CARF Compliance Software

CARF is the OECD Crypto-Asset Reporting Framework — a global standard for tax transparency in digital assets. Welcomed by G20 leaders at the Bali summit in November 2022 and finalized in 2023. It requires Reporting Crypto-Asset Service Providers (RCASPs) to collect self-certifications, validate TINs, classify transactions, and report to tax authorities. 75+ jurisdictions have committed to implementation, with data collection beginning 1 January 2026 in the EU and UK.

Reporting Crypto-Asset Service Providers (RCASPs): centralized exchanges, custodial wallet providers, crypto brokers and dealers, crypto payment processors, staking, lending, and yield providers, DeFi platforms where the operator can identify users, and NFT platforms where NFTs are classified as financial instruments. If you facilitate crypto transactions and can identify your users, CARF likely applies.

A Reporting Crypto-Asset Service Provider must do the following under CARF. 1) Identify users: obtain a self-certification from every individual and entity user when the relationship starts (existing users within the transition period), and for entities identify the controlling persons. 2) Check it: confirm the self-certification is reasonable against other information held, including AML/KYC documents, and obtain a new one if circumstances change. 3) Collect the data: name, address, tax residence, date of birth for individuals, and the TIN for each reportable jurisdiction, unless that jurisdiction issues no TIN or does not require it to be collected. 4) Track relevant transactions: exchanges against fiat currency or other crypto-assets, and transfers of crypto-assets, including reportable retail payments above USD 50,000. 5) Report once a year to the tax authority where you have your reporting nexus, aggregated by type of crypto-asset, with amounts in fiat currency. 6) Keep documentation and data for at least five years after the reporting deadline.

CARF is the OECD's global standard, and 75+ jurisdictions have committed to implement it. DAC8 (Council Directive (EU) 2023/2226) is the EU's implementation of both CRS 2.0 and CARF into European law, covering 27 EU member states. Outside the EU, each jurisdiction brings CARF into its own law, as the UK did with its Cryptoasset Reporting Framework regulations. The due diligence requirements are aligned, but reporting schemas and local enforcement vary.

CARF is an OECD standard, so there is no fixed member list. A jurisdiction takes part by committing to implement it, and the OECD Global Forum on Transparency and Exchange of Information for Tax Purposes publishes the list of jurisdictions that have committed, grouped by the year they will start exchanging information. EU member states implement CARF through DAC8 (Directive (EU) 2023/2226), which applies from 1 January 2026, and the United Kingdom through its own regulations in force from the same date. The list changes as jurisdictions commit, so check the OECD page for the current position.

Three reportable transaction types: exchanges between crypto-assets and fiat currencies, exchanges between crypto-assets, and transfers of crypto-assets, including reportable retail payments above USD 50,000. Staking rewards and similar receipts are reported as transfers, by type, where known. Each transaction must be classified by type, asset, and user, then reported per jurisdiction in either aggregate or transaction-by-transaction format.

Data collection began 1 January 2026 in the EU and UK. On the OECD list of 14 September 2026, 46 jurisdictions are due to start exchanging information by 2027, 27 by 2028 and 4 by 2029. The 2027 group includes the UK, Norway, Iceland, Liechtenstein, Brazil, Japan, New Zealand and South Africa, and every EU member state except Cyprus, which the OECD lists for 2028. The 2028 group includes Australia, Canada, Hong Kong, Israel, Singapore, Switzerland and the UAE. Platforms report to their own tax authority first: in the UK the first reports, covering 2026, are due between 1 January and 31 May 2027. CASPs must be operationally ready from Day 1 of data collection.

CARF itself (the OECD standard) does not mandate account blocking — that is a DAC8/EU-specific enforcement mechanism. Within the EU (via DAC8), if a user fails to provide a valid self-certification after two formal reminders, and at least 60 days after the first request, the crypto-asset service provider must block them from reportable transactions. Outside the EU, enforcement actions are determined by each jurisdiction's national implementation of CARF.

No. KYC verifies user identity for anti-money-laundering purposes. CARF requires CARF-specific self-certification (including all tax residency jurisdictions and TINs), mandatory TIN validation against the issuing jurisdiction, transaction-level reporting, and a documented cure workflow. KYC is a prerequisite — not a substitute.

Per OECD guidance, DeFi platforms where the operator can identify users (centralized front-end) and NFT platforms where NFTs are used as financial instruments are in scope. Platforms with centralized front-ends, login requirements, or user accounts trigger the same reporting obligations as exchanges. The scope is designed to capture any intermediary that facilitates reportable crypto transactions with identifiable users.