CARF in South Africa: Crypto Asset Reporting and Cross-Border Transparency, 2026 to 2027

Sources last verified: 28 October 2026

Official sources cited at the end of this page.

What does a South African crypto-asset service provider owe SARS under the Crypto-Asset Reporting Framework? Since 1 March 2026, regulations made under the Tax Administration Act require it to obtain a self-certification from every user, report its users resident outside South Africa for each year running from 1 March, and file the first return, for March 2026 to February 2027, by 31 May 2027.

Two features set the South African rules apart. A provider must suspend transactions for a user who has not given a compliant self-certification, a step the OECD model leaves to each jurisdiction. And the reporting year follows South Africa’s tax year, 1 March to the end of February, not the calendar year; SARS expects the first exchange with partner jurisdictions in September 2027.

Users already on the books on 28 February 2026 have twelve months from 1 March 2026 to self-certify; every user who joined since then needed one when the relationship began.

There are two ways to meet the South African rules. One collects the missing self-certifications from existing users before the twelve months run out and suspends the rest. The other completes and checks the self-certification inside onboarding, so no new user ever reaches the suspension rule. Only the second keeps suspension a rare event.

01 · South Africa CARF at a Glance

Our regulatory compliance engine builds the South African due diligence record as each user signs up. It collects and checks the self-certification, runs the TIN, reasonableness and other required due diligence checks, resolves discrepancies automatically instead of by your compliance team, and prepares the validated return, with zero remediation.

02 · International Alignment and Regulatory Context

The OECD approved the CARF and the amended Common Reporting Standard over 2022 and 2023 and published them together on 8 June 2023. South Africa signed the CARF multilateral agreement on 26 November 2024, and the Global Forum’s list of 14 September 2026 places it among the 46 jurisdictions committed to first exchanges by 2027.

The CARF regulations were made by the Minister of Finance under section 257 of the Tax Administration Act and the definition of “international tax standard” in section 1, and take effect on 1 March 2026. They are read with the OECD commentaries. The amended CRS took effect on the same date in separate regulations, GN R. 6886, covered in our South Africa CRS 2.0 article.

SARS refused requests to defer the start to 1 March 2027 or to extend the twelve-month window for existing users to 24 months, in its CARF FAQs of 5 March 2026 (FAQs 1 and 19).

03 · Scope and Applicability

A reporting crypto-asset service provider is any person that, as a business, provides a service effectuating exchange transactions for or on behalf of customers, including by acting as a counterparty or intermediary or by making a trading platform available. It reports in South Africa if it is tax resident there, incorporated or organised under South African law with legal personality or a tax filing obligation there, managed from South Africa, or has a regular place of business there; transactions through a South African branch are covered too (Section I).

SARS’s FAQs set the edges. Customers in South Africa do not by themselves create a nexus (FAQ 6). The duties are functional, so they are not limited to custodians, with a narrow, temporary deferral for decentralised arrangements where no one has sufficient control or influence (FAQ 7). A crypto-asset is in scope if it can be used for payment or investment, whatever its licensing status (FAQ 31).

Relevant crypto-assets exclude central bank digital currencies, specified electronic money products and assets the provider has adequately determined cannot be used for payment or investment. Central bank digital currencies and specified electronic money products fall under the amended CRS instead, and a financial institution that reports gross proceeds under the CARF need not report them again under the CRS, unless it elects to (CRS Regulations, Section I(G)).

04 · Due Diligence and TIN Validation

A new user must give a self-certification when the relationship is established, and the provider must confirm its reasonableness against what it holds, including its anti-money-laundering records (Section III(A)(1), (B)(1)). An existing user, one with a relationship in place on 28 February 2026, must self-certify within twelve months of the effective date. SARS’s FAQ 18 adds that reporting is not suspended during that window: users still without one are reported as having an undocumented or unvalidated residence.

A valid self-certification is signed or otherwise positively affirmed and dated, and gives the user’s name, address, every jurisdiction of tax residence, the TIN for each reportable jurisdiction, and, for an individual, date of birth; an entity’s self-certification also covers its controlling persons, unless it is an active entity or excluded person (Section III(C)). A TIN need not be collected where the jurisdiction does not issue one or its domestic law does not require it. Place of birth need not be reported unless South African law requires it, which SARS says it currently does not (FAQ 9).

When a change of circumstances makes a self-certification unreliable, the provider may keep the user’s previous status only for a limited period, ending no later than 90 calendar days after the self-certification became invalid (Section III(A)(2)).

The suspension rule

Section V(B) is South Africa’s own addition. Until it receives a compliant self-certification, a provider must suspend effectuating a relevant transaction for the user. Where, despite reasonable efforts, none arrives and the customer or transaction presents a risk of tax evasion or of frustrating the CARF, it may also end the relationship or decline the transaction.

A Durban exchange’s two cohorts

Take a fictional exchange in Durban. A customer onboarded in January 2026 is an existing user: she must self-certify within twelve months of 1 March 2026, and until she does, the exchange reports her as undocumented; if the twelve months end without one, it must suspend her transactions under Section V(B). A customer onboarded on 10 March 2026 is a new user: he needed a self-certification when the relationship was established, and without one the exchange must suspend his transactions.

05 · Transaction Capture and Reporting

For each reportable user and each type of relevant crypto-asset, the return gives annual aggregates: amounts paid and received in acquisitions and disposals against fiat currency; the fair market value of acquisitions and disposals against other crypto-assets; reportable retail payment transactions, which are transfers for goods or services above USD 50,000; other transfers to and by the user, by type where known; and transfers to wallet addresses not known to belong to a virtual asset service provider or financial institution (Section II(A)). SARS requires reporting by transaction type, not one aggregate per user (FAQ 14).

Amounts are converted to South African rand, by a reasonable method applied consistently (Section II(D), (E); FAQ 15). The regulations require the return that a public notice under section 26 of the Tax Administration Act will prescribe; SARS had not published a CARF notice by 28 October 2026, but its CARF page sets 31 May 2027 for the first return, in the format of its final business requirement specification (version 1.5).

The reportable population is wide: SARS adopted the “widest approach”, under which every jurisdiction other than South Africa is a reportable jurisdiction, whatever its treaty status (FAQ 26). South African residents are not reported under the CARF, unlike the UK’s domestic extension.

06 · Implementation Timeline

07 · Operational and Compliance Expectations

SARS’s FAQ 33 places enforcement in the Tax Administration Act: section 26 notices set the obligations, and fixed-amount penalties under section 210 apply to a person who breaches an obligation the Commissioner has listed in a public notice. For FATCA and the CRS, SARS’s penalty page applies the table in section 211: R250 to R16,000 per incidence by income band, increasing by the same amount each month the non-compliance continues (SARS: up to 36 months; s. 211(2): 35 months after assessment, or 47 where SARS cannot deliver it). SARS had not published a CARF listing notice by 28 October 2026. Section V(A)(1) also disregards any arrangement whose main purpose, or one of whose main purposes, is to avoid an obligation under the rules.

Records, including self-certifications and the steps taken, are kept for at least five years after the end of the period in which the information must be reported (Section III(D)(3)). A provider may rely on a third party for due diligence, but the obligations stay its own (Section III(D)(2)), and SARS expects the user named on an electronic self-certification to be able to produce a hard copy on request (FAQ 22).

08 · TaxDo as an Automation Layer for CARF Compliance

TaxDo runs CARF due diligence inside onboarding, from the first user self-certification to the validated return, in five steps.

Step 1 · Collect the self-certification. Guided, one question at a time, for individuals and entities, with a digital signature; controlling persons are collected in the same flow where the entity requires them.

Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.

Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine runs 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, testing each self-certification against the data already held.

Step 4 · Cure the gaps, without the compliance team:

4a · New users. Discrepancies are resolved in the same session, before the first trade, so the suspension rule is not triggered.

4b · Existing users. One click starts remediation for the pre-March 2026 book through a link in your own brand, with every answer checked by Verify+ and each case closed by a signed self-certification and an audit-ready certificate.

Step 5 · Report, and keep the evidence. Schema-validated CARF XML in rand from one data layer, prepared and validated for your platform to submit to SARS. Our team can also submit it on your behalf on request, as an additional service.

From Day-1 self-certification to the May return, with zero remediation. Every user is cleared at onboarding.

Our CARF compliance software · Crypto exchanges and CASPs

It runs beside the anti-money-laundering procedures a provider already applies, not in place of them. The reporting obligation, and the responsibility for what is reported, stays with the provider, including where TaxDo submits the return on its behalf at its request.

09 · Recent Changes and What’s Next

The next dates are the end of the twelve-month window for existing users, the end of the first reporting period on 28 February 2027 and the first return on 31 May 2027. In the EU, DAC8 has applied since 1 January 2026, and a provider within its scope reports its EU-resident users under it; see our DAC8 compliance software. The UK’s rules, which also report UK residents, are in our UK CARF article.

10 · Related Reading

Framework articles: CARF and crypto tax transparency · CRS 2.0 compliance guide for banks · Self-certification under CRS 2.0, DAC8 and CARF · South Africa CRS 2.0 · UK CARF

Product: Regulatory compliance engine · CRS compliance software · Day 1 onboarding validation