Get in touch
Sources last verified: 12 October 2026
Official sources cited at the end of this page.
Our regulatory compliance engine meets these rules on Day 1. It collects and checks each self-certification, runs the TIN, reasonableness and other required due diligence checks, resolves indicia automatically instead of by your compliance team, and prepares the validated report, with zero remediation, as section 08 shows.
Can a bank open an account, or an exchange let a new user trade, before the customer has said where they are resident for tax? Under the amended Common Reporting Standard (CRS 2.0), the EU’s DAC8 and the OECD’s Crypto-Asset Reporting Framework (CARF), the answer turns on the customer’s self-certification: a declaration of every tax residence, with a taxpayer identification number (TIN) for each. It is to be obtained when the relationship begins, and its reasonableness confirmed against what the institution already knows. Since 1 January 2026 that duty has reached e-money, central bank digital currencies and crypto-asset service providers in the EU, the UK and a widening group of jurisdictions.
The consequences of a missing declaration depend on who asks. A bank that, in exceptional circumstances, cannot obtain one in time for a new account falls back, under the rule as enacted, to the procedures for pre-existing accounts. Tax authorities still expect what the Australian Taxation Office calls strong measures, including “applying a block to all customer transactions on the account” or “closing the account”. An EU crypto-asset service provider has no such discretion: after two reminders, and not before 60 days have passed, it “shall prevent the Crypto-Asset User from performing Reportable Transactions”. In the UK, a financial institution that fails to obtain a valid self-certification faces a penalty of up to £300 for each account holder or controlling person.
There are two ways to meet the Day 1 standard. The first collects the declaration at onboarding and checks it later, by hand, chasing gaps through reminders. The second tests the declaration as collected, so every gap is settled before the account is used.The difference is when a gap is found, and what it costs to close.
The OECD published the amended CRS and CARF together on 8 June 2023. Council Directive (EU) 2023/2226 (DAC8) applies from 1 January 2026, with self-certifications from pre-existing crypto-asset users due by 1 January 2027. The UK applies the CRS updates from 1 January 2026. The first reports covering 2026 are filed in 2027.
01 · Self-Certification at a Glance
| Point | The position under CRS 2.0, CARF and DAC8 |
| What it is | The account holder’s declaration of every tax residence and the TIN for each, signed or otherwise positively affirmed, and dated |
| Legal basis | CRS Sections IV (individuals) and VI (entities), as amended in 2023; CARF Section III; DAC8 Annex I (CRS) and Annex VI (crypto-assets) |
| When | On account opening (CRS); when the relationship with a crypto-asset user is established (CARF, DAC8); EU pre-existing crypto-asset users by 1 January 2027 |
| Content, individuals | Name, residence address, every jurisdiction of tax residence, a TIN for each, date of birth |
| Content, entities | The entity’s residence and TIN; for a passive entity, its controlling persons are identified (AML/KYC records may be relied on), and the report must show each one’s role |
| Form | “In any manner and in any form” under the CRS Commentary; under CARF it may exist solely in electronic form |
| Reasonableness | Confirmed against information obtained at opening, including AML/KYC documentation (DAC8: Customer Due Diligence Procedures) |
| TIN | Required where the jurisdiction issues one and its law requires it to be collected; checking it against official sources is not required by the CRS |
| If missing, CRS | In exceptional circumstances only, pre-existing account procedures until obtained and validated (DAC8 Annex I, Section VII, Aa); authorities expect strong measures |
| If missing, DAC8 | The provider must block reportable transactions after two reminders and not before 60 days (Annex VI, Section V, A(2)) |
| Change in circumstances | CRS: a new valid self-certification. CARF and DAC8: a new self-certification, or a reasonable explanation and documentation; CARF allows the prior status to be kept for up to 90 days |
| Penalty example | UK: up to £300 per account holder or controlling person (CRS, SI 2025/740) and £300 per user (CARF, SI 2025/744) |
02 · The Liability in a ‘Wait and See’ Strategy
Waiting would make sense if the obligation began with the first report. It does not. The due diligence obligation began on the date each jurisdiction applied the new rules, which for the EU and the UK was 1 January 2026. Every reportable account opened since then without a valid self-certification will appear in the CRS report for 2026 as exactly that, because the amended CRS asks whether a valid self-certification was provided.
Transitional relief exists, but only for accounts that already existed. In the EU, for accounts maintained on 31 December 2025, the role by which a controlling person controls an entity account need only be reported, for reporting periods ending by 2027, if it is held in electronically searchable data. New accounts receive no such relief. They must carry the role, the joint-account flag and the flag showing whether a valid self-certification was provided from the first report onward.
For crypto-asset service providers in the EU the arithmetic is sharper still. Self-certifications from users who were already customers on 1 January 2026 are due by 1 January 2027, and any user who has not provided one by the time the reminders run out must be blocked from reportable transactions. A provider that waits for the reporting season will be blocking users while it files.
03 · What a Valid Self-Certification Must Contain
For individuals
Under DAC8, a crypto-asset user’s self-certification must give the user’s “first and last name”, “residence address”, every Member State of residence for tax purposes, the TIN for each, and “date of birth”. The OECD’s CARF rule uses the same list, with jurisdictions in place of Member States. The CRS rule, in the EU text of the standard, requires that where the self-certification shows a reportable residence it must include the account holder’s TIN for that jurisdiction and date of birth. A declaration that names one residence where the customer’s file points to two gives the institution reason to question it, whatever the form looks like.
For entities and controlling persons
An entity certifies its own residence and TIN. Where it is a passive non-financial entity, the institution must also identify its controlling persons, and may rely on the information it holds under AML/KYC procedures to do so. CRS 2.0 adds that the report must show “the role(s) by virtue of which each Reportable Person is a Controlling Person of the Entity”. No rule read for this article requires the role to appear on the self-certification itself, but it must be known by the time the report is prepared.
The TIN: required, but validation is not mandated
The amended CRS Commentary is explicit that the standard “does not require a Reporting Financial Institution to confirm the format and other specifications of a TIN with the information disseminated by the OECD”. It adds that institutions “may nevertheless wish to do so”, including through national TIN check services. It is equally explicit that an institution “will have reason to know that a self-certification is unreliable or incorrect if the self-certification does not contain a TIN and the information disseminated by the OECD indicates that the Reportable Jurisdiction issues TINs to all tax residents”.
DAC8 follows the same line. The Commission provides Member States with a TIN verification tool, and Member States “shall endeavour” to let reporting entities confirm TINs electronically. The European Commission’s public TIN on the Web service is narrower: it checks only the syntax and structure of a TIN and, in the Commission’s words, “does not confirm the identity of a person or the existence of the TIN”. A format check confirms that a number could exist. Only a check against the issuing authority shows that it was actually issued and, where the authority returns the holder’s name, to whom. Our TIN lookup performs that check against official sources.
Form, signature and date
The CRS Commentary allows a self-certification to be provided “in any manner and in any form”; if it is provided electronically, the system must ensure that what was received is what was sent and be able to produce a hard copy on request. Under CARF a self-certification “may also exist solely in electronic format”. Every version must be signed or otherwise positively affirmed by the person making it, and dated no later than the date it is received. An unaffirmed or undated record does not meet the standard.
What CRS 2.0 adds to the report
The 2023 update adds data points that tie the report to the onboarding record. The report must show whether a valid self-certification has been provided for each reportable person, the role of each controlling person, whether the account is joint and how many holders it has, and whether it is new or pre-existing. It also asks for the type of account and the role of each equity-interest holder. It also brings e-money and central bank digital currencies into scope, with the e-money exclusion described in section 07.
04 · The Reasonableness Test, Indicia and Change in Circumstances
Collecting the declaration is not enough. The CRS rule requires the institution to “confirm the reasonableness of such self-certification” against the information obtained when the account was opened, including the documentation collected for AML/KYC purposes. DAC8 uses the same test for crypto-asset users, with the words “Customer Due Diligence Procedures” in place of AML/KYC.
The standard for failure is objective. Under the Commentary an institution has reason to know a self-certification is unreliable where “a reasonably prudent person in the position of the Reporting Financial Institution would question the claim being made”. A declared residence that conflicts with the residence address collected for AML/KYC purposes is the obvious case. The amended Commentary adds residence claimed under a citizenship or residence-by-investment scheme that the OECD lists as potentially high-risk. Each must be resolved before the declaration can be relied on; under the CARF Commentary, which DAC8 follows, that means a valid self-certification or a reasonable explanation and documentation.
The test does not end at onboarding. When circumstances change, the institution can no longer rely on the original declaration. Under the CRS it must obtain a valid self-certification; under CARF and DAC8, a valid self-certification or a reasonable explanation and documentation. CARF allows a provider to keep treating the user as having the same status for up to 90 calendar days while it seeks one. If none arrives, the user is treated as resident both where they originally declared and where the new information points. The 90 days are a grace period for status, not a deadline for paperwork.
05 · The Day 1 Challenge: Why Manual Compliance Stops Scaling
Tax authorities read the account-opening rule literally. The Australian Taxation Office states that “a valid and reasonable self-certification must generally be obtained on ‘day one’ of the account opening process”. Where the reasonableness check is done after opening, “it must be checked within a period of 90 days and no later than the deadline for reporting”.
The fallback is now written into the rules. The paragraph on temporary lack of self-certification, as enacted in DAC8, covers “exceptional circumstances where a self-certification cannot be obtained by a Reporting Financial Institution in respect of a New Account in time to meet its due diligence and reporting obligations”. In that case the institution “shall apply the due diligence procedures for Pre-existing Accounts, until such self-certification is obtained and validated”. That is a safety net for the exceptional case, not a second route to onboarding.
Manual processes break where these rules meet volume. A form reviewed after sign-up produces a queue, and each inconsistent declaration becomes a letter to a customer already using the account. For a crypto-asset service provider under DAC8, every user who does not respond costs an initial request, two reminders and a blocking decision, and DAC8 requires records of the steps undertaken and the information relied on.
06 · Global Implementation Roadmap: The 2026 Rollout
The OECD text leaves the effective date to each jurisdiction, so the Day 1 obligation starts on the date set by national law. The dates below were confirmed at the national authority on 12 October 2026; where one could not be, the entry says so.
Europe (EU and non-EU)
DAC8 requires all 27 Member States to apply it from 1 January 2026, covering both the CRS amendments for financial institutions and CARF for crypto-asset service providers. The Netherlands enacted its law later, adopting it on 31 March 2026 with effect from 1 January 2026. The United Kingdom applies the CRS updates from 1 January 2026 and CARF from the same date, with the first crypto-asset report due between 1 January and 31 May 2027. In Switzerland, the Federal Council (Bundesrat) said the CRS changes were due to come into force on 1 January 2026, provided the referendum period expired unused, and that CARF “will not be implemented on 1 January 2026 as planned, but in 2027 at the earliest”. The State Secretariat for International Finance (SIF), in its FAQ updated on 18 May 2026, confirms that the CRS changes apply from 1 January 2026 and that CARF applies “at the earliest from 1 January 2027”. Neither source mentions a TIN validation rule. See our articles on the United Kingdom’s CRS 2.0 and CARF rules, Switzerland and Germany.
Africa
From 1 March 2026, South Africa applies the amended CRS and CARF. The South African Revenue Service confirms that the effective date, “as reflected in the final regulations, is 1 March 2026”, under regulations published in November 2025. For CARF, users onboarded from that date need a valid self-certification when the relationship begins. For the CRS, check the reference dates in the regulations themselves: under the OECD amendments as written into EU law, the new date applies only to accounts that are Financial Accounts solely because of the amendments, such as certain e-money products. More in our South Africa CRS 2.0 and CARF articles.
Asia-Pacific
Japan applies the amended CRS, in principle, from 1 January 2026, according to the National Tax Agency (Kokuzeichō). The new-account declaration now extends to certain electronic payment instruments and existing digital money. For transactions entered into before 2026 whose holders’ residence had not already been identified, the residence must be identified by 31 December 2027, or by 31 December 2026 for accounts above JPY 100 million. In New Zealand, Inland Revenue (Te Tari Taake) states that from 1 April 2026 New Zealand crypto-asset service providers must collect and report under CARF, with the first report for the year to 31 March 2027 due by 30 June 2027. Australia’s CARF exchanges begin in 2028 on the OECD list. See our Japan CRS 2.0 and CARF articles.
Americas (offshore and onshore)
The Cayman Islands government announced that “both the CARF and amended CRS frameworks will be implemented in 2026”, under regulations gazetted on 27 November 2025, with first reports on 2026 information in 2027. Canada appears on the OECD’s CARF commitments list with first exchanges in 2028. Its domestic CRS start date could not be confirmed at a Canadian source; check it with the Canada Revenue Agency. The United States, which exchanges under FATCA rather than the CRS, is listed for CARF exchanges in 2029. More in our Cayman Islands, Canada CRS 2.0 and Canada CARF articles.
| Jurisdiction | Amended CRS | CARF or DAC8 crypto rules | Confirmed at |
| EU (27 Member States) | 1 January 2026 | 1 January 2026; pre-existing users by 1 January 2027 | DAC8, Art. 2 and Annex VI |
| United Kingdom | 1 January 2026 | 1 January 2026; first report by 31 May 2027 | HMRC, HM Treasury |
| Switzerland | 1 January 2026 | 2027 at the earliest | Federal Council, SIF |
| South Africa | 1 March 2026 | 1 March 2026 | SARS |
| Japan | 1 January 2026 | First exchanges 2027 (OECD) | National Tax Agency, OECD |
| New Zealand | 1 April 2026 | 1 April 2026; first report by 30 June 2027 | Inland Revenue |
| Cayman Islands | 2026 | 2026; first reports 2027 | Cayman Islands Government |
| Canada | Proposed from 2027 (Bill C-31, not yet enacted) | Proposed from 2027 (Bill C-31); OECD lists first exchanges by 2028 | Parliament of Canada; OECD |
07 · What the Day 1 Standard Means by Institution Type
Banks and custodial institutions
For a bank the change is less about the form than about the evidence. CRS 2.0 adds a report that states whether a valid self-certification was obtained, names the role of each controlling person and flags joint and new accounts. Those fields cannot be completed accurately from a process that accepts the form first and reviews it later. Our CRS 2.0 guide for financial institutions covers the rest of the amended standard.
Crypto-asset service providers
For an exchange, broker or wallet provider, the self-certification decides how long a user can keep trading. The CARF Commentary expects a provider whose reasonableness test fails to obtain a valid self-certification or a reasonable explanation “before providing services effectuating Relevant Transactions”. DAC8 adds a hard stop for users who do not provide the required information: after two reminders, and not before 60 days, they must be blocked from reportable transactions. The detail is in our CARF guide and DAC8 guide.
E-money institutions, payment providers and neobanks
For an e-money issuer the question is first whether the account is in scope at all. An e-money account is excluded only if its rolling 90-day average end-of-day balance did not exceed USD 10,000 at any point in the calendar year, which means the test runs continuously and an account can cross into scope mid-year. A provider that waits until an account crosses the threshold before asking for a self-certification will be asking customers who are already active. Our fintech and neobank solutions page describes how the product handles this segment.
08 · Two Ways to Meet the Day 1 Requirement: By Hand, or Automated at Onboarding
By hand, collect first and check later
Typically, the onboarding flow presents a self-certification form, and a compliance team reviews the submissions in batches against the KYC file. Follow-up requests go out where something does not match. TINs are checked for format, and a remediation campaign before the reporting deadline chases the accounts still incomplete. For a small book with few cross-border customers, it works.
Its weakness is timing. Every inconsistency is found after the account is in use, when fixing it needs the cooperation of a customer who already has what they came for. Each unresolved case ends in a report filed with gaps or a restriction on a live account.
At onboarding, from Day 1
TaxDo runs self-certification and tax due diligence inside onboarding, from the first declaration to regulatory reporting, on one platform. It works in five steps, in this order, because each one needs the one before it.
Step 1 · Collect the self-certification. Guided and jurisdiction-aware, one question at a time, for individuals and entities, with a digital signature. Where the entity is passive, its controlling persons and their roles are collected in the same flow.
Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.
Step 3 · Run the due diligence. Indicia are detected across everything held on the customer, and the self-certification is tested for reasonableness against it, including the residence-by-investment questions, entity classification and the new CRS 2.0 account flags, for both CRS and CARF from one data layer.
Step 4 · Cure the gaps, without the compliance team:
4a · New customers. Discrepancies are resolved in the same session, while the customer is still onboarding, instead of landing in a queue for your team.
4b · Existing customers. The book is scanned and prioritised, missing self-certifications and TINs are remediated, and the reminders and deadlines are tracked to the end.
Step 5 · Report, and keep the evidence. Schema-validated CRS and CARF reports for each jurisdiction from one data layer, and an immutable clearance record for every account holder and user.
From Day-1 self-certification to regulatory reporting, with zero remediation. Every customer is cleared when the account opens, so nothing is left for year-end.
Our CRS 2.0 compliance software · Solutions for financial institutions · Solutions for crypto exchanges and CASPs
Where this sits, and what it does not touch
Your KYC provider keeps verifying identity and your core platform keeps holding the account. KYC answers who the customer is; tax due diligence answers where they are resident for tax. This runs at onboarding beside KYC, not in place of it, and covers CARF and DAC8 alongside the CRS on the same regulatory compliance engine.
The reporting obligation, and the responsibility for what is reported, stays with your institution. TaxDo runs the due diligence and prepares and validates the report.
At sign-up, a missing residence is one more question. After the account is in use, it is a letter, a reminder, a deadline and possibly a block.
09 · Recent Changes and What Comes Next
24 October 2023
DAC8 published in the Official Journal of the European Union.
1 January 2026
The amended CRS applies in the EU, the UK, Switzerland and Japan; DAC8 and the UK’s CARF rules apply to crypto-asset service providers.
1 March and 1 April 2026
South Africa applies the amended CRS and CARF; New Zealand applies CARF.
1 January 2027
Deadline for self-certifications from pre-existing crypto-asset users in the EU; Switzerland’s earliest CARF start date.
10 · Related Reading
Framework articles: CRS 2.0 compliance for financial institutions · CARF, the Crypto-Asset Reporting Framework · DAC8 compliance
Product: Regulatory compliance engine · Day 1 onboarding validation · CRS 2.0 compliance software · CARF compliance software · DAC8 compliance software · TIN lookup
