Tax information reporting and the OECD CARF

Until recently, tax authorities learned about crypto gains mainly from what taxpayers chose to declare. The OECD's Crypto-Asset Reporting Framework (CARF) changes that: platforms collect identity and tax data from their customers, report transactions to their tax authority every year, and the authority sends the data to the countries where the customers live. For a platform it is a large data and onboarding project; for a customer it means the tax authority already holds the numbers.

Why third-party reporting

Tax compliance is far higher when a third party reports the same figures the taxpayer must declare, as banks have done for decades. Every reporting regime rests on three elements: a definition of who must report, due diligence to identify each customer and their tax residence, and a defined set of reportable information. A fourth element, exchange between tax authorities, makes it work across borders.

Before CARF, the OECD's Common Reporting Standard (CRS), in use since 2017, already made banks, custodians and funds report accounts held by foreign residents. Crypto largely escaped it: tokens are often not "financial assets" under the CRS definitions, and exchanges and wallet providers are often not financial institutions. CARF was built to close that gap.

CARF at a glance

The OECD released CARF in October 2022, and in June 2023 published the full package: the CARF rules and commentary, a Multilateral Competent Authority Agreement (CARF MCAA) for exchanging the data, and a 2023 update to the CRS. An XML schema for the reports followed.

CARF covers Relevant Crypto-Assets: digital representations of value secured by cryptography on a distributed ledger, which in practice includes cryptocurrencies, stablecoins, many tokens and some NFTs. Three categories are excluded:

• Central bank digital currencies, which the updated CRS covers instead.
• Specified electronic money products, also moved into the CRS.
• Crypto-assets that the service provider has adequately determined cannot be used for payment or investment purposes, such as closed-loop tokens.

Who reports: RCASPs

A Reporting Crypto-Asset Service Provider (RCASP) is any individual or entity that, as a business, provides a service effecting exchange transactions for or on behalf of customers: between crypto-assets and fiat currency, or between one crypto-asset and another. That includes acting as counterparty or intermediary, or making a trading platform available. Centralized exchanges, brokers, dealers, crypto ATM operators and some wallet providers that execute swaps are in scope. A purely technical provider, such as a software developer with no control over transactions, is not.

An RCASP reports in a jurisdiction where it has a nexus, tested in order: tax residence, incorporation or organization, place of management, then a regular place of business. Rules prevent the same customer data being reported twice when a provider has a nexus in more than one country.

Due diligence and self-certification

The core of CARF is knowing which country each customer is resident in for tax purposes.

• Individuals must provide a self-certification of tax residence, with a taxpayer identification number (TIN) for each country of residence, when the relationship starts. For customers who were already on board when the rules took effect, the RCASP has 12 months to obtain one.
• The RCASP must confirm that the self-certification is reasonable against the information it already holds, especially its anti-money-laundering and know-your-customer (AML/KYC) records. An address in one country and a claimed residence in another is a red flag to follow up.
• Entities must self-certify their own residence and status, and for passive entities, such as personal holding companies, the RCASP must also identify their controlling persons (the individuals who ultimately own or control them, using AML/KYC procedures). Listed companies, governments and financial institutions are excluded from reporting.
• Jurisdictions must have rules to enforce collection, typically including penalties or a bar on transacting for customers who do not provide a valid self-certification.

What is reported

Reports are aggregated per customer, per type of crypto-asset and per calendar year, with values in fiat currency.

The last row matters for compliance: a tax authority can see that a resident moved coins from a platform to a self-custody wallet, even though CARF does not report what happens afterward.

Exchange between tax authorities

Each tax authority receives its RCASPs' reports and then sends each foreign customer's data to the customer's residence country, using the CARF MCAA or a bilateral agreement. As with the CRS, the exchange is due within nine months after the end of the calendar year. The residence country matches the data to its own taxpayers by TIN and compares it with what they declared.

Implementation comes in waves set out in an OECD list of commitments:

• A first group, including all EU member states and many other G20 and financial-center jurisdictions, collects data from 1 January 2026 for first exchanges in 2027.
• A second group follows with first exchanges in 2028.
• A few jurisdictions have committed to later dates.

Jurisdictions implement CARF through domestic law, sometimes with extras. For example, the EU's DAC8 directive applies CARF-style rules across all member states, while the US Form 1099-DA broker reporting regime serves a similar domestic purpose under US rules. Commitment lists change, so a firm should check the current one for every country where it has customers.

CARF and the CRS

The 2023 update to the CRS was designed alongside CARF. It brings specified electronic money products and central bank digital currencies into the CRS, covers derivatives that reference crypto-assets and investment entities that invest in crypto, and strengthens due diligence. It also contains rules to limit duplicate reporting, so that a financial institution that is also an RCASP need not report the same crypto activity under both regimes. In short, the CRS covers accounts and indirect exposure through financial institutions, while CARF covers direct crypto transactions.

What firms must collect and build

Platforms that already run CRS or domestic broker reporting should build one customer tax profile that serves all regimes, and check TINs at onboarding rather than at year-end, when customers are hardest to reach.

Exam focus: the building blocks of a reporting regime (who reports, due diligence, reportable information, exchange); CARF's scope and exclusions (CBDCs, specified e-money, assets that cannot be used for payment or investment); the definition of an RCASP and the nexus tests; self-certification of residence with a TIN, the reasonableness check against AML/KYC data, controlling persons, and the 12-month window for existing customers; aggregated reporting categories, including retail payments above USD 50,000 and transfers to external wallets; exchange within nine months of year-end, with first exchanges in 2027 for 2026 data; how the 2023 CRS update complements CARF.