CARF and DAC8 Explained: Crypto Gets Its CRS Moment

In This Guide

• What changes in 2027, and what already changed in 2026
• Seventy-six jurisdictions, three waves, five holdouts
• Self-custody withdrawals are on the report
• What an exchange actually hands over
• The transactions people assume are invisible
• DAC8 is the EU version, and it reaches wider than MiCA
• Moving the exchange offshore does not break the chain
• The United States took a different road
• What CRS did to offshore banking predicts what CARF does to crypto
• Frequently Asked Questions
• Sources Used in This Guide
• Related Articles

What changes in 2027, and what already changed in 2026

Crypto account data starts moving between tax authorities in 2027, and the year it describes is 2026. For the 46 jurisdictions in the first wave, domestic law had to be in effect from 1 January 2026, so providers have been logging customer identities and transaction totals all year and file their first reports in 2027 (OECD, para 29). The collection is not a future event.

Seventy-six jurisdictions have committed to the Crypto-Asset Reporting Framework: 46 for first exchanges by 2027, 29 by 2028, and the United States by 2029 (OECD Global Forum, 23 June 2026). Five jurisdictions the OECD identifies as relevant remain uncommitted: Argentina, El Salvador, Georgia, India, and Viet Nam. That is the entire list of holdouts.

CARF is the Common Reporting Standard rebuilt for assets that never sit in a bank account. The trigger is what changed. CRS reports because an institution maintains an account; CARF reports because a provider effectuates exchange transactions.

Accuracy and scope: Rules and figures were checked against primary sources available through August 3, 2026. This is general information, not tax, legal, or financial advice.

Seventy-six jurisdictions, three waves, five holdouts

The "48 countries" figure in most press coverage is not a current count. It is the number of original signatories to the joint statement of 10 November 2023, since joined by further adherents including Bermuda, Colombia, Indonesia, Mauritius, Monaco, and Poland (OECD). The live number is 76.

Two rows contradict most published summaries. Switzerland, Singapore, Hong Kong, the UAE, Canada, Mexico, Israel, and Cyprus sit in the 2028 wave, not 2027. Cayman sits in 2027, alongside Jersey, Guernsey, the Isle of Man, Liechtenstein, and San Marino (OECD). The traditional offshore centers go first; the crypto-native hubs follow twelve months behind, which is the reverse of what most holders assume.

Committing is not the same as being able to exchange. Fifty-six jurisdictions had signed the CARF Multilateral Competent Authority Agreement as of 3 March 2026, most on 26 November 2024, with the UAE, Romania, Chile, San Marino, Panama, Mauritius, and Croatia joining later (OECD). The enabling framework must be in place by September 2027 for the first wave and September 2028 for the second.

One nuance for EU readers: Cyprus sits in the 2028 CARF wave, but DAC8 obligations apply in every Member State from 1 January 2026 (European Commission). A Cyprus-based provider is collecting your data now.

Self-custody withdrawals are on the report

Withdrawing to a self-custody wallet does not remove the transaction from the report. CARF Section II and its EU counterpart require providers to report the aggregate fair market value and number of units transferred to distributed ledger addresses they cannot associate with a regulated virtual asset service provider or financial institution (Loyens & Loeff, §3). Your exchange reports that crypto left, how much, and when.

What reaches a tax official is a flagged aggregate, not an on-chain surveillance feed. That cuts both ways. A large unexplained outflow to an unhosted address is arguably a more conspicuous line item than an ordinary trade, since no matching disposal proceeds sit next to it.

What stays outside the reports is activity that never touches a reporting provider: wallet-to-wallet transfers, peer-to-peer trades, and most on-chain DeFi where no operator exercises control or sufficient influence. The OECD lets jurisdictions defer the control test for DeFi pending further guidance (OECD FAQs, IV Q1). The gap is real and narrow, because almost every position eventually needs a fiat exit.

EU transfer-of-funds rules also attach originator and beneficiary data to crypto transfers with no minimum threshold, and above EUR 1,000 to or from a customer's own unhosted wallet the provider must verify the customer controls that address — a Loyens & Loeff reading rather than the regulation text.

What an exchange actually hands over

The UK published the most concrete field list of any first-wave jurisdiction. Providers collect, per individual, name, date of birth, home address, country of residence, and National Insurance number or UTR, with a TIN for non-residents. For entities: legal name, business address, and company registration number, plus controlling-person data in some cases. Per transaction: value, asset type, transaction type, and units (HMRC).

The transaction side is aggregated, in a specific shape.

Each asset is identified by its Digital Token Identifier code where one exists, and by full name where it does not (OECD FAQs, II Q2). Standardized identifiers make cross-provider matching cheap.

UK mechanics set the tone. The first report covers 1 January to 31 December 2026, filed between 1 January and 31 May 2027, then by 31 May annually. Penalties reach £300 per user for failure to report, late filing, or inaccurate, incomplete, or unverified information (HMRC). A platform with 100,000 UK users faces penalty exposure in the millions, which explains the identity-verification emails that started arriving in 2026.

The transactions people assume are invisible

Wrapping and liquid staking are exchange transactions under CARF, reportable "irrespective of whether an Exchange Transaction gives rise to a taxable disposition under applicable tax rules." Collateralized lending is reported as a transfer, typed "Crypto loan," "Collateral," or "Other" (OECD FAQs, IV Q2 and Q3). Reportability and taxability are separate questions.

The USD 50,000 retail payment threshold is widely misread. It does not exempt smaller payments; it decides whether a payment to a merchant counts as a Reportable Retail Payment Transaction. Below it, the same payment is still reported, as an ordinary transfer (OECD FAQs, II Q1).

NFTs escape only on a four-part test: not representing financial assets or fungible crypto-assets, not marketed as an investment product or financially regulated, not a virtual asset for FATF purposes, and low value, with the FAQ offering "has not traded at a value exceeding USD 200" and no meaningful volume. Fail any limb and the token is in scope.

DAC8 is the EU version, and it reaches wider than MiCA

DAC8 is Council Directive (EU) 2023/2226, adopted 17 October 2023 and published in the Official Journal on 24 October 2023. Transposition was due 31 December 2025, the provisions apply from 1 January 2026, and reports are due between 1 January and 30 September 2027 (European Commission).

Scope matters more than the dates. DAC8 covers MiCA-licensed providers, and it also creates a "crypto-asset operator" category as a catch-all for services falling outside MiCA's licensing perimeter entirely. Non-EU providers with an EU nexus are caught. A switch-off mechanism avoids duplicate reporting where the provider's home jurisdiction already applies CARF (Loyens & Loeff, §3.2–3.3). ESMA confirmed on 23 June 2026 that MiCA's transitional periods have ended (ESMA).

One widely repeated penalty figure is wrong. The Commission's proposal for harmonized EU-wide minimum penalties was cut from the final ECOFIN text, so the EUR 20,000 to EUR 500,000 range still circulating describes a regime never adopted. Penalties are left to Member States, which must make them effective, proportionate, and dissuasive (EY). National ceilings can be severe: the Netherlands applies a sixth-category fine of up to EUR 1,030,000 where there is intent or gross negligence.

There is no single EU reporting date either. Member States choose; the Netherlands proposed 31 January of the following year, while CARF requires customer due diligence to be completed by 31 December (Loyens & Loeff, §3.6).

Moving the exchange offshore does not break the chain

A Reporting Crypto-Asset Service Provider is "any individual or Entity that, as a business, provides a service Effectuating Exchange Transactions for or on behalf of customers, including by acting as a counterparty, or an intermediary, to such Exchange Transactions, or by making available a trading platform" (OECD, Box 1). Non-custodial services are not excluded; a platform is caught where its operator exercises control or sufficient influence.

Four alternative nexus tests apply hierarchically: tax residence; incorporation plus legal personality or a filing obligation; management from the jurisdiction; or a regular place of business there. The OECD is explicit that relocating does not escape CARF unless the provider removes every nexus to every implementing jurisdiction. With 76 committed and five holdouts, that means abandoning staff, management, incorporation, offices, and the banking relationships that go with them.

The United States took a different road

The United States is committed to first exchanges by 2029, the sole member of the third wave. It signed the 2023 joint statement but has not signed the CARF-MCAA, and was absent from the 56-signatory list as of 3 March 2026 (OECD). Committed on paper, no operative exchange instrument.

Domestically it built its own pipe. Form 1099-DA requires gross proceeds reporting for transactions on or after 1 January 2025 and cost-basis reporting for covered digital assets acquired on or after 1 January 2026. Covered brokers include custodial trading platforms, certain hosted wallet providers, digital asset kiosks, and certain payment processors (IRS).

The DeFi front-end rule went the other way. H.J.Res.25 became Public Law 119-5 on 10 April 2025 under the Congressional Review Act, disapproving the IRS rule on gross proceeds reporting by brokers effectuating digital asset sales (GovInfo). A disapproved rule cannot be reissued in substantially similar form without new legislation.

None of that helps a US person who traded on a first-wave exchange. That platform reports under its own jurisdiction's rules regardless of what Washington does.

What CRS did to offshore banking predicts what CARF does to crypto

The precedent is not speculative. In 2024, information on more than 171 million financial accounts covering nearly EUR 13 trillion in offshore assets was exchanged under CRS. Exchange of information and voluntary disclosure programs have identified at least EUR 135 billion in additional revenue since 2009, and offshore bank deposits fell by USD 410 billion, roughly 24%, by 2019 (OECD).

Current crypto disclosure sits nowhere near that scale. A Freedom of Information response published 24 July 2026 and reported by FinTech Global, citing an Identomat request to HMRC, records 502 investors settling unpaid crypto tax through the UK's voluntary route over two years for £8,328,132, with the average settlement rising about 70% to £21,552. These are third-party figures, so treat them as indicative. Even so, 502 disclosures against a UK crypto-holding population in the millions is the gap 2027 closes.

The arithmetic of going first is straightforward. The UK's cryptoasset disclosure facility asks for the current year plus three previous years where you took reasonable care, plus five where you were careless, and up to twenty where the failure was deliberate, with payment due within 30 days (HMRC). Disclosing selects the shorter window and the lower penalty band. Waiting until a report names you selects the longer one.

For anyone whose plan was jurisdictional rather than evasive, the routes that still work are the ones that were always legal: residence in a country that does not tax crypto gains, properly executed. Those survive CARF, because CARF reports facts to the country you actually live in.

Frequently Asked Questions

Does CARF let tax authorities see my self-custody wallet?

Not directly. CARF places obligations on service providers, not on blockchains. But when you withdraw to a self-custody address, the exchange reports the aggregate value and units sent to addresses it cannot tie to a regulated provider, so your tax authority knows crypto left, how much, and when.

I used an offshore exchange in a country that never signed up. Am I safe?

Almost certainly not. Only five relevant jurisdictions remain uncommitted, and CARF catches an exchange that is tax resident, incorporated, managed from, or has a regular place of business in any implementing jurisdiction. Relocation works only if every nexus to every implementing jurisdiction is removed.

What is the difference between CARF and DAC8?

CARF is the OECD standard; DAC8 is the EU directive implementing it, alongside the amended CRS, across all 27 Member States. DAC8 is slightly broader, because its crypto-asset operator category captures providers outside MiCA's licensing perimeter. If you dealt with an EU platform, DAC8 binds it, and CARF lets that data travel beyond the EU.

My country starts exchanging in 2028. Does that buy me time?

It shifts the exchange date, not the liability. Tax owed on earlier disposals is owed regardless of when reporting begins, and assessment windows generally extend well past 2028 — in the UK, up to 20 years where the behavior was deliberate. The later wave changes when the data arrives, not whether the authority can act.

Is the United States really outside all of this?

Partly. It has committed to exchanges by 2029 but has not signed the CARF-MCAA, so no operative multilateral mechanism exists yet. Domestically, Form 1099-DA gross proceeds reporting began with 2025 transactions, cost-basis reporting applies to assets acquired from 1 January 2026, and the DeFi front-end broker rule was repealed in April 2025.

This guide is for general information only and is not tax advice. A qualified professional should review your specific facts before you act.

Sources Used in This Guide

• OECD Global Forum: CARF commitment table
• OECD: CARF 2025 Monitoring and Implementation Update
• OECD: CARF Frequently Asked Questions
• OECD: Taking Stock of Progress
• European Commission: DAC8
• HMRC: Reporting cryptoasset user and transaction data
• HMRC: Collecting cryptoasset user and transaction data
• HMRC: Tell HMRC about unpaid tax on cryptoassets
• IRS: Broker reporting on digital assets
• Loyens & Loeff: Quoted 166, MiCAR and DAC8

Related Articles

• The Common Reporting Standard explained — covering the bank-account reporting regime CARF was modeled on.
• Crypto tax-free countries in 2026 — covering where crypto gains are legally untaxed.
• How crypto traders legally pay zero tax — covering the legal-residency route that survives automatic exchange.
• MiCA for crypto companies in the EU — covering the EU licensing regime DAC8 sits alongside.