CARF, DAC8 and the new era of crypto tax reporting

The rule that reaches a crypto-facing institution first may not be a licensing regime at all. It is tax reporting law, and it turns exchanges, custodians and, in the United States, a narrower list of brokers into third-party informants on their own clients. Due diligence under the OECD's Crypto-Asset Reporting Framework and the EU's version of it started on 1 January 2026 in the first-wave jurisdictions. The first cross-border exchanges of that data follow in 2027.

Three regimes are moving at once, on different legal footing. The OECD's Crypto-Asset Reporting Framework (CARF) is a standard that binds no one until a jurisdiction writes it into domestic law. The EU's DAC8 is a directive already in force, whose crypto obligations have applied since a fixed date. The US regime is a broker information return under its own tax code, running on its own phase-in, with a separate and later commitment to CARF exchange. This piece takes each on its own terms and separates what is in force from what is only committed. None of it is tax advice.

What CARF requires, and who has to report

According to the OECD's November 2025 monitoring update, the OECD and G20 countries completed the core CARF rules in 2022, and the package was finalised in June 2023. It extends the automatic exchange of information model already used for bank accounts under the Common Reporting Standard (CRS) to crypto-assets. The obligation falls on a "Reporting Crypto-Asset Service Provider" (RCASP), which the framework defines as "any individual or Entity that, as a business, provides a service Effectuating Exchange Transactions for or on behalf of customers, including by acting as a counterparty, or an intermediary, to such Exchange Transactions, or by making available a trading platform."

The test for where an RCASP must report is deliberately wide. A provider is in scope in a jurisdiction if it is tax resident there, incorporated or organised there (with legal personality or a tax filing obligation there), managed from there, or has a regular place of business there. The four tests apply in that order, so that the same information is not reported in two places. The OECD is explicit about relocation: a provider that moves to a jurisdiction not implementing CARF stays covered unless it removes all nexuses to all jurisdictions that are implementing it.

The data is detailed. The OECD's 2024 implementation guide lists what a valid self-certification from an individual must contain: name, residence address, every jurisdiction of tax residence, a taxpayer identification number (TIN) for each, and date of birth. Transactions are reported on an aggregate basis for each type of crypto-asset. Exchanges against fiat currency, exchanges between crypto-assets and transfers are reported separately, and retail payments above USD 50,000 are reported in their own category.

Who has committed, and when exchanges start

Two separate processes produce the headline numbers, and they should not be conflated. The first is a joint statement made on 10 November 2023 by 48 jurisdictions, among them the United Kingdom, the United States, Japan, Korea, Canada and 25 EU member states. They stated an intention to transpose CARF and activate exchange agreements "in time for exchanges to commence by 2027, subject to national legislative procedures as applicable." Eleven more jurisdictions adhered afterwards. A statement of intent like this carries no legal force.

The second is the Global Forum on Transparency and Exchange of Information for Tax Purposes, which runs a formal commitment process with assigned years. Its commitments list, last updated on 23 June 2026, records 46 jurisdictions undertaking first exchanges by 2027, including the United Kingdom and most EU member states. Another 29 are committed for 2028, among them the United Arab Emirates, Singapore, Switzerland, Hong Kong (China), Canada and Australia. The United States is the only jurisdiction listed for 2029. The same list names five jurisdictions the Global Forum considers relevant to CARF that have not yet committed: Argentina, El Salvador, Georgia, India and Viet Nam. For a reader following the Gulf, the wider shift in Abu Dhabi now comes with a 2028 tax-transparency date attached.

The OECD's timing rule converts each commitment into an operational date. Domestic due diligence and reporting rules should be in effect from the start of the calendar year before first exchange, because each year's exchange covers the prior year. For the 2027 cohort that means 1 January 2026, and for the 2028 cohort 1 January 2027. The international legal basis for exchange must be in place by September of the exchange year. For almost every committed jurisdiction that basis is the Convention on Mutual Administrative Assistance in Tax Matters, and 53 jurisdictions had signed the CARF Multilateral Competent Authority Agreement by the OECD's November 2025 count. The same update reported that a growing number of 2027-cohort jurisdictions had legislation in force or in its final stages, with the rest expected to follow.

DAC8: the EU's version, and what applies now

Council Directive (EU) 2023/2226, known as DAC8, was adopted on 17 October 2023, published in the Official Journal on 24 October 2023 and entered into force on 13 November 2023. It amends the EU's directive on administrative cooperation in taxation. Member states had to transpose it by 31 December 2025 and apply it from 1 January 2026. The European Commission states that crypto-asset operators not authorised under MiCA need a single registration in one member state if they operate in the EU.

The Commission also fixes the reporting window. Information for the first reporting year, 2026, is due within nine months of the end of that year, that is between 1 January and 30 September 2027. Exchanges between member states for 2026 take place by 30 September 2027. The exact filing date inside that window is for national law, so an EU-facing provider should take it from the transposing law of the member state where it reports.

That transposition is itself uneven, which is the distinction between in force and applying that matters most here. On 30 January 2026 the Commission sent letters of formal notice to twelve member states that had not notified transposing measures: Belgium, Bulgaria, Cyprus, Czechia, Estonia, Greece, Luxembourg, Malta, the Netherlands, Poland, Portugal and Spain. KPMG's EU Tax Centre reported on 3 June 2026 that most had since acted, but that Bulgaria, Czechia and Spain were still pending.

DAC8 also carries an obligation that has nothing to do with crypto. It extends automatic exchange between tax authorities to advance cross-border rulings concerning individuals, covering rulings on transactions above EUR 1.5 million or rulings that determine tax residence. This is exchanged by tax authorities, not reported by the taxpayer, but a family office or principal holding such a ruling should know it will now travel.

The UK's own implementation

The UK is outside the EU and has implemented CARF through its own instrument, the Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025. The regulations were made on 24 June 2025 and came into force on 1 January 2026. Reports are due by 31 May following each calendar year, so the first, covering 2026, is due by 31 May 2027. Registration is due by 31 May 2027 or, for a provider that comes into scope later, by 31 January following its first reporting year, whichever is later.

The penalties are specific:

• Failing to apply due diligence: up to £100 per reportable user or person, or up to £300 where the failure concerns obtaining a valid self-certification.
• Failing to make a required report: up to £5,000, plus up to £600 for each day the failure continues after a penalty assessment is issued.
• Failing to register: up to £1,000, plus up to £300 a day on the same basis.

Because collection has already started, a UK provider without a working due diligence process is already behind.

The US: broker reporting on Form 1099-DA

A domestic information return, with CARF committed for later

The United States signed the November 2023 joint statement, and the Global Forum now lists it as committed to first CARF exchanges by 2029. That is a commitment, not legislation. On the OECD's general timing rule, a 2029 exchange implies domestic collection from the start of 2028. What applies to US brokers today is a different mechanism. Internal Revenue Code section 6045, the provision behind Form 1099-B for securities, now requires digital asset brokers to file Form 1099-DA. Treasury Decision 10000, the final regulations, was published in the Federal Register on 9 July 2024. It covers brokers that take possession of the digital assets their customers sell: operators of custodial trading platforms, certain hosted wallet providers, digital asset kiosks and certain processors of digital asset payments.

The phase-in and the transitional relief

Gross proceeds reporting applies to sales on or after 1 January 2025. Basis reporting applies to certain sales on or after 1 January 2026. Real estate professionals must report the fair market value of digital assets paid in property transactions closing on or after 1 January 2026.

IRS Notice 2025-33 extends the transitional relief first given in Notice 2024-56:

• Backup withholding: none is required on any digital asset sale a broker effects during 2025 or 2026.
• Customer TINs: for sales effected in 2027, a broker may rely on a pre-existing customer's uncertified TIN that has been confirmed through the IRS TIN Matching Program. A pre-existing customer is one whose account was opened before 1 January 2026.
• Customers with non-US addresses: for 2027 sales, the IRS will not impose certain information-return penalties, and will not require backup withholding, for pre-existing customers the broker has not classified as US persons and whose files show a non-US residence address.

Most of the relief therefore ends with 2027 sales.

The DeFi rule that did not survive

A separate rule, Treasury Decision 10021 of December 2024, would have treated certain non-custodial front-end service providers as brokers for sales from 1 January 2027. Congress disapproved it under the Congressional Review Act, and President Trump signed House Joint Resolution 25 on 10 April 2025. Under that Act, the IRS cannot issue a substantially similar rule without new legislation. The custodial rules in Treasury Decision 10000 were unaffected. For the accounting side of the same holdings, see digital assets in the financial statements.

What an institution should have in place, and by when

This is a map of the obligations, not advice on any institution's position.

Start with nexus, not headquarters. Under CARF, DAC8 and the UK regulations, the question is where a crypto-facing entity is tax resident, incorporated, managed or has a regular place of business. Each answer then has to be checked against that jurisdiction's own status: 2027 cohort, 2028 cohort, 2029, or not committed. Moving the legal entity does not remove a nexus that already exists elsewhere.

The collection obligation is already running. In the 2027 cohort, which covers the UK and most of the EU, the data exchanged in 2027 is the data gathered on 2026 activity. Self-certifications gathered after the fact are a remediation exercise.

Check the national DAC8 date inside the EU window. The deadline sits somewhere between 1 January and 30 September 2027. Where the member state was late to transpose, the national rules deserve a closer read.

US brokers have their own dates. For brokers within the Form 1099-DA definition, basis tracking applies to assets acquired from 1 January 2026, and the relief in Notice 2025-33 covers 2027 sales. Product analysis written before April 2025 may still assume the repealed DeFi rule applies.

Check whether a counterparty's jurisdiction will actually exchange. The Global Forum runs confidentiality and data-safeguard peer reviews. Where issues are not addressed, the OECD says a jurisdiction's partners are not expected to send it information.

An institution's actual reporting position turns on facts specific to each entity and jurisdiction, and needs confirming with its advisers and the relevant tax authority. The same discipline of separating what regulators actually permitted from what they only signalled applies to tax reporting as much as to licensing.

What is still open

Three points remain unsettled on the public record checked for this piece:

• The US 2029 commitment. The Global Forum list records the commitment, but none of the US sources reviewed here sets out domestic CARF rules. Until they appear, Form 1099-DA and CARF are two reporting tracks describing much of the same activity.
• DAC8 transposition. As of KPMG's 3 June 2026 count, three member states had still not transposed DAC8, so the EU-wide application date and the national reality do not yet coincide everywhere.
• The commitments list itself. The Global Forum identifies new jurisdictions as relevant each year, so the list moves. Any reading of it should be dated.