By 2027 tax administrations will have something they have never had before: an annual picture of an individual's crypto-asset activity, arriving down a routine automatic-exchange channel. The mechanics will feel familiar from CRS, but the object is fundamentally different: a year's worth of transaction flow instead of an account balance. And the inspector will read that flow sitting next to your return for the same period.
We covered the general theory of automatic exchange separately, in the CRS overview; the infrastructure context, from custody to stablecoins, is set out in our piece on crypto for private wealth. What follows is purely operational: who exactly reports, which fields go into the file, which fields are missing from it, when this happens across the jurisdictional waves, and what a capital holder should do with the time that is left.
CARF is engineered differently from CRS, and the engineering determines what the tax authority will see — and what it will have to reconstruct for itself.
Who reports: the RCASP and its jurisdictional nexus
The obliged party under CARF is called a Reporting Crypto-Asset Service Provider, and it is defined by function, regardless of licensing: any individual or entity that, as a business, provides a service effectuating exchange transactions in crypto-assets. HMRC's manual is usually cited for the itemised list of who this catches, but that breakdown traces back to the OECD commentary on CARF and we could not confirm it in the published pages of the manual (verification pending). The categories normally given are: exchanges and intermediaries, brokers and dealers, crypto ATM operators, and participants in decentralised venues wherever there is an identifiable operator, following the FATF logic for VASPs. A pure software or hardware provider falls outside the definition. Establish a given venue's status from the rules of its own jurisdiction.
The link to a jurisdiction works as a cascade: the provider's tax residence, then incorporation or other legal personality carrying tax obligations, then place of management, then regular place of business, and finally the branch through which the transaction was effected. The hierarchy exists precisely so that one venue does not report twice in two countries. The practical takeaway for a client: what matters is where the provider is incorporated and from where it is managed — that country will be the sender of your file.
You become a Reportable Person if you are a tax resident of a jurisdiction with which the provider's country has activated exchange. This is established through self-certification at onboarding and a cross-check of that form against the KYC file — the procedure is identical to CRS. If the client is a company or a fund, both the entity and its controlling persons go into the report: the look-through optics of CRS carry over into CARF unchanged.
What goes into the exchange — and what does not
The report is aggregate: individual transactions do not go into the file. For each calendar year, for each type of crypto-asset and each category of transaction, the provider passes on three numbers: the gross amount, the number of units, and the number of transactions. One exception: for outbound transfers to addresses not known to be associated with a VASP or a financial institution, only two numbers travel — value and number of units, with no transaction count (DAC8, Annex VI, Section II B(3)(c)(ix)). There are four categories: crypto-to-fiat exchanges (acquisitions and disposals reported separately), crypto-to-crypto exchanges (both legs at fair market value at the time of the transaction), transfers (inbound, outbound, and, on a separate line, outbound to a self-hosted wallet), and reportable retail payment transactions — payments for goods and services processed through the provider above USD 50,000. Plus client identification: name, address, every jurisdiction of tax residence, TIN, date and place of birth.
Now for what the report leaves out. CARF does not transmit wallet balances. This is a structural departure from CRS, where the year-end account balance is the core of the report. CARF looks at movement, and that architecture has a side benefit for administrations: it cannot be defeated by clearing an account down to zero on 31 December. Wallet addresses do not make it into the exchange file either — the provider is required to retain them internally (five years under the UK implementation), but they do not travel outward.
| Stage | First wave (most participants) | Second wave |
|---|---|---|
| Due diligence and data collection | from 1 January 2026 | from 1 January 2027 |
| First reporting year | 2026 | 2027 |
| First automatic exchange | 2027 | 2028 |
| Who is inside | The EU via DAC8 — except Cyprus, which the Global Forum list places in the second wave; the United Kingdom, Cayman and the Channel Islands, Japan, Korea, Brazil — and most other participants | Switzerland, Hong Kong, Singapore, the UAE, Turkey and others; check the named composition of both waves against the current OECD commitment list as at your date |
Hence the asymmetry: the tax authority will see how much you sold and bought over the year, but not how much is left. It reconstructs the position from a chain of annual reports and your own returns — which is why the working signal becomes the mismatch between the aggregate and the declaration.
The calendar: two waves and moving dates
The first wave collects data from 1 January 2026 and exchanges in 2027 for the 2026 year — it holds most CARF participants. The second wave starts a year later: collection from 2027, exchange in 2028. In Hong Kong this is still a bill: the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 was gazetted on 22 May 2026 and introduced into the Legislative Council on 3 June 2026, and the IRD states that the CARF rules will apply from 1 January 2027 with the first exchange in 2028 subject to the passage of the bill. The UAE has stated exchange by 2028 on 2027 data; Singapore (IRAS) confirms that exchanges commence in 2028. In total, 76 jurisdictions have committed to implementing CARF: on the Global Forum list as at 23 June 2026, 46 undertake first exchanges by 2027, 29 by 2028, and the United States by 2029. The OECD keeps revising the named composition of the waves as jurisdictions shift their dates — the count in each wave is a live figure, so check it against the current Global Forum commitment list.
A wave, however, is not a guarantee. Switzerland supplied the live example: the legislative framework entered into force on 1 January 2026, but on 26 November 2025 the Federal Council decided that the crypto-asset provisions of the AEOIA and its ordinance would not apply in 2026. The reason is procedural: on 3 November 2025 the National Council's Economic Affairs and Taxation Committee (WAK-N) suspended its deliberations on the list of partner states, and without parliamentary approval of that list the Federal Council cannot ratify the CARF MCAA. On the Global Forum's list the country has since moved into the second wave: data collection from 2027, first exchange in 2028. SIF puts it more cautiously — CARF will apply from 1 January 2027 at the earliest, with Parliament to set the activation date, so even the second wave is not fixed for Switzerland. Switzerland is not an isolated case: the OECD revisits the composition of the waves every time another jurisdiction shifts its dates. Hence the working rule: check the specific jurisdiction of each of your venues on a specific date.
The EU and the US: two different machines
In the EU, CARF is implemented by Directive 2023/2226 (DAC8): transposition by 31 December 2025, application from 1 January 2026, and the first exchange between member states within nine months of the reporting year, that is by 30 September 2027. The link with MiCA is direct: an authorised CASP automatically falls inside the DAC8 perimeter in its country of authorisation, while a non-EU provider serving European clients must register and report in one of the member states. The alignment of calendars is no coincidence — the MiCA transitional period closed on 1 July 2026 (Article 143(3) of the Regulation; individual member states could shorten it), and the market serving Europeans has narrowed to licensed players, meaning to those already wired into the reporting machine.
The US runs on its own track. Brokers file Form 1099-DA: gross proceeds for transactions from 1 January 2025, and cost basis for certain transactions from 1 January 2026. But this is domestic reporting to the IRS, without international exchange: the US has not signed the CARF multilateral agreement, and its accession to exchanges is announced for 2029. The asymmetry is exactly the one seen with FATCA against CRS: the US takes information in and sends nothing out. For a non-US person, an American venue temporarily remains the least transparent node as far as their home tax authority is concerned; for a US citizen or resident the picture is mirrored — the IRS sees everything, and sooner than anyone else.
CRS 2.0 alongside: what travels outside CARF
The amended CRS operates from 1 January 2026 in parallel and picks up what CARF does not cover: specified electronic money products, central bank digital currencies and — most importantly for private capital — indirect ownership of crypto. A future, forward or option on a relevant crypto-asset, as well as an interest in an investment vehicle holding crypto as a financial asset, is reported under CRS. And it is reported together with the balance, because it is an ordinary financial account with all the standard apparatus attached.
Overlap between the two regimes is real: one group can be a Reporting FI and an RCASP at the same time. To avoid duplication, the amended CRS contains a coordination rule — gross proceeds on an asset that is simultaneously a Relevant Crypto-Asset and a Financial Asset may be left out of CRS reporting if they already go out under CARF. The rule is optional and has been implemented unevenly across jurisdictions, so double reporting in particular corridors remains a practical possibility.
What to do before the first exchange
First, take inventory of the perimeter. List every venue, custodian, payment service and wallet provider where you have transacted since 2026, and answer two questions for each: is it an RCASP, and in which jurisdiction. On a separate line, record what you stated in your self-certification at onboarding. The residence you declared to an exchange three years ago is the address your file will travel to; if it is out of date, the result is a mismatch in somebody else's country.
Second, reconcile against prior-year returns. The exchange is not retrospective — nothing will be transmitted automatically for 2021 to 2025. But the 2026 picture will be read against that history: a large disposal with no previously declared acquisition is a ready-made question. The same applies to the classic crypto-to-crypto storyline, which many people do not treat as a taxable event, yet which enters the report at fair market value on both legs.
Third, keep basis records. CARF hands the tax authority gross amounts and no cost basis; proving basis will be on you, from your own records — there is a separate analysis of wallet-by-wallet method and jurisdictional specifics in crypto taxes by country. Export your transaction history now: some venues are leaving the European market under MiCA, and the archive leaves with them. In parallel, it is worth assembling a source of funds pack: a large fiat deposit onto an exchange is precisely the situation where the tax question and the banking compliance question are asked at the same moment.
Fourth, be clear-eyed about self-custody. Formally, transfers between your own wallets and P2P deals sit outside the CARF perimeter. But an outbound transfer to a self-hosted wallet is broken out as its own category in the report: the provider will disclose the amount and the number of units that left the venue, even without revealing the recipient address. And the road back into fiat almost always runs through an RCASP. The entry point and the exit point are visible; only the interval is not — as a privacy model this works poorly, but as an operational security model it still makes sense.
Fifth, act now if a discrepancy already exists. Voluntary disclosure mechanisms are built so that they retain value only until the moment the data has reached the administration. The gap between today and the first exchange is exactly that window, and it closes on a schedule.
This material is for general information and analysis only and does not constitute individual tax or legal advice; implementation dates and the composition of the waves are being refined by jurisdictions and require verification as at the date of reliance.