What Happened
On January 1, 2026, a framework most Bitcoin holders have never heard of went live across 48 countries. The Crypto-Asset Reporting Framework (CARF) is an OECD-led global standard requiring crypto service providers to collect detailed information on every user and report it to domestic tax authorities. 1 Those authorities then share it internationally, starting in 2027.
This is already happening. Exchanges operating in EU member states, the UK, Japan, South Korea, and dozens of other jurisdictions are collecting your name, home address, date of birth, tax residency, taxpayer identification number, and complete transaction history — including transfers to self-custody wallets. 2 The EU's implementation, known as DAC8, entered force on the same date with identical requirements.
The United States isn't a direct CARF participant — it already operates its own regime through Form 1099-DA, which requires exchanges to report similar data to the IRS. The U.S. is expected to join CARF's international information exchange by 2029. 3 In practice, if you've completed KYC on any major exchange in any participating jurisdiction, your crypto activity is now being catalogued for international government sharing.
Why It Matters
Bitcoin was never anonymous — it's pseudonymous. But for years, there was a practical gap between the theoretical traceability of blockchain transactions and the actual ability of tax authorities to connect on-chain activity to real identities at scale. CARF closes that gap.
Before CARF, a tax authority would need to issue a specific request to a specific exchange in a specific jurisdiction to obtain user data. Under CARF, data flows automatically. Your French tax authority doesn't need to ask Kraken for your records — Kraken reports to its domestic authority, which sends the data to France automatically. The infrastructure for global, automated crypto surveillance is now operational.
CARF covers three types of transactions: exchanges between crypto and fiat currency, exchanges between different crypto-assets, and transfers of crypto-assets (including to self-custody wallets). 2 Service providers must report the aggregate value and type of each transaction category, broken down by direction.
What CARF does not yet cover is purely on-chain activity between self-custody wallets. If you send Bitcoin from your own wallet to another wallet you control, with no exchange or service provider involved, that transaction falls outside CARF's current scope. This gap is by design, reflecting the practical difficulty of monitoring decentralized transfers. Whether it remains a gap is an open question.
One critical detail: the original CARF proposal included a requirement to report wallet addresses for transfers to self-custody. That provision was removed after industry pushback. But the infrastructure to collect that data is built into the reporting schema. Reactivating it would require a policy decision, not a technical one.
CARF doesn't exist in isolation. Layer it on top of existing surveillance infrastructure: KYC databases at exchanges (which have been breached repeatedly — Coinbase, Ledger, Waltio), blockchain analytics firms like Chainalysis and Elliptic (which map wallet clusters to real identities for law enforcement), and domestic reporting requirements like 1099-DA. The result is a multi-layered system where your crypto activity is observed from multiple angles simultaneously, with data shared between private companies, domestic agencies, and international governments.
What This Means for You
If you use KYC exchanges, assume your activity is fully visible to your tax authority and, starting in 2027, to tax authorities in every participating jurisdiction. Plan accordingly. This means maintaining meticulous records of every transaction, cost basis, and taxable event — not because you're doing anything wrong, but because you need your records to match what the government will already have.
Understand the privacy gradient. On one end: KYC exchanges that report everything automatically. On the other end: peer-to-peer transactions, Bitcoin ATMs (with varying KYC requirements), and earning Bitcoin directly for goods and services. Each method carries different privacy, cost, and legal implications. There is no one-size-fits-all answer, but there is one principle: minimize the number of entities that hold your complete identity linked to your complete transaction history.
Self-custody becomes more important, not less. CARF reports transfers to self-custody wallets but cannot monitor what happens after Bitcoin leaves an exchange. The on-chain privacy of your self-custodied Bitcoin depends on your practices — coin control, avoiding address reuse, and understanding UTXO management. The exchange is the surveillance entry point. What you do after withdrawal determines how much of your financial life remains visible.
What to Watch
Whether CARF expands to include self-custody wallet address reporting. That provision was stripped before launch, but it remains in the technical specification. If re-implemented, it would allow tax authorities to trace on-chain activity from exchange withdrawals — connecting your KYC identity to your self-custody holdings. Also watch for enforcement actions in 2027 when the first wave of internationally shared data hits tax authorities. How aggressively governments act on CARF data will signal whether this is a compliance exercise or a surveillance escalation.