OECD CARF Reporting and EU DAC8 Reporting – What are the new requirements?

Unlike the OECD’s CRS, the CARF has broad nexus hierarchy requirement to determine where an entity needs to report due diligence and transaction reporting information to a particular tax authority. The following nexus hierarchy applies:

1. Tax Residency of an Entity or individual in a participating jurisdiction;
2. Jurisdiction of incorporation;
3. Jurisdiction of management; or
4. Jurisdiction of regular place of business.

The OECD CARF requires reportable CASPs to collect valid self-certification documents. The information for individual users should include the following:

• Name
• Date of Birth
• Home address
• Country of Residence
• Tax Identification Number (TIN)

From 1 January 2026, new customers (both individuals and entities) are required to obtain a valid self-certification upon account opening.

For preexisting accounts with a relationship prior to 1 January 2026, CASPs will have up until 12 months to obtain a valid self-certification although tax authorities have recommended this is collected as soon as possible.

For reportable users, the following types of transactions will need to be reported:

• Crypto-to-Fiat: E.g. Bitcoin to USD
• Crypto-to-Crypto: E.g. Bitcoin to Ethereum trades
• Crypto Transfers: E.g. Bitcoin to/from a non-custodial wallet

The asset-by-asset transactional reporting requirements for CARF differs from the existing CRS requirements where CRS requires aggregate account balances at year end. This will greatly increase the data requirements for collection and submission to tax authorities under CARF.

Note, Central Bank Digital Currencies (CBDCs) and Specified Electronic Money Products (single fiat currency redeemable at par value at any time) are not required to be reported under CARF.

Each jurisdiction can impose penalties for non-compliance of CARF based on domestic legislation. The UK’s HMRC will impose penalties of up to £300 per user for failure to report, provide accurate information or submit late reports. The final EU DAC8 proposes penalty ranges from €20,000 – €500,000 for non-compliance.

Whilst both the OECD CARF and the DAC8 are aligned in transaction reporting requirements, there are some differences in approach with the key areas being:

• Definitions: The DAC8 draws definitions from the EU’s Markets in Crypto-Assets Regulation (MiCA) rather than the OECD CARF paper.
• Account freezing obligations: The DAC8 requires CASPs to prevent trading activities for users who have not satisfied due diligence obligations within 60 days following two reminders from the CASP.

CARF and DAC8 requirements will be a major change for businesses who offer crypto assets to individuals or businesses. With these requirements effective from 1 January 2026, it’s important to understand exposure to these requirements in addition to other reporting regimes such as the OECD’s CRS and the IRS Form 1099-DA for the USA.

• Education: Internally, there is often a challenge to understand what the new requirements are and provide education to the relevant stakeholders to start thinking about how to operationalize the compliance process for OECD CARF and DAC8.
• Determination of in-scope regimes and products: Businesses providing digital asset services must determine which reporting jurisdiction they are in – particularly for CARF where the nexus rules are broad. Banks who issue a mix of traditional and emerging crypto products will need to determine which products are in-scope for CARF/DAC8 and CRS. A very pertinent challenge is how to identify a particular product in-scope for reporting.
• Due diligence: While tax due diligence requirements can impact the overall account opening experience if not carefully managed, penalties and incorrect management of Personally Identifiable Information (PII) data can be detrimental. It is important to consider whether collected due diligence information is sufficient for tax purposes. How will customer data be obtained, validated and cross-referenced by other internal systems? A valid self-certification is required prior to effectuating exchange transactions.
• IT systems: Generating CARF reports will require large volumes of transactional data to be extracted and aggregated in the relevant format. It is important that CASPs review their internal systems alongside understanding data requirements under CARF and DAC8.