OECD CARF timeline: crypto tax reporting and automatic exchange of information from 2027
If you operate a crypto exchange, broker, OTC desk, or custodian, CARF is now a planning item. It is the OECD’s attempt to extend AEOI/CRS logic to crypto-assets. That means tax authorities will exchange data on residents’ crypto activity through foreign intermediaries.
This guide explains the published rollout timeline and what must be built before exchanges begin. The practical risk is simple. If you do not capture tax-grade data now, you may not be able to reconstruct it later.
Publish Date
27 Jan 2026
Reading Time
10 minutes
Category
Legal News
Jurisdiction
Global
What CARF is and who it targets
CARF is a reporting and exchange framework for crypto-asset transactions. It is designed to give tax authorities visibility into residents using offshore crypto intermediaries.
In practice, it targets reporting crypto-asset service providers. That includes many exchanges and brokers. It can also touch custody and intermediation models where the provider has transactional visibility.
CARF timeline: when first exchanges are planned
The OECD/Global Forum published a commitment list that groups jurisdictions by targeted first exchange year. The headline buckets are:
- 2027: 48 jurisdictions
- 2028: 27 jurisdictions
- 2029: the United States
Do not treat “first exchange year” as your delivery deadline. Your real deadline is earlier. You need domestic reporting logic, customer classification, and data retention working before the first exchange.
| First exchange target | Jurisdictions | Operator planning rule |
|---|---|---|
| 2027 | 48 | Assume build work must start now and run through 2026. |
| 2028 | 27 | Treat 2026 as the data-hardening year, not a waiting year. |
| 2029 | United States | Map US exposure separately and avoid assumptions about interaction. |
Reference list of committed jurisdictions:
OECD: Jurisdictions committed to implement CARF
Commitment vs exchange-ready: why “signed” is not the same as “implemented”
The Global Forum monitoring update reports 75 jurisdictions committed under its CARF commitment process. That is the political implementation signal.
A separate signal is the CARF-MCAA signatory list. Signing supports exchange relationships. It does not, by itself, confirm domestic law readiness or reporting infrastructure.
For operators, the planning point is to track three layers. Commitment, signing, and domestic implementation. Your project plan must be aligned to domestic law, not only OECD tables.
Reference monitoring update:
OECD: CARF 2025 Monitoring and Implementation Update
Five “relevant” jurisdictions not yet committed: what to do with this list
The Global Forum highlighted five jurisdictions of relevance that were not yet committed. The list is: Argentina, El Salvador, Georgia, India, Viet Nam.
This is not a “safe vs unsafe” list. It is a corridor-risk marker for tax transparency coverage. If you have client exposure there, treat it as a watchlist item.
Your action is governance, not guesswork. Monitor updates, document your exposure, and design reporting to handle future alignment.
What CARF changes operationally for exchanges and brokers
Customer classification becomes tax-grade
CARF needs consistent customer classification logic. Residence and entity status must be supported by evidence. Controls must survive audits and information requests.
Many crypto platforms can onboard quickly today. CARF pushes toward documented, consistent, and retained classification.
Transaction data must be reconstructible
The hardest CARF failures are “late data.” If you did not collect key fields at the time, you cannot fix it later.
Treat CARF as a data architecture project. Inventory what you log per transaction. Check where metadata is missing across products and entities.
Product and flow design will be reviewed through reporting feasibility
Some flows create exceptions and complexity. OTC, transfers to self-hosted wallets, and intermediated custody can create edge cases.
Do not wait for reporting to discover product gaps. Review product flows now and decide what you can report with confidence.
What breaks in practice when teams prepare late
Late readiness produces inconsistent customer files across entities. It also produces mismatch between declared residence and banking evidence.
The next failure is vendor dependency. Many teams rely on analytics tools that do not produce reporting-grade schemas. Exception handling then becomes manual and risky.
Finally, evidence trails go thin under pressure. If you cannot prove decisions, you lose credibility with authorities and partners.
CARF readiness: build, buy, or outsource
Start with a short decision rule. If your product set and jurisdictions are complex, building from scratch is rarely the fastest path. If your flows are simple, a lean internal build can work.
In all models, you need clear ownership. Tax, compliance, engineering, and product must share a single delivery roadmap. Reporting cannot sit only with compliance.
Decision checklist for crypto businesses
- Map exposure: link clients and operations to 2027/2028/2029 jurisdictions.
- Audit data: identify fields you cannot reconstruct after the fact.
- Assign ownership: tax, compliance, engineering, and product with one roadmap.
- Pick a delivery model: build, buy, or outsource with clear vendor controls.
- Run a pilot: validate schema logic and exception handling before scaling.
CARF-MCAA signatory reference:
OECD: CARF-MCAA signatories
How Legasset helps teams prepare for CARF
We help crypto intermediaries translate CARF into a practical roadmap. That includes exposure mapping, data-gap audits, and governance design.
We also support vendor oversight and implementation controls. The goal is reporting readiness without emergency rebuilds.
Schedule a consultation right now.
OECD CARF rollout questions crypto exchanges and brokers ask
When do CARF exchanges start in practice?
The OECD commitment list groups first exchanges into 2027, 2028, and 2029 buckets. Your real deadline is earlier, because reporting systems must run before exchanges begin.
What is the difference between a CARF commitment and signing the CARF-MCAA?
Commitment is a political implementation signal. CARF-MCAA signing supports exchange relationships. Neither guarantees domestic reporting readiness on its own.
Why does CARF create “late data” risk?
Because missing transaction or customer fields cannot be reconstructed reliably later. If you do not capture tax-grade data at the time, you may not be able to report it.
Why are five “relevant” jurisdictions mentioned as not yet committed?
The Global Forum uses this as a coverage and monitoring signal. It is a practical watchlist for corridor exposure and future alignment risk.
What is the most practical first step for a mid-size exchange?
Run a data-gap audit across products and entities. Then assign one roadmap owner spanning compliance and engineering.
Check Our Available Ready-Made Licenses
Below are all the off-the-shelf license options available for purchase. Browse through the list of licenses and read the details to choose the option that is right for your business:
