# The Day 1 Standard: Mandatory Self-Certification Under CRS 2.0, DAC8 and CARF, and How to Meet It > What a valid self-certification needs under CRS 2.0, DAC8 and CARF: content, TIN, the reasonableness test, start dates by country and how to meet Day 1. Source: https://taxdo.com/resources/blog/post/crs-2-0-dac8-mandatory-self-certification-guide Last updated: 2026-10-18 _Sources last verified: 12 October 2026_ _Official sources cited at the end of this page._ [**Our regulatory compliance engine**](https://taxdo.com/services/regulatory-compliance) **meets these rules on Day 1.** It collects and checks each self-certification, runs the TIN, reasonableness and other required due diligence checks, resolves indicia automatically instead of by your compliance team, and prepares the validated report, with zero remediation, as section 08 shows. Can a bank open an account, or an exchange let a new user trade, before the customer has said where they are resident for tax? Under the [amended Common Reporting Standard (CRS 2.0)](https://taxdo.com/resources/blog/post/crs-2-0-compliance-guide-banks), the EU’s [DAC8](https://taxdo.com/resources/blog/post/eu-dac8-compliance-crs-2-0-carf-crypto-reporting-2026) and the OECD’s [Crypto-Asset Reporting Framework (CARF)](https://taxdo.com/resources/blog/post/carf-crs2-crypto-tax-transparency-guide), the answer turns on the customer’s self-certification: a declaration of every tax residence, with a taxpayer identification number (TIN) for each. It is to be obtained when the relationship begins, and its reasonableness confirmed against what the institution already knows. Since 1 January 2026 that duty has reached e-money, central bank digital currencies and crypto-asset service providers in the EU, the UK and a widening group of jurisdictions. The consequences of a missing declaration depend on who asks. A bank that, in exceptional circumstances, cannot obtain one in time for a new account falls back, under the rule as enacted, to the procedures for pre-existing accounts. Tax authorities still expect what the Australian Taxation Office calls strong measures, including “applying a block to all customer transactions on the account” or “closing the account”. An EU crypto-asset service provider has no such discretion: after two reminders, and not before 60 days have passed, it “shall prevent the Crypto-Asset User from performing Reportable Transactions”. In the UK, a financial institution that fails to obtain a valid self-certification faces a penalty of up to £300 for each account holder or controlling person. **There are two ways to meet the Day 1 standard.** The first collects the declaration at onboarding and checks it later, by hand, chasing gaps through reminders. The second tests the declaration as collected, so every gap is settled before the account is used.**The difference is when a gap is found, and what it costs to close.** The OECD published the amended CRS and CARF together on [8 June 2023](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report.html). [Council Directive (EU) 2023/2226 (DAC8)](https://publications.europa.eu/resource/celex/32023L2226) applies from 1 January 2026, with self-certifications from pre-existing crypto-asset users due by 1 January 2027\. The [UK applies the CRS updates from 1 January 2026](https://www.gov.uk/government/publications/regulations-to-update-the-uks-automatic-exchange-of-information-agreements/tax-administration-regulations-to-update-the-uks-automatic-exchange-of-information-agreements). The first reports covering 2026 are filed in 2027. ## **01 · Self-Certification at a Glance** | **Point** | **The position under CRS 2.0, CARF and DAC8** | | ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | What it is | The account holder’s declaration of every tax residence and the TIN for each, signed or otherwise positively affirmed, and dated | | Legal basis | CRS Sections IV (individuals) and VI (entities), as amended in 2023; CARF Section III; DAC8 Annex I (CRS) and Annex VI (crypto-assets) | | When | On account opening (CRS); when the relationship with a crypto-asset user is established (CARF, DAC8); EU pre-existing crypto-asset users by 1 January 2027 | | Content, individuals | Name, residence address, every jurisdiction of tax residence, a TIN for each, date of birth | | Content, entities | The entity’s residence and TIN; for a passive entity, its controlling persons are identified (AML/KYC records may be relied on), and the report must show each one’s role | | Form | “In any manner and in any form” under the CRS Commentary; under CARF it may exist solely in electronic form | | Reasonableness | Confirmed against information obtained at opening, including AML/KYC documentation (DAC8: Customer Due Diligence Procedures) | | TIN | Required where the jurisdiction issues one and its law requires it to be collected; checking it against official sources is not required by the CRS | | If missing, CRS | In exceptional circumstances only, pre-existing account procedures until obtained and validated (DAC8 Annex I, Section VII, Aa); authorities expect strong measures | | If missing, DAC8 | The provider must block reportable transactions after two reminders and not before 60 days (Annex VI, Section V, A(2)) | | Change in circumstances | CRS: a new valid self-certification. CARF and DAC8: a new self-certification, or a reasonable explanation and documentation; CARF allows the prior status to be kept for up to 90 days | | Penalty example | UK: up to £300 per account holder or controlling person (CRS, SI 2025/740) and £300 per user (CARF, SI 2025/744) | ## **02 · The Liability in a ‘Wait and See’ Strategy** Waiting would make sense if the obligation began with the first report. It does not. The due diligence obligation began on the date each jurisdiction applied the new rules, which for the EU and the UK was 1 January 2026\. Every reportable account opened since then without a valid self-certification will appear in the CRS report for 2026 as exactly that, because the amended CRS asks whether a valid self-certification was provided. Transitional relief exists, but only for accounts that already existed. In the EU, for accounts maintained on 31 December 2025, the role by which a controlling person controls an entity account need only be reported, for reporting periods ending by 2027, if it is held in electronically searchable data. New accounts receive no such relief. They must carry the role, the joint-account flag and the flag showing whether a valid self-certification was provided from the first report onward. For crypto-asset service providers in the EU the arithmetic is sharper still. Self-certifications from users who were already customers on 1 January 2026 are due by 1 January 2027, and any user who has not provided one by the time the reminders run out must be blocked from reportable transactions. A provider that waits for the reporting season will be blocking users while it files. ## **03 · What a Valid Self-Certification Must Contain** ### **For individuals** Under DAC8, a crypto-asset user’s self-certification must give the user’s “first and last name”, “residence address”, every Member State of residence for tax purposes, the TIN for each, and “date of birth”. The OECD’s CARF rule uses the same list, with jurisdictions in place of Member States. The CRS rule, in the [EU text of the standard](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014L0107), requires that where the self-certification shows a reportable residence it must include the account holder’s TIN for that jurisdiction and date of birth. A declaration that names one residence where the customer’s file points to two gives the institution reason to question it, whatever the form looks like. ### **For entities and controlling persons** An entity certifies its own residence and TIN. Where it is a passive non-financial entity, the institution must also identify its controlling persons, and may rely on the information it holds under AML/KYC procedures to do so. [CRS 2.0](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report/component-12.html) adds that the report must show “the role(s) by virtue of which each Reportable Person is a Controlling Person of the Entity”. No rule read for this article requires the role to appear on the self-certification itself, but it must be known by the time the report is prepared. ### **The TIN: required, but validation is not mandated** The amended [CRS Commentary](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report/component-13.html) is explicit that the standard “does not require a Reporting Financial Institution to confirm the format and other specifications of a TIN with the information disseminated by the OECD”. It adds that institutions “may nevertheless wish to do so”, including through national TIN check services. It is equally explicit that an institution “will have reason to know that a self-certification is unreliable or incorrect if the self-certification does not contain a TIN and the information disseminated by the OECD indicates that the Reportable Jurisdiction issues TINs to all tax residents”. DAC8 follows the same line. The Commission provides Member States with a TIN verification tool, and Member States “shall endeavour” to let reporting entities confirm TINs electronically. The European Commission’s public [TIN on the Web](https://taxation-customs.ec.europa.eu/online-services/online-services-and-databases-taxation/taxpayer-identification-number-tin%5Fen) service is narrower: it checks only the syntax and structure of a TIN and, in the Commission’s words, “does not confirm the identity of a person or the existence of the TIN”. A format check confirms that a number could exist. Only a check against the issuing authority shows that it was actually issued and, where the authority returns the holder’s name, to whom. [Our TIN lookup](https://taxdo.com/services/tax-identity/tin-lookup) performs that check against official sources. ### **Form, signature and date** The CRS Commentary allows a self-certification to be provided “in any manner and in any form”; if it is provided electronically, the system must ensure that what was received is what was sent and be able to produce a hard copy on request. Under CARF a self-certification “may also exist solely in electronic format”. Every version must be signed or otherwise positively affirmed by the person making it, and dated no later than the date it is received. An unaffirmed or undated record does not meet the standard. ### **What CRS 2.0 adds to the report** The 2023 update adds data points that tie the report to the onboarding record. The report must show whether a valid self-certification has been provided for each reportable person, the role of each controlling person, whether the account is joint and how many holders it has, and whether it is new or pre-existing. It also asks for the type of account and the role of each equity-interest holder. It also brings e-money and central bank digital currencies into scope, with the e-money exclusion described in section 07. ## **04 · The Reasonableness Test, Indicia and Change in Circumstances** Collecting the declaration is not enough. The CRS rule requires the institution to “confirm the reasonableness of such self-certification” against the information obtained when the account was opened, including the documentation collected for AML/KYC purposes. DAC8 uses the same test for crypto-asset users, with the words “Customer Due Diligence Procedures” in place of AML/KYC. The standard for failure is objective. Under the Commentary an institution has reason to know a self-certification is unreliable where “a reasonably prudent person in the position of the Reporting Financial Institution would question the claim being made”. A declared residence that conflicts with the residence address collected for AML/KYC purposes is the obvious case. The amended Commentary adds residence claimed under a citizenship or residence-by-investment scheme that the OECD lists as potentially high-risk. Each must be resolved before the declaration can be relied on; under the CARF Commentary, which DAC8 follows, that means a valid self-certification or a reasonable explanation and documentation. The test does not end at onboarding. When circumstances change, the institution can no longer rely on the original declaration. Under the CRS it must obtain a valid self-certification; under CARF and DAC8, a valid self-certification or a reasonable explanation and documentation. CARF allows a provider to keep treating the user as having the same status for up to 90 calendar days while it seeks one. If none arrives, the user is treated as resident both where they originally declared and where the new information points. The 90 days are a grace period for status, not a deadline for paperwork. ## **05 · The Day 1 Challenge: Why Manual Compliance Stops Scaling** Tax authorities read the account-opening rule literally. The [Australian Taxation Office](https://www.ato.gov.au/about-ato/international-tax-agreements/in-detail/obtaining-valid-self-certifications-for-all-new-accounts) states that “a valid and reasonable self-certification must generally be obtained on ‘day one’ of the account opening process”. Where the reasonableness check is done after opening, “it must be checked within a period of 90 days and no later than the deadline for reporting”. The fallback is now written into the rules. The paragraph on temporary lack of self-certification, as enacted in DAC8, covers “exceptional circumstances where a self-certification cannot be obtained by a Reporting Financial Institution in respect of a New Account in time to meet its due diligence and reporting obligations”. In that case the institution “shall apply the due diligence procedures for Pre-existing Accounts, until such self-certification is obtained and validated”. That is a safety net for the exceptional case, not a second route to onboarding. Manual processes break where these rules meet volume. A form reviewed after sign-up produces a queue, and each inconsistent declaration becomes a letter to a customer already using the account. For a crypto-asset service provider under DAC8, every user who does not respond costs an initial request, two reminders and a blocking decision, and DAC8 requires records of the steps undertaken and the information relied on. ## **06 · Global Implementation Roadmap: The 2026 Rollout** The OECD text leaves the effective date to each jurisdiction, so the Day 1 obligation starts on the date set by national law. The dates below were confirmed at the national authority on 12 October 2026; where one could not be, the entry says so. ### **Europe (EU and non-EU)** DAC8 requires all 27 Member States to apply it from 1 January 2026, covering both the CRS amendments for financial institutions and CARF for crypto-asset service providers. The [Netherlands](https://www.eerstekamer.nl/nonav/wetsvoorstel/36782%5Fwet%5Fimplementatie%5Feu) enacted its law later, adopting it on 31 March 2026 with effect from 1 January 2026\. The United Kingdom applies the [CRS updates from 1 January 2026](https://www.gov.uk/government/publications/regulations-to-update-the-uks-automatic-exchange-of-information-agreements/tax-administration-regulations-to-update-the-uks-automatic-exchange-of-information-agreements) and CARF from the same date, with the [first crypto-asset report](https://www.gov.uk/guidance/reporting-cryptoasset-user-and-transaction-data) due between 1 January and 31 May 2027\. In Switzerland, the [Federal Council (Bundesrat)](https://www.admin.ch/en/newnsb/oAaJyRFS1lqJ7PN3sLJTP) said the CRS changes were due to come into force on 1 January 2026, provided the referendum period expired unused, and that CARF “will not be implemented on 1 January 2026 as planned, but in 2027 at the earliest”. The [State Secretariat for International Finance (SIF)](https://www.sif.admin.ch/dam/en/sd-web/3DLzoBB6uMYz/MM%20E-AIAV%20FAQ%20EN.pdf), in its FAQ updated on 18 May 2026, confirms that the CRS changes apply from 1 January 2026 and that CARF applies “at the earliest from 1 January 2027”. Neither source mentions a TIN validation rule. See our articles on the [United Kingdom’s CRS 2.0](https://taxdo.com/resources/blog/post/crs-2-0-uk-financial-institutions-global-tax-transparency) and [CARF rules](https://taxdo.com/resources/blog/post/uk-carf-crs-2-0-day1-compliance-the-corporate-criminal-offence-cco-risk), [Switzerland](https://taxdo.com/resources/blog/post/switzerland-crs-2-0-compliance-guide) and [Germany](https://taxdo.com/resources/blog/post/germany-crs2-dac8-compliance). ### **Africa** From 1 March 2026, South Africa applies the amended CRS and CARF. The [South African Revenue Service](https://www.sars.gov.za/legal-pub-faqs-tadm02-sars-faqs-on-common-reporting-standard) confirms that the effective date, “as reflected in the final regulations, is 1 March 2026”, under regulations published in November 2025\. For CARF, users onboarded from that date need a valid self-certification when the relationship begins. For the CRS, check the reference dates in the regulations themselves: under the OECD amendments as written into EU law, the new date applies only to accounts that are Financial Accounts solely because of the amendments, such as certain e-money products. More in our [South Africa CRS 2.0](https://taxdo.com/resources/blog/post/crs-2-0-south-africa-cross-border-transparency-2026-2027) and [CARF](https://taxdo.com/resources/blog/post/carf-south-africa-crypto-asset-reporting-2026-2027) articles. ### **Asia-Pacific** Japan applies the amended CRS, in principle, from 1 January 2026, according to the [National Tax Agency (Kokuzeichō)](https://www.nta.go.jp/taxes/shiraberu/kokusai/crs/pdf/0025006-044-03.pdf). The new-account declaration now extends to certain electronic payment instruments and existing digital money. For transactions entered into before 2026 whose holders’ residence had not already been identified, the residence must be identified by 31 December 2027, or by 31 December 2026 for accounts above JPY 100 million. In New Zealand, [Inland Revenue (Te Tari Taake)](https://www.ird.govt.nz/international-tax/exchange-of-information/crypto-asset-reporting-framework/crypto-asset-reporting-framework-overview) states that from 1 April 2026 New Zealand crypto-asset service providers must collect and report under CARF, with the first report for the year to 31 March 2027 due by 30 June 2027\. Australia’s CARF exchanges begin in 2028 on the OECD list. See our [Japan CRS 2.0](https://taxdo.com/resources/blog/post/japan-crs-2-0-tax-transparency-for-financial-institutions) and [CARF](https://taxdo.com/resources/blog/post/crypto-tax-transparency-japan-carf-compliance) articles. ### **Americas (offshore and onshore)** The [Cayman Islands government](https://gov.ky/w/regulations-now-published-on-carf-and-crs) announced that “both the CARF and amended CRS frameworks will be implemented in 2026”, under regulations gazetted on 27 November 2025, with first reports on 2026 information in 2027\. Canada appears on the [OECD’s CARF commitments list](https://www.oecd.org/content/dam/oecd/en/networks/global-forum-tax-transparency/commitments-carf.pdf) with first exchanges in 2028\. Its domestic CRS start date could not be confirmed at a Canadian source; check it with the Canada Revenue Agency. The United States, which exchanges under [FATCA](https://taxdo.com/services/regulatory-compliance/fatca) rather than the CRS, is listed for CARF exchanges in 2029\. More in our [Cayman Islands](https://taxdo.com/resources/blog/post/cayman-islands-carf-crs-2-0-compliance-guide-2026), [Canada CRS 2.0](https://taxdo.com/resources/blog/post/canada-crs-2-0-implementation-2026) and [Canada CARF](https://taxdo.com/resources/blog/post/carf-canada-crypto-asset-reporting-2026) articles. | **Jurisdiction** | **Amended CRS** | **CARF or DAC8 crypto rules** | **Confirmed at** | | --------------------- | ----------------------------------------------- | ------------------------------------------------------------------ | -------------------------- | | EU (27 Member States) | 1 January 2026 | 1 January 2026; pre-existing users by 1 January 2027 | DAC8, Art. 2 and Annex VI | | United Kingdom | 1 January 2026 | 1 January 2026; first report by 31 May 2027 | HMRC, HM Treasury | | Switzerland | 1 January 2026 | 2027 at the earliest | Federal Council, SIF | | South Africa | 1 March 2026 | 1 March 2026 | SARS | | Japan | 1 January 2026 | First exchanges 2027 (OECD) | National Tax Agency, OECD | | New Zealand | 1 April 2026 | 1 April 2026; first report by 30 June 2027 | Inland Revenue | | Cayman Islands | 2026 | 2026; first reports 2027 | Cayman Islands Government | | Canada | Proposed from 2027 (Bill C-31, not yet enacted) | Proposed from 2027 (Bill C-31); OECD lists first exchanges by 2028 | Parliament of Canada; OECD | ## **07 · What the Day 1 Standard Means by Institution Type** ### **Banks and custodial institutions** For a bank the change is less about the form than about the evidence. CRS 2.0 adds a report that states whether a valid self-certification was obtained, names the role of each controlling person and flags joint and new accounts. Those fields cannot be completed accurately from a process that accepts the form first and reviews it later. Our [CRS 2.0 guide for financial institutions](https://taxdo.com/resources/blog/post/crs-2-0-compliance-guide-banks) covers the rest of the amended standard. ### **Crypto-asset service providers** For an exchange, broker or wallet provider, the self-certification decides how long a user can keep trading. The CARF Commentary expects a provider whose reasonableness test fails to obtain a valid self-certification or a reasonable explanation “before providing services effectuating Relevant Transactions”. DAC8 adds a hard stop for users who do not provide the required information: after two reminders, and not before 60 days, they must be blocked from reportable transactions. The detail is in our [CARF guide](https://taxdo.com/resources/blog/post/carf-crs2-crypto-tax-transparency-guide) and [DAC8 guide](https://taxdo.com/resources/blog/post/eu-dac8-compliance-crs-2-0-carf-crypto-reporting-2026). ### **E-money institutions, payment providers and neobanks** For an e-money issuer the question is first whether the account is in scope at all. An e-money account is excluded only if its rolling 90-day average end-of-day balance did not exceed USD 10,000 at any point in the calendar year, which means the test runs continuously and an account can cross into scope mid-year. A provider that waits until an account crosses the threshold before asking for a self-certification will be asking customers who are already active. Our [fintech and neobank solutions page](https://taxdo.com/solutions/fintechs-neo-banks) describes how the product handles this segment. ## **08 · Two Ways to Meet the Day 1 Requirement: By Hand, or Automated at Onboarding** ### **By hand, collect first and check later** Typically, the onboarding flow presents a self-certification form, and a compliance team reviews the submissions in batches against the KYC file. Follow-up requests go out where something does not match. TINs are checked for format, and a remediation campaign before the reporting deadline chases the accounts still incomplete. For a small book with few cross-border customers, it works. Its weakness is timing. Every inconsistency is found after the account is in use, when fixing it needs the cooperation of a customer who already has what they came for. Each unresolved case ends in a report filed with gaps or a restriction on a live account. ### **At onboarding, from Day 1** TaxDo runs self-certification and tax due diligence inside onboarding, from the first declaration to regulatory reporting, on one platform. It works in five steps, in this order, because each one needs the one before it. **Step 1 · Collect the self-certification.** Guided and jurisdiction-aware, one question at a time, for individuals and entities, with a digital signature. Where the entity is passive, its controlling persons and their roles are collected in the same flow. **Step 2 · Validate the identity.** Every TIN is checked in real time against official sources in 130+ countries, and the business against [registries in 120+](https://taxdo.com/services/tax-identity/business-registry). **Step 3 · Run the due diligence.** Indicia are detected across everything held on the customer, and the self-certification is tested for reasonableness against it, including the residence-by-investment questions, entity classification and the new CRS 2.0 account flags, for both CRS and CARF from one data layer. **Step 4 · Cure the gaps, without the compliance team:** **4a · New customers.** Discrepancies are resolved in the same session, while the customer is still onboarding, instead of landing in a queue for your team. **4b · Existing customers.** The book is scanned and prioritised, missing self-certifications and TINs are remediated, and the reminders and deadlines are tracked to the end. **Step 5 · Report, and keep the evidence.** Schema-validated CRS and CARF reports for each jurisdiction from one data layer, and an immutable clearance record for every account holder and user. **From Day-1 self-certification to regulatory reporting, with zero remediation.** Every customer is cleared when the account opens, so nothing is left for year-end. [**Our CRS 2.0 compliance software**](https://taxdo.com/services/regulatory-compliance/crs) · [**Solutions for financial institutions**](https://taxdo.com/solutions/financial-institutions) · [**Solutions for crypto exchanges and CASPs**](https://taxdo.com/solutions/crypto-exchanges-casps) ### **Where this sits, and what it does not touch** Your KYC provider keeps verifying identity and your core platform keeps holding the account. KYC answers who the customer is; tax due diligence answers where they are resident for tax. This runs at onboarding beside KYC, not in place of it, and covers [CARF](https://taxdo.com/services/regulatory-compliance/carf) and [DAC8](https://taxdo.com/services/regulatory-compliance/dac8) alongside the CRS on the same [regulatory compliance engine](https://taxdo.com/services/regulatory-compliance). The reporting obligation, and the responsibility for what is reported, stays with your institution. TaxDo runs the due diligence and prepares and validates the report. **At sign-up, a missing residence is one more question. After the account is in use, it is a letter, a reminder, a deadline and possibly a block.** ## **09 · Recent Changes and What Comes Next** ### **24 October 2023** DAC8 published in the Official Journal of the European Union. ### **1 January 2026** The amended CRS applies in the EU, the UK, Switzerland and Japan; DAC8 and the UK’s CARF rules apply to crypto-asset service providers. ### **1 March and 1 April 2026** South Africa applies the amended CRS and CARF; New Zealand applies CARF. ### **1 January 2027** Deadline for self-certifications from pre-existing crypto-asset users in the EU; Switzerland’s earliest CARF start date. ## **10 · Related Reading** **Framework articles:** [CRS 2.0 compliance for financial institutions](https://taxdo.com/resources/blog/post/crs-2-0-compliance-guide-banks) · [CARF, the Crypto-Asset Reporting Framework](https://taxdo.com/resources/blog/post/carf-crs2-crypto-tax-transparency-guide) · [DAC8 compliance](https://taxdo.com/resources/blog/post/eu-dac8-compliance-crs-2-0-carf-crypto-reporting-2026) **Product:** [Regulatory compliance engine](https://taxdo.com/services/regulatory-compliance) · [Day 1 onboarding validation](https://taxdo.com/resources/blog/post/crs-2-0-carf-compliance-day-1-onboarding-validation) · [CRS 2.0 compliance software](https://taxdo.com/services/regulatory-compliance/crs) · [CARF compliance software](https://taxdo.com/services/regulatory-compliance/carf) · [DAC8 compliance software](https://taxdo.com/services/regulatory-compliance/dac8) · [TIN lookup](https://taxdo.com/services/tax-identity/tin-lookup) ## Frequently asked questions ### What is a CRS self-certification? It is the account holder’s own statement of every jurisdiction where they are resident for tax purposes, with the TIN issued by each, which the financial institution collects at account opening. The CRS rule describes it as a self-certification “that allows the Reporting Financial Institution to determine the Account Holder’s residence(s) for tax purposes”. For an individual with a reportable residence it must also give the date of birth. It is valid only if signed or otherwise positively affirmed and dated, and the institution must confirm that it is reasonable against what it learned when the account was opened. ### What is the purpose of self-certification? To establish where the customer is resident for tax, and so which tax authorities will receive the account’s information through automatic exchange. Without it the institution cannot classify the account at opening, and under the amended CRS the report itself must show whether a valid self-certification was provided. ### What is required for effective CARF self-certification during customer onboarding? Four things, best settled before the user transacts. The user declares every tax residence with a TIN for each, and gives a name, address and date of birth. The declaration is signed or otherwise positively affirmed, and dated. Finally, it passes a reasonableness check against the information collected for customer due diligence. The CARF Commentary expects a failed check to be cured, by a new self-certification or a reasonable explanation, before services are provided. Effective onboarding asks the tax questions in the same flow as identity verification, while the customer is still present. ### How does CRS 2.0 align with frameworks like CARF and DAC8? They were designed together. The OECD approved the CRS amendments and CARF as one package, and the self-certification fields largely match. DAC8 is the EU vehicle for both: it writes the CRS amendments into Annex I for financial institutions and CARF into Annex VI for crypto-asset service providers. An institution offering both fiat or e-money accounts and crypto-assets can collect one self-certification and use it for both reports, which it files separately. The main difference is enforcement, where DAC8 adds mandatory blocking for crypto-asset users. Our CARF guide covers the crypto side. ### How can firms ensure accurate CARF self-certification during onboarding? By testing the declaration against the firm’s own data before accepting it. Accuracy fails in predictable ways. A declared residence contradicts the address on file. A TIN is missing for a jurisdiction that issues TINs to all residents, or is well formed but belongs to someone else. Residence is claimed under a high-risk investment scheme. Firms that check each of these during onboarding, while the user is present, ensure accuracy at the source. ### What are CRS 2.0 self-certification requirements for TIN, tax residency and address verification for information reporting compliance? The self-certification must state every jurisdiction of tax residency and the TIN issued by each, and its reasonableness must be confirmed against the information obtained at account opening, including the residence address verified for AML/KYC purposes. The CRS does not require TINs to be checked against official sources, but a missing TIN from a jurisdiction that issues them to all residents gives the institution reason to know the declaration is unreliable. A declared residence that conflicts with the verified address must be resolved before the self-certification is relied on. ### What tax information must financial institutions collect for CRS 2.0 self-certification compliance? For individuals: name, address, every tax residence with its TIN, and date of birth. For entities: the entity’s residence and TIN, its classification, and, for a passive entity, its controlling persons with their residence and TIN, together with the role the report must show. Financial institutions must also be able to report whether a valid self-certification was obtained, whether the account is joint and how many holders it has, and whether it is new or pre-existing. ### What are best practices for maintaining audit-ready tax compliance under CRS 2.0? Create the evidence as the work happens and keep it for the period the law requires, which under the EU text of the CRS is at least five years. An audit-ready file for each account shows the self-certification and how it was affirmed, and the reasonableness check with the data it used. It records any indicia and how they were cured, the TIN and how it was checked, any change in circumstances and the response, and the reporting history. ### How can firms prepare onboarding workflows to support CRS 2.0 compliance for digital asset users? Put the self-certification inside sign-up and route each product to the right framework. Digital asset users may be reportable under CARF for crypto-assets and under CRS 2.0 for e-money, central bank digital currencies or crypto exposure held through financial assets. A workflow prepared for both collects one declaration with every residence and TIN and tests it against customer due diligence data. It classifies entity customers and their controlling persons, and records which products each customer holds, so that both reports come from the same record. ### How can automation enable audit-ready tax compliance under CARF? By recording each step as it happens. A provider must be able to show that it requested the self-certification and tested its reasonableness, and, under DAC8, that it sent the reminders and blocked the user where the rules required it. DAC8 requires records of the steps undertaken and the information relied on to be kept for at least five and at most ten years. Automation inside the onboarding and account systems writes that evidence as each step happens, so nobody has to assemble it later. ## References - [OECD, International Standards for Automatic Exchange of Information in Tax Matters](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report.html): 8 June 2023 - [OECD, Amendments to the CRS: Rules](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report/component-12.html): new data points - [OECD, Amendments to the CRS: Commentary](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report/component-13.html): TIN paragraph 4bis and reason to know - [OECD, Standard for Automatic Exchange of Financial Account Information, second edition](https://www.oecd.org/content/dam/oecd/en/publications/reports/2017/03/standard-for-automatic-exchange-of-financial-account-information-in-tax-matters-second-edition%5Fg1g73eb6/9789264267992-en.pdf): self-certification form - [OECD Global Forum, jurisdictions committed to implement CARF](https://www.oecd.org/content/dam/oecd/en/networks/global-forum-tax-transparency/commitments-carf.pdf): as at 14 September 2026 - [Council Directive (EU) 2023/2226 (DAC8), Official Journal text](https://publications.europa.eu/resource/celex/32023L2226): Annexes I and VI - [Council Directive 2014/107/EU (DAC2)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014L0107): CRS rules in EU law - [European Commission, TIN on the Web](https://taxation-customs.ec.europa.eu/online-services/online-services-and-databases-taxation/taxpayer-identification-number-tin%5Fen): public TIN check service - [HMRC and HM Treasury, regulations to update the UK’s AEOI agreements](https://www.gov.uk/government/publications/regulations-to-update-the-uks-automatic-exchange-of-information-agreements/tax-administration-regulations-to-update-the-uks-automatic-exchange-of-information-agreements): 1 January 2026 start - [The International Tax Compliance (Amendment) Regulations 2025 (SI 2025/740)](https://www.legislation.gov.uk/uksi/2025/740/made): UK CRS penalties - [SI 2025/744](https://www.legislation.gov.uk/uksi/2025/744/made): UK CARF regulations and penalties - [HMRC, Reporting cryptoasset user and transaction data](https://www.gov.uk/guidance/reporting-cryptoasset-user-and-transaction-data): first UK CARF report by 31 May 2027 - [Swiss Federal Council, press release of 26 November 2025](https://www.admin.ch/en/newnsb/oAaJyRFS1lqJ7PN3sLJTP): CRS and CARF dates - [State Secretariat for International Finance, AEOI FAQ](https://www.sif.admin.ch/dam/en/sd-web/3DLzoBB6uMYz/MM%20E-AIAV%20FAQ%20EN.pdf): updated 18 May 2026 - [South African Revenue Service, FAQs on the Common Reporting Standard](https://www.sars.gov.za/legal-pub-faqs-tadm02-sars-faqs-on-common-reporting-standard): effective date 1 March 2026 - [National Tax Agency of Japan, CRS reporting system](https://www.nta.go.jp/taxes/shiraberu/kokusai/crs/pdf/0025006-044-03.pdf): amended CRS from 1 January 2026 - [Inland Revenue New Zealand, CARF overview](https://www.ird.govt.nz/international-tax/exchange-of-information/crypto-asset-reporting-framework/crypto-asset-reporting-framework-overview): obligations from 1 April 2026 - [Cayman Islands Government, regulations published on CARF and CRS](https://gov.ky/w/regulations-now-published-on-carf-and-crs): 28 November 2025 - [Australian Taxation Office, obtaining valid self-certifications for all new accounts](https://www.ato.gov.au/about-ato/international-tax-agreements/in-detail/obtaining-valid-self-certifications-for-all-new-accounts): day one guidance _This article is general information on self-certification under the OECD Common Reporting Standard as amended in 2023, the Crypto-Asset Reporting Framework and Council Directive (EU) 2023/2226 (DAC8), verified against the official sources listed on 12 October 2026\. National implementation differs and continues to change; confirm the rules in each jurisdiction where you report with its tax authority (HMRC, the Bundeszentralamt für Steuern (Federal Central Tax Office), SARS or their equivalent) or a qualified tax adviser._ --- ![Ali Baniasadi](https://wp.taxdo.com/wp-content/uploads/2026/09/Ali-Baniasadi.jpg) Ali Baniasadi [ LinkedIn ](https://www.linkedin.com/in/baniasadi/)