The OECD Crypto-Asset Reporting Framework went live in committed jurisdictions on 1 January 2026. First reports cover calendar-year 2026 data, with first international exchanges of information in 2027. The window between "the rules are now law" and "your first report is due" is short, and most Reporting Crypto-Asset Service Providers (RCASPs) are now mid-implementation.
This guide is a practical, step-by-step CARF implementation checklist for compliance teams at exchanges, brokers, custodians, dealers, ATM operators, and traditional financial institutions that have added crypto products. It covers the OECD framework, EU DAC8, UK CARF, and US 1099-DA, the data requirements, and a five-phase implementation path that ships a working program by Q4 2026.
CARF live, no slippage. The OECD's CARF rules came into effect from 1 January 2026 in committed jurisdictions, with first reporting and exchange of information in 2027 covering calendar-year 2026 data (OECD, CARF 2025 Monitoring and Implementation Update, November 2025).
Approximately 76 committed jurisdictions, staggered. 46 jurisdictions are committed to first exchanges by 2027 (UK, all EU-27, Japan, Canada, Switzerland, Cayman, Jersey, Guernsey, and others); approximately 29 by 2028 (Singapore, Hong Kong (China), UAE, Bahamas, BVI, Türkiye); the United States targeting 2029. See the full list of jurisdictions that have signed the CARF Multilateral Competent Authority Agreement (OECD, Jurisdictions Committed to Implement the CARF).
EU DAC8 transposition deadline 31 December 2025; uneven Member-State compliance. EU Member States were required to transpose DAC8 by 31 December 2025 and apply it from 1 January 2026; first reporting period is FY2026 with reports due by 31 January 2027 and competent-authority exchange by 30 September 2027.
The implication for compliance leaders: there is no longer headroom on the timeline. The 2026 program is the program.
A Reporting Crypto-Asset Service Provider is any individual or entity providing services that effectuate exchange transactions in relevant crypto-assets for or on behalf of customers. The OECD's CARF FAQ articulates the scope and the carve-outs.
Inside scope:
Outside scope:
The boundary between custodial-and-in-scope and non-custodial-and-out-of-scope is the most important determination most RCASPs will make early in their implementation. Get it wrong and the program is either over-scoped (cost) or under-scoped (penalty exposure).
CARF applies to crypto-assets that can be held and transferred in a decentralised manner using cryptographically secured distributed ledger technology.
For each User the RCASP must capture:
For each transaction type, separately:
Fair market value must be determined at transaction time in fiat in a consistent manner across asset classes, with stored evidence of the pricing source.
CARF was designed to interoperate with the amended CRS rather than overlap with it.
CRS 2.0 closes the gaps CARF leaves. The OECD's June 2023 amendments expand CRS to include SEMPs and CBDCs as Depository Accounts, add new due-diligence requirements, and harmonise XML schemas with CARF. Anti-overlap rules: gross-proceeds reporting under CRS is switched off where the same data is reported under CARF; CRS due diligence may be relied on for CARF and vice versa.
MiCA and the Travel Rule sit alongside. EU MiCA sets prudential and authorisation requirements for crypto-asset service providers. The FATF Travel Rule mandates originator and beneficiary information accompany crypto transfers above thresholds. Neither replaces CARF reporting.
1099-DA in the United States. The US committed to first CARF exchanges in 2029, but Form 1099-DA reporting begins with 2026 transactions for digital-asset brokers. Standard IRC §6721/§6722 information-return penalties apply, currently around USD 310 per return capped in the multi-million range.
For multi-jurisdiction RCASPs, the practical consequence is that one customer transaction can produce reporting obligations under CARF, CRS, 1099-DA, and a MiCA filing — each with different schemas. A single underlying ledger that maps to all four output formats is the only sustainable architecture.
EU / DAC8. Member States must set "effective, proportionate, dissuasive" penalties; the directive's recitals reference fines in the EUR 20,000 to EUR 500,000 range, with several Member States layering turnover-percentage fines and MiCA passport revocation.
United Kingdom. Up to GBP 300 per inaccurate, incomplete, or unverified user record; further penalties for due-diligence, record-keeping, and late-filing failures; users supplying wrong information also face up to GBP 300 fines.
United States. No CARF-specific penalty yet; standard 1099-DA penalties apply.
This is the sequence that ships a working CARF program by the end of 2026.
CARF is, structurally, a CRS-style reporting regime applied to crypto. The data model — self-certification, controlling-person look-through, jurisdiction-specific schema, audit trail, error-correction loop — is the same shape as FATCA and CRS.
Trans World Compliance's CRS/FATCA One platform was built for that data model, and the architecture maps to CARF and DAC8 reporting workflows. Institutions that already run CRS and FATCA on a unified platform have a substantial head start on CARF: the classification engine, audit trail, validation rules, and multi-jurisdiction reporting layer carry over.
For groups operating in NTJ jurisdictions where economic substance overlaps with crypto activities — Cayman, BVI, Bahamas, Bermuda — TACS handles the substance side on the same data foundation.
When does CARF start and when is the first exchange? CARF data collection began 1 January 2026 in committed jurisdictions. The first reports cover calendar-year 2026 data, with first international exchanges of information in 2027.
How many jurisdictions have committed to CARF? Approximately 67. Around 52 jurisdictions are committed to first exchanges by 2027 (UK, all EU-27, Japan, Canada, Switzerland, Cayman, Jersey, Guernsey, others), approximately 15 by 2028 (Singapore, Hong Kong (China), UAE, Bahamas, BVI, Türkiye), and the United States is targeting 2029.
Who has to report under CARF? Reporting Crypto-Asset Service Providers — centralised exchanges, brokers and dealers, custodial wallet providers, crypto ATM operators, and certain DeFi intermediaries that exercise sufficient control over the transaction. Non-custodial wallet software and pure peer-to-peer protocols without a service layer are generally outside scope.
What is DAC8 and how does it relate to CARF? DAC8 is the EU directive that transposes CARF into EU law. Member States were required to transpose DAC8 by 31 December 2025 and apply it from 1 January 2026. First reports are due by 31 January 2027 covering FY2026 data, with competent-authority exchange by 30 September 2027.
What is the UK CARF deadline? The UK Reporting Cryptoasset Service Providers Regulations 2025 came into force 1 January 2026. First reports are due 31 May 2027.
Are NFTs reportable under CARF? Tradeable NFTs are reportable. The OECD provides a four-part test in its CARF FAQ to identify out-of-scope NFTs (e.g., used solely as collectibles, not as an investment or payment instrument). CBDCs and Specified Electronic Money Products are excluded from CARF and instead reported under the amended CRS.
What are the penalties for CARF non-compliance? EU DAC8 references fines in the EUR 20,000 to EUR 500,000 range, with several Member States layering turnover-percentage fines and MiCA passport revocation. The UK applies up to GBP 300 per inaccurate, incomplete, or unverified user record, with further penalties for due-diligence, record-keeping, and late-filing failures.