Global Crypto Surveillance Framework is Live
The Crypto Asset Reporting Framework (CARF) is now in effect, requiring exchanges to collect and report user transaction data to tax authorities worldwide. According to analysis, this creates an "information highway" for financial surveillance that links real-world identities to on-chain activity. The framework also creates massive, centralized honeypots of sensitive user data, raising significant security and privacy concerns.
The Crypto-Asset Reporting Framework (CARF), developed by the OECD, establishes a standardized, international system for the automatic exchange of user data among tax authorities. This framework mandates that crypto-asset service providers in participating countries collect and report information on transactions. The first exchanges of this information are scheduled to begin in 2027, based on data collected from January 1, 2026. As of late 2024, 63 jurisdictions have committed to implementing CARF. This group includes the European Union member states, the UK, Canada, Brazil, Japan, and Singapore, who are targeting first information exchanges by 2027. A second group, including the United States, Hong Kong, and the UAE, is expected to begin exchanges by 2028. The framework requires reporting on a broad range of transactions, including exchanges between crypto and fiat currencies, exchanges between different cryptocurrencies, and certain transfers. The definition of a "Reporting Crypto-Asset Service Provider" is intentionally wide, encompassing centralized and some decentralized exchanges, crypto ATM operators, brokers, and dealers. Data shared between jurisdictions will include user identity details like name, address, jurisdiction of tax residence, and Taxpayer Identification Numbers (TINs). Transaction-level data will also be reported, such as the type of crypto-asset, gross amounts, number of units, and the fair market value for crypto-to-crypto exchanges. This information will be transmitted using a specific CARF XML Schema to standardize the data exchange between tax authorities. The European Union is implementing these rules through an amendment to its Directive on Administrative Co-operation, known as DAC8. This directive aligns with CARF and ensures consistent application across all 27 EU member states, compelling them to adopt the framework by January 1, 2026. The framework specifically excludes certain assets from reporting, such as Central Bank Digital Currencies and crypto-assets that cannot be used for payment or investment purposes. However, the scope is broad, covering cryptocurrencies, stablecoins, and some Non-Fungible Tokens (NFTs) if they are used for investment. Critics point out potential loopholes, such as the ability for users to avoid in-scope intermediaries and other vulnerabilities inherited from the existing Common Reporting Standard (CRS) for traditional finance.
