CARF and DAC8: from 2026 your exchange reports you to the tax office

What changes on 1 January 2026

The OECD's Crypto-Asset Reporting Framework (CARF) extends the automatic exchange of information that already covers bank accounts (the CRS) to crypto. In the EU it is implemented through the DAC8 directive, which applies from 1 January 2026: crypto-asset service providers collect self-certifications and transaction data for the 2026 year and report it, with the first exchanges of data between tax administrations in 2027. Dozens of further jurisdictions — the UK among the first movers — have committed to CARF on the same or a closely following timetable. The era in which an exchange account abroad was invisible to your local tax office is ending on a published schedule.

Who reports and what they send

The reporting net is deliberately wide. In the EU, DAC8 covers CASPs authorised under MiCA and operators outside the EU that serve EU-resident clients — a non-EU exchange with EU customers is pulled into registration and reporting rather than left as a loophole. For each reportable user, providers report:

• Identity: name, address, jurisdiction(s) of tax residence, tax identification number, date of birth;
• Transaction aggregates per asset type: gross proceeds and units from crypto-to-fiat disposals, the value of crypto-to-crypto exchanges (both legs reportable), and certain transfers — including aggregate value sent to self-hosted wallet addresses;
• Retail payments above a threshold processed on behalf of merchants.

Note what is not reported: your cost basis and your gains. The tax office receives gross proceeds — which is precisely why the data looks worse than reality for long-term holders until a return explains it.

What tax offices will do with the data

The same thing they did with CRS banking data: bulk matching against filed returns. Where reported gross proceeds exist and no return mentions crypto, the mismatch generates a letter — a nudge letter first in many jurisdictions, an audit where the numbers are large or the silence repeats. Because CARF data arrives as annual aggregates per person per asset, it is exceptionally well suited to automated risk-scoring; the experience with CRS suggests the first waves of letters follow within one to two years of the first data exchange.

If you have unreported years: the window is now

CARF reports the 2026 year onwards — it does not itself expose 2021. But the moment a tax office sees substantial 2026 proceeds, the obvious next question is where the assets came from, and the answer walks back into your prior years; several administrations have already paired CARF preparation with crypto-specific disclosure campaigns. The period before the first data lands in 2027 is the last clean window in which coming forward is unambiguously voluntary — and voluntary status is what buys reduced penalties and, in most regimes, protection from criminal treatment. The mechanics of voluntary disclosure for unreported crypto are on the dedicated page; expect the same reconstruction work to answer a bank's or platform's source of funds questions, which increasingly arrive in parallel.

We watched exactly this movie with CRS and offshore bank accounts: years of "they'll never really match the data", then the letters arrived in bulk and the voluntary-disclosure terms people had passed up were gone. My advice on CARF is unglamorous — assume the 2026 numbers will land on your tax office's desk in 2027, read your own filings the way their matching software will, and if prior years need fixing, fix them while the initiative is still legally yours.

Mark Eichorn · Managing Partner