Seventy-seven jurisdictions have committed to the OECD's Crypto-Asset Reporting Framework (CARF), with the first wave of 46 countries — including the UK, France, Germany, Japan, and South Korea — actively collecting user transaction data from crypto-asset service providers since January 1, 2026. ...
"The era of crypto tax secrecy is effectively over. Platforms are now collecting the data, and cross-border sharing begins next year." — Pascal Saint-Amans, former Director of the OECD Centre for Tax Policy and Administration
Seventy-seven jurisdictions have committed to the OECD's Crypto-Asset Reporting Framework (CARF), with the first wave of 46 countries — including the UK, France, Germany, Japan, and South Korea — actively collecting user transaction data from crypto-asset service providers since January 1, 2026. Cross-border automatic exchange of that data is scheduled to begin in 2027. A second cohort of 27 jurisdictions, including Canada and Hong Kong, will join by January 1, 2027, with four additional nations committed by 2029.
France accelerated its domestic ratification on October 27, 2026, when its Senate approved Bill No. 921, establishing the legal basis for automatic crypto tax data sharing with 46 partner jurisdictions starting 2027. The bill now awaits National Assembly approval. The move follows the EU's DAC8 directive, which went live across all 27 member states on January 1, 2026, requiring exchanges to collect and report detailed user data covering crypto-to-fiat, crypto-to-crypto trades, transfers to unhosted wallets, and retail payments exceeding $50,000.
The compliance infrastructure required to meet CARF and DAC8 obligations is reshaping the exchange landscape. Industry estimates from Forrester Research put implementation costs at $3–7 million for major platforms and $500,000–1.5 million for smaller operators. Analysts expect further consolidation of an industry already contracting — 82 crypto projects shut down in 2026 through October, many citing insufficient revenue relative to operational costs.
The Crypto-Asset Reporting Framework was finalized by the OECD in June 2023 and signed as a multilateral agreement on November 26, 2024, in Asunción, Paraguay. It establishes a standardized mechanism for tax authorities to collect information from crypto-asset service providers and automatically share it with counterpart jurisdictions where users are tax resident.
CARF defines "Reporting Crypto-Asset Service Providers" (RCASPs) broadly: centralized exchanges, brokers, dealers, custodial wallet providers, crypto ATM operators, and certain DeFi intermediaries that exercise sufficient control over transactions. These entities must identify customers, determine their tax residency, and capture standardized transaction data.
The framework covers cryptocurrencies, ERC-20 tokens, stablecoins (unless they qualify as e-money under the updated CRS 2.0), and tradeable NFTs that fail the OECD's four-part exclusion test. Indirect exposure through derivatives and certain DeFi applications where a service provider exercises sufficient control is also in scope.
As of September 2026, the OECD lists 77 jurisdictions committed to first exchanges by 2027, 2028, or 2029 — 46 by 2027, 27 by 2028, and 4 by 2029. According to PwC's Global Tax Policy Bulletin, this represents the most rapid adoption of a new tax information exchange standard since the Common Reporting Standard itself.
Wave 1 (46 jurisdictions, exchanges by 2027): Data collection began January 1, 2026. First reports to national tax authorities are due in early-to-mid 2027. Participating jurisdictions include Austria, Belgium, Brazil, Bulgaria, Cayman Islands, Chile, Colombia, Croatia, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Guernsey, Hungary, Iceland, Indonesia, Ireland, Isle of Man, Italy, Japan, Jersey, Kazakhstan, Korea, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Romania, San Marino, Slovak Republic, Slovenia, South Africa, Spain, Sweden, Uganda, and the United Kingdom.
Wave 2 (27 jurisdictions, exchanges by 2028): Canada, Hong Kong, Singapore, and other jurisdictions join with domestic data collection starting January 1, 2027.
Wave 3 (4 jurisdictions, exchanges by 2029): The United States and three additional countries have committed to the latest timeline. As of September 2026, proposed US Treasury and IRS rules extending digital-asset broker reporting for CARF purposes remain in the rulemaking process.
On October 27, 2026, the French Senate approved Bill No. 921 on first reading, according to Cryptonomist and CryptoBriefing. The bill authorizes ratification of two multilateral instruments signed in Asunción on November 26, 2024: the Multilateral Agreement on Automatic Information Exchange between Competent Authorities regarding CARF, and the supplementary instrument to the Multilateral Agreement on Automatic Exchange of Financial Account Information under the updated Common Reporting Standard (CRS 2.0).
The bill creates no new tax. Its function is procedural: it provides the legal basis for French tax authorities to share crypto transaction data with 46 jurisdictions initially, scaling to 77 by 2029. Reportable data includes users' identities, tax residency, tax identification numbers, and detailed transaction records.
The bill now requires National Assembly approval. According to News.Bitcoin.com, the legislative timeline suggests completion before the end of 2026 to meet the 2027 exchange deadline.
Within the European Union, the Directive on Administrative Cooperation 8th revision (DAC8) operates as the regional implementation vehicle for CARF. DAC8 went live across all 27 EU member states on January 1, 2026, with a six-month grace period for full compliance extending to July 1, 2026.
DAC8 mandates reporting across four transaction categories: crypto-to-fiat exchanges, crypto-to-crypto trades, transfers including those to unhosted wallets, and retail crypto payments exceeding $50,000 in aggregate annual value.
A critical feature of DAC8 is its extraterritorial reach. According to PwC Netherlands, a US-based exchange serving users who are tax resident in EU member states faces substantially the same data collection, due diligence, and reporting obligations as an EU-based exchange. This extends the directive's practical scope well beyond European borders.
The first reporting period covers calendar year 2026. Reports are due to national tax authorities between January 1 and September 30, 2027.
The United States has committed to CARF with first exchanges scheduled by 2029 but has not formally adopted the framework. Instead, the IRS implemented Form 1099-DA, effective for brokers starting tax year 2025 and for DeFi front-ends starting 2026.
Form 1099-DA requires brokers to report gross proceeds from digital-asset dispositions. Cost-basis reporting is phasing in for covered digital assets sold in 2026. According to Withum, the form achieves similar domestic reporting objectives to CARF but does not yet enable automatic cross-border data sharing.
Proposed Treasury rules to align US reporting with CARF for international exchange purposes remain in the rulemaking process as of September 2026, according to multiple tax advisory firms. Until those rules are finalized, US crypto users' data will not flow to foreign tax authorities through the CARF channel — a gap that South Korean lawmaker Park Min-gyu cited in his October 16, 2026, bill proposing to delay Korea's 22% crypto gains tax until international data-sharing arrangements, including with the US, are operational.
Under CARF, RCASPs must collect and transmit the following data annually:
User identification: Full name, date of birth, address, jurisdiction of tax residence, and taxpayer identification number (TIN).
Transaction data by type:
According to CoinTracker's CARF compliance guide, platforms must report to every jurisdiction where a user claims tax residency. A single exchange operating globally may need to file with dozens of tax authorities simultaneously. Filing dates, formats, penalties, and nexus rules are implemented locally, adding multi-jurisdictional operational complexity.
The OECD published XML reporting schemas in late 2024. According to RSM US, exchanges had approximately 18 months from schema publication to build compliant systems — a timeline multiple industry participants described as compressed.
The cost of CARF and DAC8 compliance is material. Forrester Research estimates implementation costs of $3–7 million for major platforms such as Coinbase, Binance, and Kraken, which maintain dedicated compliance teams. Smaller exchanges and regional platforms face costs of $500,000–1.5 million, according to the same analysis. Annual ongoing compliance costs for smaller European crypto companies run to a high six-figure amount, according to FintechLaw UK.
These costs arrive at a difficult time. Eighty-two crypto projects shut down in 2026 through October, according to DeFiLlama data compiled by researcher Stacy Muur. The shuttered projects collectively raised approximately $1 billion in venture funding but generated only $250 million in cumulative fees. Lack of product-market fit was the most commonly cited reason, followed by depleted funding and insufficient revenue.
Analysts expect CARF compliance costs to accelerate consolidation among smaller exchanges. According to OneSafe's industry analysis, platforms unable to afford multi-jurisdictional compliance infrastructure face three options: exit certain markets, merge with larger operators, or shut down. The result concentrates trading activity further on platforms large enough to absorb the regulatory overhead.
This dynamic carries echoes of the post-2018 consolidation in traditional financial services following FATCA and CRS implementation, where the number of reporting financial institutions in several jurisdictions declined even as the volume of information exchanged grew.
CARF's treatment of DeFi remains the framework's most contested boundary. The standard applies to intermediaries that "exercise sufficient control" over transactions — a threshold that captures DeFi front-ends, bridges, and aggregators with identifiable operators, but excludes fully autonomous smart contracts with no controlling entity.
The EU's DAC8 takes a similar approach. According to the European Commission's directive documentation, the focus is on "intermediated" crypto transactions where a service provider can be identified and held accountable for reporting.
This creates a structural gap. According to Lukka's CARF compliance guide, fully decentralized protocols operating without an identifiable intermediary fall outside reporting requirements. Whether this gap persists depends on how national tax authorities interpret "sufficient control" in enforcement, and whether future OECD guidance narrows the exclusion.
The IRS took a more expansive approach with its 2024 DeFi broker rule, which extended reporting obligations to DeFi front-end operators effective 2026 — though that rule faces ongoing legal challenge.
The CARF rollout represents the largest coordinated expansion of tax information exchange infrastructure into the crypto sector to date. With 46 jurisdictions already collecting data and cross-border sharing 60-90 days from initiation, the practical impact on crypto users — particularly those holding assets across multiple jurisdictions — will become visible in 2027 tax assessments.
The framework does not create new taxes. It creates new visibility. Tax authorities that previously had no systematic access to cross-border crypto transaction data will receive standardized reports covering user identity, transaction type, and fiat-equivalent value. For compliant users, the change is procedural. For those who relied on jurisdictional opacity, the window is closing.
The economic consequences for the exchange industry are more immediate. CARF and DAC8 compliance costs represent a fixed overhead that scales with the number of jurisdictions served, not with revenue. This structure inherently favors larger platforms — a dynamic that, combined with 82 project shutdowns in 2026 and record hack losses, is compressing the industry's long tail of smaller operators.
The outstanding question is the DeFi boundary. CARF was designed for intermediated transactions. The degree to which national authorities extend reporting obligations to decentralized protocols — and the legal durability of those extensions — will determine whether the framework captures the full scope of crypto economic activity or merely the centralized portion of it.