CARF: what crypto data starts moving, and when

For fifteen years, a lot of people holding digital assets assumed exchanges didn't report and tax authorities couldn't see. That assumption has an expiry date, and it's close.

The OECD's Crypto-Asset Reporting FrameworkCARF (crypto reporting)The crypto version of CRS: exchanges and crypto service providers report users' transactions to tax offices, which share them across borders. (CARF) does for crypto what the Common Reporting StandardCRS (Common Reporting Standard)The global system where banks report account holders' details and balances to their tax office, which passes them to the country where the holder is tax resident. did for bank accounts. Crypto platforms must now collect your tax residenceTax residenceThe country that treats you as living there for tax purposes, and so can tax your worldwide income. Each country sets its own rules; your passport doesn't decide it. details and report your transactions and balances to their local tax authority. That authority then passes the information, automatically, to the country where you live for tax.

When does this start?

It starts for most of Europe in 2027, and for several major financial centres in 2028. Your platform may already be collecting your details.

Per the Global Forum's commitment list as updated in June 2026, countries fall into waves:

• First exchanges by 2027 (46 jurisdictions): the EU member states, the UK, Guernsey, Jersey, the Isle of Man, the Cayman Islands, Liechtenstein, Japan, Korea, Norway, Brazil, South Africa and others.
• First exchanges by 2028 (29 jurisdictions): including Switzerland, Singapore, Hong Kong, the UAE, the Bahamas, Bermuda, the British Virgin Islands, Gibraltar, Mauritius, Panama, the Seychelles and Canada.
• A further group has committed to later dates.

Each exchange covers the period before it, so data collection generally begins a year ahead of the first exchange. EU and UK platforms are collecting now. UAE, Swiss and Singapore platforms begin shortly.

In the EU, the mechanism is called DAC8DAC8The EU directive that brings crypto-asset service providers and some e-money into automatic exchange of information between EU tax offices.. It writes CARF into each member state's law and extends it to certain e-money and digital-currency reporting.

What actually gets reported?

More than most people expect. It isn't just cashing out. Reporting covers:

• Exchanges between crypto and ordinary money (fiat currency, meaning pounds, euros, dollars and so on).
• Exchanges between one crypto-asset and another.
• Transfers of crypto-assets, including to unhosted wallets (wallets you control yourself, with no platform holding them) in defined circumstances.
• Retail payment transactions above a value threshold.

For each person, the platform reports their name, address, country (or countries) of tax residence, tax identification number and, for individuals, date of birth. For companies and other entities, it reports equivalent details plus information on the people who control them.

So swapping one token for another on a reporting platform creates reportable data, whether or not any cash moves. The taxman may be able to see your token-hopping even if your bank account never noticed.

Which platforms have to report?

The rule follows what a business does, not what it calls itself. Exchanges, brokers, dealers, certain custodians (firms that hold crypto for you) and crypto ATM operators all count.

It also doesn't depend on one fixed link to a country. A provider can be caught by where it operates, where it's managed, or where its customers are, depending on each country's own rules.

Genuinely non-custodial protocol software with no operator behind it sits outside the net. That boundary is being tested, and the trend is for it to get wider.

Where are the grey areas?

Most of CARF is clear. A few edges depend on facts or are still being tested, and it's worth knowing which.

What does this change in practice?

Four things. Each is something you can check against your own situation.

Old positions become visible. Once a platform reports a balance, the question "where did this come from, and was it declared?" follows. The time to deal with a past non-disclosure is before the first automatic exchange, not after a letter arrives.

Your residence claim has to match reality. CARF reports to the country where you say you're tax resident. Platforms must test that claim against what they hold, such as your address, phone number and, in some implementations, IP patterns. If the platform's own data contradicts your claim, you're in a poor spot.

Holding through a company doesn't fix it. Reporting on the people who control an entity mirrors the Common Reporting Standard approach. Say a BVI company holds tokens on a reporting exchange. The company is reported and, for passive entities, so are the individuals behind it.

Self-custody means you hold the assets yourself, with no platform in between. A provider doesn't report assets held that way, but transfers to and from that wallet through a reporting provider are reported. Either way, the tax you owe is the same.

What should you do in the time that's left?

Five steps, in this order. The first one takes longer than anyone expects.

1. Reconcile. That means building a complete transaction history across every platform and wallet, with your cost basis (what you originally paid). Everything else depends on it.
2. Work out your actual tax position in the country where you live, for each year. Include token-to-token swaps where those count as taxable events.
3. Regularise where you're exposed. That means putting right any past gaps through the voluntary disclosure route in your country, while it's still voluntary. Penalty regimes are materially worse once an automatic exchange has triggered an enquiry.
4. Line up your residence and paperwork. If your tax residence has genuinely changed, the platform records, address evidence and self-certifications should show that, backed by the real-life facts to support it.
5. Decide your go-forward set-up (personal, company or fund), with reporting visibility as a design input, not an afterthought.

What don't we advise?

We don't advise moving assets to a country with a later commitment date to buy two years. That's a plan with a known end date and a worsening penalty profile. The later waves are delays, not opt-outs.

FAQs

Does CARF apply to NFTs?

Where an NFT is used as a payment or investment instrument, it can fall in scope. Genuinely unique collectibles with no financial character are generally outside, but each case depends on its facts.

Is stablecoin activity reported?

Yes. Stablecoins (crypto designed to hold a steady value) count as crypto-assets for CARF. In the EU they're also caught by parallel e-money reporting.

I live in a zero-tax country. Does this matter?

Reporting still goes to the country where you're resident. If there's no tax there, there's no tax. The risk lies in residence claims that wouldn't survive scrutiny.

Can a trust or foundation hold crypto outside this?

It changes who is reported, not whether. The rules on reporting the people in control, and on settlors and beneficiaries, still apply.

Related reading

• MiCA one year in: what changed for crypto structures
• Economic substance in practice