Your Exchange Will Tell On You: CARF & DAC8 End Crypto Secrecy

• From 1 January 2026, EU-licensed crypto platforms must collect user and transaction data for tax reporting under DAC8. 
• CARF makes this automatic across 51+ jurisdictions, including many classic offshore hubs that agreed to exchange data from 2027. 
• The OECD CARF XML schema reports not just trades but also wallet transfers, linking KYC’d users to on-chain moves. 
• DeFi and pure self-custody remain the hardest for authorities to see, but once you touch a reporting intermediary, secrecy weakens. 
• For most users, declaring crypto will be easier than fighting a 2027 tax letter triggered by DAC8/CARF data.

From 1 January 2026, crypto trading on regulated platforms stops being a private sport. Platforms will collect your data through the year, and in 2027 tax authorities will start exchanging it, just like they already do for bank accounts under CRS and FATCA. The OECD built the global version, CARF. The EU plugged it into its own law and called it DAC8.

People always assumed crypto was anonymous so states couldn’t see. That was never really the problem. The problem was that states didn’t have a standard way to make exchanges send them the data. That’s what CARF fixes globally and DAC8 fixes inside the EU. The governments finally built the pipe to get the data without asking you nicely first.

Try the leading VASP data free for 1 month. No card required.

Here’s What’s Happening

Under DAC8, EU platforms that let you buy, sell or exchange crypto have to identify you, tag your tax residence, and report your transactions for the 2026 calendar year. First reports go in 2027. That date matters, because it means 2025 is the last full year of “they don’t have the feed yet.” After that, they do. Reporting crypto-asset service providers must report no later than 31 January of the following year, starting 1 January 2026. So January 2027 is when the first real crypto files hit EU tax offices.

CARF runs on the same schedule but wider. The OECD’s list shows 51 jurisdictions starting exchanges in 2027 and another 20 in 2028. That’s Europe, UK, Switzerland, UAE, Singapore, Cayman, Guernsey, Isle of Man, basically the places people thought were “offshore.” They signed. So the classic “I’ll keep it in a nice island that doesn’t talk” idea doesn’t really work when that island signs the CARF-MCAA on 26 November 2024 and commits to send data from 2027.

So yes, the clock is real. OECD already published the XML user guide in July 2025. If the XML exists, they intend to use it.

CARF vs. DAC8

CARF is the global template from the OECD. It says that every “Reporting Crypto-Asset Service Provider” (they call it RCASP) must tell the tax authority who the user is, where they live for tax, and what crypto transactions they made in the year. Then tax authorities swap that data automatically under the CARF-MCAA. It’s literally modelled on CRS, and if you know CRS/FATCA you can read CARF. That’s the point since they copied what already works.

DAC8 is the EU doing the same thing inside the EU legal system. It amends Directive 2011/16/EU, reuses the MiCA definitions for who is a crypto-asset service provider, and then tells every Member State, “transpose by 31 December 2025 and start applying from 1 January 2026.” So if you are an EU-licensed exchange, you don’t get to say “we’ll wait for national guidance.” The Commission will issue standardised computerised forms before 1 January 2026 so everyone reports in the same way. So the EU side is very much locked in.

There is one nuance. DAC8 defines “reportable crypto-assets” slightly narrower than CARF. It keeps out e-money and CBDCs from full transaction reporting, it only wants balances there, because they’re stable and easy to monitor. But anything that can be used for payment or investment is in scope. That includes a chunk of NFTs. And because there’s room for interpretation, Member States can diverge, which means some CASPs will still go jurisdiction shopping. The DAC8 warns about that and even names forum shopping as a thing it wants to stop. So the EU knows people will try to slip through weak Member States.

XML Sees Transfers

The 2025 CARF XML schema is very explicit. Inside the “CARF Body” there is a section called “Relevant Transactions.” Then it lists them: crypto to crypto in, crypto to crypto out, crypto to fiat in, crypto to fiat out, crypto transfer in, crypto transfer out, and a separate “Transfer Wallet” element. That last part matters because that’s where the provider says whether you sent it to your own wallet or to someone else’s. So when people online say, “I’ll just withdraw to my ledger,” fine, but the fact that you withdrew is in the file. It’s not full chain surveillance, but it gives the tax authority the link between a KYC’d person and an on-chain move. That’s what was missing so far.

The future of finance is here. Trade crypto and more

This is why we can say crypto secrecy is ending for normal users. Once the platform reports that you bought 2.4 BTC, sold 0.4 BTC, and transferred 2.0 BTC to a self-hosted wallet on 13 March 2026, the tax office has enough to ask, “where is the gain?” You can no longer hide behind “but the blockchain is pseudonymous.” They have the bridge.

Offshore Yes, But Not Off-Record

Your files show the November 2025 list of signatories to the CARF-MCAA. It’s not just the EU and the usual OECD crowd. It’s Cayman Islands, Gibraltar, Guernsey, Isle of Man, Jersey, Singapore, UAE, and even a second wave like Bahamas and BVI slated for 2028. These are exactly the places people used to name when they wanted to open a company, a brokerage, or a “crypto friendly” account away from their home tax office. They are literally on the list. So the old idea of “offshore = silent” is outdated as of 2025.

Even better for us, the commitments document names who is not yet committed, including Argentina, Australia, El Salvador, India, Panama, Vietnam. It’s a short list. That means the story is actually “most liquidity hubs will report, a small tail won’t, but they are being nudged.” So we can honestly write that the secrecy era is ending because the jurisdictions people trusted decided to send the data. 

Who Gets Hit First

Centralised exchanges with an EU licence, UK-based platforms, Swiss players serving EU clients, and anyone in those 51 jurisdictions doing exchanges in 2027. They already have KYC, so adding tax reporting is just a systems job. For the user, the change is bigger. The tax office will now know you had crypto even if you never filed a crypto line in your return.

One study on Norway shows that about 40% of people self-report. So 60% don’t. That’s exactly the problem DAC8 and CARF are written to fix. They’re moving reporting away from the individual to the platform because self-reporting failed. And because EU law allows penalties for “recalcitrant CASPs,” national tax offices have a stick if a platform pretends not to see you.

So the people most at risk are people who used only big, KYC’d platforms, people who did high volume in 2026 thinking “I’ll sort tax later,” and people who moved large amounts to self-custody right after buying.

Skip the wait. Buy a licensed company.

All three patterns will be visible in the 2027 files.

But There Are Leaks

CARF may capture almost all exchanges, but it mainly targets intermediaries, so it is only as strong as the willingness to read it broadly. CARF may also likely fail to shut down the crypto tax haven unless it’s tightened. So it’s safe to say that early on in its implementation, secrecy may end for the lazy and not necessarily for the sophisticated. 

If you never touch a reporting CASP, if you only ever do peer-to-peer, if you only ever interact with a DEX front-end that’s not in a CARF jurisdiction, if you never bridge back to fiat in a covered country, your data is not in the automatic exchange. The Norwegian thesis says exactly that: decentralisation makes it difficult for tax authorities to ensure compliance. That won’t change just because Brussels said “DAC8.”

But that path is narrow, high-effort, and will look suspicious if at any point you did KYC on a regulated exchange and then everything suddenly goes on-chain. Authorities can still use collective information requests to go backwards, as Germany already did with some platforms. So it’s a leak.

From a business perspective, the main issue is cost. Compliance can cost a high six-figure amount per year for smaller European crypto companies. That’s very believable once you look at the CARF XML. Unlike a three-columned CSV, XML is a full CRS-style structure with crypto-to-crypto, wallet flags, controlling persons, and corrections. Big exchanges and neobanks will eat that cost because it brings them closer to the institutional crowd that wanted clarity. Smaller CASPs will look at this, look at MiCA, look at DAC8, and decide to geofence the EU. So EU users might end up with fewer domestic platforms after all

Goodbye Crypto Secrecy

Is crypto no longer anonymous? Classical offshore crypto secrecy, yes. The one where you open in Malta or Cayman or Singapore, never tell your tax office, and assume nobody talks, that one is being dismantled because those jurisdictions themselves agreed to send the data starting 2027/28.

What remains is niche, technical, and increasingly at odds with how most people actually use crypto. Most users buy with fiat on a KYC’d platform. Most users will keep doing that. CARF and DAC8 are written exactly for that flow. The more the industry centralised, the easier it got for tax authorities to copy the old CRS/FATCA model and slap it on crypto. Governments finally aligned their tools with how people actually trade. Do with that info what you will. 

Buy bitcoin and stocks. Signup to Coinbase today

Frequently Asked Questions (FAQ)

What is CARF in simple terms?

CARF (Crypto-Asset Reporting Framework) is the OECD’s new system that tells crypto platforms to identify their users, record their crypto transactions for the year, and send that data to tax authorities so it can be shared across countries, similar to CRS/FATCA for bank accounts. It targets the platforms, not the users.

What is DAC8 and how is it different from CARF?

DAC8 is the EU version. It plugs CARF-style crypto reporting into EU law and forces all Member States to make EU-licensed crypto service providers report from 1 January 2026, with first filings in 2027. CARF is global and voluntary via the MCAA, DAC8 is binding inside the EU.

When does this start affecting me?

The key date is 1 January 2026. Transactions from 2026 get reported in 2027. If you trade on an EU-licensed or CARF-jurisdiction exchange in 2026, expect that data to reach your tax office in 2027.

Will transfers to my own wallet be reported too?

Yes, the OECD CARF XML has a field for crypto transfers and a flag for whether the destination is your own (self-hosted) wallet or someone else’s. Authorities won’t see your seed phrase, but they will see that you withdrew from a KYC’d exchange to a wallet. That’s enough to start questions.

Does this kill offshore crypto?

It kills the lazy version. Many classic “offshore” places signed the CARF multilateral agreement and will start exchanging crypto data in 2027/28, so parking assets there and hoping for silence won’t work the way it used to. Only flows that never touch a reporting intermediary will stay harder to see.

What happens if I don’t declare and they get the report?

In most EU countries that will look like underreporting or tax evasion, especially after the authority sees a 2026 crypto file tied to your name. “I didn’t know crypto was taxable” won’t hold anymore because DAC8’s whole purpose is to remove that excuse. Penalties will depend on national law.

Are DeFi and self-custody exempt?

Not exempt, just harder to capture automatically. DAC8 and CARF are built around intermediaries. If there is no intermediary in a participating jurisdiction, there is no automatic file. Even the academic work you shared says this is the weak spot.

Try the leading VASP data free for 1 month. No card required.

I use Binance/Bybit/OKX. Do they report too?

If a platform such as OKX holds an EU licence or operates in a CARF-signing jurisdiction (like Lithuania, Malta, France, UAE, Singapore, Cayman, etc.), it will have reporting obligations for users in scope. That’s the whole point of pulling offshore into the MCAA.

Will they report old years too?

CARF/DAC8 start with 2026 data. But tax authorities can still issue group/collective information requests for earlier years, as has already happened in Europe, so old activity isn’t completely safe.

What should I do now?

Get your 2022-2025 trades clean, start keeping full records, and assume 2026 activity will be matched automatically. Compliance becomes cheaper than explaining gaps in 2027.