How can firms ensure data accuracy and validation in CARF reporting workflows?

By validating at the point of collection. Check that each self-certification is complete and signed or positively affirmed, and test it for reasonableness against the KYC file. Check each TIN against the issuing jurisdiction where an official check exists, classify every transaction by reportable type as it happens, and validate the file against the schema before it is filed. In Canada, under Bill C-31, the return would be due before 2 May, so errors found in April are the expensive ones.

Should firms invest in scalable tax reporting infrastructure to future-proof CARF compliance?

Yes, where the user base or the number of user jurisdictions is large. The CARF reports every reportable user by crypto-asset type, the reports reach each user’s jurisdiction of residence through exchanges between tax authorities, and the same customer data, residence and TIN, is needed for the amended CRS on e-money and custodial accounts. A Canadian platform would face both from 2027, for most of the CRS amendments, if Bill C-31 is enacted as drafted, and its partners’ timelines run from 2027 to 2029, so infrastructure that handles one framework and one jurisdiction at a time will be rebuilt more than once.

How does the Crypto-Asset Reporting Framework (CARF) apply to global crypto exchanges and custodial platforms?

Through a connection with each jurisdiction. A provider that effectuates exchange transactions for customers reports in a jurisdiction where it is resident or otherwise connected, following the CARF’s order of priority where it is connected to several, and reports transactions made through a branch where the branch is based. In Canada, Bill C-31 would catch providers resident in Canada, organised in Canada and filing Canadian returns, partnerships managed from Canada and providers carrying on business in Canada (s. 297(1)). A global platform therefore maps its entities and branches to each jurisdiction’s rules.

What role does CARF compliance automation play in reducing operational overhead?

It removes the follow-up work. Most CARF overhead is chasing: missing self-certifications, TINs that fail, declarations that contradict the KYC file. Automation run inside onboarding settles those while the user is present, so the compliance team handles exceptions rather than the whole book. Our CARF compliance software is built to that order.

What infrastructure is needed for enterprise crypto tax reporting aligned with CARF?

Four layers. A self-certification flow inside onboarding for individuals, entities and controlling persons; identity validation for TINs and entities; a transaction layer that classifies each trade and transfer and values it in fiat. Then a reporting layer that aggregates by user and crypto-asset type, validates against the CARF XML Schema and keeps the records. Under Bill C-31, Canadian providers would keep those records for at least six years.

How can automation enable audit-ready tax compliance under CARF?

By recording each decision when it is made. An audit-ready file shows the self-certification as received and when it was affirmed, the reasonableness result and what it was tested against, each TIN result and its source, each indicator found and how it was cured, and the aggregation behind each reported figure. Bill C-31 expressly includes self-certifications and records of documentary evidence among the records a provider must keep.

Can the CRA track cryptocurrency?

Under the CARF it would receive information rather than track it directly. If Bill C-31 passes, reporting crypto-asset service providers in Canada would file annual information returns with the Minister of National Revenue from the 2027 year. Through CARF exchanges, which the OECD lists for Canada by 2028, the Canada Revenue Agency would also receive, from the tax authorities of other committed jurisdictions, the information their providers report on Canadian residents.

Canada CARF: Crypto-Asset Reporting and Compliance from 2027

Sources last verified: 20 October 2026

Official sources cited at the end of this page.

Bill C-31, the Budget 2025 Implementation Act, No. 2, would write the Crypto-Asset Reporting Framework (CARF) into Canada’s Income Tax Act as a new Part XXI, applying from the 2027 calendar year. As drafted, a reporting crypto-asset service provider would complete due diligence when it establishes a relationship with a user, cover users already on its books at 31 December 2026 before 2028, and file an information return before 2 May each year for the year before. The bill is at committee in the House of Commons and has not received royal assent, so every Canadian rule below is a proposal until it does.

The date has already moved once. Finance Canada’s draft of 13 August 2025 applied the CRS amendments from 2026, treated crypto users onboarded by 31 December 2025 as pre-existing and gave providers until the end of 2026 to cover them; Bill C-31 moves all three a year later. Every user onboarded from January 2027 needs a valid self-certification at the start, and every existing user needs one collected while they are still active on the platform, which is far easier in 2027 than in the weeks before the deadline.

There are two ways to prepare. One waits for royal assent and then remediates the whole user base in a single campaign. The other builds the self-certification into onboarding now, so new users arrive cleared and the existing book is worked down over 2027. The second leaves nothing for the first filing season, and section 07 shows how it runs.

The rules Canada would adopt are the OECD’s, published in a consolidated text on 8 June 2023. On the OECD’s list of 14 September 2026, Canada is among 27 jurisdictions committed to first exchanges by 2028.

01 · CARF in Canada at a glance

Point	Position on 20 October 2026
Status	Proposed in Bill C-31; at committee in the House of Commons; not yet law
Applies from	The 2027 calendar year (clause 99)
Who would report	Reporting crypto-asset service providers with a Canadian connection (s. 297(1)), set out in section 03
New users	Due diligence when the relationship is established (s. 299(6))
Existing users	Those with a relationship at 31 December 2026: due diligence before 2028
Self-certification	Valid only if signed or positively affirmed on or before the date it is received (s. 299(8))
Information return	Filed electronically with the Minister of National Revenue before 2 May, for the preceding year (s. 300(1) and (2)); first return for 2027
Records	At least six years after the last year to which they are relevant (s. 301)
User penalty	CAD 500 for each failure to provide a TIN on request, with exceptions (s. 303(3))
Anti-avoidance	An arrangement whose primary purpose is to avoid an obligation is disregarded (s. 302)
Amended CRS	Proposed in the same bill, mostly from 2027
First exchanges	By 2028 (OECD list, 14 September 2026)

Our regulatory compliance engine clears every crypto-asset user of a Canadian crypto exchange or wallet provider for CARF on Day 1. It collects and checks the self-certification, runs the TIN, reasonableness and other due diligence checks, resolves indicia automatically instead of by your compliance team, and prepares the validated CARF report, with zero remediation.

02 · International Coordination and Policy Context

The OECD developed the CARF to address the rapid growth of the crypto-asset market and to ensure that recent gains in global tax transparency are not gradually eroded. The OECD Committee on Fiscal Affairs approved the framework over 2022 and 2023, and the consolidated rules, Commentary and multilateral competent authority agreement were released on 8 June 2023. The framework changes what providers report, not how users are taxed: under the Income Tax Act, a gain on a crypto-asset is business income (s. 9) or a capital gain (s. 39), depending on the facts of each case.

The OECD’s list counts 77 committed jurisdictions in three waves: 46 by 2027, 27 by 2028 and 4 by 2029. Canada sits in the second wave with the Bahamas, Singapore, Switzerland and the United Arab Emirates. The Cayman Islands and every EU Member State except Cyprus, which is listed for 2028, are in the first, while the United States, Mexico, Azerbaijan and Argentina make up the third. EU users add a second regime: DAC8 has applied in the EU since 1 January 2026, a year before Canada’s proposed start, and a provider within its scope reports its EU-resident users under it. Our DAC8 compliance software covers that side.

03 · Scope and Applicability: Who Would Report in Canada

Under the OECD model, a reporting crypto-asset service provider is any individual or entity that, as a business, provides a service effectuating exchange transactions for or on behalf of customers, including as a counterparty, as an intermediary or by making a trading platform available. Bill C-31 sets the Canadian connection in section 297. It reaches a provider resident in Canada; an entity organised under Canadian or provincial law that must file tax returns or information returns in Canada; a partnership managed from Canada; and a provider that carries on business in Canada (s. 297(1)). Subsections (3) to (7) relieve a provider that already completes equivalent requirements in a partner jurisdiction, but transactions effectuated through a branch in Canada stay reportable in Canada (s. 297(2)).

The transactions in scope are exchanges and transfers of relevant crypto-assets, a defined term that excludes central bank digital currencies, specified electronic money products and crypto-assets the provider has adequately determined cannot be used for payment or investment (s. 296(1)). A transfer paying for goods or services worth more than USD 50,000 is also reported as a separate category, a reportable retail payment transaction, with the merchant’s customer treated as the user only where the provider must verify that customer’s identity under Canada’s anti-money-laundering law, the PCMLTFA (s. 296(1)). Transfers to wallet addresses not known to belong to a virtual asset service provider or financial institution are reported in aggregate, by value and number of units, and, under the OECD Commentary, the addresses themselves are kept on file rather than reported.

04 · Customer Due Diligence and TIN Verification

For an individual user, the bill asks the provider to obtain a valid self-certification that allows it to determine the user’s residence for tax purposes, and to confirm the reasonableness of that self-certification against the information it holds, including documentation collected under its AML/KYC procedures. An entity user is checked under parallel rules, and its controlling persons are identified only where it is neither an excluded person nor an active entity (s. 299). A provider that is also a financial institution may rely on the due diligence it completed under the CRS sections 274 and 276 (s. 299(11)). The return then carries each reportable user’s name, address, jurisdiction of residence and TIN, and the date of birth of each individual, so the self-certification is where the report begins.

Each reportable user’s TIN is reported, and the bill backs the provider’s request with a penalty. A user who fails to provide a TIN on request would face CAD 500 for each failure, unless they apply for one within 90 days of the request and provide it within 15 days of receiving it, or another statutory exception applies. A TIN that is present but wrong, or does not match the declared jurisdiction, is the harder case, and the cheapest point to catch it is onboarding, on Day 1, while the user is still in the session and can correct it.

05 · Transaction Capture and Reporting

Reporting under the CARF is aggregated, not transaction by transaction. For each reportable user and each type of crypto-asset, the provider reports the year’s acquisitions and disposals against fiat, the exchanges against other crypto-assets, and the transfers in and out, each as an aggregate gross amount, a number of units and a count of transactions. Capturing that well means classifying every transaction by type as it happens and keeping a fair market value in fiat for transfers that are not exchanges.

The bill would require the information return to be filed with the Minister of National Revenue before 2 May of each calendar year, for the preceding year, by electronic filing (s. 300). For the 2027 year, the first return would fall due before 2 May 2028. The bill also says what an outsourced arrangement does not change: where a provider relies on a third party for its due diligence, those obligations remain the reporting crypto-asset service provider’s responsibility (s. 299(13)).

06 · The CARF XML Schema

The OECD released the first CARF XML Schema User Guide in October 2024, separately from the 2023 rules, and an updated User Guide, for schema version 1.5, in July 2025. The schema is the format for exchanges between tax authorities, and the OECD notes that providers can also use it for domestic reporting, to the extent the jurisdiction’s domestic law permits. Bill C-31 refers to an information return in prescribed form; until the Canada Revenue Agency (Agence du revenu du Canada) publishes that form, a provider building its reporting layer is safest working from the OECD data model, the one in which the information is exchanged.

07 · Operational and Compliance Requirements: Two Ways to Meet Them

By hand, after royal assent

A provider can wait for the bill to pass, then send every existing user a self-certification request, chase the replies, test them against its KYC files and build the first return from what comes back. For a small user base that works. The case against it is timing: the existing users must be covered before 2028, every user who stops answering becomes a gap in the return, and new users onboarded meanwhile join the queue.

Automation and Compliance, Step by Step

TaxDo runs CARF due diligence inside onboarding, on one platform, in five steps.

Step 1 · Collect the self-certification. Guided and jurisdiction-aware, one question at a time, with a digital signature; controlling persons, where the rules require them, in the same flow.

Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.

Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine runs 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, including official TIN lookup in 130+ countries.

Step 4 · Cure the gaps, without the compliance team:

4a · New users. Reasonableness tested and discrepancies resolved in the same session, before they reach your team’s queue.

4b · Existing users. One click starts a remediation campaign for users on the books at 31 December 2026, with guided questions through a link in your brand and every answer checked by Verify+. Each case closes with a signed self-certification and an audit-ready certificate.

Step 5 · Report, and keep the evidence. Each transaction classified by reportable type, and schema-validated CARF XML for each jurisdiction from one data layer, prepared and validated for your platform to submit. On request, our team can also submit it on your behalf as an additional service.

From Day-1 wallet-holder self-certification to CARF reporting, with zero remediation.

Our CARF compliance software · Crypto exchanges and CASPs

Where this sits, and what it does not touch

It runs beside your KYC provider and trading systems, not in place of them. The reporting obligation, and the responsibility for what is reported, stays with the provider, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.

Worked example: a Vancouver crypto exchange preparing for 2027

Take a fictional Vancouver crypto exchange that serves retail users in Canada and abroad. Every user with a relationship at 31 December 2026 is a pre-existing user under the bill, and the crypto exchange must complete due diligence on each before 2028. If it builds the self-certification into its sign-up flow in 2026, users who join in 2027 are cleared at onboarding and the remediation list stops growing on 1 January. If it waits, the list grows until royal assent and the crypto exchange starts its first return, due before 2 May 2028, with the largest possible backlog.

08 · Implementation Timeline: From the 2025 Draft to 2028

13 August 2025

Finance Canada’s draft proposals apply the CRS amendments from 2026, with existing crypto users covered before 2027.

4 November 2025

Budget 2025 is tabled in Parliament; Bill C-31 implements part of it.

6 May 2026

First reading of Bill C-31 in the House of Commons.

3 June 2026

Second reading; the bill is referred to the Standing Committee on Finance.

20 October 2026

Bill C-31 is at committee in the House of Commons, with no royal assent; CARF is proposed from 2027, and most of the amended CRS from 2027.

31 December 2026

Users with a relationship on this date are pre-existing users.

1 January 2027

Proposed start: due diligence on new users when the relationship is established.

Before 2028

Due diligence on pre-existing users completed.

Before 2 May 2028

First information return, for 2027; the OECD lists Canada’s first exchanges by 2028.

09 · Integration with CRS 2.0 and Global Reporting

The same bill amends Part XIX of the Income Tax Act, which carries the Common Reporting Standard, and most of those amendments would apply from 2027 (clauses 91 to 98). The amended CRS, set out in the CRS 2.0 guide, brings e-money and central bank digital currencies into scope, adds new data points and brings indirect crypto-asset investments, through derivatives and investment vehicles, into the CRS, while crypto-assets themselves are reported under the CARF. A Canadian institution that holds e-money or crypto-asset derivatives for customers and also runs a crypto exchange can carry both obligations. Canada’s CRS 2.0 rules cover the financial-account side; the customer data both need, residence and TIN, is best collected once.