CARF: How the ATO Will Track Your Crypto From 2027

🌐 What is CARF?🔗

CARF stands for Crypto-Asset Reporting Framework. The OECD developed it to close a gap: crypto assets can be transferred and held without going through a bank, so the reporting systems built around banks and other financial institutions miss a large share of taxable activity. Under CARF, crypto exchanges and other service providers collect standardised information about their users and transactions, report it annually to their local tax authority, and that authority automatically exchanges the data with the tax authorities of the countries where those users actually live.

🎯 The essential: It's essentially the crypto version of the Common Reporting Standard (CRS) that already applies to foreign bank accounts. The OECD approved the CARF model rules in August 2022. Australia joined dozens of other jurisdictions in a joint OECD statement committing to implement it in November 2023.

The key shift for Australians: once Australia's exchange begins, the ATO will receive data on Australians using overseas exchanges, not just the local ones it already sees.

🔍 CARF vs the ATO's existing data matching🔗

Many Australians already know the ATO runs a domestic crypto tax data matching program: Australian exchanges have been sharing user data with the ATO for years, focused on platforms with an Australian presence. CARF is a different, complementary mechanism.

So if you've been using an overseas exchange, the ATO has had limited visibility on that activity historically. CARF closes that gap. From Australia's first international exchange, the ATO is expected to receive standardised data from every CARF-participating country where an Australian holds an account. For the full detail on how the ATO's existing domestic program works, see our guide to what the ATO already knows about your crypto.

🏢 Who has to report under CARF?🔗

The obligation falls on Reporting Crypto-Asset Service Providers (RCASPs), broadly defined as any individual or entity that, as a business, provides a service effectuating exchange transactions in crypto assets on behalf of customers. In practice that covers crypto exchanges, custodial wallet providers (where the platform holds the keys), brokers and dealers, crypto ATM operators, and platforms that make a trading venue available even if they aren't the direct counterparty to the trade.

🎯 The essential: The definition is functional, not legal. It doesn't matter whether the provider is a licensed financial institution. A provider is subject to Australia's rules if it's tax-resident, incorporated, managed from, has a regular place of business, or operates a branch in Australia, only one of those five connection points needs to apply.

DeFi and non-custodial wallets. Non-custodial wallets, where you hold your own keys, like a hardware wallet or a browser extension wallet, are generally out of scope. There's no service provider in the middle with access to your identity or transaction data. DeFi protocols are only in scope where there's an identifiable operator with sufficient control or influence over the protocol. A fully autonomous, permissionless protocol with no controlling party is generally out of scope, but decentralisation alone doesn't automatically exclude a platform if a company runs the front-end, controls smart contract upgrades, or otherwise exercises meaningful control. NFTs are in scope only if they're usable for payment or investment purposes, pure digital collectibles with no payment or investment function are generally excluded. This is an evolving area, our DeFi tax guide covers what's clear and what's still genuinely unclear.

📋 What data gets reported?🔗

For each user, a reporting provider must collect and submit:

• Identity, full name, address, date and place of birth
• Tax residency, the jurisdiction(s) where you're a tax resident
• Tax Identification Number (TIN), the equivalent of your Australian Tax File Number
• Transaction type, crypto-to-fiat exchange, crypto-to-crypto exchange, transfer, or retail payment transaction
• Transaction details, the gross amount and number of units of the relevant crypto asset
• For entities, information on the controlling persons, the natural persons who actually control the entity

🗺️ Which countries are involved?🔗

Around 76 jurisdictions have committed to CARF globally as of 2026, rolling out in waves based on when they'll first exchange data internationally. Roughly 46 jurisdictions began collecting data from 2026 and are due to make their first exchange around 2027, a group that includes the UK, the EU (via its own DAC8 directive), Japan, New Zealand, South Africa and Brazil. A second wave of around 29 jurisdictions, including Australia, Canada, Singapore, Hong Kong, Switzerland and the UAE, is set to start collecting from 2027 with a first exchange expected in 2028. The United States is the sole jurisdiction currently slated for the slowest wave, with a first exchange expected around 2029.

Practically, this means platforms based in the UK, the EU or Japan have already been collecting CARF-standard data since 2026. That data is expected to start flowing to the ATO from Australia's first exchange year.

📅 Australia's CARF timeline🔗

This is a live legislative process, and the exact dates below are proposed rather than settled law until the legislation actually passes. Here's the sequence so far.

🎯 The essential: As of August 2026, CARF is not yet law in Australia. Treasury has released draft material for consultation and the government has confirmed its intention to legislate, but the bill still needs to pass Parliament. Treat 1 January 2027 as a proposed start date, not a locked-in one.

A related set of changes, CRS 2.0, expands the existing Common Reporting Standard to cover stablecoins, derivatives referencing crypto assets, and central bank digital currencies, and is running on a similar timeline.

🧭 What this means for you as a crypto holder🔗

If you've been reporting crypto gains and losses correctly, CARF changes little in practice. It's a compliance and enforcement mechanism, not a new tax, the underlying rules covered in our crypto tax guide (capital gains treatment, income treatment for staking rewards) don't change. But if you've been relying on the ATO not knowing about an overseas exchange account, that assumption is expiring.

If you use an overseas exchange, once Australia's international exchange begins, the ATO is expected to receive your transaction data from that exchange's home tax authority, covering activity from the CARF commencement date onward.

If you hold crypto in a self-custody wallet, non-custodial wallets are out of scope for CARF reporting, but if funds were moved from a centralised exchange into self-custody, the exchange will have reported that transfer, so the ATO will see the outflow even if it can't see what happens next.

If you use DeFi, fully permissionless protocols are generally out of scope, but this area is still developing and worth watching.

If you'd rather sidestep this entirely, CARF targets crypto exchanges and wallet providers, not ASX-listed products. Holding Bitcoin or Ethereum exposure through a crypto ETF in a normal brokerage account sits outside CARF reporting, and is taxed like any other ETF instead, see our crypto ETF tax guide for how that works.

If you haven't been reporting, CARF doesn't create a new amnesty, but it does create new urgency. The ATO's voluntary disclosure process exists and generally produces better outcomes than being caught later, a registered tax agent can help you work through your options.

🗂️ Get your records in order now🔗

The 2027 proposed commencement date is closer than it sounds. Legislation needs to pass and exchanges need time to build reporting systems, but the practical window to get your own records straight is now.

• Download your full transaction history from every exchange you've used, including overseas ones, most platforms allow CSV export
• Record the AUD value at the time of each transaction, needed to calculate any capital gain or loss
• Track transfers between your own wallets, not a taxable event, but you need records to prove that's what it was
• Identify any years where reporting may not have been correct and speak with a registered tax agent before CARF data starts flowing
• Don't assume DeFi or NFT activity is invisible, even where currently out of scope, the on-chain record is permanent and the rules may change

Crypto tax software (Koinly, CoinTracker, CryptoTaxCalculator or similar) can help pull transaction histories together and calculate gains. It's not a substitute for professional advice, but it's useful for record-keeping while there's still time to get it right.

❓ Frequently asked questions🔗