CARF and the amended CRS

CARF: bringing crypto-asset activity into automatic exchange of information

CARF is an international tax transparency framework developed by the OECD to address the growth of crypto-assets and the use of crypto-asset platforms outside the scope of traditional financial account reporting. Its objective is to provide tax authorities with standardised, tax-relevant information on crypto-asset transactions undertaken by users who are tax resident in reportable jurisdictions.

Unlike CRS, which is built around financial accounts maintained by Financial Institutions, CARF focuses on transactions in relevant crypto-assets. This includes exchanges between crypto-assets and fiat currency, exchanges between different crypto-assets, transfers of crypto-assets, and certain retail payment transactions. The reporting obligation generally falls on Reporting Crypto-Asset Service Providers, which are persons or entities that, as a business, provide services effecting exchange transactions for or on behalf of users.

For Bermuda, the introduction of CARF will be particularly relevant for crypto-asset exchanges, brokers, wallet providers, digital asset platforms, and other businesses that may act as intermediaries or service providers in crypto-asset transactions. Existing regulatory status under Bermuda’s digital asset regime will be relevant, but it will not necessarily answer every CARF question. 

Businesses will need to consider whether they fall within the tax reporting definitions, whether they have a Bermuda nexus, and which users and transactions must be reviewed and reported.

In practical terms, affected Crypto-Asset Service Providers should expect to undertake the following steps:

• Determine whether the business is a Reporting Crypto-Asset Service Provider for Bermuda CARF purposes.
• Map relevant crypto-asset products, services, transaction flows, and user journeys.
• Identify reportable users and collect self-certifications or other required tax residence information.
• Capture the data needed to report relevant transactions, including transaction type, value, crypto-asset type, and user information.
• Review onboarding, know-your-customer, anti-money laundering, tax due diligence, and record-keeping processes to ensure they support CARF compliance.
• Assess whether systems can produce annual CARF reporting files in the required format once Bermuda’s reporting schema and portal requirements are confirmed.
• Establish governance, controls, and review procedures to evidence compliance and manage corrections or tax authority queries.

Amended CRS: expanding and refining financial account reporting

Alongside CARF, the OECD has also developed amendments to the CRS. These amendments are intended to modernise CRS for developments in digital finance and to improve the quality and usability of information exchanged between tax authorities. For Bermuda Reporting Financial Institutions (RFIs), the amended CRS, often referred to as CRS 2.0,  is likely to require both definitional analysis and practical changes to due diligence and reporting processes.

CRS 2.0 expands the framework to address certain products and arrangements that were not fully contemplated when CRS was first introduced. This includes bringing certain electronic money products and central bank digital currencies within scope, ensuring that indirect investments in crypto-assets through derivatives or investment products are appropriately covered, and refining the treatment of Investment Entities and financial assets. CRS 2.0 also introduces enhanced reporting fields and clarifications designed to improve data quality and reduce ambiguity in implementation.

For Bermuda RFIs, this means that the impact will not be limited to institutions with direct crypto exposure. Banks, custodians, brokers, investment funds, insurance companies with cash value or investment-linked products, trustees, and other entities classified as Financial Institutions should assess whether their products, account holders, controlling persons, and reporting data are affected by the amendments.

From a due diligence perspective, RFIs should expect to review whether existing onboarding and remediation procedures remain sufficient. In particular, institutions may need to update self-certification forms, account opening workflows, reasonableness checks, relationship manager guidance, and procedures for identifying controlling persons. They should also consider whether preexisting accounts require additional review where new data points or product classifications become relevant.

From a reporting perspective, CRS 2.0 will require RFIs to ensure that their source systems and reporting tools can capture and validate the additional information required under the revised standard. Bermuda’s current CRS compliance environment already places emphasis on data quality, including Taxpayer Identification Number collection, correction processes, undocumented account treatment, portal administration, and annual compliance certification. CRS 2.0 should therefore be approached as part of a broader compliance operating model rather than a narrow annual filing exercise.

Key practical areas for RFIs to consider include:

• Revisiting CRS entity classification analyses in light of amended definitions.
• Assessing whether products involving e-money, digital currencies, derivatives, or indirect crypto exposure are brought into scope.
• Updating customer self-certifications, onboarding checklists, and change-in-circumstances procedures.
• Reviewing due diligence procedures for preexisting accounts and controlling persons.
• Testing whether systems capture all data fields required under CRS 2.0.
• Strengthening controls over TIN collection, undocumented account reporting, corrections, and annual compliance certification.
• Training relationship managers, operations teams, compliance teams, and service providers on the practical impact of the amendments.