carf crypto-asset reporting framework Aug 20, 2026

Can Tax Authorities Be Trusted With Your Crypto Data?

By Clinton Donnelly, LLM, EA | CEO & Founder, CryptoTaxAudit With Jamie Nuttall Bsc Hons, FCCA| Managing Director, Myna L2 Accountancy

On January 1, 2026, crypto exchanges in the United Kingdom started collecting their users' full names, home addresses, tax identification numbers, and wallet addresses. They are legally required to hand that data to HMRC, the UK tax authority. The first international exchange of that information begins in early 2027.

This is the Crypto-Asset Reporting Framework, or CARF. It is an OECD system built to do for crypto what bank reporting already does for cash. The data it collects is nearly identical to what the IRS now collects from US exchanges through Form 1099-DA.

The promise is a transparent system where everyone pays the right tax. The unanswered question is the one a growing number of investors and advisors are asking out loud. Once tax authorities around the world hold your wallet address and transaction history, can they be trusted to keep it safe?

This analysis draws on a conversation between CryptoTaxAudit founder Clinton Donnelly and Jamie Nuttall, Managing Director at Myna L2, who works with UK digital-asset investors directly and HMRC, the UK tax authorities

Key Takeaways

CARF is live in the UK as of January 1, 2026: UK cryptoasset service providers now collect user and transaction data for HMRC, with the first cross-border exchange due in 2027 for 2026 activity. The EU follows the same timeline.
CARF and Form 1099-DA collect the same data: The US 1099-DA reports a taxpayer's crypto sales, cost basis, and transfers to the IRS. If the US activates CARF, US exchanges would send the same data on foreign residents to their home tax authorities.
The US has not activated CARF: The US joined the 2023 commitment in principle, but a January 2025 White House memorandum rejected the broader OECD tax deal, and the US has never joined the banking-data equivalent, the Common Reporting Standard.
Wallet addresses become permanent government records: Transfers are reported, not just sales, so wallet addresses get disclosed. Once an authority has one address, it can trace the entire connected history backward.
Moving your own crypto can trigger a false tax notice: Tax authorities see centralized-exchange data but not your self-custody wallets necessarily, so a transfer between two wallets you own can look like a taxable disposal.
A French tax official was accused of selling crypto holders' data to criminals: Data exposure is a physical-security issue, not only a compliance one. France recorded more than 40 crypto-related kidnappings between mid-2023 and the end of 2025.

What Is CARF and Why Does It Matter Now?

The Crypto-Asset Reporting Framework is an OECD standard that requires crypto exchanges and custodial wallet providers to report their users' identities and transactions to tax authorities, which then exchange that data internationally. It does for crypto what the Common Reporting Standard has done for bank accounts since 2017.

The OECD finalized CARF in June 2023. A first wave of 48 jurisdictions, including the UK and the EU, began recording data on January 1, 2026, with the first UK reports due by May 31, 2027, for the 2026 calendar year. A second wave of roughly 28 jurisdictions, including Switzerland, the UAE, and Hong Kong, begins recording in 2027 with the first exchange in 2028. Mexico is set to come into scope in 2027.

Reporting providers, called RCASPs, must collect each user's tax residence, taxpayer identification number, name, and address. They then report the user's yearly activity: purchases, sales, crypto-to-crypto swaps, and transfers in and out. The stated goal is to close the gap that allows crypto to move across borders without effective tax oversight.

How CARF and the 1099-DA Are the Same System

Form 1099-DA is the US domestic version of CARF. It reports a taxpayer's digital asset sales, gross proceeds, cost basis, and transfers to the IRS, which is the same data CARF requires exchanges to collect abroad.

The 1099-DA is already in effect. It reports gross proceeds on 2025 sales, filed in early 2026, with cost basis reporting starting for 2026 transactions. The two systems were built to line up. If the US activated CARF, US exchanges would identify which country a foreign user is tax-resident in and send a 1099-DA-equivalent to that country's tax authority.

One difference matters for privacy. Under US law, the taxpayer receives a copy of their own 1099-DA. Under CARF, the data flows from the provider to the local tax authority and then to the foreign authority. The user is not automatically sent a copy of what gets reported about them across borders.

Where the US Actually Stands on CARF

The United States has not activated CARF, despite joining the 2023 international commitment in principle alongside 47 other jurisdictions.

In January 2025, the White House issued a memorandum declaring that the OECD Global Tax Deal has no force or effect in the US absent an act of Congress, and directing the Treasury to notify the OECD. That memorandum targeted the global minimum tax, not CARF specifically, but it signaled a broader retreat from OECD tax commitments. The US has also never joined the Common Reporting Standard. It collects data on foreign-held US accounts through FATCA but does not reciprocate at the same level, which is why the US is often described as the largest tax haven for non-residents.

Extending crypto information sharing would run counter to that long-standing position. Clinton Donnelly wrote to the President arguing that sharing crypto data with foreign governments contradicts both the executive order and the practice of not sharing brokerage information abroad. Whether a future administration activates CARF remains open. Timelines discussed for a possible US start fall in the 2028 to 2029 range.

Your Wallet Address Is Becoming a Government Record

CARF and the 1099-DA both report wallet transfers, not just profitable sales, which means your wallet addresses get disclosed to tax authorities. Once an authority holds an address, the blockchain does the rest.

Public ledgers are permanent and fully traceable. An address handed over for 2026 activity exposes every transaction that the wallet has ever made, backward and forward. The reporting start date does not limit how far back the data can be read.

The IRS already runs this kind of analysis. It uses Palantir's Foundry and Gotham platforms to connect millions of records across agencies, and contract documents show that view extends to Bitcoin, Ethereum, Litecoin, and Ripple. Analysts track transfers from one address to the next, map connected wallets, and reconstruct a holder's full position even when only a single address is reported. One disclosed address can unravel an entire portfolio.

Why You Could Get a Tax Notice for Moving Your Own Crypto

Tax authorities receive data from centralized exchanges and brokers, but not from your self-custody wallets, and that gap produces false alarms. When you move crypto from an exchange to your own hardware wallet, the exchange reports it as a transfer out.

The authority sees value leaving but cannot see that it landed in a wallet you control. Under the UK's data-matching, that can generate an inquiry: a letter claiming you may have disposed of tens of thousands in Bitcoin when you only moved it between your own wallets. The same mismatch risk exists with the 1099-DA. The IRS matches the form against your return, and unexplained transfers or missing cost basis can trigger a CP2000 notice.

The defense is documentation. A clean, reconciled record that shows which movements were disposals and which were transfers between your own wallets is what answers the inquiry before it becomes an assessment.

Reconciling transfers against disposals across all wallets and exchanges is exactly where most crypto tax errors start. The Full Service Crypto Gain Calculation from CryptoTaxAudit builds a complete, audit-ready record of your gains, losses, and wallet-to-wallet transfers, so a self-custody move never reads as a taxable sale.

Can Tax Authorities Be Trusted With This Data?

The central risk of CARF is not the tax. It is the security of a global database that links your identity, home address, and total crypto wealth in one place.

The network is only as strong as its weakest member. CARF connects dozens of tax authorities, so a breach in one country can expose data shared across the entire system. The track record is not reassuring. A former French tax official was placed under investigation for allegedly passing crypto investors’ personal data to criminal contacts. Separately, France recorded more than 40 crypto-related kidnappings and home invasions between mid-2023 and the end of 2025. Globally, reported “wrench attacks,” in which victims are physically forced to surrender access to their crypto, increased by 75% in 2025.

The risk reaches the US. In September 2025, two Texas men were charged over a violent nine-hour home-invasion robbery of a crypto holder in Minnesota. CryptoTaxAudit has worked directly with a client targeted in an attack of this kind. Data that was meant for tax administration becomes a targeting list the moment it leaks.

Once the IRS holds your 1099-DA data, the question is not whether your return gets matched against it, but when. TaxShield membership monitors your IRS account for new activity and puts a team of crypto tax professionals in your corner if a notice or audit ever lands.

What Crypto Investors Can Do Right Now

There is no way to opt out of CARF or 1099-DA reporting, so the practical defense is accurate records and clean filing before the data-matching catches a mismatch.

Reconcile every wallet and exchange. Separate true disposals from transfers between your own wallets, so a move does not read as a taxable sale.

Track cost basis now. The 1099-DA reports cost basis from 2026 forward. Gaps in your own records are where mismatches and penalties start.

File accurately and on time. Underreported crypto can draw penalties of 20% for negligence up to 75% for civil fraud.

Limit public exposure. Avoid linking your identity to your holdings on social media, given the documented connection between data exposure and physical attacks.

The investors who get hurt are usually not the ones who owe tax. They are the ones whose records cannot explain what the blockchain already shows.

Frequently Asked Questions About CARF and Crypto Data

Q: What is CARF and when does it start?

A: CARF is the OECD Crypto-Asset Reporting Framework. UK providers began collecting data on January 1, 2026, with the first international exchange in 2027 for 2026 activity. The EU follows the same timeline, and a second wave including Switzerland, the UAE, and Hong Kong starts collecting in 2027.

Q: Is the US part of CARF?

A: The US joined the 2023 international commitment in principle but has not activated CARF exchange. A January 2025 White House memorandum rejected the broader OECD tax deal, and the US has never joined the Common Reporting Standard. The US 1099-DA already collects equivalent data domestically.

Q: I moved Bitcoin from Coinbase to my own wallet. Will the IRS think I sold it?

A: Possibly. The exchange reports the transfer out, but the IRS cannot see that it landed in a wallet you control. Without records showing it was a transfer and not a sale, that movement can trigger a CP2000 notice. Keep a reconciled record across every wallet and exchange.

Q: Should I amend my past crypto returns or wait for the IRS to contact me?

A: If you know a past return underreported crypto, amending before the IRS matches your 1099-DA data is almost always the lower-risk path. Penalties run from 20% for negligence to 75% for civil fraud, and a voluntary correction is treated differently than a mismatch the IRS finds first. The crypto tax preparation team can handle the amendment.

Q: Can tax authorities keep my crypto data secure?

A: There is no guarantee. CARF links many tax authorities, so a breach in one can expose data across the network. A French tax official was accused of selling crypto holders' data to criminals, and data exposure has been tied to a rise in physical attacks on holders.

Q: Does CARF mean I owe new taxes on my crypto?

A: No. CARF does not create new taxes. It gives tax authorities direct data to compare against what you report. Your obligation to report gains and income is the same. The difference is that mismatches are now easy to spot.

Q: Need help getting your crypto records audit-ready?

A: CryptoTaxAudit can reconcile your full transaction history and defend your return if the IRS questions it. Book a free consultation to get a clear picture of where you stand before the data-matching does.

The UK perspective in this article draws on a conversation with Jamie Nuttall, Managing Director at Myna L2. Follow his work on YouTube and X.

About CryptoTaxAudit: Founded in 2015 by Clinton Donnelly (LLM, EA), CryptoTaxAudit specializes exclusively in cryptocurrency tax preparation and IRS audit defense. Clinton holds an advanced law degree in international financial planning, federal Enrolled Agent status, and the Certified Cryptoasset Anti-Financial Crime Specialist credential from ACAMS. The firm has filed more than 5,000 crypto tax returns, defended clients in over 50 IRS audits, and represented five traders in U.S. Tax Court. CryptoTaxAudit serves clients across 71 countries and works directly with investors whose exchange data is now being matched against their tax returns under the 1099-DA and CARF reporting regimes.