.svg)
The Organisation for Economic Co-operation and Development’s (OECD) new multilateral reporting framework aims to address tax evasion and tax avoidance in the crypto-asset sector through information sharing and standardisation.
The Crypto-Asset Reporting Framework (CARF) is a global tax transparency initiative that will automate and standardise the exchange of crypto-related tax information between regulators.
Under CARF, tax information provided by reporting crypto-asset service providers (RCASPs) will be shared with the tax authorities of relevant participating jurisdictions on an annual basis.
The framework also provides for mandatory registration for reporting purposes, with penalties for non-compliance set under domestic law.
CARF was finalised in 2023, following concerns that the rapid growth of the crypto-asset sector risked undermining the tax transparency gains achieved since 2014, when the OECD introduced its Common Reporting Standards (CRS).
The CRS targets traditional financial assets and financial institutions, and has since become a key tool in addressing offshore tax evasion.
CARF aims to replicate this success by applying similar rules to an asset class that has historically sat outside of traditional financial reporting regimes.
The new framework consists of three distinct components that must be implemented by each participating jurisdiction:
- Rules and related commentary that can be transposed into domestic law to collect information from RCASPs.
- A multilateral competent authority agreement enabling automatic exchange of information under CARF, supported by commentary (or, where applicable, bilateral agreements).
- An electronic reporting format (XML schema) to be used by competent authorities for information exchange, and by RCASPs when reporting to tax administrations, as required under domestic law.
The regime marks a decisive shift in how crypto-asset activity is treated for tax transparency purposes, both domestically and internationally.
From policy framework to UK law
The UK is among the 48 jurisdictions that have committed to implement CARF requirements in time for the first annual exchange of information under the framework in 2027.
CARF requirements have been implemented in the UK via secondary legislation, adding new reporting and due diligence provisions to the UK’s existing international tax transparency framework overseen by HM Revenue & Customs (HMRC).
The rules apply from January 1, 2026, but the first reporting cycle, covering activity during the 2026 calendar year, will not be submitted to HMRC until 2027.
However, this delayed reporting start should not be mistaken for a grace period. CARF relies heavily on transaction-level data collection, user due diligence and system design choices that cannot be retrofitted easily.
For in-scope firms, 2026 is the year in which data must be captured correctly, even if it is not yet submitted.
Who and what is in scope?
CARF applies to RCASPs that, as a commercial activity, facilitate crypto-asset trades, transfers or payments on behalf of customers.
In-scope businesses include crypto exchanges, brokers, wallet providers, payments firms and crypto ATMs, as well as certain non-custodial and decentralised finance (DeFi) entities where a single party exercises sufficient control.
In the UK context, HMRC notes that “approximately 50 RCASPs” are currently in-scope. This broadly corresponds to the 55 crypto-asset firms that are currently registered with the Financial Conduct Authority (FCA) under the 2017 Money Laundering Regulations (MLRs).
However, as Vixio has covered previously, the FCA is developing a new comprehensive regulatory framework, set to take effect from October 2027, which will expand the range of crypto-asset activities that will require firms to register with the FCA.
Under CARF, in-scope crypto-assets are described as “relevant” crypto-assets, and the criteria for these assets are deliberately wide, capturing most cryptocurrencies and stablecoins, along with certain non-fungible tokens (NFTs).
Assets such as central bank digital currencies (CBDCs) and regulated electronic money products are excluded from CARF, but are brought into scope via targeted CRS updates.
For traditional financial institutions, CARF and CRS are designed to operate side by side.
Direct crypto-asset transactions are generally reportable under CARF, whereas indirect exposure through funds, derivatives or tokenised securities is reportable under CRS.
For firms that straddle both frameworks, the compliance challenge is not in choosing one regime over the other, but rather in ensuring that assets and transactions are mapped correctly between them.
Automatic exchange is the real change
The most consequential feature of CARF is that reporting information collected domestically from firms will be automatically exchanged with tax authorities in other participating jurisdictions.
The 48 jurisdictions that will take part in the first exchange in 2027 include not only the G20 and major EU economies, but also a number of jurisdictions that have historically been viewed as offshore tax havens.
The Cayman Islands, Jersey, Guernsey and the Isle of Man, for example, will participate in the 2027 annual reporting and exchange cycle.
In 2028, they will be joined by a further 27 jurisdictions, which again includes several jurisdictions that are considered offshore tax havens, namely the Bahamas, Bermuda, the British Virgin Islands, Cyprus, Panama and the UAE.
Finally, in 2029, the US is due to take part in the third annual reporting and exchange cycle.
For firms accustomed to managing regulatory exposure on a country-by-country basis, this represents a major operational shift and poses new risks of non-compliance.
Information reported once will be disseminated widely across jurisdictions with different tax rules, enforcement cultures and risk appetites, meaning that errors, inconsistencies or gaps in the data will no longer be contained locally.
Regulatory arbitrage is narrowing fast
One of CARF’s explicit policy objectives is to reduce opportunities for regulatory and tax arbitrage in the crypto-asset sector, and the list of committed participants underscores how seriously the OECD is taking this goal.
Jurisdictions often cited as alternative domiciles for crypto businesses – whether for tax efficiency, regulatory flexibility or historical confidentiality – are not sitting outside of the framework. Many are early adopters, and others will follow within a year.
At the same time, the OECD has identified five “relevant” jurisdictions that have not yet formally committed to CARF: Argentina, El Salvador, Georgia, India and Vietnam.
India and Vietnam are among the world’s largest retail crypto markets, Argentina has seen sustained crypto adoption in response to high inflation and currency controls, and El Salvador and Georgia have both positioned themselves as crypto-friendly jurisdictions.
The designation of these jurisdictions as relevant signals the direction of travel among regulators. Although commitment to CARF is currently patchy, the expectation of eventual inclusion is clear.
For firms designing compliance frameworks today, building around current gaps in geographic coverage is therefore a risky strategy, given CARF’s clear trajectory towards near-global adoption.
