CARF Australia: what the new crypto tax reporting rules mean for crypto businesses

Together, the measures would give the ATO a much clearer view of crypto activity in Australia and offshore. Providers should now determine which regimes apply, where they overlap and what must change across onboarding, customer data, systems and reporting.

Who will need to report?

CARF is expected to apply to Reporting Crypto-Asset Service Providers (RCASPs): entities carrying out crypto exchange transactions for or on behalf of customers. The domestic regime will apply to providers of registrable virtual asset services under the AML/CTF Act, including exchanges, brokers, custodians and transfer services. Many providers will fall within both regimes. Existing CRS reporting institutions may also need to update their processes, even if they do not offer crypto products.

How will CARF work?

The draft establishes the framework for implementing CARF, but much of the operational detail will follow in regulations and ministerial rules. Those rules will determine which providers, users and transactions are covered, the information to be reported, due diligence requirements, deadlines and penalties.

The OECD model covers crypto-assets that rely on cryptographically secured distributed ledger or similar technology, including stablecoins, tokenised derivatives and certain NFTs. Assets that cannot be used for payment or investment are excluded, as are central bank digital currencies and specified electronic money products, which fall within the CRS. Reportable transactions include crypto-to-fiat and crypto-to-crypto exchanges, transfers and potentially high-value merchant payments.

RCASPs will need to link each user’s identifying and tax residence information to their crypto activity. They will also need to report purchase amounts and gross sale proceeds for crypto-to-fiat trades, fiat values for crypto-to-crypto trades, and the number and value of units transferred, including transfers to unhosted wallets. RCASPs should test now whether they can identify and extract this data reliably.

This is not simply a back-end tax exercise. RCASPs will need to collect more customer information, refresh existing records and add new prompts and verification steps. Aligning this work with current AML/CTF reforms will help avoid duplicated requests, inconsistent data and rework.

The timetable is tight. CARF collection is proposed to begin on 1 January 2027, with the first reports due to the ATO in 2028 for international exchange. With consultation closing on 28 October 2026, providers have only days to raise practical concerns about scope, data requirements and implementation. Planning will need to begin before the legislation and operational rules are finalised. Australia must also sign the CARF Competent Authority Agreement and the Addendum to the CRS Multilateral Competent Authority Agreement before the regime can operate.

Australia’s domestic regime goes further

The proposed Domestic Crypto Reporting Regime (DCRR) will add a separate Australian layer. Reporting entities will need to report exchanges and transfers made by or for Australian resident users. Treasury expects each report to identify the provider and user, including the user’s name, address, ABN and bank account details. It will also capture the asset, date and time, Australian dollar value and transaction ID for each transaction.

Quarterly reporting is proposed from 1 July 2027, with reports due 31 days after each quarter. The draft includes no minimum transaction value, so high-volume providers could face substantial reporting volumes. Data quality, exception handling and repeatable governance will be central.

The CRS is also expanding

Under the proposed laws, from 1 January 2027, the CRS will expand to include certain e-money products, central bank digital currencies, crypto derivatives and investment entities dealing in crypto. Reporting entities will need to provide more information, including whether a valid self-certification was obtained, whether an account is new or pre-existing, the account type, any joint holdings and the roles of controlling persons.

What should impacted businesses do now?

Cryptocurrency service providers should treat CARF, the DCRR and the CRS as one coordinated implementation program. Priorities are to confirm which regimes apply, assign ownership, map customer and transaction data, identify systems and control gaps, and separate work that can begin now from decisions that depend on the final rules.

Smaller providers may face the greatest implementation pressure alongside broader regulatory change. Coordinated input from legal, compliance, tax, product, technology and operations will be essential. Providers should also assess whether they have sufficient internal capability or would benefit from targeted embedded counsel or fractional GC support.

The rules are not final, but the direction of travel is clear and embedded in Australia’s OCED commitments. Businesses that wait may leave themselves too little time. The better approach is to identify likely gaps now, consider whether to respond within the short consultation window and build flexibility into the implementation program.