El reporte CARF se basa en datos de 2026 y vence en 2027: autocertificaciones, NIF, residencia fiscal y personas de control.
The first CARF exchange has not happened yet, but the reporting year that feeds it is already running. The quality of a 2027 report is being decided by onboarding forms today.
What is CARF, and when does reporting actually start?
The OECD Crypto-Asset Reporting Framework (CARF) is the automatic-exchange standard for crypto-asset transactions, adopted alongside amendments that expand the Common Reporting Standard. Reporting Crypto-Asset Service Providers (RCASPs) must run due diligence on their users and report specified transaction and account information annually to their domestic tax authority for exchange with partner jurisdictions. Jersey’s implementation runs from 1 January 2026, and its guidance points to a first reporting deadline of 30 June 2027 for the 2026 period. As of 23 June 2026, 46 jurisdictions had committed to implement CARF for the 2026 reporting period, with 29 more for 2027 and one for 2028 — so “first reporting year” is a present-tense operational fact, not a future project.
Commitment is not the same as a live exchange relationship
A jurisdiction is reportable for a given period only where an active exchange agreement covering CARF is in place and the jurisdiction appears on the published reportable list. Jersey’s list for the 2026 period, as at 22 July 2026, named 19 jurisdictions and is expected to grow as agreements are completed. Reporting populations therefore need to be re-derived from current lists at reporting time, not hard-coded at onboarding.
What must an RCASP collect, and from whom?
Due diligence comes first and is broader than reporting. RCASPs must collect due-diligence information — including taxpayer identification numbers (TINs) and jurisdiction or jurisdictions of tax residence — for all users, typically through self-certification. Reporting then narrows to users identified as reportable users, and to controlling persons of entity users who are themselves reportable persons. That two-step shape will be familiar to CRS teams: collect for everyone, report for the in-scope population, and be able to show how each person was classified.
- Self-certification of tax residence for every user, individual and entity.
- TIN for each claimed residence, with a tracked path for users who cannot yet provide one.
- For entity users, identification of controlling persons and their residences.
- A classification record: why this user is, or is not, reportable for this period.
- Change-in-circumstances handling when residence, control, or account facts change mid-year.
Why is the controlling-person step the hard part?
For entity users, CARF follows the CRS look-through logic: where an entity user is not itself an active or otherwise excluded entity, the RCASP must look through to the natural persons who control it and test their reportability. That work depends on beneficial-ownership and control evidence that many firms already collect for KYC — registers, declarations, structure charts, and the reasoning that resolved ambiguous control. Where CARF due diligence is run as a separate exercise, the same facts get collected twice and can quietly diverge. Where the ownership record is shared, a change in control can trigger both the KYC refresh and the reporting-classification review from one event.
Reasonableness checks need the KYC file
A self-certification cannot be accepted blindly where other information the firm holds contradicts it. Validating residence claims against onboarding documents, addresses, and account behaviour requires the tax-reporting process to read from the same customer record as the AML process — and to document what was checked when the two appear to disagree.
How should teams prepare during the first reporting year?
Because 2026 data feeds 2027 reports, preparation is mostly remediation done early: find the gaps while users are still active and contactable, and fix the record rather than the eventual report.
- Inventory the user base: Identify individual and entity users in scope of CARF due diligence, and the transactions that will be reportable if the user is a reportable user.
- Test self-certification coverage: Measure how many users have a valid self-certification with residence and TIN; queue outreach for the gaps, oldest and highest-value first.
- Resolve controlling persons: For entity users, confirm controlling-person identification is current and evidenced, reusing the beneficial-ownership record where it exists.
- Dry-run the reporting population: Derive the reportable population from current reportable-jurisdiction lists and reconcile it to the due-diligence record before the filing season.
What does CARF change for firms that already run CRS?
Less than the acronym suggests, and more than a copy-paste. The disciplines transfer — self-certification, indicia and reasonableness checks, controlling-person look-through, annual reporting cycles, and correction handling. The differences sit in scope and data: crypto-asset service providers rather than financial institutions, transaction-level reporting categories, and a user base that may never have completed a tax self-certification before. Firms that treat CARF as a second reporting view over one owned customer record will scale it; firms that build a parallel spreadsheet regime will spend every reporting season reconciling two versions of the same customer.
What should the first dry run actually reconcile?
A dry run that only counts reportable users will miss the failures that matter at exchange time. Reconcile in both directions: every reportable user in the reporting population should trace back to a valid self-certification, a residence determination, and — for entity users — a controlling-person record that still matches the ownership evidence on file. Every excluded user should carry a reason a reviewer can test: out-of-scope service, non-reportable residence for this period, or an entity classification that does not require look-through. Then test the joins that usually break quietly: users whose residence changed during the year, accounts opened before self-certification was wired into onboarding, and controlling persons identified for KYC under a name spelling that does not match the tax record. The output of the exercise is not a cleaner spreadsheet; it is a short list of record defects with owners and dates, closed while the reporting year is still running and the users involved can still be reached. That is what makes the eventual filing a rendering of the record rather than an annual reconstruction of it.
Practical takeaways
- CARF applies to the 2026 reporting period in early-adopter jurisdictions, with first reporting deadlines falling in 2027.
- Due diligence is owed for all users — self-certification, tax residence, and TIN — while reporting covers reportable users and their controlling persons.
- Controlling-person look-through reuses beneficial-ownership evidence; teams that keep one record avoid collecting the same facts twice.
Conclusion
CARF extends the logic tax teams already know from FATCA and CRS to crypto-asset activity: classify, collect self-certifications, validate against what you hold, and report on a fixed annual cycle. The operational risk is timing. Because the first reports draw on the 2026 period, missing TINs, stale residences, and unexamined controlling persons cannot be repaired at filing time. Treat the due-diligence record as the product and the annual report as its extract, and the 2027 deadlines become a reporting exercise rather than a remediation project.
Explore related KYCONSOLE capabilities
Sources
- Government of Jersey — Crypto-Asset Reporting Framework (CARF) and expansion of CRS
- OECD — Jurisdictions committed to implement the Crypto-Asset Reporting Framework
Explore how KYCONSOLE keeps tax-residence, ownership, and reporting evidence connected for cross-border work. Explore capabilities