When does CARF apply in the UAE?

The Ministry of Finance’s readiness circular targets 1 January 2027 for due diligence, 31 December 2027 for existing users’ self-certifications, 30 June 2028 for the first report and 1 September 2028 for the first exchange. The Cabinet Decision that will make those dates law had not been published by 28 October 2026.

How does CRS 2.0 align with frameworks like CARF and DAC8?

They divide the field. The amended CRS covers financial accounts, now including e-money, central bank digital currency and indirect crypto exposure; the CARF covers crypto-assets traded or transferred through service providers; DAC8 is the EU’s version of both. In the UAE, the amended CRS and the CARF are both timed for 2027.

How does CARF vs DAC8 impact firms operating across both OECD and EU jurisdictions?

A group with a UAE provider and an EU establishment can face DAC8 from 2026 for its EU business and the UAE rules from their targeted start on 1 January 2027. DAC8 also requires a reporting crypto-asset service provider to block reportable transactions by a user who has not provided the required information after two reminders and at least 60 days (Annex VI, Section V(A)(2)); the OECD model leaves this to each jurisdiction. Whether the UAE will adopt it is not yet known.

How can firms prepare onboarding workflows to support CRS 2.0 compliance for digital asset users?

By collecting one self-certification at sign-up that meets both the CRS and the CARF requirements: every jurisdiction of residence, a TIN for each reportable one, date of birth, and for entities their controlling persons, checked for reasonableness against the KYC file.

How can firms ensure data accuracy and validation in CARF reporting workflows?

By checking each TIN against its jurisdiction’s format and official sources where available, testing declared residence against the KYC address and documents, valuing every transaction in fiat at the time it happens, and keeping the evidence for at least five years after the reporting deadline, as the model rules require.

What software helps crypto-asset service providers comply with CARF reporting, including self-certification collection and XML filing?

Look for one that completes the self-certification before the first trade, validates TINs against official sources, records the reasonableness check, aggregates by user and crypto-asset, and outputs the OECD CARF XML schema. Our CARF compliance software can be tested on each point.

UAE CARF: Due Diligence From 2027, First Report in June 2028

Sources last verified: 28 October 2026

Official sources cited at the end of this page.

The UAE’s crypto reporting will run on the OECD’s Crypto-Asset Reporting Framework and the multilateral agreement that carries it, which the UAE signed on 21 July 2025 and ratified by Federal Decree No. 60 of 2026 on 4 May 2026. The Ministry of Finance’s CARF readiness circular, published in October 2026, sets the target: due diligence from 1 January 2027, existing users self-certified by 31 December 2027, and the first annual report, or a nil return, by 30 June 2028.

What has not been published is the domestic rulebook. The circular refers to a Cabinet Decision and Ministerial Decisions targeted to take effect on 1 January 2027; as at 28 October 2026 neither had been published. The Ministry’s CARF page, updated 27 October 2026, says the implementing instrument has been enacted with effect from 1 January 2027 but names none; no Cabinet Decision or Ministerial Decision on the CARF appears on the UAE legislation portal, and the circular still gives 1 January 2027 as a target. The dates below are therefore the Ministry’s targets, and the rules are the OECD standard, not yet published UAE law.

The CRS moves on the same clock. The Ministry announced on 8 November 2025 that the amended CRS takes effect on 1 January 2027, with first exchanges in 2028, timed to match the CARF.

There are two ways to prepare for the UAE rules. One waits for the Cabinet Decision and then documents an existing customer base by the end of 2027. The other builds a CARF-grade self-certification into onboarding now, so the users who join before 2027 are already documented. Only the second avoids a 2027 remediation project.

01 · UAE CARF at a Glance

Point	Position as at 28 October 2026
Status	Agreement ratified; domestic Cabinet Decision and Ministerial Decisions targeted for 1 January 2027, not yet published
Agreement	CARF multilateral competent authority agreement signed 21 July 2025; Cabinet approval 29 March 2026; ratified by Federal Decree No. 60 of 2026, 4 May 2026
Due diligence from	1 January 2027 (target, readiness circular)
Existing users	Self-certification by 31 December 2027 (target)
Registration	Through the Ministry’s Reporting System in 2027; deadline to be confirmed
First report	2027 period: annual CARF report or nil return by 30 June 2028 (target)
First exchange	1 September 2028 (readiness circular); by 2028 on the Global Forum list
Who would report	Crypto-asset service providers with a UAE nexus: tax residence; incorporation or organisation under UAE law with legal personality or UAE tax reporting duties; management; a regular place of business; or a UAE branch
Amended CRS	Announced effective 1 January 2027 (Ministry, 8 November 2025), amending rules not yet published; first exchange 2028; Addendum to the CRS agreement signed 11 August 2025
Penalties	No CARF schedule yet; the CRS penalties sit in Cabinet Resolution No. 93 of 2021

Our regulatory compliance engine builds the CARF due diligence record as each UAE user signs up, before the rules require it. It collects and checks the self-certification, runs the TIN, reasonableness and other required due diligence checks, resolves discrepancies automatically instead of by your compliance team, and prepares the validated report, with zero remediation.

02 · Understanding CARF

The OECD approved the CARF and the CRS amendments over 2022 and 2023 and published them together on 8 June 2023. The CARF obliges reporting crypto-asset service providers to collect a self-certification from each user and report, once a year, aggregated figures per user and per crypto-asset: acquisitions and disposals against fiat currency and against other crypto-assets, retail payments above USD 50,000, other transfers by type, and transfers to wallets not known to belong to a virtual asset service provider or financial institution.

Relevant crypto-assets exclude central bank digital currencies, specified electronic money products and crypto-assets the provider has adequately determined cannot be used for payment or investment. Specified electronic money products and central bank digital currencies, and indirect exposure through derivatives and investment vehicles, belong to the amended CRS instead; a crypto-asset that cannot be used for payment or investment is outside both.

03 · Entities and Individuals Exposed to CARF

The Ministry’s overview follows the OECD definition. A reporting crypto-asset service provider is an individual or entity that, as a business, effectuates exchange transactions for customers, as a counterparty, an intermediary or by making a trading platform available. It reports in the UAE if it is tax resident there, incorporated or organised there with legal personality or a tax filing duty, managed from the UAE, has a regular place of business there, or effectuates transactions through a UAE branch.

Users are not reporters. A user’s exposure comes through the provider: the self-certification it gives, and the information the provider reports to the Ministry for exchange with the user’s jurisdictions of residence. A user resident only in the UAE is not reportable to a partner jurisdiction under the model rules.

04 · UAE’s Regulatory Approach to CARF

The Ministry of Finance runs the exchange. On 15 September 2025 it opened an eight-week public consultation, which closed on 8 November 2025, aimed at advisory service providers, intermediaries, traders, custodians, exchange platforms and others active in the crypto-asset sector. Its overview describes the licensing map the reporting rules will sit on: the Securities and Commodities Authority is the primary federal regulator of virtual assets across the UAE, including the free zones, except activities within the remit of other authorities, such as the Central Bank or the Virtual Assets Regulatory Authority, and the two financial free zones, the Abu Dhabi Global Market (ADGM) and the Dubai International Financial Centre (DIFC), which regulate them within their own boundaries; the Virtual Assets Regulatory Authority regulates virtual asset activity in Dubai outside the DIFC; and the Central Bank regulates virtual assets used as a means of payment.

Neither the overview nor the readiness circular says how the CARF duties will be allocated across those regimes, and the live version of this page stated a penalty of up to AED 1 million that no official source contains. The penalties the overview cites are those of Cabinet Resolution No. 93 of 2021 for the CRS, among them AED 20,000 for a self-certification the person should have known to be incorrect, AED 50,000 for a report not submitted on time and in the required form, and AED 250,000 for a breach intended to circumvent the rules. Whether the CARF instrument adopts the same schedule is still to be seen.

05 · UAE’s Position on CRS 2.0 Versus CARF

The two regimes start together by design. The Ministry’s announcement of 8 November 2025 says the amended CRS will take effect on 1 January 2027, with first exchanges in 2028, building on Federal Decree No. 48 of 2018 and Cabinet Resolution No. 93 of 2021. The UAE signed the Addendum to the CRS agreement on 11 August 2025.

Under the amended CRS, specified electronic money products and central bank digital currency held for customers come into scope, and a financial institution that is also a crypto-asset service provider need not report the same gross proceeds twice. Under the CARF model rules, a provider that is also a CRS financial institution may rely on the new-account due diligence it completed under Sections IV and VI of the CRS, and on a self-certification collected for another tax purpose if it meets the CARF requirements (Section III(D)(1)).

06 · The Role of the Tax Identification Number (TIN)

A valid CARF self-certification for an individual is signed or otherwise affirmed and dated, and gives first and last name, residence address, every jurisdiction of tax residence, the TIN for each reportable jurisdiction, and date of birth. A TIN need not be collected only where the jurisdiction does not issue one or its domestic law does not require it to be collected.

For a UAE platform, whose users come from many jurisdictions, three failures to test for are a TIN in the wrong format for the declared country, a residence that conflicts with the KYC address, and a missing TIN where the country does issue one. The provider must confirm the self-certification’s reasonableness against the information it holds, including its anti-money-laundering records.

07 · Practical Industry Solution: TaxDo

TaxDo runs CARF due diligence inside onboarding, from the first user self-certification to the validated report, in five steps.

Step 1 · Collect the self-certification. Guided, one question at a time, for individuals and entities, with a digital signature; controlling persons are collected in the same flow where the entity requires them.

Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.

Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine runs 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, testing each self-certification against the data already held.

Step 4 · Cure the gaps, without the compliance team:

4a · New users. Discrepancies are resolved in the same session, before the first trade.

4b · Existing users. One click starts remediation for the existing book through a branded link, each case closed by a signed self-certification and an audit-ready certificate.

Step 5 · Report, and keep the evidence. Schema-validated CARF XML from one data layer, prepared and validated for your platform to submit once the UAE rules apply. Our team can also submit it on your behalf on request, as an additional service.

From Day-1 self-certification to CARF reporting, with zero remediation. Every user is cleared at onboarding.

Our CARF compliance software · Crypto exchanges and CASPs

It runs beside the KYC process anti-money-laundering rules already require, not in place of it. The reporting obligation, and the responsibility for what is reported, stays with the provider, including where TaxDo submits the report on its behalf at its request.

A Dubai exchange’s 2026 cohort

Take a fictional exchange licensed in Dubai that onboards 8,000 users during 2026. If the Cabinet Decision follows the OECD model, those users will be pre-existing users on 1 January 2027, and the circular gives until 31 December 2027 to collect a valid self-certification from each; every user onboarded with a CARF-grade self-certification in 2026 is one fewer case in that campaign. Users joining from 1 January 2027 need one when the relationship is established.

08 · International Jurisdictions Signed onto CARF

The CARF agreement signatory list had 56 signatories at 3 March 2026. The Global Forum’s commitments list of 14 September 2026 places the UAE among 27 jurisdictions committed to first exchanges by 2028, with the Bahamas, Bahrain, Hong Kong (China), Singapore and Switzerland; 46 others, including the UK and every EU member state except Cyprus (listed for 2028), are committed to first exchanges by 2027. Our Cayman Islands and Bahamas articles cover two other financial centres.

In the EU, DAC8 has applied since 1 January 2026, and a provider within its scope reports its EU-resident users under it; see our DAC8 compliance software.

09 · Market Sentiment and What’s Next

The live version of this page cited market and sentiment figures, among them a USD 25 billion annual transaction volume, that no official source supports; they are removed. What a UAE platform can act on is the sequence the readiness circular sets: operational preparations, and each potential provider’s assessment of its own status under the CARF and its UAE nexus, by 31 December 2026, due diligence from 1 January 2027, registration in 2027, XML reporting systems ready by 31 December 2027, the first report by 30 June 2028 and the first exchange on 1 September 2028. Still to be published: the Cabinet Decision, the Ministerial Decisions, the registration deadline and any CARF penalty schedule.