CARF: The OECD Crypto-Asset Reporting Framework Explained

CARF, the Crypto-Asset Reporting Framework, is an OECD tax standard that requires crypto exchanges, brokers and similar providers to collect their customers' tax residence and tax identification numbers, report yearly transaction totals to their local tax authority, and have that data automatically shared with the tax authorities of the countries where customers live. It is the crypto equivalent of the Common Reporting Standard (CRS), which already does the same for bank and investment accounts.

The first data covers calendar year 2026 in the earliest-adopting countries, with the first exchanges between governments in 2027. This guide covers who has committed, who has to report, what is reported, how CARF relates to CRS and the EU's DAC8, and what you will be asked as a user.

What is CARF?

CARF was developed by the Organisation for Economic Co-operation and Development (OECD) under a mandate from the G20. It was approved by the OECD on 26 August 2022, according to recital 9 of the EU's DAC8 directive, and was published together with amendments to the CRS in June 2023 as a single package, the OECD's International Standards for Automatic Exchange of Information in Tax Matters.

The reason it exists is simple. Crypto can be bought, held and moved without a bank, and crypto assets generally fell outside the existing automatic exchange systems. As HMRC's 2024 consultation put it, that left tax authorities without full visibility. CARF closes the gap by making the intermediaries report.

CARF is a tax standard, not an anti-money laundering rule. It sits alongside KYC and the Travel Rule but serves a different purpose: telling your tax authority what you did, so it can check your return.

Which countries have committed, and when

On 10 November 2023, a group of jurisdictions issued a joint statement committing to transpose CARF into domestic law and activate exchange agreements "in time for exchanges to commence by 2027". The OECD Global Forum now tracks formal commitments. Its list of committed jurisdictions, last updated on 23 June 2026, shows:

That is 76 committed jurisdictions. The same list names five jurisdictions the Global Forum considers relevant to CARF that have not yet committed: Argentina, El Salvador, Georgia, India and Viet Nam. A first exchange "by 2027" means providers in those countries collect data during 2026 and report it in 2027.

Who has to report: RCASPs

The obligation falls on Reporting Crypto-Asset Service Providers (RCASPs). HMRC's guidance describes an RCASP as a business that either transacts cryptoassets on behalf of users or provides a means for users to transact them. Examples include crypto exchanges, brokers and dealers.

Because many providers operate in several countries, CARF uses nexus rules to decide where a provider reports. The criteria are applied as a hierarchy, with tax residence at the top; the other criteria are incorporation, management and having a regular place of business in the country. A provider that is tax resident in France and incorporated in the UK reports only in France, for example.

Not every token counts. Under HMRC's guidance, a cryptoasset must be usable for payment or investment purposes, and central bank digital currencies and specified electronic money products are left to the CRS instead. Stablecoins and many other tokens are in scope.

What gets reported

Providers report two blocks of information per customer. HMRC lists the identity data as:

• Individuals: name, date of birth, home address, country of residence and tax identification number (TIN) with its issuing country.
• Entities, such as companies, partnerships, trusts and charities: legal name, main business address, registration number or TIN, and in some cases details of the controlling persons behind the entity.

The transaction data is aggregated per customer, per cryptoasset and per transaction type. The reportable transactions are:

• exchanges between cryptoassets and fiat currency, in both directions;
• exchanges between one cryptoasset and another;
• reportable retail payment transactions, meaning crypto payments for goods or services worth more than USD 50,000;
• other transfers to and from the customer;
• transfers to external wallet addresses, which in practice includes withdrawals to self-custody wallets.

Where the provider knows about them, it also tags transactions by type, including staking, crypto loans, wrapping and collateral. These are annual totals, not a trade-by-trade log, and CARF does not report gains or losses. Your tax authority receives the inputs and still relies on your own tax return to work out what you owe.

CARF vs CRS vs DAC8

CRS is the OECD's existing standard for financial accounts: banks, custodians and some investment entities report foreign account holders' balances and income. The 2023 package amended the CRS at the same time as it created CARF. One result is a clear split: under HMRC's guidance, central bank digital currencies and specified electronic money products are reported under the CRS, and other cryptoassets under CARF.

DAC8 is how the EU puts CARF into law. Council Directive (EU) 2023/2226 has applied since 1 January 2026, and EU tax authorities must exchange the data within nine months of the end of each calendar year, so the first exchange of 2026 data is due by 30 September 2027. DAC8 follows CARF closely but adds EU-specific rules, such as registration for non-EU crypto-asset operators that serve EU residents. Our DAC8 guide covers it in detail.

The US has its own domestic broker reporting system, Form 1099-DA, which began with 2025 transactions. The US commitment on the OECD list is for exchanges by 2029. See our Form 1099-DA guide.

Example: how the UK is implementing CARF

The UK is one of the first movers, and HMRC's published guidance shows what implementation looks like in practice:

• From 1 January 2026, UK RCASPs must carry out due diligence on their customers.
• The UK has extended CARF to UK-resident customers too, so UK users are reported to HMRC as well as foreign users being reported to their home countries (HMRC policy paper, November 2025).
• Providers must register with HMRC's online service and tell users they will be reporting their details by 31 January 2027.
• The first report, covering 1 January to 31 December 2026, is due between 1 January and 31 May 2027 (HMRC).
• Penalties can reach £300 per user for failing to report, reporting late or submitting inaccurate information.

What users will be asked: the self-certification

The part of CARF most users notice is the tax self-certification. It is a short declaration, usually a form in the app, confirming your country or countries of tax residence and your TIN for each.

• New customers give it at sign-up. HMRC's manual says it should be obtained before the provider carries out any transactions for you.
• Existing customers get a catch-up window. In the UK, providers had until 31 December 2026 to collect self-certifications from customers who were already on their books at the start of 2026 (IEIM8000470).
• The provider checks the self-certification against what it already knows from KYC, such as your address and ID document. A UK address with a claimed tax residence elsewhere will prompt questions.
• HMRC's cryptoassets manual warns that failing to give a provider the required information may result in a penalty, and the provider may refuse to provide further services.

Identity checks and the tax form run together: exchanges typically collect the self-certification in the same onboarding flow as ID verification, using tools such as iDenfy's crypto identity verification for the KYC step.

What about DeFi and self-custody?

CARF reports through intermediaries. Coins you hold in your own wallet and swaps you make directly on-chain are not reported by anyone under CARF, but a withdrawal from a reporting exchange to your wallet is reported as a transfer to an external address. Whether a particular DeFi front end counts as an RCASP depends on whether it transacts for users or provides them a means to transact, which is a facts-based question. None of this changes your own duty to report taxable gains and income.

JewelSwap's DeFi apps are non-custodial and don't collect tax self-certifications. See KYC in DeFi explained.

Frequently asked questions

What does CARF stand for?

Crypto-Asset Reporting Framework. It is an OECD standard for the automatic exchange of tax information on crypto transactions between countries, approved in 2022 and published with amendments to the Common Reporting Standard in June 2023.

When does CARF start?

It depends on the country. According to the OECD Global Forum's list updated 23 June 2026, 46 jurisdictions will make first exchanges by 2027 (covering 2026 data), 29 by 2028 and the United States by 2029.

Is the United States part of CARF?

The OECD Global Forum lists the United States as committed to first exchanges by 2029. Domestically, US brokers already report customer sales on Form 1099-DA, starting with 2025 transactions.

What information does CARF report about me?

Your name, address, date of birth, tax residence and tax identification number, plus annual totals per cryptoasset of your crypto-to-fiat and crypto-to-crypto exchanges, transfers in and out, and withdrawals to external wallets. It does not report gains or losses.

What is the difference between CARF and DAC8?

CARF is the global OECD standard. DAC8 is the EU directive that puts CARF into EU law, with some EU-specific additions such as registration for non-EU crypto operators. DAC8 has applied since 1 January 2026.

Why is my exchange asking for my tax residence and TIN?

Under CARF and DAC8, providers must collect a tax self-certification from every customer. New customers give it at sign-up and existing customers within a catch-up period. In the UK, HMRC warns that failing to provide the required information may lead to a penalty and the provider may refuse further services.

Keep reading

• DAC8 crypto reporting explained
• Form 1099-DA explained
• What is MiCA regulation?
• What happens to your KYC data
• Crypto AML compliance guide for exchanges and VASPs

This article is educational and is not tax, legal or financial advice. Commitment figures are from the OECD Global Forum's list of jurisdictions committed to CARF, last updated 23 June 2026. UK details are from HMRC guidance and manuals, and EU details from Council Directive (EU) 2023/2226, all checked on 9 October 2026. Rules and timelines change; check your local tax authority's guidance.