The Crypto-Asset Reporting Framework, usually shortened to CARF, is the OECD's system for automatic exchange of crypto tax information between countries. It requires crypto exchanges, brokers and similar businesses to identify their customers, record where each customer is tax resident, and send an annual summary of that customer's crypto activity to the local tax authority. The tax authority then forwards the data to the customer's country of residence.
The framework is no longer theoretical. Data collection started on 1 January 2026 in the first group of countries, and the first government-to-government exchanges are due in 2027. As of the OECD's list dated 14 September 2026, 77 jurisdictions have committed to exchange CARF data by 2029, including every major financial center that matters for crypto.
This guide explains how the CARF works, what it does and does not cover, the timeline by country, and what it means for people who hold crypto while living or moving abroad.
Key takeaways
- The CARF makes crypto service providers collect a tax residence self-certification and tax ID from every user, then report yearly totals to their tax authority.
- Reported data covers crypto-to-fiat trades, crypto-to-crypto trades, transfers, and retail payments above USD 50,000, aggregated by asset type.
- 46 jurisdictions committed to first exchanges by 2027, 27 by 2028 and 4 (including the United States) by 2029, according to the OECD's September 2026 list.
- Self-custody wallets are not reported directly, but transfers from an exchange to an outside wallet are reported in aggregate, and providers keep the wallet addresses.
- The data goes to the country you declare as your tax residence, so an accurate and supportable residence position matters more than ever.
What the CARF is and why it exists
The OECD built the CARF because crypto had slipped through the gap in the Common Reporting Standard (CRS). The CRS, which most countries apply to bank and investment accounts, covers financial institutions and financial assets. Crypto exchanges and wallets often fell outside those definitions, so tax authorities had little visibility over gains made on them.
The OECD released the CARF rules in October 2022 and published the complete package, including the commentary, a multilateral exchange agreement and updates to the CRS, in June 2023. The framework sits beside the CRS rather than inside it, but it borrows the same building blocks: self-certification of tax residence, annual reporting, and automatic exchange through the same secure transmission system. If the CRS is new to you, our guide to the Common Reporting Standard covers the older regime.
The EU implemented the CARF through its own directive, known as DAC8, which applies from 1 January 2026. The EU rules follow the OECD model closely, with some additions covered in our DAC8 explainer.
Who has to report: Reporting Crypto-Asset Service Providers
The CARF puts the reporting duty on Reporting Crypto-Asset Service Providers, or RCASPs. The OECD defines them by function, not by license. An RCASP is any individual or entity that, as a business, carries out exchange transactions for or on behalf of customers. In practice that covers:
- centralized exchanges and trading platforms
- brokers and dealers that buy or sell crypto for clients
- operators of crypto ATMs
- businesses that buy tokens from an issuer to resell them to customers
- people or entities with control or sufficient influence over a trading platform, which can include some decentralized finance (DeFi) platforms
Some actors are outside the definition. A person or company that only validates blockchain transactions, such as a miner or validator, is not an RCASP for that activity. An investment fund that simply holds crypto as a passive investment is not one either.
Where a provider reports
An RCASP reports in the country it is most closely connected to. The rules use a hierarchy: tax residence first, then place of incorporation, then place of management, then a regular place of business such as a branch. This means a provider based outside your home country can still report on you, because it reports to its own tax authority, which then exchanges the data with yours.
What information is collected and reported
The CARF has two layers: identity information about the user and transaction information about what the user did during the year.
| Category | What the provider records and reports |
|---|---|
| Identity (individuals) | Name, residence address, every country of tax residence, tax ID for each, date of birth |
| Identity (entities) | Legal name, address, tax residence, tax ID, and the controlling persons behind passive entities |
| Crypto bought or sold for fiat | Aggregate fiat amount paid or received, net of fees, per crypto-asset type |
| Crypto swapped for crypto | Aggregate fair market value of assets acquired and disposed of |
| Retail payments | Transfers paying a merchant more than USD 50,000 for goods or services |
| Other transfers in and out | Aggregate value, units and number of transfers, split by type where known, such as staking income, airdrops or loans |
| Transfers to outside wallets | Aggregate units and fair market value sent to addresses not linked to a regulated provider |
Two details matter for most users. First, the reporting is aggregated by asset and transaction type. A tax authority sees totals for the year, not a line for each trade. Second, the self-certification is central. A user must declare every jurisdiction where they are tax resident, and the provider must check that the answer is reasonable against what it already knows from anti-money-laundering checks. If a user is resident in more than one country, all of them go on the form.
Existing customers are not exempt. Providers must complete the same due diligence on customers who joined before the rules took effect, generally within 12 months of the start date.
What the CARF does not cover
The definition of a reportable asset is broad. It covers cryptocurrencies, stablecoins, and tokens such as tradable NFTs. Three groups are carved out:
- central bank digital currencies, which are handled under the updated CRS instead
- certain regulated electronic money products
- tokens the provider has determined cannot be used for payment or investment, such as some closed-loop loyalty points
Self-custody is the area people ask about most. An early draft of the CARF would have required providers to report external wallet addresses. The final rules dropped that. However, providers still report the aggregate value of transfers to wallets that are not known to belong to a regulated business, and they must keep those wallet addresses on file for at least five years so a tax authority can ask for them later. Transactions made purely between self-custody wallets, with no provider involved, are outside the reporting chain. Our overview of Bitcoin self-custody for nomads covers the practical side of holding your own keys.
CARF timeline: which countries exchange data and when
Each jurisdiction commits to a first exchange year. Domestic rules start one year earlier, because the first exchange covers data collected in the previous calendar year. The table uses the OECD's commitment list as last updated on 14 September 2026.
| First exchange | Data collected from | Count | Examples |
|---|---|---|---|
| By 2027 | 1 January 2026 | 46 | 26 EU member states, United Kingdom, Japan, Korea, Brazil, Chile, Colombia, Indonesia, Norway, New Zealand, South Africa, Cayman Islands, Jersey, Guernsey, Isle of Man, Liechtenstein |
| By 2028 | 1 January 2027 | 27 | Australia, Canada, Switzerland, Singapore, Hong Kong, United Arab Emirates, Bahrain, Cyprus, Panama, Costa Rica, Bahamas, Bermuda, British Virgin Islands, Malaysia, Thailand, Türkiye |
| By 2029 | 1 January 2028 | 4 | Argentina, Azerbaijan, Mexico, United States |
| Not yet committed | n/a | 4 | El Salvador, Georgia, India (in the process of committing), Viet Nam |
National rules can add to the OECD baseline. The UK, for example, requires providers to report UK-resident users as well as foreign ones. According to HMRC's reporting guidance, the first UK report covers calendar year 2026 and is due by 31 May 2027, and a provider can face a penalty of up to £300 per user for missing, late or inaccurate reports.
The United States is in the 2029 group for international exchange, but it already runs a domestic system. Brokers report digital asset sales to the IRS and to customers on Form 1099-DA, which started with 2025 transactions.
CARF compared with CRS and FATCA
| Feature | CRS | CARF | FATCA |
|---|---|---|---|
| Who reports | Banks, custodians, investment entities, some insurers | Crypto exchanges, brokers, dealers, ATM operators, some platforms | Foreign financial institutions reporting on US persons |
| Assets | Financial accounts and financial assets | Crypto-assets, including stablecoins and tradable NFTs | Financial accounts |
| What is reported | Year-end balances, income and gross proceeds | Annual transaction totals and transfers | Balances and income |
| Basis | Tax residence | Tax residence | US citizenship or residence |
| Network | More than 100 jurisdictions | 77 committed jurisdictions as of September 2026 | United States and partner countries |
The main shift is from balances to activity. A CRS report tells a tax authority what you held at year end. A CARF report tells it how much you bought, sold, swapped and moved during the year.
What the CARF means for nomads and people who move
The CARF follows tax residence, so the most important field on any exchange form is the residence you declare. A few practical points follow from the rules.
Residence changes need updating. Providers may only rely on a self-certification while they have no reason to doubt it. A move, a new address or a new phone number can trigger a request for a fresh form. If the declared residence does not match the rest of a customer's profile, the provider must ask for an explanation or a new self-certification before it continues to process transactions.
No residence is not a hiding place. Someone who has left one country and not clearly become resident elsewhere may struggle to complete the form at all. People in this position often look at how residence is established in the first place. Our guides on tax residency certificates and on crypto taxes when you move abroad cover that side of the question.
Past years still count. Moving after 2026 does not remove data that a provider has already collected for an earlier year. Where a former home country taxes gains made while a person was resident there, CARF data can help that country check its own records.
Formal residence options. Some internationally mobile people look at formal tax residence arrangements that come with official documents. One option some nomads look at is Honduras tax residency through Próspera, which Nomad Layer helps people obtain under a flat annual lump-sum tax. Any residence claimed on a CARF self-certification needs to be genuine and supportable, and whether a person has actually left a previous tax system depends on that country's own rules.
Frequently asked questions
When does the Crypto-Asset Reporting Framework start?
For the first group of 46 jurisdictions, including the EU and the UK, providers began collecting data on 1 January 2026 and the first exchanges between tax authorities are due in 2027. The 2028 group starts collecting in 2027, and the 2029 group, which includes the United States, in 2028.
Does the CARF report my self-custody wallet?
Not directly. Providers report the aggregate value of transfers they send to wallets not linked to a regulated business, and they keep the destination addresses for at least five years. Activity that happens only between self-custody wallets, with no provider involved, is outside CARF reporting, although it can still be taxable.
Does the CARF apply if I use an exchange in a country that has not joined?
A provider reports to the jurisdiction it has a nexus with. If that jurisdiction has not implemented the CARF, the provider may have no CARF duty there. However, most large platforms operate entities or branches in committed jurisdictions, and only four relevant jurisdictions are listed as not yet committed.
Is DeFi covered by the CARF?
Partly. A person or entity with control or sufficient influence over a trading platform can be treated as a reporting provider. Fully decentralized protocols with no one in that position are hard to bring into scope, and how far national rules reach in practice is still developing.
Is the CARF the same as DAC8?
DAC8 is the EU directive that puts the CARF into EU law. It follows the OECD rules and adds some EU-specific features, such as a single registration for non-EU providers that serve EU customers.
Important: This article is general information, not tax, legal or financial advice. Rules change often and depend on your personal circumstances. Speak with a qualified professional in each relevant country before you act.