The Organisation for Economic Cooperation and Development (OECD) developed the Common Reporting Standard (CRS) as a key tool to ensure cross-border transparency and reduce the opportunity for bank accounts to be used to hide offshore assets. Understandably, as the CRS was published in 2014, it did not bring cryptoassets into scope as they are, generally, not considered as a financial asset and they can be owned outside of financial intermediaries such as banks. To tackle this increasing information gap, the OECD began to develop the Cryptoasset Reporting Framework (CARF) in 2019 to increase the transparency of cryptoassets. 

Like the CRS, the CARF requires intermediaries to provide the relevant information. However, a key difference is that the CARF focuses on the transactions that reportable cryptoasset service providers (RCASPs) effectuate for their customers rather than providing year-end balances as the CRS does. But like the CRS, the CARF is an automatic exchange of information, with more than 60 jurisdictions committed to implementing it. HMRC and other tax administrations will not need to demonstrate any tax risk to receive the information. While cryptoassets are often considered to be untraceable, the CARF is making the world of cryptoassets ever more visible. 

HMRC recently published the legislation to bring the CARF into UK law. The effective commencement date is 1 January 2026, after which transactions will need to be recorded by exchanges to be reported to tax administrations. The first exchange of information will be in 2027. Owners of cryptoassets have recently come under increasing scrutiny from HMRC, and the CARF is likely to increase HMRC’s compliance activity. At the same time, amendments are being made to the original CRS agreement so that it better reflects current practices. We should expect the CARF to be amended on a more regular basis than has been the case for the CRS. 

The impact on individuals

HMRC is already able to obtain information relevant to individuals’ tax affairs from various sources. The information it will receive through the CARF and potentially under the amended CRS means that HMRC will receive more information about cryptoasset transactions that individuals have undertaken. The increased availability of information means that HMRC is likely to raise more questions about individuals’ tax affairs. This could include tax return enquiries into a specific individual’s tax affairs or sending ‘one-to-many’ letters to a number of taxpayers about whom HMRC has received information, asking them to check their returns. 

If all information has been disclosed and all tax paid, there should be nothing further to disclose and no further tax to pay. However, as the information HMRC will receive under the CARF will not be income and gains as calculated for UK tax purposes and will not align with the UK tax year end of 5 April, there may be a discrepancy or timing difference between the information that HMRC receives and the amounts included in an individual’s tax return. This means action could be required to make sure nothing has been omitted and to explain to HMRC how the information received under the CARF relates to information disclosed on tax returns.

In some cases, taxpayers may not have met all their tax obligations. In these cases, the information HMRC obtains under the CARF will better enable it to identify and collect underpaid tax liabilities. Taxpayers may wish to check that they have not omitted or miscalculated tax liabilities in advance of the CARF changes. 

Cryptoasset service providers 

The CARF legislation will make significant changes to the reporting obligations of cryptoasset service providers (CASPs). This will require proactive monitoring of how the CARF is implemented in each jurisdiction and engagement with domestic tax authorities as they transpose the CARF into local law, leveraging technology and adapting existing operational models. 

Here’s how CASPs can get ready to prepare for the new rules.

Determine CASP status

The first step will be to identify those CASPs that are within the scope of the CARF. Some CASPs (eg, financial institutions such as exchanges, custodians and brokers) that are reportable under the CRS are probably already aware of their upcoming relevant regulatory and reporting requirements under the CARF. 

However, many others who don’t fall within the CRS (such as decentralised exchanges and those businesses identifying as operating in the tech sector as opposed to the financial sector) are likely to be less aware, with no experience of tax information collection and reporting. They will need to determine whether they fall within the CARF and are considered as a RCASP, which is defined to include both individuals and entities that provide services effectuating exchange transactions in relevant cryptoassets. 

Identify jurisdictional nexus

Next, determine whether the RCASP has sufficient nexus to a jurisdiction that has adopted the CARF and, therefore, in which jurisdictions the RCASP is subject to the associated due diligence and reporting requirements. This involves assessing where the RCASP is tax resident, incorporated, managed, or has a regular place of business. To avoid duplication in reporting, the CARF sets out a hierarchy among these nexus criteria and there are also rules to address situations where a RCASP is subject to the same nexus in two or more partner jurisdictions. 

The CARF requires fewer connections to a jurisdiction than the traditional assessment for tax residence or permanent establishment in a jurisdiction. Consequently an RCASP may have CARF reporting obligations to a jurisdiction that it does not otherwise pay taxes to or report tax information to. 

Understand due diligence and reporting obligations

RCASPs must review and identify their customer base to determine whether any of their cryptoasset users or the controlling persons of their relevant entity cryptoasset users are subject to exclusions and should, therefore, not be reported on or are resident in a reportable jurisdiction. To make this determination, RCASPs will need to collect valid self-certifications for their cryptoasset users and from the controlling persons of certain entity cryptoasset users.

Implement robust systems and procedures

Ensure the necessary systems and procedures are in place to conduct due diligence and report accurately. This includes:

• Data collection and storage Establish systems to collect and store transactional data securely. This includes user identity verification, transaction volumes and asset classification.
• Due diligence protocols Implement robust due diligence to verify customers’ tax residency and reporting status.
• Cross-border compliance strategy For businesses operating in multiple jurisdictions, a cross-border compliance approach is essential.
• Automation and reporting solutions Investing in automated solutions for data processing and reporting can streamline compliance efforts and reduce the administrative burden. In this regard, jurisdictions will be seeking to ensure that the contents of the information reported is consistent with the requirements of the CARF XML Schema.

Where applicable (ie, where RCASPs are also financial institutions for the purposes of the CRS), the procedures and systems developed in relation to the CRS may be further built upon by CASPs to implement the CARF.

Notify users and maintain records

RCASPs may be obligated to notify users about reportable transactions, maintain accurate records and conduct comprehensive due diligence. Ensure that policies and procedures comply with these requirements.

Penalties for non-compliance

The draft UK CARF regulations, published following the 2024 Autumn Budget, establish a strict penalty regime. Penalties can include significant fines for non-compliance with late or inaccurate reporting, record-keeping, invalid self-certifications, failure to notify reportable users, failure to register and failure to apply due diligence requirements. Penalties can be applied per reportable user, leading to substantial fines for RCASPs with a significant number of reportable users.

In the UK, the new rules and reporting requirements will apply from 1 January 2026. This means that the first report will be for the year to 31 December 2026 and will be due for submission by 31 May 2027. 

While this may seem far away to some, don’t underestimate the time and work required to get ready to report – and commercially, RCASPs will need to come to terms with the increased internal budgets required to comply with these rules.

Conclusion

Just as the CRS made the world of offshore banking more transparent, the CARF is doing the same for cryptoassets. The CARF will also significantly change how HMRC approaches cryptoassets, which is likely to result in greater compliance activity in this area. 

It is clear that both those who own cryptoassets and those who effectuate the transactions will have to take note of the changes that are rapidly coming from 1 January 2026. 

• Members of ICAEW’s digital assets working party who have contributed to this article include Dion Seymour (Andersen LLP), Michelle Robinson (Deloitte LLP) and Yuri Hamano (BDO LLP).