A new era of global tax transparency
In a bold move to strengthen global tax transparency, the Organisation for Economic Co-operation and Development (OECD) unveiled major reforms in 2023 through the release of the updated Common Reporting Standard (CRS 2.0) and the new Cryptoasset Reporting Framework (CARF). These landmark initiatives aim to close critical gaps in the Automatic Exchange of Information (AEOI) and introduce tighter oversight of the fast-evolving cryptoasset landscape.
The UK has recently enacted regulations to implement these frameworks, with certain penalty provisions taking effect from 16 July 2025. These changes reflect a broader global effort to modernise tax compliance in response to the digitalisation of finance and the rise of decentralised financial products. By expanding the scope of reportable assets and tightening due diligence requirements, CRS 2.0 and CARF are designed to ensure that tax authorities can keep pace with innovation, reduce evasion, and maintain a level playing field. As the 1 January 2026 implementation deadline approaches, financial institutions must begin adapting to the sweeping changes already in motion.
What Is CRS 2.0?
The Common Reporting Standard (CRS) was introduced by the OECD in 2014 to facilitate the automatic exchange of financial account information between participating jurisdictions. CRS 2.0 marks the first major update to the framework. It reflects nearly a decade of implementation experience and responds to the rise of digital financial products and cryptoassets.
Key changes under CRS 2.0
Building on the original framework, the new and improved CRS 2.0 introduces a series of targeted updates to reflect the evolving financial landscape. These changes broaden the scope of reportable financial products, strengthen due diligence obligations, and increase reporting complexity — raising the bar for compliance and aligning more closely with CARF.
- A broader net for financial products
CRS 2.0 expands the definition of financial accounts to capture emerging instruments such as electronic money and central bank digital currencies. This reflects the growing digitalisation of financial markets and the use of e-money as an alternative to traditional assets. Additionally, direct investments in cryptoassets, including those made through derivatives and investment vehicles, are now potentially within scope, subject to the interaction with the CARF regime.
- Enhanced due diligence requirements
CRS 2.0 introduces a more rigorous due diligence framework, significantly raising the bar for financial institutions. One of the most notable changes is the requirement to obtain and validate self-certifications not only for Account Holders but also for Controlling Persons. These certifications must be collected at onboarding or within a defined timeframe and must be complete, accurate, and up to date.
Institutions are also expected to report more detailed information, including:
- The type of financial account
- The roles of controlling persons
- Whether an account is preexisting or new
These changes will require updates to onboarding processes, client outreach protocols, and internal systems to ensure that all relevant data is captured and validated.
- Reduced reporting burden for certain entities
CRS 2.0 includes provisions to:
- Exempt genuine non-profit organisations, allowing certain investment entities to be treated as Non-Reporting Financial Institutions.
- Create an Excluded Account category for capital contribution accounts, typically used in corporate formation or restructuring.
While these updates bring greater clarity, they also introduce stricter enforcement expectations. Institutions must now demonstrate that they have robust internal controls in place to ensure compliance and failure to do so could result in significant consequences.
Increased reporting complexity
The volume and granularity of data required under CRS 2.0 has increased substantially. Financial institutions must now report:
- Whether an account is joint, and if so, the number of account holders.
- The specific role(s) by which a Reportable Person holds an equity interest in a legal arrangement (eg settler, trustee, beneficiary).
- The classification of accounts as preexisting or new affects the applicable due diligence procedures.
These requirements will likely necessitate system upgrades, staff training, and enhanced data governance. Institutions that rely on legacy systems or manual processes may find themselves particularly exposed.
Importantly, CRS 2.0 is designed to coordinate with CARF, reducing the risk of duplicate reporting, especially for crypto-related transactions. In the UK, the first CRS 2.0 reporting deadline is 31 May 2027, but the groundwork must be laid well in advance.
Compliance risks and consequences of Inaction
To enforce these enhanced obligations, HMRC has introduced a tougher compliance regime with clear deadlines and escalating penalties:
- Mandatory registration with HMRC is required by 31 December 2025 for UK Reporting Financial Institutions and specified Non-Reporting Financial Institutions.
- Penalties of up to £100 per account holder or controlling person may apply for due diligence failures, such as failing to obtain valid self-certifications or misclassifying accounts.
- Fines of up to £300 per instance may be levied for each failure to obtain a valid self-certification under CRS or FATCA.
- Daily default penalties may be imposed for ongoing non-compliance, particularly where institutions fail to act after being notified by HMRC.
What’s at stake?
In a worst-case scenario, a financial institution that fails to prepare could face:
- Cumulative penalties running into six figures, especially if systemic failures affect large volumes of accounts.
- Regulatory investigations and audits, which may lead to reputational damage, increased scrutiny, and even restrictions on business operations.
- Loss of client trust, particularly if the institution is seen as a weak link in the global tax transparency framework.
- Cross-border enforcement risks, as data shared under AEOI and CARF may trigger investigations in other jurisdictions.
These are not theoretical risks. HMRC has made clear that it will use the data collected under CRS 2.0 and CARF to identify non-compliance and take enforcement action where necessary. Institutions that delay preparation risk being caught off guard by the scale and complexity of the new requirements.
Understanding CARF
The Cryptoasset Reporting Framework is a new global standard developed by the OECD to support the automatic exchange of tax-relevant information on cryptoassets. It aims to close transparency gaps created by the rapid growth of the crypto market and the ability to transact outside traditional financial systems.
CARF provides a framework for domestic implementation, including:
- Scope of assets – covering a broad range of cryptoassets such as stablecoins, NFTs, and tokenised securities.
- Reporting obligations – applying to Cryptoasset Service Providers (CASPs), including exchanges, wallet providers, and intermediaries.
- Due diligence requirements – mandating the identification of users and their relevant tax jurisdictions.
Why was CARF introduced?
Cryptoassets have enabled users to transact outside traditional financial systems, creating gaps in oversight for tax authorities. CARF was introduced to ensure tax administrations can effectively monitor and assess tax liabilities in this evolving space, reinforcing global tax transparency.
Who is impacted?
Entities classified as Relevant Cryptoasset Service Providers (RCASPs) (including exchanges, wallet providers, and certain intermediaries) will be required to comply with CARF’s due diligence and reporting standards. With the new rules taking effect from 1 January 2026, the window for preparation is narrowing, making early action essential.
Crucially, CARF applies to all crypto users, regardless of whether they are based in the UK or in another reportable jurisdiction. As a result, reporting volumes may be significantly higher than under traditional frameworks.
Reporting under CARF is conducted at the transaction level, meaning RCASPs must capture and report detailed information such as the type of cryptoasset, its value, and the nature of the transaction. The first HMRC reporting deadline is 31 May 2027.
While HMRC has issued some guidance on the reporting process, several key implementation issues remain unresolved, adding to the complexity of compliance. As with CRS 2.0, registration with HMRC is mandatory for RCASPs, with a registration deadline of 31 January 2027.
Even if an entity does not fall within the definition of an RCASP, it may still be required to provide relevant information to another institution to help them meet their obligations under CARF.
How to prepare for CRS 2.0 and CARF?
As the regulatory landscape shifts, CRS 2.0 and CARF are not just technical updates but represent a broader transformation in how financial data is reported, verified, and exchanged globally. For financial institutions, this is a pivotal moment to reassess readiness, not just for compliance, but for long-term resilience.
The scale and complexity of these frameworks demand more than incremental adjustments. Institutions will need to align cross-functional teams, modernise data infrastructure, and embed compliance into day-to-day operations. Those with crypto exposure must also determine their obligations under CARF and prepare for transaction-level reporting.
While the first reporting deadlines may seem distant, the lead time required to implement these changes is substantial. Institutions that act early will be better positioned to manage risk, avoid disruption, and maintain trust with clients and regulators alike.
For tailored guidance on preparing for these changes, contact Martin Killer.
Operational taxes: what will they look like in 2023?
