The global crypto tax net closes: 75 OECD nations adopt CARF

The OECD's Crypto-Asset Reporting Framework went live on January 1, 2026. Seventy-five jurisdictions — the EU, the UK, 🇯🇵 Japan, 🇧🇷 Brazil, 🇸🇬 Singapore, the 🇦🇪 UAE, and nearly every offshore financial center you've heard of — are now automatically sharing detailed crypto transaction data between tax authorities. The first cross-border data dumps land in 2027.

The era of holding crypto on a regulated exchange without your government knowing about it is over.

But here's what matters strategically: not every country joined. 🇸🇻 El Salvador — the world's first Bitcoin legal tender country — remains a deliberate holdout. So do 🇮🇳 India, 🇦🇷 Argentina, 🇬🇪 Georgia, and 🇻🇳 Vietnam. Understanding exactly which jurisdictions participate, which don't, and why it matters to your wealth is the entire point of this analysis.

Why CARF happened and how fast it moved

The starting gun was April 2021. G20 Finance Ministers told the OECD to close the crypto blind spot in international tax enforcement. Traditional financial accounts had been covered since 2014 under the Common Reporting Standard — but crypto operated entirely outside it. Pseudonymous wallets. Cross-border transfers. Decentralized exchanges. A Norwegian study found that only about 40% of crypto holders were self-reporting. Tax authorities already suspected this. Now they had confirmation.

The OECD moved unusually quickly. A public consultation draft in March 2022. Final CARF rules published October 2022. G20 endorsement in Bali in November 2022. The G20 New Delhi Declaration in September 2023 called for "swift implementation." On November 10, 2023, 48 jurisdictions issued a joint statement committing to transpose CARF into domestic law by 2027.

By November 2025, the number was 75 — with 54 jurisdictions having signed the CARF Multilateral Competent Authority Agreement, the legal instrument that actually moves data between governments.

That's roughly 18 months from 48 to 75 committed jurisdictions. The pace of adoption should tell you something about how seriously governments are taking this.

What gets reported, and to whom

CARF works through a relay. Crypto exchanges collect your data, report it to their domestic tax authority, and that authority automatically forwards it to every country where you're tax-resident. The same transmission system that has powered CRS bank data exchanges for years.

Who reports: Reporting Crypto-Asset Service Providers — RCASPs — are the linchpin. The OECD defines an RCASP as any business providing exchange transactions in crypto on behalf of customers: centralized exchanges (Coinbase, Binance, Kraken), crypto brokers, crypto ATM operators, certain DeFi platforms where an entity exercises control. Purely decentralized protocols with no identifiable operator, software developers, and transaction validators are excluded.

What data flows: Two categories. First, identity: your full name, address, date of birth, tax residency, and taxpayer identification number. For corporate accounts, controlling persons too. Second, transactions — four types:

Crypto-to-fiat exchanges: aggregate fair market value and volume, by crypto type, per year
Crypto-to-crypto trades: same
Transfers: movements to external wallets where the exchange can't confirm the destination, including hardware wallets, staking deposits, lending activity, airdrops, and collateral movements
Retail payment transactions in crypto exceeding $50,000

Worth noting: the original 2022 draft required reporting the actual wallet addresses for transfers to self-custody wallets. The industry pushed back, and it was removed from the final rules. But exchanges must still collect and retain external wallet addresses for a minimum of five years. The data exists. It just doesn't flow automatically — yet.

What crypto assets are covered: Bitcoin, Ethereum, all major cryptocurrencies, stablecoins, security tokens, utility tokens, DeFi tokens, and most NFTs with tradeable value. CBDCs are explicitly excluded — they fall under the amended CRS instead. Closed-loop tokens like gaming credits or loyalty points are also out.

How CARF compares to FATCA and CRS

You need to understand the architecture here, because CARF is fundamentally different from both of its predecessors.

CRS (Common Reporting Standard, 2014) requires traditional financial institutions — banks, custodians, insurers — to report account balances and income for non-resident account holders. Over 100 jurisdictions participate. A French bank reports on non-French clients.

FATCA (2010) is a unilateral U.S. regime. Foreign financial institutions report on American account holders to the IRS, enforced through a 30% withholding penalty on U.S.-source payments to non-compliant institutions. FATCA was never updated for crypto. The U.S. doesn't participate in CRS.

CARF differs in three ways that matter:

First, it targets crypto-asset service providers specifically, not banks. Second, it reports on transactions — annual aggregate volumes by type — not year-end account balances. Third, and most importantly: CARF requires reporting on all users, resident and non-resident. Under CRS, a French bank only flags foreign clients. Under CARF, a French exchange reports on everyone — and that data goes to every relevant tax authority globally.

The U.S. joining CARF by 2029, despite staying out of CRS, is one of the more telling facts in this story. Even Washington, which has historically resisted multilateral financial surveillance frameworks, sees CARF as necessary. That's not nothing.

Every jurisdiction committed to CARF

As of November 28, 2025, 75 jurisdictions have committed to implement CARF. They're grouped into three waves based on when the first data exchanges actually happen.

Wave 1: first exchanges in 2027

These jurisdictions began collecting data January 1, 2026. Cross-border exchanges start mid-2027. This group includes virtually the entire EU, implementing CARF through the DAC8 directive (Council Directive EU 2023/2226, adopted October 2023):

🇦🇹 Austria · 🇧🇪 Belgium · 🇧🇬 Bulgaria · 🇭🇷 Croatia · 🇨🇿 Czechia · 🇩🇰 Denmark · 🇪🇪 Estonia · 🇫🇮 Finland · 🇫🇷 France · 🇩🇪 Germany · 🇬🇷 Greece · 🇭🇺 Hungary · 🇮🇪 Ireland · 🇮🇹 Italy · 🇱🇻 Latvia · 🇱🇮 Liechtenstein · 🇱🇹 Lithuania · 🇱🇺 Luxembourg · 🇲🇹 Malta · 🇳🇱 Netherlands · 🇵🇱 Poland · 🇵🇹 Portugal · 🇷🇴 Romania · 🇸🇲 San Marino · 🇸🇰 Slovakia · 🇸🇮 Slovenia · 🇪🇸 Spain · 🇸🇪 Sweden

Beyond the EU, Wave 1 includes:

🇬🇧 United Kingdom — regulations published June 25, 2025, data collection from January 1, 2026. HMRC had already sent 65,000 "nudge letters" to suspected non-filers before CARF even went live.

UK Crown Dependencies and Overseas Territories: Cayman Islands, Guernsey, Jersey, Isle of Man, Gibraltar, Faroe Islands

Key non-EU economies: 🇯🇵 Japan · 🇰🇷 South Korea · 🇧🇷 Brazil · 🇨🇴 Colombia · 🇮🇩 Indonesia · 🇳🇿 New Zealand · 🇿🇦 South Africa · 🇨🇱 Chile · 🇮🇸 Iceland · 🇰🇿 Kazakhstan · 🇺🇬 Uganda

Wave 2: first exchanges in 2028

These jurisdictions start collecting data in 2027 and exchange in 2028. Several major financial centers sat in this group after pulling back from the 2027 deadline during 2025:

🇦🇺 Australia · 🇨🇦 Canada · 🇭🇰 Hong Kong · 🇸🇬 Singapore · 🇨🇭 Switzerland · 🇦🇪 UAE

Also Wave 2: 🇧🇸 Bahamas · 🇧🇭 Bahrain · 🇧🇧 Barbados · 🇧🇿 Belize · 🇧🇲 Bermuda · British Virgin Islands · 🇨🇷 Costa Rica · 🇨🇾 Cyprus · 🇮🇱 Israel · 🇰🇪 Kenya · 🇲🇾 Malaysia · 🇲🇺 Mauritius · 🇲🇽 Mexico · 🇲🇳 Mongolia · 🇳🇬 Nigeria · 🇵🇦 Panama · 🇵🇭 Philippines · St. Vincent and the Grenadines · 🇸🇨 Seychelles · 🇹🇭 Thailand · 🇹🇷 Türkiye

Switzerland's delay deserves its own note. The Swiss Parliament approved CARF in September 2025. Then in November 2025, deliberations on partner countries were suspended. First exchanges now expected 2028. Switzerland is committed — just slow. This matters for anyone currently using Swiss crypto infrastructure.

Wave 3: first exchanges in 2029

🇺🇸 United States — alone in this wave. Simultaneously rolling out its domestic Form 1099-DA regime: custodial brokers are already reporting gross proceeds for 2025 transactions. From 2026, they must also report cost basis.

The five jurisdictions that haven't joined

The OECD's November 2025 monitoring update identifies five jurisdictions as "relevant to the CARF" that have not committed:

🇦🇷 Argentina — has adhered to the Joint Statement indicating intent, but no formal commitment made. Crypto is already heavily taxed domestically.

🇸🇻 El Salvador — has neither adhered to the Joint Statement nor indicated any process toward commitment. No official government statement on CARF. Just silence.

🇬🇪 Georgia — no commitment, no stated timeline.

🇮🇳 India — described by the OECD as "in the process" of making a political commitment. Absent for now, which is remarkable given that India ranks first globally in crypto adoption.

🇻🇳 Vietnam — fourth in global crypto adoption. No commitment.

The absence of India and Vietnam alone covers a massive slice of the world's crypto activity. Neither has joined. The OECD framework is comprehensive. It is not complete.

And then there's El Salvador — which is a deliberate, architectural decision, not bureaucratic delay.

El Salvador: the holdout with a plan

Of the five non-committed jurisdictions, El Salvador is the only one that has built an entire national economic strategy around being the crypto-friendliest country on earth. Its non-participation in CARF isn't an oversight. It's the product.

From mandatory legal tender to strategic anchor

On June 9, 2021, El Salvador's Legislative Assembly passed the Bitcoin Law — the first country to make Bitcoin legal tender. Zero capital gains tax on Bitcoin. Government-backed Chivo wallets. Permanent residency for foreign investors putting in 3 BTC or more.

Then came the IMF deal. Under pressure from the Fund, Legislative Decree No. 199 (published January 30, 2025) removed mandatory Bitcoin acceptance, prohibited tax payments in Bitcoin, restricted public sector Bitcoin activity, and committed to unwinding the Chivo wallet. These were conditions of a $1.4 billion Extended Fund Facility, part of a broader $3.5 billion package.

The question is: what didn't change?

The 0% capital gains tax on Bitcoin. Still in effect. The Bitcoin Office. Still operating. And President Bukele has openly defied the spirit of the IMF arrangement — in November 2025, El Salvador purchased approximately 1,090 BTC (~$100 million) in a single day, bringing its national holdings to an estimated 6,190–7,474 BTC. Bukele wrote on X in March 2025: "No, it's not stopping."

By December 2025, the IMF softened its stance after El Salvador posted 4% GDP growth — above regional averages — without reiterating demands to halt Bitcoin accumulation. The IMF backed down. Bukele didn't.

What El Salvador actually offers crypto holders

The tax picture: territorial taxation — foreign-sourced income generally not taxed. Domestic income tax ranges from 0% to 30%, but crypto businesses licensed by the Commission of Digital Assets are exempt from corporate income tax, service transfer tax, and municipal taxes on Bitcoin-related activity. Non-Bitcoin capital gains: 10% flat. Bitcoin capital gains: zero.

In August 2025, El Salvador approved a new Investment Banking Law allowing investment banks to hold Bitcoin and digital assets on their balance sheets. Minimum capital requirement: $50 million. Sophisticated investor threshold: $250,000 in liquid assets. This is a country building an institutional-grade Bitcoin financial system while most of the world is building reporting infrastructure to surveil crypto transactions.

Citizenship and residency through Bitcoin

El Salvador's Freedom Visa Program, launched December 7, 2023 in partnership with Tether, is the first citizenship-by-investment program that accepts only cryptocurrency. The investment is a $1 million non-refundable donation in Bitcoin or USDT. Processing: approximately 4–6 weeks. No residency requirement. The Salvadoran passport provides visa-free or visa-on-arrival access to 135+ countries including the Schengen Area. The program is capped at 1,000 applicants per year.

Separately, the original 3 BTC pathway to permanent residency under the Bitcoin Law remains available.

For full details on El Salvador's citizenship and residency pathways — including current requirements and how they interact with global tax obligations — CitizenX has a complete overview here.

Why El Salvador's CARF absence isn't accidental

Think about it. Zero crypto capital gains tax. Territorial taxation. A citizenship program priced in Bitcoin. A national Bitcoin reserve the president keeps adding to despite IMF pressure. An Investment Banking Law explicitly authorizing digital asset balance sheets.

Every single element of El Salvador's policy architecture is structurally incompatible with CARF's purpose. CARF exists to let governments tax crypto activity across borders. El Salvador doesn't tax crypto activity in the first place. There's nothing to report to, and nothing to report.

The OECD has publicly identified El Salvador as a "relevant" jurisdiction — meaning it recognizes the country hosts or will host material crypto-asset service provider activity. The invitation to join has been extended. El Salvador hasn't responded. That's not an oversight. That's a positioning decision.

DAC8: the EU goes further than the OECD

The EU's implementation of CARF through DAC8 has a feature that makes it more aggressive than the base framework: extraterritorial scope.

DAC8 applies to any platform serving EU residents regardless of where the platform is based. A Salvadoran exchange with EU clients. A U.S. exchange with European users. A platform registered in a non-CARF jurisdiction with customers in Germany. All of them must comply or lose access to the European market through MiCA passporting revocation.

DAC8 also adds penalties that the base CARF standard doesn't specify. If a customer fails to provide a valid self-certification after two reminders within 60 days, the platform must block the user from transacting. Penalties can reach €150,000 per violation in certain member states, with additional percentage-of-turnover penalties under EU Minimum Penalty Standards.

Germany enacted its Cryptoasset Tax Transparency Act (KStTG) in late 2025. Spain has gone further still — proposing to tax crypto gains at income tax brackets (up to 47%) and requiring Model 721 disclosures for overseas crypto holdings over €50,000. The reporting standard is harmonized across the EU. The tax rates behind it vary enormously. This creates meaningful planning opportunities even within Wave 1 jurisdictions.

What this actually means for crypto holders

CARF doesn't create taxes. It creates information. But information in the hands of tax authorities who already suspected underreporting — and who have been building enforcement infrastructure for years — produces consequences.

Starting January 1, 2026, every transaction on a regulated exchange in 48 jurisdictions is being systematically recorded for cross-border reporting. When the first automatic exchanges occur in 2027, tax authorities will receive comprehensive annual transaction data on their residents — crypto-to-fiat conversions, crypto-to-crypto trades, transfers to external wallets, large retail payments.

They will cross-reference this against your tax returns. Discrepancies will trigger inquiries.

HMRC's 65,000 "nudge letters" sent before CARF even started tells you how much enforcement appetite already exists. These agencies have been waiting for the data infrastructure. Now they have it.

The traditional offshore crypto strategy no longer works. The Cayman Islands, BVI, Bahamas, Bermuda, Gibraltar, Guernsey, Jersey, Isle of Man, Singapore, the UAE, Switzerland — all committed. Holding crypto in a zero-tax offshore jurisdiction still means zero local tax. But the exchange data flows back to your home country's tax authority regardless. Zero tax where you hold assets plus full transparency to where you live is a very different proposition than zero tax plus no visibility.

The critical gaps CARF cannot close

The framework's entire architecture depends on intermediaries. Remove the intermediary and the reporting chain breaks.

Self-custody wallets — hardware devices like Ledger and Trezor, software wallets like MetaMask — are outside CARF's scope. Direct peer-to-peer transactions. On-chain DeFi interactions without an identifiable controlling entity. None of these are reported.

But every transfer from a KYC-verified exchange to an external wallet creates a traceable link. The exchange records it. The wallet address is retained for five years. The on-chain movement is public. The gap between "reported" and "traceable" is narrowing.

The OECD's July 2025 FAQ introduced a "Control or Sufficient Influence" (COSI) test designed to bring some DeFi protocols under CARF scope where an identifiable entity exercises enough control. Jurisdictional interpretations will vary. Enforcement against truly decentralized protocols remains technically challenging. The intent is clear: the OECD wants to close this gap. The mechanics aren't there yet.

The compliance industry boom

Major exchanges are actively adapting. Binance — with over 100 million accounts, operating through EU entities in Malta and Lithuania — falls squarely under DAC8's extraterritorial reach. Coinbase faces both Form 1099-DA domestically and DAC8 for European operations. Kraken published a public CARF FAQ confirming it will provide jurisdiction-specific updates as rules finalize.

A compliance technology sector is exploding around this. TaxBit, TAINA Technology, Blockpit, Regnology — all positioning themselves as essential infrastructure for exchanges navigating simultaneous multi-jurisdiction reporting requirements.

TaxBit noted in November 2025 that CARF data "could eventually provide unprecedented access into crypto ownership and identity details, potentially enabling authorities to identify anonymous crypto holders, serve as an intelligence source, and help link identities to criminal activity." That's a company whose customers are exchanges framing the use case for their own product. Worth reading twice.

The heavy compliance cost is expected to accelerate market consolidation. Large, well-resourced exchanges absorb the cost. Smaller providers can't. Regulatory compliance is increasingly a competitive moat.

The strategic picture in 2026

Here is where things stand:

Seventy-five jurisdictions are collecting data. Forty-eight start exchanging it in 2027. The architecture covers every major financial center, every traditional offshore hub, every G7 economy, and most emerging markets.

Five jurisdictions have not committed. Of those five, only one — El Salvador — has constructed a coherent, deliberate alternative framework: zero crypto capital gains tax, territorial taxation, Bitcoin as national reserve asset, and citizenship programs priced in Bitcoin.

India and Vietnam's absence from CARF represents a massive coverage gap by volume of users. But neither has built the kind of infrastructure that makes them viable long-term bases for crypto wealth management. Their non-participation reflects political delay, not strategic intent.

The window is real but narrowing. The OECD's "Jurisdictions of Relevance" process creates sustained pressure on non-participating countries. Peer review, public identification, and market access leverage have proven effective — see the rapid expansion from 48 to 75 committed jurisdictions in under 12 months. El Salvador's structural divergence from CARF's premise makes it more durable than most holdouts. But no jurisdiction's non-participation should be treated as permanent.

What is certain: tax authorities will have CARF data beginning in 2027, and they will use it to look back at prior-year returns. For anyone who has operated on assumptions of opacity through regulated exchanges, the time to assess your position — voluntary disclosure, jurisdictional restructuring, accurate prospective reporting — is before the first exchanges arrive, not after.

This analysis is for informational purposes only and does not constitute tax or legal advice. CARF implementation timelines and country-level rules are subject to change. Consult a qualified international tax adviser before making jurisdictional or reporting decisions.