OECD CARF

What is CARF, and how does it differ from the common assumption that "this is just an EU rule"?

When many people first hear about cross-border crypto information exchange, they intuitively think of the EU's DAC8, since that's the most commonly discussed specific regulation. But CARF (the Crypto-Asset Reporting Framework) is actually a higher-level, broader international standard developed by the OECD (Organisation for Economic Co-operation and Development), and DAC8 is just one implementation of that international standard translated into concrete legal obligations within the EU.

This means CARF's participation extends far beyond the EU — more than 48 jurisdictions have currently committed to implementing it, including non-EU countries like the UK, Japan, South Korea, Australia, and Canada. Understanding it as merely "an EU rule" seriously underestimates the actual geographic scope this mechanism covers, and can also lead to misjudging whether you're affected — even if neither your tax residency nor the exchange you use is in the EU, you may still fall within CARF's coverage.

Why is an international standard that sits above individual regional regulations needed, and what problem does this mechanism solve?

Before CARF, different countries' approaches to advancing crypto tax transparency were fragmented — even if one country's domestic legislation required exchanges to report data, as long as an investor used an exchange in another country without a similar requirement, the information gap persisted. This fragmented state made cross-border asset allocation a natural channel for evading reporting obligations — investors could strategically place assets in jurisdictions with more lenient reporting requirements, making it difficult for tax authorities to see the full picture.

CARF's design logic works through the OECD as a cross-border coordination platform, getting most major economies to adopt the same data collection and exchange standard, systematically closing off the path of "just switch to an exchange in another country to evade reporting." This also explains why the number of participating countries is itself a key measure of this mechanism's effectiveness — the more countries that participate, the smaller the exploitable room in cross-border information gaps becomes, which is also why the OECD continuously publishes updates to the list of jurisdictions that have committed to implementation — that list itself functions as a public progress-tracking mechanism.

How does CARF actually work, and how do different roles' obligations differ?

This mechanism primarily involves three roles:

1. Reporting Crypto-Asset Service Providers (RCASPs): including exchanges, custodians, and some wallet service providers — these are the entities actually responsible for collecting user data and filing reports, required to perform due diligence on users (confirming tax residency) and periodically report transaction data to the tax authority in their own jurisdiction
2. Each country's tax authority: responsible for collecting data from domestic service providers and, following the exchange mechanism CARF establishes, transmitting this data to the tax authorities of other participating countries where the relevant user is a tax resident
3. The investor (Reportable User): doesn't need to take any proactive reporting action toward the CARF mechanism itself, but is required to cooperate with the service provider's due diligence procedures (such as providing a tax residency declaration), and their own transaction data gets recorded and transmitted through this entire mechanism

In practice, the CARF impact an investor typically notices is being asked to provide more detailed identity and tax residency information when opening or maintaining an exchange account — this is the concrete manifestation of the RCASP fulfilling its due diligence obligation.

What does CARF actually mean for me, and what risks should I watch for?

The most direct impact is that if the exchange or service provider you use is located in a jurisdiction that has committed to implementing CARF, your transaction data is likely already being collected, even if cross-border exchange hasn't actually happened yet. This means the urgency of assessing whether your past reporting has been complete is rising — CARF's data collection doesn't wait until you're personally ready to begin; this is noticeably different from the previous environment of "information scattered, hard to track."

Another easily overlooked risk is that determining whether you're affected by CARF can't be based solely on where your tax residency is — you also need to consider which jurisdiction the service provider you actually use is located in. Even if your own tax residency country hasn't committed to participating in CARF, as long as the exchange you use is located in a jurisdiction that has committed, that exchange may still need to collect and report your data. In practice, it's advisable to confirm the jurisdiction each exchange or service provider you use is located in, cross-reference it against CARF's list of committed jurisdictions, and assess your own data collection status — rather than assuming you're unaffected just because you haven't proactively received a notification.