Institution

Crypto-Asset Reporting Framework (CARF) — UAE Public Consultation Brief

Analysis of the October 2025 public consultation on UAE implementation of the OECD CARF and implications for VASPs.

Summary

In October 2025, VARA issued a circular inviting public consultation on the UAE’s implementation of the Crypto-Asset Reporting Framework (CARF). Developed by the OECD as a complement to the Common Reporting Standard (CRS), CARF establishes an international framework for the automatic exchange of tax-relevant information on crypto-asset transactions between jurisdictions. The UAE’s adoption of CARF will impose significant new tax reporting obligations on all VARA-licensed VASPs and represents a major expansion of regulatory requirements beyond AML/CFT into the tax compliance domain.

Background

The OECD CARF Framework

CARF was developed by the OECD in response to the growing use of crypto-assets for cross-border transactions and the potential for tax evasion. Endorsed by the G20, CARF provides a standardised framework for:

Reporting Crypto-Asset Service Providers (RCASPs): Defining which entities are required to report — broadly aligned with the VASP definition used by VARA and the FATF
Reportable Transactions: Specifying which crypto-asset transactions trigger reporting obligations, including exchanges between crypto-assets and fiat currencies, exchanges between different crypto-assets, and transfers of crypto-assets
Due Diligence Procedures: Establishing how RCASPs must identify reportable users and determine their tax residence
Reporting Format: Standardising the information to be reported and the format for exchange between jurisdictions

UAE Context

The UAE’s participation in CARF implementation reflects its commitment to international tax transparency standards. As a member of the OECD/G20 Inclusive Framework on Base Erosion and Profit Shifting, the UAE has progressively adopted international tax standards. The October 2025 public consultation on CARF implementation signals the UAE’s intent to meet the timeline for early adoption.

For VARA-licensed entities, CARF implementation adds a tax reporting layer on top of existing AML/CFT, Travel Rule, and EOCN sanctions screening obligations.

Regulatory Implications for VASPs

Reporting Obligations

Under CARF, licensed VASPs — including Binance Dubai, OKX Middle East, BitOasis, Crypto.com Dubai, Bybit Dubai, and Rain Financial — will be required to:

Collect tax identification numbers and tax residence information from all users
Report specified transaction data (volumes, values, asset types) to UAE tax authorities
Implement due diligence procedures to determine users’ tax residences
Maintain records supporting the accuracy of reported information

Technology and Systems Impact

CARF implementation requires significant technology investment:

Customer Onboarding: KYC processes must be enhanced to capture tax residency information and tax identification numbers, supplementing existing AML/CFT due diligence
Transaction Reporting: Systems must aggregate and format transaction data for CARF reporting, tracking individual user activity across crypto-to-fiat, crypto-to-crypto, and transfer transactions
Data Validation: Procedures to verify tax residency information and detect discrepancies
Cross-Referencing: Integration of CARF reporting with existing CRS, FATCA, and other tax reporting obligations

Interaction with Existing Obligations

CARF intersects with several existing VARA requirements:

Travel Rule: Both CARF and Travel Rule require information about transaction counterparties, though for different purposes (tax vs AML)
AML/CFT CDD: Customer identification already collected for AML may partially satisfy CARF requirements, but additional tax-specific information is needed
FATF High-Risk Jurisdiction Screening: CARF’s jurisdiction-based reporting may overlap with FATF screening processes

Timeline and Implementation

The October 2025 public consultation indicates that CARF implementation is in the policy development phase. Typical implementation timelines for international tax reporting standards involve:

Public consultation and policy finalisation
Legislation or regulatory instrument publication
Implementation period for RCASPs to build systems and processes
First reporting period
First automatic exchange of information with partner jurisdictions

For VASPs, early preparation is advisable given the technology and process changes required.

International Context

CARF implementation is proceeding across multiple jurisdictions simultaneously. The EU has incorporated CARF principles into its DAC8 directive. The UK, Singapore, and other major financial centres are also developing implementation approaches. For VASPs operating across multiple jurisdictions — as many VARA-licensed entities do — coordinated CARF compliance across jurisdictions will be essential.

For comparison with regulatory approaches in other jurisdictions, see our VARA vs EU MiCA and VARA vs international frameworks analyses.

CARF Technical Architecture

The Crypto-Asset Reporting Framework establishes a structured approach to tax information exchange that operates across several technical layers:

Scope — Crypto-Assets vs Virtual Assets

CARF uses the term “crypto-asset” rather than “virtual asset,” and the scope may differ slightly from VARA’s definition. CARF’s scope is designed to capture assets that can be held and transferred in a decentralised manner without the intervention of traditional financial intermediaries, potentially including certain digital assets that fall outside VARA’s regulatory definition and excluding others that VARA does regulate.

Understanding the precise overlap between CARF’s “crypto-asset” definition and VARA’s “virtual asset” definition is critical for compliance planning. Licensed VASPs must map their product offerings against both definitions to identify which transactions are reportable under CARF.

Reporting Crypto-Asset Service Provider (RCASP) Definition

CARF defines RCASPs broadly, covering entities that exchange crypto-assets for fiat currencies, exchange crypto-assets for other crypto-assets, or transfer crypto-assets on behalf of customers. This definition closely maps to several of VARA’s licensed activity categories, meaning that most VARA-licensed VASPs will likely qualify as RCASPs.

Reportable Transactions

Three categories of transactions are reportable under CARF:

Crypto-to-Fiat Exchanges: Transactions where a user exchanges a crypto-asset for fiat currency — a core activity for platforms like BitOasis and Rain Financial that focus on fiat gateway services
Crypto-to-Crypto Exchanges: Transactions between different crypto-assets, which constitute the majority of trading volume on exchanges like Binance Dubai and Bybit Dubai
Crypto-Asset Transfers: Transfers of crypto-assets to addresses not associated with the RCASP, which intersects with Travel Rule compliance

Due Diligence Requirements

CARF requires RCASPs to determine the tax residence of each reportable user through due diligence procedures that include:

Collecting self-certifications of tax residence from users
Obtaining tax identification numbers (TINs) for each user
Validating self-certifications against other information held by the RCASP
Re-certifying tax residence information at regular intervals

These requirements overlap with but are distinct from VARA’s AML/CFT due diligence requirements. While AML due diligence focuses on identity verification and risk assessment for financial crime prevention, CARF due diligence focuses on tax residence determination for information exchange purposes.

Implementation Challenges for Dubai VASPs

Multi-Jurisdictional Complexity

Many VARA-licensed entities operate globally, with users across dozens of jurisdictions. CARF implementation requires:

Determining the tax residence of each user, which may differ from their country of citizenship, residency, or the jurisdiction from which they access the platform
Understanding the CARF implementation status of each jurisdiction to determine information exchange obligations
Coordinating CARF reporting across multiple regulatory jurisdictions where the entity holds licences

For entities like Crypto.com Dubai and OKX Middle East, which serve as regional hubs within global platforms, CARF compliance requires coordination between Dubai operations and global compliance functions.

Technology Integration

CARF reporting must integrate with existing compliance technology infrastructure:

KYC/onboarding systems must be enhanced to capture tax residency information and TINs
Transaction monitoring systems must aggregate reportable transaction data per user per reporting period
Reporting systems must generate CARF-compliant reports in the standardised XML format
Data quality controls must ensure accuracy and completeness of reported information

Interaction with UAE Tax Framework

The UAE’s introduction of corporate tax (effective June 2023) and existing VAT framework means that CARF implementation adds to a growing tax compliance landscape. While the UAE does not levy personal income tax on individual residents, CARF reporting relates to the tax obligations of users in their respective jurisdictions of tax residence — not UAE domestic tax.

Connection to VARA’s 41 Circulars

The CARF consultation is one of 41 circulars and announcements VARA has issued through early 2026. It sits alongside other recent circulars including the March 2026 AML/CFT/CPF implementation circular, the February 2026 Travel Rule circular, and the January 2026 qualified investor classification circular. Together, these instruments are progressively building a comprehensive regulatory framework that extends well beyond licensing into ongoing operational compliance.

Enforcement Implications

While CARF is primarily a tax compliance obligation, failure to implement CARF reporting could trigger enforcement consequences under both VARA’s framework and the UAE’s broader tax compliance regime. The enforcement actions dashboard tracks VARA enforcement activity, and the FUZE case demonstrates that VARA penalises failures in compliance systems and controls generally — suggesting that CARF compliance gaps could be treated as systemic compliance failures.

Global Timeline

Multiple jurisdictions are targeting 2026-2027 for CARF implementation:

EU: DAC8 directive incorporating CARF principles, with reporting beginning in 2026
UK: HM Revenue and Customs developing implementation approach
Singapore: MAS coordinating with IRAS on CARF adoption
UAE: October 2025 public consultation, with implementation timeline to be determined

For VASPs operating across these jurisdictions — as many VARA-licensed entities do — coordinating multi-jurisdictional CARF compliance is a significant operational challenge that requires early planning.

varacomplianceregulatorybrief