What the Crypto-Asset Reporting Framework asks of a tax administration

The Crypto-Asset Reporting Framework, or CARF, extends automatic exchange of information to crypto-assets. It places reporting duties on crypto-asset service providers and asks the tax administration to receive, check, protect and exchange what they report.

For an administration that already exchanges under the Common Reporting Standard, much of the groundwork exists. The difference is in who reports, how they are found, and how their reporting is checked.

What CARF is

The OECD published the Crypto-Asset Reporting Framework in October 2022, alongside amendments to the Common Reporting Standard.^[1] It was designed to close a gap. Crypto-assets largely fall outside the Common Reporting Standard, which limits what a tax administration can see of its residents’ holdings abroad.^[2]

Under CARF, reporting crypto-asset service providers collect information on their users and report it to their tax administration once a year.^[3] Three kinds of transaction are covered:^[1]

• exchanges between crypto-assets and fiat currency
• exchanges between one crypto-asset and another
• transfers of crypto-assets, including retail payments above USD 50,000

Providers must also obtain a self-certification of tax residence and taxpayer identification number from each user, and check that it is reasonable against the other information they hold.^[1] The administration then exchanges the information with the jurisdictions where users are resident, where an exchange relationship is in place.

For jurisdictions starting in 2027, providers collect information on transactions from 1 January 2026, and the first exchanges take place in 2027.^[3][4]

Who has committed, and when

CARF commitments are managed by the Global Forum on Transparency and Exchange of Information for Tax Purposes. The Global Forum expects jurisdictions that host relevant crypto-asset service providers to implement it, with first exchanges in 2027, or in 2028 for jurisdictions facing particular challenges with the earlier date.^[5] Because the market moves quickly, jurisdictions that may become relevant are placed under monitoring.^[5]

By early 2026, 76 jurisdictions had committed to CARF, 20 of them developing countries.^[6] Argentina has since committed to start exchanges by 2029.^[7]

Small and island jurisdictions are well represented. The Global Forum’s June 2025 list included the Cayman Islands, Bermuda, Guernsey, Jersey and the Isle of Man for 2027, and the Bahamas, Barbados, the British Virgin Islands, Saint Vincent and the Grenadines and Seychelles for 2028.^[8]

What CARF asks of a tax administration

Writing in 2025, the Head of the Global Forum Secretariat set out what implementation involves.^[2] For an administration it comes down to five things.

1. Domestic legislation. A legal framework that requires crypto-asset service providers to carry out due diligence and report, with rules to enforce it. These rules closely mirror those of the Common Reporting Standard.^[2]

2. A legal basis for exchange. The Convention on Mutual Administrative Assistance in Tax Matters can provide the legal basis, with the CARF Multilateral Competent Authority Agreement setting out the details of exchange. Bilateral agreements are also possible.^[2]

3. Systems to receive and exchange the data. The administration must be able to receive reports from providers and exchange them using the CARF XML Schema. The OECD’s Common Transmission System, which jurisdictions already use for the Common Reporting Standard, can also carry CARF exchanges.^[2]

4. An administrative compliance framework. The administration needs a way to enforce compliance by providers. Existing Common Reporting Standard compliance strategies are a useful starting point.^[2]

5. Confidentiality and data safeguards. The information received must be protected in law and in practice. The Global Forum’s confidentiality and data safeguards assessments cover both the Common Reporting Standard and CARF.^[9] Our article on Global Forum peer reviews explains how those assessments work.

Where CARF differs from the Common Reporting Standard in practice

The reporting population is harder to find. Under the Common Reporting Standard, the reporting population is mostly banks, insurers and investment entities, which are usually licensed and known to a supervisor. Crypto-asset service providers may be newer, smaller, registered with a different regulator, or not registered at all. Building and maintaining the list of who should be reporting is likely to take more work than it did for financial institutions.

The population changes faster. Providers enter and leave the market quickly, and the Global Forum itself reviews which jurisdictions are relevant on an ongoing basis.^[2] A list of reporting entities drawn up once and left alone will go out of date.

Checking the data is less familiar. Staff who know how to read a bank’s account report may be less sure what a reasonable crypto-asset report looks like. Valuations, transaction types and wallet transfers are new territory for many compliance teams.

The infrastructure is shared. The legal basis, the transmission system and the confidentiality framework can all build on what is already in place for the Common Reporting Standard. Where the same confidentiality framework is used, the work done for one standard supports the other.

What this means for small administrations

The first question is whether the jurisdiction is relevant. The Global Forum’s expectation applies to jurisdictions that host relevant crypto-asset service providers. A jurisdiction outside that group may not be asked to commit, but it should know whether providers are operating from it, because that can change.

Receiving data is not automatic. To receive CARF information on its residents from other jurisdictions, an administration needs, at a minimum, a legal basis for exchange and confidentiality and data safeguards that meet the Global Forum standard.^[2] Neither happens without preparation.

Compliance work is where the effort goes. For an administration already exchanging under the Common Reporting Standard, the legal and technical pieces largely extend what exists. Finding providers, keeping the list current and checking what they report is new work, and in a small administration it is likely to fall to the same few people who run the Common Reporting Standard.

Support exists. The Global Forum Secretariat ran a series of three advanced regional workshops on CARF implementation in March and April 2026,^[10] and its broader programme gave bilateral technical assistance to more than 110 jurisdictions in 2025.^[6]