Cross-Border Reporting Frameworks

Regulator-Grade Guidance Document

Date: June 2026 Domain: Digital Asset Taxation Section: Cross-Border Reporting Audience: Tax authorities, international cooperation officials

1. The Three Major Frameworks

Three overlapping but structurally distinct frameworks now govern cross-border tax reporting for digital assets: the OECD CARF,

EU DAC8, and

US Form 1099-DA. Each framework reflects a different design philosophy -- global model standard, supranational directive, and domestic unilateral reporting -- and each creates different obligations for Reporting Crypto-Asset Service Providers (RCASPs) and tax administrations. Understanding the interplay between these frameworks is essential for any jurisdiction designing or implementing cross-border crypto tax reporting.

1.1 OECD CARF

The Crypto-Asset Reporting Framework (CARF) is a global tax transparency standard finalized by the OECD in June 2023 at the request of the G20. CARF provides model rules for the automatic exchange of tax-relevant information on crypto-asset transactions between jurisdictions, administered by the Global Forum on Transparency and Exchange of Information for Tax Purposes.

Legal nature: Voluntary model framework. CARF has no legal force unless transposed into domestic law by individual jurisdictions.

Scope: CARF applies to Reporting Crypto-Asset Service Providers (RCASPs) -- a definition intentionally broader than FATF's VASP definition -- covering centralized exchanges, brokers, dealers, crypto-asset ATM operators, custodial wallet providers, and DeFi platforms where an identifiable entity or individual exercises sufficient control to comply with reporting obligations.

Reportable assets: Cryptocurrencies, ERC-20 and similar tokens, tradeable NFTs, stablecoins, and certain crypto derivatives. Exclusions: CBDCs (covered by amended CRS 2.0), specified electronic money products, and closed-loop crypto-assets.

Reportable transactions: Four categories trigger reporting: (1) crypto-to-fiat exchanges, (2) crypto-to-crypto exchanges, (3) retail payment transactions exceeding USD 50,000 in aggregate, and (4) transfers to external/unhosted wallet addresses.

Due diligence: RCASPs must collect self-certifications from customers to determine tax residence(s), collect Tax Identification Numbers (TINs), perform reasonableness checks against information on file, identify controlling persons for entity customers, and maintain ongoing monitoring procedures.

Exchange mechanism: The Multilateral Competent Authority Agreement on CARF (MCAA-CARF) enables automatic bilateral exchange between signatory tax authorities. As of June 2026, numerous jurisdictions have signed the MCAA-CARF, including emerging adopters such as

Brazil (21 November 2024),

Singapore (26 November 2024),

Germany (26 November 2024), and the

UAE (21 July 2025).

Key references:

• OECD (2023), International Standards for Automatic Exchange of Information in Tax Matters: CARF and Amendments to CRS
• CARF XML Schema (July 2025): https://www.oecd.org/en/publications/crypto-asset-reporting-framework-xml-schema-july-2025_6e60235b-en.html
• Step-by-Step Implementation Guide: https://www.oecd.org/content/dam/oecd/en/networks/global-forum-tax-transparency/step-by-step-guide-understanding-implementing-crypto-asset-reporting-framework.pdf

1.2 EU DAC8

Council Directive (EU) 2023/2226 (DAC8) is the

EU's binding implementation of CARF into EU law, adopted on 17 October 2023. Unlike CARF, DAC8 is a mandatory directive that all 27 EU member states must transpose into domestic legislation.

Transposition deadline: 31 December 2025. Application date: 1 January 2026. First reporting: calendar year 2026. First exchange of information between tax authorities: by 30 September 2027.

Where DAC8 goes beyond CARF:

1. Extraterritorial reach: DAC8 applies to all RCASPs regardless of geographic location if they serve EU-resident taxpayers. Non-EU platforms (e.g., Binance, Coinbase, Kraken) serving EU residents must comply. CARF only applies to entities in participating jurisdictions.

2. Customer blocking provision: If a customer fails to provide self-certification after two reminders, the RCASP must block the customer from performing reportable transactions within 60 days. CARF contains no equivalent enforcement mechanism.

3. GDPR notification: RCASPs must provide GDPR notifications to customers before collecting and reporting their personally identifiable information. This obligation is absent from CARF.

4. Penalty framework: DAC8 establishes penalties ranging from EUR 20,000 to EUR 500,000 for serious non-compliance (e.g., complete absence of reporting despite administrative reminders). Under CARF, penalties are left entirely to domestic law.

5. Broader asset coverage: DAC8 covers assets defined under MiCA (Regulation (EU) 2023/1114), including e-money tokens and certain NFTs, and also encompasses CBDC balances (with low-risk exceptions) -- whereas CARF excludes CBDCs entirely, deferring them to CRS 2.0.

Transposition status (June 2026): On 30 January 2026, the European Commission launched formal infringement procedures against 12 member states that had not notified transposition measures: Belgium, Bulgaria, Cyprus, Czechia, Estonia, Greece, Luxembourg, Malta, Netherlands, Poland, Portugal, and Spain. Several have since transposed:

Germany via the Kryptowerte-Steuertransparenzgesetz (KStTG, in force 1 January 2026);

France via Finance Act 2025 Article 54; Italy gazetted 22 December 2025; Poland (Official Gazette, in force 18 March 2026); Luxembourg (Law of 27 March 2026, parliamentary adoption 19 March 2026); and

Portugal via Law No. 26/2026 of 3 June 2026 (which also transposes DAC9/Pillar Two; parliamentary text approved 11 May 2026). Portugal's transposition removes it from the cohort of jurisdictions that had missed the deadline.

Key references:

• European Commission DAC8 overview: https://taxation-customs.ec.europa.eu/taxation/tax-transparency-cooperation/administrative-co-operation-and-mutual-assistance/directive-administrative-cooperation-dac/dac8_en
• KPMG, EC launches infringement procedures: https://kpmg.com/us/en/taxnewsflash/news/2026/02/ec-launches-infringement-procedures-dac9-dac8.html
• RSM, DAC8 and CARF reporting challenges: https://rsmus.com/insights/tax-alerts/2025/dac8-and-carf-present-extensive-reporting-challenges-for-crypto-platforms.html

1.3 US Form 1099-DA / FATCA

The

US approach is structurally different from CARF and DAC8. Rather than adopting the OECD model rules directly, the US developed a domestic broker reporting regime through Form 1099-DA, with international exchange as a future layer.

Legal basis: IRC Section 6045, as amended by the Infrastructure Investment and Jobs Act (IIJA, P.L. 117-58, Section 80603). Final regulations published as T.D. 9989 (July 9, 2024).

Reporting timeline:

• January 1, 2025: Gross proceeds reporting by custodial brokers begins
• January 1, 2026: Cost basis reporting begins for covered securities
• Transition relief: Notice 2024-56 (no penalties for good-faith noncompliance in 2025); Notice 2025-7 (cost basis identification relief for 2025); Notice 2025-33 (backup withholding relief through 2027)

Who must report: Custodial digital asset trading platforms (e.g., Coinbase, Kraken), digital asset hosted wallet providers, digital asset kiosks (ATMs), and certain processors of digital asset payments (PDAPs).

DeFi exclusion: Treasury Decision 10021, which would have extended Form 1099-DA to DeFi participants, was repealed by H.J. Res. 25 (signed April 10, 2025) under the Congressional Review Act. The IRS is prohibited from issuing a substantially similar rule without new legislation.

Cost basis reporting: A feature unique to the US framework -- neither CARF nor DAC8 require cost basis reporting. Beginning January 1, 2026, brokers must report cost basis on a per-wallet/per-account FIFO basis (Rev. Proc. 2024-28 basis allocation) unless the taxpayer elects specific identification.

CARF adoption timeline: The US has committed to CARF implementation but on a longer timeline than the 2027 first-mover cohort, with first exchanges expected by 2029 -- significantly later than the 2027 target for most participating jurisdictions. On November 14, 2025, Treasury submitted CARF implementation proposed regulations to the White House Office of Information and Regulatory Affairs (OIRA) for review (still under review as of mid-2026). This is notable as the US does not participate in the Common Reporting Standard (CRS), making CARF the first US participation in an OECD automatic exchange framework.

Key references:

• IRS, Instructions for Form 1099-DA (2025): https://www.irs.gov/instructions/i1099da
• IRS, Final regulations for broker reporting: https://www.irs.gov/newsroom/final-regulations-and-related-irs-guidance-for-reporting-by-brokers-on-sales-and-exchanges-of-digital-assets
• OECD CARF Monitoring and Implementation Update 2025: https://www.oecd.org/content/dam/oecd/en/networks/global-forum-tax-transparency/crypto-asset-reporting-framework-monitoring-implementation-update-2025.pdf

2. Detailed Comparison Table

3. Implementation Status by Jurisdiction

The following section covers all 19 jurisdictions studied in this domain. The CARF first-exchange year is the single fastest-moving variable in cross-border crypto tax reporting, so the table below mirrors each jurisdiction's exact status, first-exchange year, DAC8 applicability, and domestic reporting posture from the canonical fact matrix.

3.1 CARF Status and First-Exchange Year (as of June 2026)

3.2 First-Exchange Cohorts Among the 19 Studied Jurisdictions

DAC8 applicability: Of the 19 studied jurisdictions, 4 are subject to DAC8 -- the EU 27-state bloc, France, Germany, and Portugal (the three EU member states studied individually). The remaining 15 are non-EU and implement CARF directly (or, like the US, build a domestic reporting regime). Form 1099-DA applies to exactly 1 of the 19 (the United States).

3.3 Global Commitment Context

Beyond the 19 studied jurisdictions, the OECD records a broader global commitment picture: a first-mover cohort begins data collection on 1 January 2026 (with exchanges in 2027), a second wave targets 2028, and the US targets 2029. A small set of "relevant" jurisdictions -- including

El Salvador, Argentina, Georgia, India's regional peers, and Vietnam -- had not committed at the time of the OECD's 2025 monitoring update; India has since committed (CBDT rules finalised 8 September 2025, first exchange targeted for 2027).

Source: OECD, Jurisdictions committed to implement CARF (updated regularly): https://www.oecd.org/content/dam/oecd/en/networks/global-forum-tax-transparency/commitments-carf.pdf

4. Technical Architecture

4.1 CARF XML Schema

The OECD released the CARF XML Schema in October 2024, with an updated version published in July 2025. The schema serves dual purposes: domestic reporting by RCASPs to national tax authorities, and international exchange between tax administrations under the MCAA-CARF.

Schema structure:

1. RCASP Section -- reporting entity identity, reporting obligation, and nexus to the reporting jurisdiction
2. Crypto Users Section -- reportable users' identities and relevant transaction data

Data elements are classified as either:

• Validation (mandatory for all records, subject to automated checks)
• Optional (not required for schema validation but recommended)

User identification data reported:

• Full name, address, tax residence jurisdiction(s), Tax Identification Number(s), date of birth (individuals), entity type and controlling persons (entities)

Transaction data reported:

• Type of crypto-asset, aggregate gross amount paid and number of units for exchange transactions, aggregate fair market value and number of units for transfers, wallet addresses for external transfers

Technical reference: https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/07/crypto-asset-reporting-framework-xml-schema-july-2025_d1f81247/6e60235b-en.pdf

4.2 Data Exchange Mechanisms

4.3 IT Infrastructure Requirements for Tax Authorities

Implementing CARF requires significant technical investment by tax administrations. Based on the OECD Step-by-Step Implementation Guide and the UK's published impact assessment, the core infrastructure components include:

Receiving and processing systems:

• Intake portal for domestic RCASP submissions (XML upload, validation, error handling)
• Automated validation engine applying CARF schema validation rules
• Data matching capability to link reported crypto users with domestic taxpayer records
• Secure storage infrastructure meeting Global Forum confidentiality and data safeguard standards

Exchange infrastructure:

• Connection to the Common Transmission System (CTS) or equivalent secure channel for bilateral exchange
• Encryption and authentication protocols compliant with OECD standards
• Status message handling (using the 2025 Status Message XML Schema) for structured feedback on data quality

Compliance and monitoring tools:

• Risk assessment engine for identifying non-compliant RCASPs
• Audit trail and logging for data access
• Penalty administration workflow

UK cost benchmark: HMRC estimated total CARF implementation cost at GBP 69 million covering IT delivery, support, exchange systems, and compliance operations, with estimated exchequer benefit of GBP 40--110 million annually from 2026 to 2028.

Source: UK Gov, Implementation of the CARF: https://www.gov.uk/government/publications/cryptoasset-reporting-framework/implementation-of-the-cryptoasset-reporting-framework-carf

4.4 Relationship with CRS 2.0

CARF and the amended CRS (CRS 2.0) operate as complementary frameworks designed to avoid duplication:

• CARF tracks crypto-asset transactions through service providers
• CRS 2.0 monitors electronic money and digital currency holdings through traditional financial institutions
• CBDCs and specified electronic money products fall under CRS 2.0, not CARF
• The OECD published the Addendum to the CRS-MCAA, with signatories listed as of December 2025
• South Africa illustrates the combined model, adopting CARF and the updated CRS together from 1 March 2026

Both frameworks use aggregate transaction reporting over time, rather than year-end balance snapshots. This design prevents manipulation through year-end asset shifting between wallets.

5. Challenges

5.1 DeFi and Unhosted Wallets

The intermediary-based architecture of CARF, DAC8, and 1099-DA creates a fundamental coverage gap for decentralized finance. All three frameworks depend on a Reporting Crypto-Asset Service Provider (RCASP) or broker as the compliance node. Where no identifiable intermediary exists, reporting obligations cannot attach.

DeFi coverage under each framework:

• CARF: Applies to DeFi platforms where an entity or individual "exercises sufficient control" to comply. Fully decentralized protocols without identifiable controllers remain outside scope. The OECD has signaled future updates may expand coverage.
• DAC8: Same principle as CARF. The EU's broader AML Regulation (Reg. (EU) 2024/1624) may provide supplementary enforcement through VASP licensing requirements under MiCA.
• US 1099-DA: DeFi platforms are explicitly excluded following the Congressional Review Act repeal of T.D. 10021 (April 2025). The IRS is legally barred from issuing a substantially similar rule without new legislation.

Unhosted wallet reporting: RCASPs must report transfers to unhosted (self-hosted) wallet addresses, including the wallet address and value transferred. However, wallet-to-wallet transfers without any intermediary are not directly captured. They become reportable only when funds subsequently flow through a covered service provider.

The EU has taken the most aggressive stance: under its AML framework, VASPs must verify identities of both sender and recipient for every transfer (the EU Transfer of Funds Regulation, Reg. (EU) 2023/1113, applies to all crypto transfers with no minimum threshold, in force 30 December 2024), and from July 2027 anonymous wallet interactions with regulated services are effectively curtailed.

5.2 Privacy Coins

Privacy-enhancing cryptocurrencies (Monero, Zcash, Dash) present a structural incompatibility with CARF and DAC8 reporting. Their core protocols make it technically impossible for exchanges to identify sender or receiver addresses, creating a direct conflict with reporting obligations.

Regulatory responses:

• The
  EU has banned exchanges and custodial services from listing or holding privacy coins by July 2027 under new AML rules, though individual use in self-hosted wallets remains legal.
• Multiple exchanges have delisted privacy coins in EU jurisdictions ahead of the ban.
• The OECD has acknowledged the gap but has not issued specific guidance on privacy coins.
• No jurisdiction has solved the fundamental problem of reporting on transactions that are cryptographically designed to be untraceable.

5.3 Cross-Chain Transactions

Cross-chain bridges, atomic swaps, and wrapped token conversions create reporting blind spots. When a user moves assets from one blockchain to another (e.g., BTC to wBTC on Ethereum), the transaction may not pass through any single RCASP, or it may be recorded on two separate chains with no unified reporting view.

Current status: Neither CARF, DAC8, nor 1099-DA provide specific guidance on cross-chain transaction reporting. Blockchain analytics companies offer partial solutions, but no framework has established a standardized approach to cross-chain data reconciliation.

5.4 The Sunrise Problem

The sunrise problem (also called the "sunrise issue") is the most significant operational challenge facing cross-border crypto tax reporting. It refers to the transitional period during which frameworks are not uniformly implemented across jurisdictions, creating a compliance patchwork.

The problem in context:

Originally identified in the FATF Travel Rule context, the sunrise problem arises because:

1. Some jurisdictions have mandatory CARF compliance while others have not yet implemented it
2. RCASPs in compliant jurisdictions cannot fulfill all cross-border obligations when counterparties operate in non-compliant jurisdictions
3. Users can exploit implementation gaps by moving to exchanges in jurisdictions that have not yet adopted reporting requirements

CARF-specific sunrise dynamics across the studied jurisdictions:

• The 2027 first-exchange cohort (11 of the 19 studied, including the EU bloc, UK, Germany, France, Portugal, Japan, South Korea, India, Brazil, Canada, and South Africa) begins data collection in 2026.
• A 2028 cohort (Australia, Singapore, Thailand, Nigeria, UAE) follows, with Switzerland's delayed crypto provisions producing a first exchange around 2028.
• The US targets 2029 on its longer unilateral timeline.
• El Salvador has not committed at all, leaving Salvadoran CASP data outside automatic exchange.
• This staggered rollout creates a multi-year window during which regulatory arbitrage is possible.

How jurisdictions are addressing it:

• South Korea: Allows conditional transactions during the sunrise period
• Japan: Exempts certain cross-border transfers to non-compliant regions
• UK: Applies risk-based determinations when counterparty jurisdiction is non-compliant
• EU: Leverages extraterritorial reach of DAC8 to capture non-EU RCASPs serving EU residents, partially mitigating the gap

Source: Notabene, "Addressing the Sunrise Issue": https://notabene.id/post/addressing-the-sunrise-issue-navigating-compliance-in-the-staggered-rollout-of-the-crypto-travel-rule

6. What Works and What Doesn't

What Works

1. Building on CRS infrastructure. Jurisdictions with mature CRS (Common Reporting Standard) implementations have a significant head start. CARF leverages CRS infrastructure for exchange mechanisms, confidentiality frameworks, and peer review processes. The

   UK's CARF SI 2025/744 explicitly builds on existing CRS reporting channels, and
   South Africa adopts CARF and updated CRS together from 1 March 2026.

2. Aggregate transaction reporting over time. Both CARF and DAC8 require reporting of aggregate transaction values across the full reporting period, not point-in-time balances. This prevents the manipulation tactic of emptying accounts before a reporting date -- a known weakness of balance-based reporting under original CRS.

3. The UK's domestic extension. The

   UK extended CARF reporting to cover all customers, including UK residents -- going beyond the OECD minimum (which only requires reporting on non-residents for international exchange). This eliminates a domestic blind spot and provides HMRC with comprehensive data. Estimated benefit: GBP 40--110 million annually.

4. DAC8's customer blocking mechanism. The 60-day self-certification deadline with transaction blocking creates a powerful incentive for user compliance. Without self-certification, users cannot transact -- making the due diligence process self-enforcing.

5. US phased rollout with transition relief. The IRS's approach of phasing in gross proceeds (2025) before cost basis (2026), combined with good-faith compliance relief (Notices 2024-56, 2025-7, 2025-33), provides a pragmatic model for complex regulatory transitions.

6. Early CARF alignment by emerging economies.

   Brazil's Normative Instruction RFB 2291/2025 (14 November 2025) aligned its domestic crypto reporting with CARF requirements, and
   South Africa went live on 1 March 2026 -- demonstrating that emerging economies can implement CARF within existing regulatory capacity.

What Doesn't Work

1. Reliance on intermediaries for a decentralized ecosystem. The fundamental design assumption of all three frameworks -- that reporting obligations attach to an intermediary (RCASP/broker) -- creates structural gaps for DeFi, P2P transactions, and self-custodied assets. This is not a fixable deficiency within the current architecture; it is a design limitation.

2. Fragmented timelines. The staggered 2027/2028/2029 implementation creates a multi-year arbitrage window. Users seeking to avoid reporting can migrate to exchanges in jurisdictions that have not yet implemented CARF, or to non-committed jurisdictions like

   El Salvador.

3. Overlapping compliance burdens. An RCASP operating globally may face simultaneous obligations under CARF (for the 2027 and 2028 cohorts), DAC8 (for EU residents), 1099-DA (for US customers), and domestic frameworks in each country of operation. The data elements are similar but not identical, creating duplicative compliance costs. RSM characterizes this as "extensive reporting challenges" for crypto platforms operating across jurisdictions.

4. No solution for privacy coins. All three frameworks assume that transaction counterparties and wallet addresses are identifiable. Privacy coins fundamentally violate this assumption. The EU's response (banning exchange listings) pushes activity to P2P and unregulated channels rather than solving the reporting problem.

5. US DeFi exemption creates a global gap. The Congressional Review Act repeal of DeFi broker reporting (April 2025) means the world's largest DeFi market has no broker reporting obligations, and the IRS cannot impose them without new legislation. This undermines the global coherence of cross-border reporting.

6. Even mandatory directives face delays. The January 2026 infringement proceedings against 12 EU member states (Belgium, Bulgaria, Cyprus, Czechia, Estonia, Greece, Luxembourg, Malta, Netherlands, Poland, Portugal, and Spain) demonstrate that even binding EU directives face implementation delays -- though several, including Poland (18 March 2026), Luxembourg (27 March 2026), and

   Portugal (Law No. 26/2026 of 3 June 2026), have since transposed. Voluntary OECD frameworks face an even higher risk of staggered adoption.

7. Recommended Framework for Countries Not Yet Implementing

For jurisdictions that have not yet committed to CARF or established domestic crypto tax reporting, the following phased approach is recommended based on observed best practices:

Phase 1: Foundation (Months 0-12)

1. Commit to CARF. Signal political commitment through the OECD Global Forum process. This provides access to capacity-building programs and peer support. Failure to commit risks becoming a regulatory arbitrage destination and being identified by the OECD as a non-cooperative jurisdiction.

2. Align definitions. Adopt CARF terminology and definitions (RCASP, Relevant Crypto-Asset, Reportable Transaction) into domestic tax law. This avoids definitional conflicts during future data exchange.

3. Establish RCASP registration. Require domestic crypto-asset service providers to register with the tax authority. This can build on existing FATF-compliant VASP registration if available.

Phase 2: Domestic Reporting (Months 12-24)

1. Implement domestic reporting using CARF XML Schema. Require registered RCASPs to report user identification data and transaction data to the domestic tax authority in CARF XML format. Using the OECD schema from the outset avoids costly format migrations later.

2. Extend reporting to domestic residents. Follow the

   UK model: require RCASPs to report on all customers, including domestic residents, not just non-residents. This provides the tax authority with comprehensive data for domestic compliance and eliminates the need for a separate domestic reporting regime.

3. Build IT infrastructure. Invest in receiving, validating, and matching systems. The UK's GBP 69 million cost benchmark provides a reference point, though smaller jurisdictions can implement at lower cost by leveraging cloud infrastructure and OECD-provided tools.

Phase 3: International Exchange (Months 24-36)

1. Sign MCAA-CARF. Execute the multilateral competent authority agreement to enable automatic exchange with partner jurisdictions.

2. Undergo Global Forum pre-exchange confidentiality review. This is a prerequisite for receiving CARF data from partner jurisdictions. The review ensures adequate data safeguards are in place.

3. Begin bilateral exchanges. Commence automatic exchange of CARF data with partner jurisdictions. First exchanges should target jurisdictions with the highest volumes of cross-border crypto activity involving the implementing country's tax residents.

Key Decision Points

• Domestic extension (UK model) vs. international-only: Strongly recommend the UK model. Reporting on domestic residents provides immediate tax compliance benefits and avoids building two parallel systems.
• Penalty regime: Establish clear penalties for RCASP non-compliance. The DAC8 range (EUR 20,000--500,000) provides a reference. The UK's per-day penalties (up to GBP 300/day for failure to register, GBP 600/day for failure to report) offer an alternative scaled model.
• Customer blocking: Consider adopting DAC8's blocking mechanism for non-certified users. This is the most effective self-enforcing due diligence tool available but raises access concerns.

8. Decision Matrix

The following matrix helps regulators identify which framework elements to adopt based on their jurisdiction's characteristics.

8.1 Framework Selection Criteria

8.2 Cost-Benefit Summary

8.3 Timeline Benchmarks

Verification Notes

This is a refresh synthesis (modified 2026-06-04). All cross-border reporting facts mirror the canonical per-jurisdiction fact matrix (t5: CARF status, first-exchange year, DAC8 applicability, domestic reporting) for all 19 studied jurisdictions. No fact has been introduced that is not in the matrix or the prior verified version. Where the matrix records uncertainty (e.g.,

Thailand CARF transposition "not yet enacted";

Switzerland first exchange "expected ~2028"), this document reflects that honestly rather than asserting a firm date.

CARF first-exchange years (mirrored exactly from the matrix t5):

1. 2027 cohort (11 of 19):
   Brazil,
   Canada,
   India,
   Japan,
   South Korea, the
   EU 27-state bloc,
   France,
   Germany,
   Portugal, the
   UK, and
   South Africa.
2. 2028 cohort (5 of 19):
   Australia,
   Singapore,
   Thailand,
   Nigeria, and the
   UAE (UAE go-live 1 January 2027, first exchange 2028 covering the 2027 reporting year).
3. ~2028 delayed (1 of 19):
   Switzerland -- crypto provisions of the AEOIA do not apply in 2026; earliest application 2027, first exchange around 2028 if the partner-jurisdiction list is activated.
4. 2029 (1 of 19): the
   United States -- longer unilateral timeline; proposed CARF regulations submitted to OIRA on 14 November 2025 and still under review.
5. Not committed (1 of 19):
   El Salvador -- one of five "relevant" jurisdictions outside CARF; no automatic exchange of Salvadoran CASP data.

Key corrections applied in this refresh:

• India is now committed to CARF (CBDT rules finalised 8 September 2025; first exchange targeted 2027) -- previously recorded as not yet committed.
• Portugal has now transposed DAC8/CARF via Law No. 26/2026 of 3 June 2026 (first exchange 2027) -- previously shown only in infringement proceedings for a missed deadline. Poland (18 March 2026) and Luxembourg (27 March 2026) have likewise transposed since the January 2026 infringement launch.
• Switzerland first exchange corrected to ~2028 (crypto provisions suspended for 2026), not 2027.
• Brazil CARF-MCAA signed 21 November 2024; IN RFB 2291/2025 CARF-aligned reporting; first exchange 2027. (Separately, on the substantive tax side, MP 1303/2025's flat 17.5% rate expired on 8 October 2025; Brazil's progressive 15--22.5% CGT and R$35,000 monthly exemption remain in force.)
• Nigeria CARF framework now rests on the NTAA 2025 (and ISA 2025); CARF-aligned procedures required by 1 January 2028, first exchange 2028.
• UAE signed the CARF-MCAA on 21 July 2025 (MoF announcement 20 September 2025); go-live 1 January 2027, first exchange 2028.
• The US 2026 long-term capital-gains 20% rate breakpoint is USD 613,700 (MFJ) -- noted here for cross-domain consistency with the income-classification and incentives guidance, though rates themselves are outside this document's cross-border-reporting scope.

Other facts verified against the matrix:

1. DAC8 applies to 4 of the 19 studied jurisdictions -- the EU bloc plus France, Germany, and Portugal; all 15 non-EU jurisdictions implement CARF directly or build a domestic regime.
2. Form 1099-DA applies to 1 of the 19 -- the United States (gross proceeds from 1 January 2025, cost basis from 1 January 2026).
3. DAC8 first exchange by 30 September 2027 for the EU; first reporting year calendar 2026.
4. US CARF first exchange 2029 on the longer US timeline; proposed regulations under OIRA review since 14 November 2025.
5. EU Transfer of Funds Regulation (Reg. (EU) 2023/1113) applies to all crypto transfers with no minimum threshold, in force 30 December 2024.
6. DeFi broker rule repeal (H.J. Res. 25) signed 10 April 2025 (Congressional Review Act); IRS barred from a substantially similar rule without new legislation.
7. CARF XML Schema updated July 2025; UK CARF implementation cost GBP 69 million (HMRC).
8. DAC8 customer blocking -- 60 days after two reminders; penalties EUR 20,000--500,000.

Items requiring ongoing monitoring:

• US CARF proposed regulations (under OIRA review since November 2025)
• Remaining EU member-state DAC8 transpositions and infringement outcomes
• Switzerland's activation of its CARF partner-jurisdiction list (proposed exchange with up to 74 jurisdictions)
• Thailand's CARF transposition (Revenue Department working on it; not yet enacted)
• OECD future guidance on DeFi and privacy coins
• EU AML ban on privacy coin exchange listings (effective July 2027)

Sources

Primary Sources (International Organizations)

1. OECD, Jurisdictions committed to implement CARF: https://www.oecd.org/content/dam/oecd/en/networks/global-forum-tax-transparency/commitments-carf.pdf
2. OECD, CARF XML Schema (July 2025): https://www.oecd.org/en/publications/crypto-asset-reporting-framework-xml-schema-july-2025_6e60235b-en.html
3. OECD, Step-by-Step Implementation Guide: https://www.oecd.org/content/dam/oecd/en/networks/global-forum-tax-transparency/step-by-step-guide-understanding-implementing-crypto-asset-reporting-framework.pdf
4. OECD, CARF 2025 Monitoring and Implementation Update: https://www.oecd.org/content/dam/oecd/en/networks/global-forum-tax-transparency/crypto-asset-reporting-framework-monitoring-implementation-update-2025.pdf
5. OECD, MCAA-CARF Signatories List: https://www.oecd.org/content/dam/oecd/en/topics/policy-issues/tax-transparency-and-international-co-operation/carf-mcaa-signatories.pdf
6. OECD, CARF FAQs: https://www.oecd.org/content/dam/oecd/en/topics/policy-issues/tax-transparency-and-international-co-operation/faqs-crypto-asset-reporting-framework.pdf
7. European Commission, DAC8 Overview: https://taxation-customs.ec.europa.eu/taxation/tax-transparency-cooperation/administrative-co-operation-and-mutual-assistance/directive-administrative-cooperation-dac/dac8_en

Primary Sources (National Authorities)

1. IRS, Instructions for Form 1099-DA (2025): https://www.irs.gov/instructions/i1099da
2. IRS, Final regulations for broker reporting: https://www.irs.gov/newsroom/final-regulations-and-related-irs-guidance-for-reporting-by-brokers-on-sales-and-exchanges-of-digital-assets
3. UK Gov, Implementation of the CARF: https://www.gov.uk/government/publications/cryptoasset-reporting-framework/implementation-of-the-cryptoasset-reporting-framework-carf
4. UK, SI 2025/744 (CARF Regulations): https://www.legislation.gov.uk/uksi/2025/744/contents/made
5. UK Gov, Domestic reporting of UK resident cryptoasset users: https://www.gov.uk/government/publications/cryptoasset-reporting-framework-reporting-of-uk-resident-cryptoasset-users/domestic-reporting-of-uk-resident-cryptoasset-users-under-the-cryptoasset-reporting-framework
6. KPMG, Germany: Implementation of DAC8 and CARF: https://kpmg.com/us/en/taxnewsflash/news/2026/01/tnf-germany-updated-crs-guidance-implementation-of-dac8-and-carf.html
7. KPMG, South Africa: Draft business requirement specifications for CARF: https://kpmg.com/us/en/taxnewsflash/news/2025/11/tnf-south-africa-draft-business-requirement-specifications-for-fatca-crs-and-carf.html

Secondary Sources (Analysis and Commentary)

1. RSM, DAC8 and CARF reporting challenges: https://rsmus.com/insights/tax-alerts/2025/dac8-and-carf-present-extensive-reporting-challenges-for-crypto-platforms.html
2. Carey Olsen, Introducing CARF: https://www.careyolsen.com/insights/briefings/introducing-carf-oecds-crypto-asset-reporting-framework
3. TaxBit, Understanding and Implementing DAC8 & CARF: https://www.taxbit.com/blogs/understanding-and-implementing-dac8-crypto-asset-reporting-framework-carf
4. Camuso CPA, CARF & DAC8 Readiness: https://camusocpa.com/global-crypto-tax-reporting/
5. Notabene, Addressing the Sunrise Issue: https://notabene.id/post/addressing-the-sunrise-issue-navigating-compliance-in-the-staggered-rollout-of-the-crypto-travel-rule
6. KPMG, EC launches infringement procedures for DAC8: https://kpmg.com/us/en/taxnewsflash/news/2026/02/ec-launches-infringement-procedures-dac9-dac8.html
7. Sumsub, Global Crypto Tax Data Collection Under CARF: https://sumsub.com/media/news/global-crypto-tax-data-collection-under-carf/
8. Blockpit, 2026: Tax authorities will get your crypto data: https://www.blockpit.io/tax-guides/tax-authorities-will-get-your-crypto-data
9. FATF, Best Practices for Travel Rule Supervision (June 2025): https://www.fatf-gafi.org/content/dam/fatf-gafi/recommendations/Best-Practices-Travel-Rule-Supervision.pdf
10. Noked, N., "Ending the Crypto Tax Haven," Harvard Business Law Review (2025): https://journals.law.harvard.edu/hblr/wp-content/uploads/sites/87/2025/03/04_HLB_15_1_Noked171-216.pdf