations, the Regulations have effect as if the arrangements had not been entered into. The wording is neutral as to whom it catches and works in both directions — against a restructuring by the provider and against arrangements made by the client.

CRS 2.0 alongside: what travels outside CARF

The amended CRS operates from 1 January 2026 in parallel and picks up what CARF does not cover: specified electronic money products, central bank digital currencies and — most importantly for private capital — indirect ownership of crypto. A future, forward or option on a relevant crypto-asset, as well as an interest in an investment vehicle holding crypto as a financial asset, is reported under CRS. And it is reported together with the balance, because it is an ordinary financial account with all the standard apparatus attached.

Overlap between the two regimes is real: one group can be a Reporting FI and an RCASP at the same time. To avoid duplication, the amended CRS contains a coordination rule — gross proceeds on an asset that is simultaneously a Relevant Crypto-Asset and a Financial Asset may be left out of CRS reporting if they already go out under CARF. The rule is optional and has been implemented unevenly across jurisdictions, so double reporting in particular corridors remains a practical possibility.

What to do before the first exchange

First, take inventory of the perimeter. List every venue, custodian, payment service and wallet provider where the client has transacted since 2026, and answer two questions for each: is it an RCASP, and in which jurisdiction. On a separate line, record what was stated in the self-certification at onboarding. The residence declared to an exchange three years ago is the address the file will travel to; if it is out of date, the result is a mismatch in somebody else's country.

Second, reconcile against prior-year returns. The exchange is not retrospective — nothing will be transmitted automatically for 2021 to 2025. But the 2026 picture will be read against that history: a large disposal with no previously declared acquisition is a ready-made question. The same applies to the classic crypto-to-crypto storyline, which many people do not treat as a taxable event, yet which enters the report at fair market value on both legs.

Third, keep basis records. CARF hands the tax authority gross amounts and no cost basis; proving basis falls to the client, from their own records — there is a separate analysis of wallet-by-wallet method and jurisdictional specifics in crypto taxes by country. The transaction history is best exported now: some venues are leaving the European market under MiCA, and the archive leaves with them. In parallel, it is worth assembling a source of funds pack: a large fiat deposit onto an exchange is precisely the situation where the tax question and the banking compliance question are asked at the same moment.

Fourth, be clear-eyed about self-custody. Formally, transfers between one's own wallets and P2P deals sit outside the CARF perimeter. But an outbound transfer to a self-hosted wallet is broken out as its own category in the report: the provider will disclose the amount and the number of units that left the venue, even without revealing the recipient address. And the road back into fiat almost always runs through an RCASP. The entry point and the exit point are visible; only the interval is not — as a privacy model this works poorly, but as an operational security model it still makes sense.

Fifth, the anti-avoidance layer, which tends to be remembered last. UK regulation 26 is drafted neutrally as to whom it catches: where the main purpose, or one of the main purposes, of entering into arrangements is to avoid any obligation under those rules, the rules apply as if the arrangements had not been entered into. The wording reaches a move of the relationship to a venue in a non-committed jurisdiction timed to the reporting year, a split of holdings across several venues, and the insertion of an entity between client and provider. The Union circuit solves the same problem mechanically: under Section V(A)(2) of Annex VI to the DAC, a user who has not provided the required information after two reminders and no sooner than 60 days from the initial request loses the ability to carry out reportable transactions — the provider is obliged to block them. Silence in response to the form closes access to the venue and cancels no reporting; in the UK version it also costs up to £300 on the client under regulation 13.

Sixth, act now if a discrepancy already exists. Voluntary disclosure mechanisms are built so that they retain value only until the moment the data has reached the administration. The gap between today and the first exchange is exactly that window, and it closes on a schedule.