DAC8 and CARF: what crypto platforms now tell tax offices

The Crypto-Asset Reporting Framework is an OECD standard. Its Committee on Fiscal Affairs approved it over 2022 and 2023, and the OECD Council folded it into its exchange-of-information recommendation on 8 June 2023 (OECD, CARF and 2023 update to the CRS). A country signs up, writes the rules into its law, and agrees with partners to swap the data.

DAC8 is the EU's version, adopted as Council Directive (EU) 2023/2226 on 17 October 2023. Member states had to put it into national law by 31 December 2025 and apply it from 1 January 2026 (Article 2). Two differences matter to users. DAC8 also catches platforms outside the EU that serve EU customers: they register in one member state. And it reports EU residents to their own country, not only foreigners. The European Commission's DAC8 page sets out both points.

1. 2023OECD standard published in June; DAC8 adopted on 17 October
2. 2026EU and UK platforms collect from 1 January; self-certifications start
3. 2027First exchanges: 46 jurisdictions, including every EU state but Cyprus, the UK, Cayman, Jersey
4. 202827 more: UAE, Hong Kong, Singapore, Switzerland, BVI, Bermuda, Bahamas, Cyprus
5. 2029Argentina, Azerbaijan, Mexico and the United States

Years are when a jurisdiction commits to send its first data, from the OECD CARF commitments list, last updated 14 September 2026. Each first exchange covers the calendar year before.

Not every member state was ready. On 30 January 2026 the Commission opened infringement cases against 12 member states that had not transposed DAC8 on time, among them Cyprus, Malta, Bulgaria and Estonia. The rule still applies to 2026 activity, and platforms in those countries have been collecting regardless.

Every year the platform files one record per customer. It holds two halves: who you are, then totals for each coin you dealt in. Section II of the CARF lists the fields, and Annex VI of DAC8 copies them. A shortened record looks like this:

The four kinds of activity that count

What it does not cover

The CARF excludes central bank digital currencies, regulated single-currency e-money products and coins the platform has shown cannot be used to pay or invest (CARF IV.A(2)). Those first two do not escape reporting altogether: they move into the CRS, below. A wallet you control yourself is not a reporting platform, so nothing reports what happens inside it. The report captures the moments coins enter or leave a platform.

The rules land on a Reporting Crypto-Asset Service Provider: any person or firm that, as a business, carries out exchanges for customers, as a counterparty, a broker or by running a trading platform (CARF IV.B(1)). That covers exchanges, brokers and some wallet providers. A platform reports in a country when it is tax resident there, incorporated there, managed from there or has a regular place of business there (CARF I.A).

In the EU the providers are those authorised under the MiCA regulation, plus "Crypto-Asset Operators" from outside the EU that serve EU customers. An operator registers with one member state, and loses that registration if it fails to report after two reminders (DAC8 Annex VI, V.F).

The self-certification form

When you open an account, and for existing customers within a year of the start date, the platform must get a self-certification: your residence for tax, your tax number and, for individuals, your date of birth. It checks the answers against what it already knows from its identity checks (CARF III.A). A customer who has not answered after two reminders and 60 days must be blocked from trading under DAC8 (Annex VI, V.A(2)). So the form is not optional. Our guide to tax identification numbers shows the number each country issues.

The OECD's list (last update 14 September 2026) names 77 committed jurisdictions and 4 it considers relevant that have not committed. We added the three places Heirson forms companies in that the list does not name. Search by name, filter by start year or see only the places we form companies in.

Where do you live? pick it

What changed since 2025

The list moves. Against the June 2025 version, Switzerland, Bermuda, Gibraltar and Cyprus slipped from 2027 to 2028, the US from 2028 to 2029, and Panama, Mauritius, Belize and Bahrain were added for 2028. Cyprus is the odd one: the OECD shows 2028, but as an EU member it applies DAC8, so its platforms collect 2026 data like the rest of the EU, and Ireland's Revenue already lists it as a 2027 partner (Revenue reportable jurisdictions, 10 June 2026).

The Common Reporting Standard has covered bank and custody accounts since 2017. The CARF was published together with a set of CRS amendments, so the two now split the work between them:

In the EU, DAC8 brings in both halves at once from 1 January 2026. E-money accounts stay out of the CRS while their average 90-day balance stays at or under USD 10,000 for the year.

Many people hold coins through a company: a crypto holding company, a trading company that is paid in stablecoins, or a family vehicle. To the platform the company is an Entity Crypto-Asset User. It self-certifies the company's own tax residence; if the company says it has none, the platform can use the place it is managed or its main office address (CARF III.B(1)).

Our reading: a company whose assets are mostly coins held for investment will usually fail the 50% income and asset tests, so the platform looks through it to the owners. A trading or services company whose income comes from sales usually passes and is reported on its own. This mirrors how a bank treats a Passive NFE under the CRS.

Say you live in Spain and your BVI company trades on an EU exchange

A wallet the company controls itself, with no platform involved, is outside the report except when coins move to or from a reporting platform. That is not a gap worth building around: banks ask where funds came from when they are cashed out, and the bank account is reported under the CRS.

CARF reports go to the country where you are tax resident. So the 0% that matters is the rule of the country you actually live in, not where your company or exchange sits. Places that tax individuals' crypto gains at 0%, or only in some cases:

Three things decide whether any of this applies to you. Residence: you have to move, live there and stop being resident at home, which many countries test by days, home and family. What you do: in Singapore, Hong Kong and Switzerland, frequent trading turns gains into taxable income. Other taxes: Switzerland taxes wealth, and the UAE taxes business income above its threshold. Our guide to tax free countries covers residence routes, and the tax haven list compares company and personal tax side by side.

1. Answer the self-certification honestly, for you and the companyThe platform checks it against your ID file, and a wrong residence is the kind of mismatch that gets flagged. Use the company's real tax number, and the residence your company can prove. For a UAE free zone company, that can be a UAE tax residency certificate.
2. Know whether your company is Active or passiveIf most of its income and assets are investments, expect to be reported as its controlling person. If it trades, keep the accounts that show it.
3. Keep your own records from 2026The report shows totals, not your cost. Your gain is worked out from your purchase prices, so keep them per coin.
4. Check your home country's rules on the company itselfReporting does not create tax, but it tells your tax office the company exists. CFC rules may tax its profits on you, and a tax treaty decides which country can tax what.
5. Choose the company's home for its law and costsEvery major place we form companies in is on the list or already sends bank data under the CRS. Compare Cayman, the BVI, UAE and the others on what they charge and require, not on reporting.

We take payment in crypto because it works from any country and settles the exact amount. If you pay from an exchange account, that exchange may record the payment as a transfer out to an address it cannot attribute. That is fine: a company formation is a normal business cost.