Tax Rules · September 17, 2026 · 14 min read · By CryptoTaxCalc Team

CARF 2027: The End of Anonymous Crypto? 7-Country Reporting Rules

In 2026, crypto exchanges start reporting your name, tax number, wallets and annual trade totals. In 2027, that data flies automatically to tax authorities in 48+ countries. Here's how CARF works, how DAC8 plugs it into EU law, and where the US, UK, Germany, Canada, Australia, Japan and India actually stand.

Image: Illustrative purposes. Rules cited from the OECD CARF (2022, finalised 2023), EU Directive 2023/2226 (DAC8), HMRC/HMT CARF regulations, Canada Budget 2024, Australian Treasury exposure draft, Japan 2026 tax reform and India CBDT Rules 2025.

I'll admit something slightly embarrassing. Back in 2021 I opened an account on an exchange based in a country I didn't live in. I did the KYC, uploaded a passport, moved some ETH through it, and quietly assumed my home tax authority would never connect that account to me. The platform was foreign. The balance was in crypto. Who was going to tell?

Starting in 2027, the answer is automatic. That exchange — or whatever bank or fintech acquired it — will hand my name, my tax identification number, my wallet addresses and my annual transaction totals to its own tax authority. That authority will then forward the file to mine. No treaty request. No auditor. No human decision anywhere in the chain.

The machine doing this has a name: CARF, the OECD's Crypto-Asset Reporting Framework. People in the tax world call it the CRS for crypto, and the shorthand "CRS crypto 2027" is starting to show up in compliance decks everywhere. Honestly, I think it's the biggest change in crypto taxation since the IRS declared Bitcoin property in 2014. Here's what it actually does.

1. What CARF is, and why it exists

CARF is a rulebook published by the OECD — first in 2022, finalised in 2023 — that tells countries how to force crypto service providers to report their customers for tax purposes. It's modelled directly on the Common Reporting Standard, which since 2017 has made banks automatically report foreign account holders to 120-plus tax authorities. If you've ever had a bank in Europe ask you to sign a tax-residency self-certification, that was CRS. CARF copies that plumbing and points it at exchanges.

The mechanism is three steps:

• Due diligence. When you open an account, the platform collects a self-certification with your name, address, date and place of birth, tax-residence country (or countries) and taxpayer identification number. Pre-existing accounts had to be reviewed and remediated too.
• Annual reporting. Each year, the so-called Reporting Crypto-Asset Service Provider (RCSP) files a report on you with its domestic tax authority — wallet addresses, gross proceeds, transfer totals, balances, the lot.
• Automatic exchange. The tax authority sends your data, automatically and in bulk, to every jurisdiction where you're a tax resident, under the CARF Multilateral Competent Authority Agreement (MCAA).

The timeline everyone is working toward: 2026 is the first reporting year, meaning platforms track and file data for the 2026 calendar year, and 2027 is the first mass automatic exchange, when tax authorities swap those files. A handful of jurisdictions have built faster tracks and may start exchanging limited data in 2026, but 2027 is the year the network effect really bites.

As of mid-2026, more than 48 jurisdictions have formally committed — all 27 EU member states via DAC8, plus the UK, Japan, South Korea, Canada, Australia, Singapore, India, Brazil and others. That's most of the world's crypto trading volume outside one conspicuous exception we'll get to.

2. Who reports, and exactly what gets sent

An RCSP is, in plain English, any business that effects exchanges or transfers of crypto-assets for customers. In practice that covers the entities you actually use:

• centralised exchanges — Coinbase, Kraken, Binance's regulated entities, Bitflyer, CoinSwitch and the rest;
• broker-dealers and payment processors that settle crypto trades;
• crypto ATM (kiosk) operators, which several jurisdictions explicitly pulled into scope;
• custodial wallet providers — anyone who holds the keys on your behalf.

What they send is more detailed than most people expect. Identity data first: legal name, residential address, jurisdiction(s) of tax residence, TIN, date and place of birth. Then the financial data: all wallet addresses associated with the account, the aggregate gross amount paid or credited during the year broken out by type of crypto-asset, transaction-level detail for certain transfers, and in some implementations the year-end balance. Fiat-only payments that merely touch a stablecoin at the back end are in scope if the service provider is an RCSP.

Two details in the standard deserve their own paragraphs because they cause the most questions.

Non-custodial wallets don't report — but nothing is private. MetaMask, Rabby, a Ledger, a node you run yourself: there is no legal person behind them holding your identity, so nothing files a CARF report in your name from that side. What changes is everything around them. Your exchange reports every transfer it sends to your hardware wallet, the blockchain permanently records the movement, and your own legal duty — capital-gains self-assessment in the UK, Form 8949 in the US, Einkommensteuererklärung in Germany — is completely untouched. CARF narrows the gap between what you could hide and what you can prove. It does not legalise non-reporting.

The $50,000 unhosted-wallet threshold. When an RCSP sends transfers totalling more than USD 50,000 in a year to a wallet it doesn't host — your hardware wallet, a DeFi contract, someone else's self-custody address — the framework's due-diligence rules require the platform to obtain and verify documentation proving who controls that wallet, and to keep transaction-level records of the transfers. Parallel US broker regulations use the same threshold. Moving $60,000 of BTC to your own Ledger is not a taxable event. But the exchange now has to be able to show a regulator whose Ledger it was. "Not your keys, not your coins" remains true. "Not your keys, nobody sees" was never true on-chain, and from 2026 it isn't true at the ramp either.

3. DAC8: CARF wearing a European suit

If CARF is the OECD's global template, DAC8 is the law that force-feeds it to the European Union. Council Directive (EU) 2023/2226, adopted in October 2023, amended the old Administrative Cooperation Directive so that CARF's due diligence, reporting and automatic-exchange rules become directly binding on every member state.

The dates that matter for anyone filing in Europe: the reporting period begins 1 January 2026, national filings follow in early 2027, and the first EU-wide automatic exchange between member states — and to non-EU CARF partners — happens during 2027. Member states had to write DAC8 into national law by the end of 2025; in Germany that means amendments to the Abgabenordnung (the fiscal code), with the Bundeszentralamt für Steuern running the exchange.

DAC8 is actually broader than CARF in a few ways. It adds e-money tokens and certain central-bank digital currency settlements, it requires ten years of record retention, and it introduces the hall-of-mirrors "mandatory disclosure" regime where advisers must flag certain cross-border crypto tax arrangements. But the core is CARF: when people ask me the difference, I say CARF is the standard and DAC8 is the vehicle. Germany, France, Italy, Spain and the other 23 don't sign the MCAA as a stand-alone crypto deal — they get the whole package through Brussels.

4. Seven countries, seven rollouts

I tracked the current status for the seven countries this site covers. The destination is the same everywhere; the legal vehicles and timelines differ.

United States — the holdout with its own machine. The US Treasury publicly supports CARF and has run technical pilots, but America has not signed the MCAA. Washington prefers unilateral leverage: broker reporting under Internal Revenue Code §6045, delivered through Form 1099-DA (first issued for the 2025 tax year), plus FATCA-style bilateral reciprocal agreements negotiated country by country. Talks with EU capitals and London are grinding forward. For a US taxpayer the practical result isn't invisibility — foreign platforms identify Americans at onboarding and many report them under FATCA anyway — it's duplication. You'll be inside two overlapping systems.

United Kingdom — first mover. The UK signed the MCAA early and HMRC is running one of the faster implementations. British regulations require RCSPs to collect due-diligence certificates on the DAC8 timetable, with HMRC expecting its first exchanged datasets in 2026 and the full steady-state cycle covering the 2026 reporting year in 2027. If you're a UK resident using an offshore exchange, assume HMRC already knows the account exists by the time you file your 2027 Self Assessment.

Germany — DAC8, no short cuts. Germany implements CARF purely through the EU directive. The Berlin finance ministry completed the national transposition into the Abgabenordnung, platforms begin reporting on 1 January 2026, and the BZSt exchanges data with partner authorities through 2027. Pair that with Germany's existing strict world-wide crypto taxation and the one-year holding rule, and the reporting net here is among the tightest anywhere.

Canada — Budget 2024 did the heavy lifting. The CRA's CARF regime was legislated through the 2024 federal budget's amendments to the Income Tax Act, with reporting starting in 2026 and the first exchange in 2027. Canadian-resident users of foreign platforms are the main target group — historically one of the biggest blind spots in CRA crypto compliance.

Australia — legislation lands in 2026. Canberra signed the MCAA, consulted on exposure drafts through 2025, and introduced the implementing legislation in 2026. The ATO's timeline mirrors Canada's: 2026 data, first exchange in 2027. The ATO already matches Australian bank data and fund flows, so CARF slots into a compliance machine that's unusually well warmed up.

Japan — the 2026 tax reform. Japan signed the MCAA and enacted its RCSP reporting rules through the 2026 tax-reform package, amending the special tax measures law that already handles cross-border payment reporting. The National Tax Agency's first automatic exchange follows in 2027. Given Japan taxes active crypto gains as miscellaneous income at rates up to 55%, the revenue case for enforcement was never in doubt.

India — CBDT moved quickly. India signed the MCAA and the Central Board of Direct Taxes notified its implementing rules in 2025 under the Income Tax Rules, layering CARF on top of the existing 30% VDA tax and 1% TDS machinery. Early data exchanges could begin in 2026, with full participation from 2027. Indian exchanges already deduct TDS on transfers; CARF gives the CBDT the matching data on every foreign platform an Indian resident touches.

5. What changes for a normal person

Here's the thing most explainers skip: CARF doesn't raise tax rates or create new taxes. It changes visibility. And visibility, in tax enforcement, is basically everything.

The offshore-exchange era is over. For years, a chunk of crypto tax planning consisted of routing activity through a platform in a jurisdiction your home authority couldn't easily reach. Under automatic exchange, the platform's authority hands your file over as a matter of routine. Choosing an exchange by its flag stops being a privacy strategy in 2026. The only platforms outside the net will be unhosted wallets — which means you alone carry the full reporting burden.

One account opening now means visibility in several countries. When you tick that tax-residency box on onboarding, you're not informing one company. You're telling it which governments to mail your annual statement to. Dual residents, green-card holders living abroad, students, digital nomads and recent migrants are the highest-risk group: tick the wrong country — or leave an old address on file after you move — and your data lands with the wrong authority, which looks like evasion rather than an admin error. I wrote about how residency transitions interact with crypto tax in this guide.

Datasets will be crossed against each other. In the US, the IRS already receives your 1099-DA from domestic brokers. From 2027 it also expects CARF-derived information sharing through whatever bilateral channel replaces the MCAA. A foreign exchange showing $200,000 of proceeds with nothing on your Form 8949 is the cleanest possible audit trigger — automated, numeric, no judgement required. This is exactly the mismatch profile that feeds the campaigns I broke down in the guide to IRS crypto audits and CP2000 letters.

There's no "small fish" exemption. CRS essentially has no de minimis for individual accounts, and CARF follows the same philosophy. The thresholds that exist (like the $50,000 unhosted-wallet documentation trigger) concern what's collected, not who's reported. A $400 account still gets a record. The machine doesn't care about size; it cares about matching rows.

6. Your 2026 action list

CARF is one of those rare moments where six hours of paperwork now genuinely saves years of grief later. This is what I'm doing myself, in order.

• Fix your identity records on every platform. Log into each exchange and confirm the email, residential address, country of tax residence and TIN. If you've moved countries, update the record before the first filing snapshot is taken. A stale address is the most common reason CARF data gets sent to the wrong authority.
• Build the complete inventory. List every platform you've ever used — including dead ones like FTX or Celsius, accounts you think you closed, and that exchange you tried once in 2019. CARF remediation reaches back into pre-existing accounts, so assume dormant ones still hold records with your name on them.
• Download all historical CSVs now. Exchanges prune trade history, close accounts and get acquired. Reconstructing 2021 trades from on-chain data and email receipts is a miserable weekend. Pull every annual transaction and gain/loss file while you still can, and drop them into the free batch CSV import on this site — it runs locally in your browser, applies US FIFO, UK same-day/30-day and German rules, and needs no signup.
• Estimate gains, then losses. Once the CSVs are in, run the numbers for each tax year. If 2026 is showing unrealised gains against a portfolio full of 2021-era losers, the tax-loss harvesting calculator will show you what harvesting before year-end can actually offset — in the US wash-sale constraints are still debated for crypto, but don't assume the current window stays open forever.
• Repair history before the data lands. If the exercise turns up years you didn't report, amend returns or use a voluntary disclosure route while you still can. The IRS streamlined procedures, HMRC's Worldwide Disclosure Facility and equivalents in Canada, Australia, Germany, Japan and India all treat coming forward dramatically better than being matched. Walk in before your file does.

If you want the blunt version of why step five matters, read what happens when you simply don't report crypto. Under CARF, "I didn't know" stops being believable the moment a government-produced spreadsheet with your TIN on it arrives first.

Bottom line

CARF isn't a tax increase. It's the end of the information gap that made anonymous offshore crypto activity possible. Reports start in 2026, the first automatic exchange sweeps 48-plus jurisdictions in 2027, the EU runs the whole thing through DAC8, and even the American holdout already has 1099-DA doing the same job from the other direction. Non-custodial wallets stay outside the reporting perimeter, but the ramps into them don't, and the $50,000 documentation rule means large self-custody moves come with identity homework. The move is the same one every generation of offshore finance eventually makes: secrecy to transparency, requests to automation, don't-ask to already-know. Get your records straight before the first file with your name on it travels.

General information, not tax advice. CARF implementation timelines and national regulations are still being finalised in several jurisdictions, and US participation may change as bilateral agreements are signed. For material amounts or multi-country residency, speak with a tax professional in each relevant country.

FAQ