The Day-1 Era: Why CRS 2.0, CARF and DAC8 Compliance Starts at Onboarding, Not Reporting

Sources last verified: 20 October 2026

Official sources cited at the end of this page.

The first reports under CRS 2.0, the Crypto-Asset Reporting Framework (CARF) and the EU’s DAC8 fall due in 2027 in the EU and the UK, but the due diligence they report on starts the day an account opens. Since 1 January 2026 the amended Common Reporting Standard has applied in the EU and the UK, and each reportable account must now show whether a valid self-certification has been provided. In the EU, a crypto-asset provider must prevent a user who has not self-certified after two reminders from performing reportable transactions, though not before 60 days have passed. Compliance under all three frameworks now begins at onboarding.

Leaving it for later has a price that is easy to trace. A self-certification accepted in March that contradicts an address already on file is a due diligence failure in March; it surfaces when the next year’s report is built, by which time the customer may no longer answer. Where, in exceptional circumstances, a new account’s self-certification cannot be obtained in time, the amended CRS falls back on the pre-existing account procedures until it is obtained and validated, and the OECD says that fallback is not an alternative to collecting one.

There are two ways to meet the Day-1 standard. One collects the form and tests it later, in a remediation campaign that grows with the book. The other tests it while the customer is still opening the account, so a missing TIN or a conflicting address is settled in the same session. The second leaves nothing for year-end, and section 02 shows how it runs.

The rules come from the OECD’s 2023 update of the CRS and the CARF, published as one consolidated text on 8 June 2023, and from Council Directive (EU) 2023/2226, which Member States apply from 1 January 2026.

01 · What Day 1 Has to Prove

A new account is cleared for tax purposes when three things hold, and each needs the one before it.

1. A self-certification with every jurisdiction of tax residence and, for each reportable one, a TIN, signed or positively affirmed and dated no later than receipt.
2. A declaration that holds up against what the institution already knows from its AML/KYC file, with every conflicting indicator resolved or explained.
3. A record from which a schema-valid report can be built and defended, years later, step by step.

Most onboarding flows check the first. The second and third decide whether the report holds up, and they are the ones that cannot be repaired cheaply once the customer has gone.

Our regulatory compliance engine clears new accounts at banks, e-money institutions and crypto-asset providers on Day 1. It collects and checks the self-certification, runs the TIN, reasonableness and other due diligence checks, resolves indicia automatically instead of by your compliance team, and prepares the validated report, with zero remediation.

02 · Pick Your Path to Compliance: Year-End Remediation or Day 1

By hand, after onboarding

An institution can collect the form as a PDF or a web page, run a format check on the TIN, keep a spreadsheet of indicia and write to customers when something does not fit. For a small book that works. The case against it is arithmetic and timing, not quality: each gap found after onboarding needs the customer to answer again, each reminder is a dated event someone must log, and the flag in the report records the outcome either way.

The Day-1 Compliance Infrastructure Layer

TaxDo runs CRS 2.0, CARF and DAC8 due diligence inside onboarding, on one platform, in five steps.

Step 1 · Collect the self-certification. Guided and jurisdiction-aware, one question at a time, with a digital signature; a passive entity’s controlling persons in the same flow.

Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.

Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine runs 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, including official TIN lookup in 130+ countries.

Step 4 · Cure the gaps, without the compliance team:

4a · New accounts. Reasonableness tested and discrepancies resolved in the same session, before they reach your team’s queue.

4b · Existing accounts. One click starts a remediation campaign for the cohort, with guided questions through a link in your brand and every answer checked by Verify+. Each case closes with a signed self-certification and an audit-ready certificate, and on DAC8 both reminders and the 60-day clock run and are logged automatically.

Step 5 · Report, and keep the evidence. CARF and DAC8 transactions classified by reportable type, and schema-validated CRS XML, CARF XML and DAC8 XML for each jurisdiction from one data layer, prepared and validated for your institution to submit. On request, our team can also submit them on your behalf as an additional service.

From Day-1 self-certification to CRS 2.0, CARF and DAC8 reporting, with zero remediation.

CRS 2.0 compliance software · Banks and custodians · Crypto exchanges and CASPs · Fintechs and neo-banks

Where this sits, and what it does not touch

The KYC provider keeps verifying identity and the core platform keeps holding the account. KYC answers who the customer is; tax due diligence answers where they are resident for tax, and whether that declaration holds up against what the institution already knows. This runs at onboarding beside KYC, not in place of it, and alongside an existing reporting stack.

The difference is when the gap is found. At onboarding it is one question to the customer. At year-end it is a remediation campaign, a reminder log and a report filed with gaps.

The reporting obligation, and the responsibility for what is reported, stays with your institution, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.

03 · The Embedded Kill Switch: What Happens Without a Self-Certification

For the amended CRS the rule is a fallback, not a block. Where a new account’s self-certification cannot be obtained in time, the institution applies the pre-existing account procedures until it is obtained and validated, which the amended Commentary expects within 90 calendar days in any case. The Australian Taxation Office says a valid self-certification must generally be obtained on day one, and names blocking all transactions on the account, or closing it, as the options it considers strong measures. In the UK, failing to obtain a valid self-certification carries a penalty of up to £300 for each account holder or controlling person.

CARF does not itself mandate blocking. Its Commentary asks for strong measures and names one: legislation making the effectuating of transactions conditional on a valid self-certification. DAC8 makes a version of it law in the EU, applied after a grace period. Annex VI requires the provider to prevent a user from performing reportable transactions after two reminders following the initial request, and not before 60 days. That is the switch embedded in the customer journey, and our CARF compliance software is built around it.

Worked example: an Irish e-money institution with a crypto desk

Take a fictional Dublin e-money institution that also exchanges crypto-assets for its customers. Ireland’s rules, in S.I. No. 584 of 2025, count the 60 days from the second written reminder, not from the first request. A user onboarded on 12 January without a self-certification, reminded on 9 February and again on 9 March, can keep trading until the 60 days after 9 March run out on 8 May. For four months the institution carries a user it cannot classify, under a rule that our DAC8 compliance software tracks date by date. Had the self-certification been a condition of finishing onboarding, there would have been no clock to run.

The same customer’s e-money account sits on the CRS side. The EU’s version of the amended CRS treats an entity that holds e-money for customers as a depository institution, so the account needs CRS due diligence too, subject to an exclusion for small e-money balances.

04 · The Data Gap: What Changes at Onboarding

CRS 2.0 asks onboarding to capture more than the old forms did. The report must now record the role by which each reportable person is a controlling person of an entity, whether the account is new or pre-existing, whether it is joint and with how many holders, and whether a valid self-certification was provided. Dual residents must declare every jurisdiction of tax residence, since treaty tiebreaker rules may no longer be used for self-certification.

Two concessions ease the change. For accounts held on 31 December 2025, the EU reference date, controlling-person roles need to be reported only if they are in electronically searchable data, for reporting periods ending by 2027. And where an institution itself reports gross proceeds from a sale under DAC8, the EU’s version of the amended CRS does not require them again unless it elects otherwise, so a system that cannot tell the two regimes apart risks reporting the same sale twice.

Specified e-money products and central bank digital currencies come into the CRS, while the CARF leaves both out of the crypto-assets it covers, so they are reported under the CRS rather than the CARF. On the TIN, the amended Commentary does not require a format check, but a blank TIN from a jurisdiction that issues TINs to all residents gives reason to know the self-certification is unreliable. TIN validation under CRS 2.0 covers that rule and its exceptions.

For individual crypto-asset users and controlling persons, the CARF and DAC8 ask for the same five items on a self-certification: name, residence address, jurisdictions of tax residence, a TIN for each reportable jurisdiction and date of birth. For users whose relationship predates the rules, the CARF has the provider obtain a self-certification by 12 months after the effective date; in the EU, for pre-existing individual users, that date is 1 January 2027.

05 · Global Implementation Roadmap: Where Day 1 Has Started

The OECD’s list of jurisdictions committed to the CARF, last updated on 14 September 2026, puts 46 in the first exchanges by 2027, 27 by 2028 and 4 by 2029. Domestic dates below come from each government.

Europe: EU and Non-EU

Americas: Offshore and Onshore

Asia-Pacific and Africa

06 · Why Most Compliance Stacks Fail at Onboarding

Three tools are often taken for the whole answer, and each covers only part of it. KYC is not tax due diligence: it establishes who the customer is, not where they are resident for tax, and a clean KYC file can sit beside a self-certification that contradicts it. A format check is not a validation: it confirms that a TIN is well formed, and passes a well-formed number that belongs to nobody. An XML generator is not due diligence: it reports whatever it is given, accurately, including the gaps.

Each does its own job well; the failure is timing, because all three sit after the moment when the customer could still have been asked.

07 · The Verdict: Audit Survivability Means Evidence for Every Account

The amended Commentary expects a positive affirmation to be captured so that it can be credibly demonstrated, by a voice recording or a digital footprint for example. CRS records are kept, under the Commentary, for at least five years after the end of the period in which the information must be reported. For crypto-asset providers in the EU, DAC8 sets between five and ten years from the same reference point, and each Member State chooses within that range.

A defensible account file holds the self-certification as received and when, the reasonableness result and what it was tested against, each TIN result and its source, every indicator found and how it was cured, and each reminder with its date. Built at onboarding, that file exists from day one; rebuilt at year-end, it is a reconstruction.

08 · Related Reading

Framework articles: CRS 2.0 for financial institutions · CARF and crypto tax transparency · DAC8 compliance · Self-certification under CRS 2.0, DAC8 and CARF

Product: Regulatory compliance engine · CARF compliance software · DAC8 compliance software