Get in touch
Sources last verified: 28 October 2026
Official sources cited at the end of this page.
Finland applies the OECD’s Crypto-Asset Reporting Framework through Act 1041/2025, in force since 1 January 2026, and through DAC8, the EU directive that carries it. A crypto-asset service provider reporting to Finland must complete each user’s self-certification before it carries out any reportable transaction for that user, and file an annual return with the Finnish Tax Administration (Verohallinto) by the end of January, the first time for 2026.
Section 41 of the Act makes due diligence a condition of trading, so a self-certification collected after the first exchange is already late. For users onboarded before 2026, the deadline is 1 January 2027, and a user who still has not answered after two reminders and sixty days from the first request must be blocked from reportable transactions (s. 42).
The failure lands twice: the January 2027 return goes in with gaps, and every blocked user is a customer who cannot trade.
There are two ways to meet the Finnish rules. One chases users by email and reminder in the weeks before each deadline. The other completes and tests the self-certification inside onboarding, so the Act’s order of events is built into the flow. Only the second meets section 41 for new users by design.
01 · Finland CARF at a Glance
| Point | Position as at 28 October 2026 |
| Legal basis | Act 1041/2025 on the reporting obligation of reporting crypto-asset service providers; the duty itself in s. 17 g of the Act on Assessment Procedure (VML, 1558/1995), added by Act 1043/2025 |
| Authority | Verohallinto (Finnish Tax Administration); authorisation by Finanssivalvonta (FIN-FSA) |
| Who reports | Providers authorised by FIN-FSA under MiCA or notified to it, and others resident, incorporated, managed or with a regular place of business in Finland (s. 2) |
| Due diligence from | 1 January 2026, completed before any reportable transaction (ss. 41, 53) |
| Pre-existing users | Self-certification by 1 January 2027 from users onboarded by 31 December 2025 (s. 54) |
| Return | Each calendar year by the end of January, nil returns included (s. 46); first return by 1 February 2027 |
| Format | XML through Ilmoitin.fi |
| Finnish extra data | Information to calculate Finnish-resident individuals’ gains and losses (s. 48) |
| Blocking | After two reminders and 60 days from the original request (s. 42) |
| Penalties | Laiminlyöntimaksu up to EUR 2,000, EUR 5,000 or EUR 15,000 (VML s. 22 a) |
| Records | At least six years from the end of the calendar year concerned (s. 52) |
| First exchange | By September 2027 |
Our regulatory compliance engine completes Finnish CARF due diligence before the first trade. It collects and tests each user’s self-certification, runs the TIN and reasonableness checks, resolves indicia automatically instead of by your compliance team, and prepares the validated return, with zero remediation.
02 · Scope of CARF in Finland
The Act reaches a reporting crypto-asset service provider in two ways (Act 1041/2025, s. 2). The first is regulatory: an entity authorised by FIN-FSA under Article 63 of the Markets in Crypto-Assets Regulation (MiCA, Regulation (EU) 2023/1114), or one entitled to provide crypto-asset services after notifying FIN-FSA under Article 60. The second is a Finnish link for a provider without either: tax residence in Finland, incorporation or organisation under Finnish law with legal personality or a tax-filing duty here, management from Finland, or a regular place of business here. Transactions carried out through a Finnish branch are reported in Finland in either case.
| Question | Answer under Act 1041/2025 |
| Is staking or lending covered? | Yes. A crypto-asset service is a MiCA service plus staking and lending (s. 9). |
| Which assets are reportable? | Crypto-assets other than central bank digital currencies, e-money and assets the provider has properly determined cannot be used for payment or investment (s. 8). |
| Does a payment to a merchant count? | A transfer for goods or services worth over USD 50,000 is a reportable retail payment; the merchant’s customer is a user only where the AML Act (444/2017), or a foreign equivalent, requires the provider to verify that customer (ss. 15, 17). |
| Already reporting elsewhere? | A provider in scope only through a Finnish link that meets equivalent duties in another qualified jurisdiction can be relieved, in one route by notifying Verohallinto by the end of January (ss. 3, 50). |
| Not MiCA-authorised? | A crypto-asset operator with a Finnish link registers with Verohallinto before the end of the calendar year, unless it meets the duties in another Member State, in which case it must not (s. 51). |
The crypto licence behind the duty
Tax reporting follows authorisation, and the two are separate. Finland’s national transition period for virtual currency providers ended on 30 June 2025, and FIN-FSA has stated that from 1 July 2026 crypto-asset services may not be provided without authorisation anywhere in the EU or the European Economic Area, reverse solicitation aside. A provider authorised by FIN-FSA reports here. One authorised in another Member State reports in Finland only for transactions through a Finnish branch, or where it has a Finnish link and no relief applies (ss. 2, 3).
03 · Operational Compliance Workflow
Identify the user before the first trade
For an individual or an entity, the provider obtains a self-certification when the relationship is established and confirms its reasonableness against what it already holds, including documents collected under anti-money-laundering rules (ss. 38 and 39). An individual’s self-certification is valid only if signed or otherwise confirmed, dated no later than receipt, and gives full name, residence address, every jurisdiction of residence, the TIN for each, and date of birth (s. 44). A TIN can be left out only where the residence jurisdiction issues none or does not require it to be collected.
Look through the entity
An entity user is presumed reportable unless the self-certification, or information the provider holds or that is publicly available, reliably shows it is a non-reportable person (s. 39). Controlling persons are identified only for an entity that is neither a non-reportable person nor an active entity, and active status must rest on the entity’s own self-certification (s. 40). For controlling persons it may rely on beneficial-ownership data from its AML procedures.
Remind, then block
A user who does not supply the information is reminded. Once two reminders have gone unanswered and sixty days have passed since the original request, the provider must prevent that user from carrying out reportable transactions until the information arrives (s. 42). The sixty days run from the original request, so a request sent late in 2026 cannot reach the block before 1 January 2027.
Keep it current
A change in circumstances that gives the provider reason to know the self-certification is wrong ends its use. The provider may keep the earlier treatment for up to 90 calendar days while it obtains a new one. After that, the user is treated as resident both where the original form said and where the change points (s. 43).
04 · Three Provider Situations
A Tampere crypto exchange with a pre-2026 book
Take a fictional crypto exchange in Tampere, authorised by FIN-FSA, with 18,000 users onboarded before 2026, of whom 2,400 have no valid self-certification. Each needs one by 1 January 2027 (s. 54). Requests sent on 1 November 2026 reach sixty days on 31 December, so a provider that wants the option of blocking non-responders by the deadline needs both reminders out within that window.
A crypto-asset operator managed from Helsinki but not authorised under MiCA still reports in Finland. It registers with Verohallinto before the end of the reporting year, naming the Member States and non-EU qualified jurisdictions concerned, and keeps the registration current. If it fails its reporting duties and does not correct them after two warnings, the registration is revoked 30 to 90 days after the second (s. 51).
The technical view: what the return holds
Per user and per crypto-asset type, the return gives the gross amounts paid and received against fiat currency, the fair market value of crypto-to-crypto acquisitions and disposals, retail payments, and transfers in and out, each with the number of units and transactions (s. 47). Fiat amounts are stated net of transaction costs in the currency paid or received, converted consistently to one currency where several were used; fair market values are given in one fiat currency, and the currency is always stated. Verohallinto takes the file as XML through Ilmoitin.fi (Verohallinto form description); with partners outside the EU, authorities exchange it in the OECD’s CARF XML schema.
05 · Deadlines, Records and Penalties
The return is due each year by the end of the January after the calendar year, and a provider with nothing to report files a nil return (s. 46). For 2026 the date falls on Sunday 31 January 2027, so Verohallinto expects the return by 1 February 2027 and will not accept it before 1 January 2027. Records of every step and every piece of information used are kept for at least six years from the end of the calendar year they relate to, and for six years after the year a customer relationship ends (s. 52).
Sanctions run through the general information-return regime. A minor error left uncorrected after a proven reminder, a return filed late without good reason, or one filed by the wrong method can draw a laiminlyöntimaksu (negligence penalty) of up to EUR 2,000. A substantially deficient return, or one filed only after a proven reminder, may draw up to EUR 5,000; no return at all, a substantially false one given intentionally or with gross negligence, or a breach of that kind of another duty in the chapter, due diligence included, up to EUR 15,000 (VML s. 22 a). The amount reflects how much data was involved and is set in full hundreds of euros. Section 28 a makes anyone who designs, markets, organises or carries out an arrangement one of whose main purposes is to avoid these duties subject to them, as if the proper form had been used.
06 · Tax Implications for Crypto Users
Finland asks for more than the CARF. Besides the CARF data, a provider must give Verohallinto the information needed to calculate the gains, losses and other income of individual users resident in Finland, from sales, other disposals and income events, so far as the provider holds it (s. 48; VML s. 17 g). Verohallinto collects it on a separate annual return on disposals of crypto-assets and crypto income (FICARF).
The user’s own position does not change. Verohallinto’s guidance says owners must still check the pre-completed tax return and report gains, losses and other crypto income themselves. Where the provider holds acquisition data for Finnish-resident individuals, it reports that as well as the CARF’s annual totals.
07 · Two Ways to Meet Finland’s Crypto-Asset Rules
By request and reminder
A provider can collect self-certifications by email, log two reminders and block whoever has not answered once sixty days have passed. The cost is timing: a user onboarded without a completed self-certification breaches section 41 from the first trade, and every dormant user becomes a block.
Inside onboarding, step by step
TaxDo runs CARF and DAC8 due diligence inside onboarding, from the first user self-certification to the validated return, in five steps.
Step 1 · Collect the self-certification. Guided, one question at a time, for individuals and entities, with a digital signature; a passive entity’s controlling persons are collected in the same flow.
Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.
Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine runs 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, testing each self-certification against what the provider holds and classifying each transaction by reportable type.
Step 4 · Cure the gaps, without the compliance team:
4a · New users. Discrepancies are resolved in the same session, before the first reportable transaction.
4b · Existing users. One click starts remediation for the whole pre-2026 cohort through a link in your own brand, and each case closes with an eIDAS-compliant signed self-certification and an audit-ready certificate. Every answer is checked by Verify+, and both reminders and the 60-day clock run and are logged automatically.
Step 5 · Report, and keep the evidence. Schema-validated CARF XML from one data layer, prepared and validated for your platform to submit. Our team can also submit it on your behalf on request, as an additional service. Every user keeps an immutable clearance record.
From Day-1 self-certification to CARF reporting, with zero remediation. Every user is cleared at onboarding.
Our CARF compliance software · Crypto exchanges and CASPs
Where this sits, and what it does not touch
It runs beside the KYC process the AML Act already requires, not in place of it, and the Finnish gains data under section 48 still comes from the provider’s own ledger. The reporting obligation, and the responsibility for what is reported, stays with the provider, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.
08 · Recent Changes and What’s Next
8 June 2023
The OECD releases the CARF with its Commentary.
28 November 2025
Act 1041/2025 and the VML amendments (Act 1043/2025) are given; published on 1 December 2025.
1 January 2026
The Act applies; due diligence and reportable transactions run from this date.
4 June 2026
The government bill for a new anti-money-laundering act, HE 105/2026, is given to Parliament; its proposal 26 would amend sections 17, 23, 30 and 40 of Act 1041/2025 to point to the new AML rules. It was in committee on 28 October 2026 and is not yet law.
1 July 2026
No crypto-asset services without MiCA authorisation anywhere in the EU or EEA.
1 January 2027
Self-certifications due from pre-2026 users.
1 February 2027
First annual return, for 2026, together with the FICARF return.
By September 2027
Finland’s first exchange of CARF data with partner jurisdictions; Finland is among the jurisdictions committed to first exchanges in 2027 on the OECD list of 14 September 2026. DAC8 has applied across the EU since 1 January 2026, so a provider within its scope reports its EU-resident users under it; see our DAC8 compliance software for the EU-wide view.
09 · Related Reading
Framework articles: CARF and crypto tax transparency · DAC8 under CRS 2.0 and CARF · Self-certification under CRS 2.0, DAC8 and CARF · Finland’s CRS 2.0 rules · France CARF · UK CARF and CRS 2.0 · Austria’s crypto-asset reporting
Product: Regulatory compliance engine · Day 1 onboarding validation
