Every trade and transfer your customers have made since 1 January is already inside a filing you may not have built yet.
Collection obligations went live on 1 January 2026. The reporting window does not wait for you to be ready.
CARF is the OECD standard for reporting customer crypto activity to tax authorities. DAC8 is how the EU enacts it. Between them, 46 jurisdictions already require it, and the obligation attaches the moment a customer can trade, convert, or transfer through you.
Who Has to File
CARF binds any Reporting Crypto-Asset Service Provider, meaning an entity that executes exchange transactions for customers. That net is considerably wider than “exchange”.
Exchanges. Retail and institutional venues with customer accounts, order books, and an internal ledger.
Brokers and OTC desks. Executing on behalf of a client is enough. Voice and RFQ desks are in scope alongside screen venues.
Payments and remittance. A fiat-to-crypto conversion inside a payment flow is a reportable exchange transaction.
Custody and wallets. In scope where the provider facilitates exchanges or holds customer accounts, though not where it is purely technical infrastructure.
The test is straightforward. Does a customer transact through you, and do you know who they are? Then you file.
Where It Applies, and When
Per the OECD Global Forum’s jurisdiction commitment list, last updated 23 June 2026.
In force now. 2026 activity, filed in 2027. 46 jurisdictions, including 26 of the EU’s 27 member states via DAC8, with Cyprus exchanging a year later than the rest of the bloc. Also the UK, Norway, Iceland, the Crown Dependencies of Guernsey, Jersey and the Isle of Man, plus Japan, Korea, Brazil, South Africa, New Zealand and Uganda.
Next wave. 2027 activity, filed in 2028. 29 jurisdictions including Switzerland, Singapore, the UAE, Hong Kong and Türkiye, alongside Canada, Australia, Mexico and Cyprus. All four of those exchange a year later than earlier industry materials assumed. Israel, Malaysia, Thailand, Mongolia and a group of Gulf, Caribbean and African jurisdictions complete the wave.
United States. CARF exchange from 2029, the only jurisdiction in the 2028 reporting period.
Five jurisdictions identified as relevant to CARF have not yet made a formal commitment: Argentina, El Salvador, Georgia, India and Vietnam.
Three dates matter now. Collection has been live since 1 January 2026 in first-wave jurisdictions, so every trade and transfer since then sits in that filing population. First filings to domestic authorities land in 2027, with the UK’s due on 31 May. The first automatic exchange between tax authorities happens by 30 September 2027, which is when cross-border visibility begins.
This list moves. Check the OECD’s current commitment list before finalising scope for a specific client or jurisdiction.
If You Are a US Entity, 2029 Is Not Your Date
The US exchanges from 2029, and that number has been widely misread as a three-year reprieve. It is not.
CARF and DAC8 obligations follow the customer, not the head office. A US-domiciled exchange, broker, payment provider or OTC desk with customers resident in the EU or the UK is within scope of those regimes now, on 2026 activity, and files there in 2027. The US timeline governs when US authorities begin exchanging their own data. It says nothing about what a US business owes to a European tax authority in respect of a European customer.
Domestic US reporting is also already running ahead of CARF. Form 1099-DA covers gross proceeds, with cost basis added for 2026.
The practical consequence is that a US business with any material European customer base has the same 2027 deadline as a Dublin or Frankfurt venue, and the same 2026 data population behind it.
What the Report Actually Contains
Each report carries two layers per account holder.
Aggregated activity. Every trade sorted into a reportable bucket by direction and asset, then counted, summed in units, and valued. Crypto-to-crypto, crypto-to-fiat, and retail payment transactions. Gross only. CARF asks for activity rather than tax, so there is no cost basis, no realised gain, and no field anywhere in the schema for tax withheld.
Transfers and destination. Every transfer is coded by reason on the way in: airdrop, staking, mining, hard fork, or other. On the way out, each destination carries a different disclosure rule. A transfer to a regulated provider names the provider and keeps the wallet address out of the file. A transfer to an unhosted wallet discloses the full address.
That second layer is where most of the exposure sits. A regulated-to-regulated transfer stays low friction. A transfer to an unhosted wallet puts a full on-chain address into a cross-border tax filing.
Why This Matters Now
The deadline is fixed and the data is already accruing. Every trade and transfer since 1 January 2026 forms part of what eventually gets filed, whether or not the process to produce that filing exists yet.
Book a CARF readiness review to see where your data stands today.
Interested in TRES?
