For fifteen years, the working assumption behind a lot of digital-asset holding was that exchanges did not report and tax authorities could not see. That assumption has an expiry date, and it is close.
The OECD''s Crypto-Asset Reporting Framework (CARF) does for crypto what the Common Reporting Standard did for bank accounts: it requires reporting crypto-asset service providers to collect tax residence data on their users and report transaction and balance information to their local authority, which then exchanges it automatically with the user''s country of residence.
The timetable
Per the Global Forum''s commitment list as updated in June 2026, jurisdictions fall into waves:
- First exchanges by 2027 (46 jurisdictions): the EU member states, the UK, Guernsey, Jersey, the Isle of Man, the Cayman Islands, Liechtenstein, Japan, Korea, Norway, Brazil, South Africa and others.
- First exchanges by 2028 (29 jurisdictions): including Switzerland, Singapore, Hong Kong, the UAE, the Bahamas, Bermuda, the British Virgin Islands, Gibraltar, Mauritius, Panama, the Seychelles and Canada.
- A further group has committed to later dates.
Because exchanges cover the preceding reporting period, the data collection generally begins a year before the first exchange. In practice: EU and UK providers are collecting now; UAE, Swiss and Singapore providers begin shortly.
In the EU the mechanism is DAC8, which brings CARF into member-state law and extends it to certain e-money and digital-currency reporting.
What is actually reported
CARF is broader than most people expect. Reporting covers:
- Exchanges between crypto-assets and fiat currency.
- Exchanges between one crypto-asset and another.
- Transfers of crypto-assets, including to unhosted wallets in defined circumstances.
- Retail payment transactions above a value threshold.
For each reportable user: name, address, jurisdiction(s) of tax residence, tax identification number, and date of birth for individuals; equivalent details plus controlling-person information for entities.
Note what this means: the reporting is not limited to cashing out. Swapping one token for another on a reporting platform generates reportable data, whether or not any fiat moves.
Who is a reporting provider
The definition follows the service, not the label: exchanges, brokers, dealers, certain custodians, and operators of crypto ATMs. It is deliberately residence-agnostic — a provider can be caught by where it operates, where it is managed, or where its customers are, depending on the implementing jurisdiction''s nexus rules.
Genuinely non-custodial protocol software with no operator is outside the perimeter. The perimeter is being tested and the trend is expansionary.
What this changes in practice
Historic positions become visible. Once a platform reports a balance, the question "where did this come from and was it declared?" follows. The time to address a historic non-disclosure is before the first automatic exchange, not after a letter arrives.
Residence claims must match reality. CARF reports to the jurisdiction of stated tax residence, and platforms are required to apply due-diligence procedures to test that claim against the indicia they hold — address, phone number, IP patterns in some implementations. A residence claim that the platform''s own data contradicts is a poor place to be.
Entity holdings do not solve it. Controlling-person reporting mirrors the CRS approach. A BVI company holding tokens on a reporting exchange results in reporting on the company and, for passive entities, on the individuals behind it.
Self-custody is not a reporting shield, but it is a reporting difference. Assets in genuine self-custody are not reported by a provider — but transfers to and from that wallet through a reporting provider are, and the tax obligation is unchanged either way.
What to do in the remaining window
- Reconcile. Build a complete transaction history across every platform and wallet, with cost basis. This is the input to everything else and it takes longer than anyone expects.
- Determine the actual tax position in your jurisdiction of residence for each year, including token-to-token disposals where those are taxable events.
- Regularise where there is exposure, using the voluntary disclosure route available in that jurisdiction while it remains voluntary. Penalty regimes are materially worse after an automatic exchange has triggered an enquiry.
- Align residence and documentation. If tax residence has genuinely changed, the platform records, address evidence and self-certifications should reflect that, with the substance to support it.
- Decide the go-forward structure — personal, corporate or fund — with reporting visibility as a design input rather than an afterthought.
What we do not advise
Moving assets to a jurisdiction with a later commitment date to buy two years is a plan with a known end date and a worsening penalty profile. The later waves are not opt-outs; they are delays.
FAQs
Does CARF apply to NFTs?
Where an NFT is used as a payment or investment instrument it can fall in scope. Genuinely unique collectibles with no financial character are generally outside, but the assessment is fact-specific.
Is stablecoin activity reported?
Yes. Stablecoins are crypto-assets for CARF purposes and are also caught by parallel e-money reporting in the EU.
I live in a zero-tax jurisdiction. Does this matter?
Reporting still occurs to your jurisdiction of residence; if there is no tax there, there is no tax. The risk lies in residence claims that would not survive scrutiny.
Can a trust or foundation hold crypto outside this?
It changes who is reported, not whether. Controlling-person and settlor/beneficiary reporting concepts apply.
