CARF (Crypto-Asset Reporting Framework)

The Crypto-Asset Reporting Framework (CARF) is the OECD’s international standard for the automatic exchange of tax information relating to crypto asset transactions. Developed in 2022 in response to a G20 mandate, CARF adapts the information exchange model of the Common Reporting Standard (CRS) — which has been used for financial account reporting since 2017 — to crypto asset service providers. It is the most significant development in international crypto tax enforcement policy and will, when fully implemented, expose holders of offshore crypto accounts to their home tax authorities for the first time.

Background and Development

The OECD developed CARF to address a specific and growing concern: as CRS progressively closed offshore bank account secrecy, crypto assets were emerging as a potential substitute vehicle for offshore tax evasion. A taxpayer who had previously hidden assets in an undisclosed Swiss bank account — information now exchanged automatically with their home tax authority under CRS — could potentially achieve similar opacity by holding crypto at an exchange in a non-CRS jurisdiction or by self-hosting assets in a hardware wallet with no reporting obligation. CARF was designed to close this gap by applying CRS-like automatic exchange obligations to crypto service providers.

The framework was developed by the OECD’s Working Party 10 on Exchange of Information and Tax Compliance, endorsed by the G20 Finance Ministers in October 2022, and subsequently adopted by 75+ jurisdictions as part of their international tax cooperation commitments.

Reporting Crypto-Asset Service Providers

CARF imposes reporting obligations on Reporting Crypto-Asset Service Providers (RCASPs) — entities that, as a business, provide services effectuating exchange transactions in crypto assets for, or on behalf of, customers, including crypto-to-fiat exchange, crypto-to-crypto exchange, transfer services, and participation in token offerings. The RCASP definition is broadly aligned with the FATF VASP definition, though with some technical differences reflecting the tax rather than AML purpose.

RCASPs must collect customer due diligence information — name, address, date of birth, Tax Identification Number (TIN), and tax residency — for each reportable customer. They must then report to their domestic tax authority: for each customer, the aggregate value of transactions in each crypto asset type, the aggregate of consideration received and paid, and the number of units and aggregate value of transfers to and from accounts not associated with a financial institution or VASP. Tax authorities then exchange this information automatically with the tax authorities of the customers’ countries of residence.

Data Fields and Reporting

The required data elements are more granular than CRS in several respects. In addition to aggregate transaction amounts, RCASPs must report transfers involving unhosted wallets — transactions where the counterparty is an unhosted address — separately from VASP-to-VASP transfers. This is designed to capture scenarios where crypto assets move between the reporting service provider and self-hosted storage, providing tax authorities with visibility into asset movements that might otherwise be obscured. Specific crypto asset types are identified by name and type (fungible versus non-fungible), allowing tax authorities to cross-reference with market price data to calculate gain amounts.

The CRS Analogy and Differences

CARF is consciously modelled on CRS but with adaptations for the crypto asset context. Like CRS, it operates as a bilateral automatic exchange network: each participating jurisdiction’s tax authority collects from domestic RCASPs and exchanges with the tax authorities of customers’ residence countries. Unlike CRS, which covers financial accounts at reporting financial institutions (a relatively static and well-defined universe), CARF covers a dynamic and diverse population of service providers — from major centralised exchanges to smaller token-swap platforms — and must adapt to a rapidly evolving product landscape.

DeFi and NFT Gaps

CARF’s scope explicitly addresses the treatment of non-fungible tokens (NFTs) and DeFi. NFTs that are used for investment or payment purposes (as opposed to genuinely unique digital art with no financial instrument characteristics) are included in CARF’s scope. DeFi presents the same challenge for CARF as for AML regulation: where there is no identifiable service provider, there is no RCASP to report. CARF’s guidance note acknowledges that DeFi front-end operators with customers and transaction records may qualify as RCASPs, but the characterisation of fully autonomous DeFi protocols remains outside the framework’s reach.

US Non-Participation

The United States has not joined CARF as a signatory jurisdiction, a significant gap in the global information exchange network. The US operates its own FATCA-based information exchange regime, which is bilateral and does not currently incorporate CARF’s crypto-specific data elements. US-based crypto service providers are therefore not reporting to the CARF exchange, meaning that non-US customers of US exchanges do not have their transaction data automatically shared with their home tax authorities through CARF. This creates an information asymmetry exploitable by non-US taxpayers with access to US-based crypto platforms.

Implementation Timeline

Forty-eight jurisdictions committed to early adoption began implementation in 2025 for first exchange of data by June 30, 2027. A second wave of jurisdictions follows with first exchanges in 2028. National transposition of CARF requires domestic legislation designating RCASPs, specifying reporting requirements, and empowering the domestic tax authority to collect and exchange data. Several major jurisdictions — including the EU (through DAC8), the UK, Switzerland, and Japan — have passed or are in the process of passing the necessary domestic legislation.