The Crypto-Asset Reporting Framework (“CARF”) is a set of rules introduced by the OECD to ensure tax transparency for crypto-assets through annual reporting. It introduces automatic exchange information between tax authorities on crypto-asset transactions, similar to the Common Reporting Standard (“CRS”) for traditional financial assets. CARF is incorporated into EU law through Directive 2023/2226, commonly known as DAC8 (“DAC8”). DAC8 provisions will apply from 1 January 2026 and the first reporting year is 2026, with the first filing to be submitted by 30 June 2027.
CARF in Luxembourg
Luxembourg is implementing DAC8 through Draft Law n°8592, published on 24 July 2025 and in force as from 1 January 2026. A Crypto-Asset Service Provider (CASP) in Luxembourg will need to register with the Luxembourg Tax Administration (“LTA”), collect and validate client tax information, monitor changes in tax residency and report annually to the LTA, similar to the Common Reporting Standard (CRS).
Which data are to be reported?
Although CRS and CARF reporting obligations share the same tax transparency goal, the scope and data to be reported differ because of the nature of the assets involved. The reporting obligations for CASPs are divided into three main categories:
- Information about the provider which includes details such as the name of the provider, registration number and address
- Personal information about users which includes among other things, the name, address, Tax Identification Number (“TIN”), date and place of birth (for individuals) and country of tax residence (based on self-certification)
- Transactional information about users which includes among other things full name and type of relevant crypto-asset involved, purchases and sales against fiat currency, purchases and sales against other crypto-assets, reportable retail payments, transfers and transfers to external wallets not known to the provider
Clients may receive a copy of the personal and financial information reported. Clients may also exercise their right of rectification of personal data, as provided for under the General Data Protection Regulation (GDPR), in order to ensure that accurate and up-to-date data will be communicated to the tax authorities. If a data subject wishes to exercise this right to rectification, he or she may, at any time, contact the following e-mail address: dpo.lu@swissquote.lu
What does CARF means for Swissquote clients?
Similarly to CRS application, Swissquote will determine if customers enter into the CARF field of application and will be legally obliged to report these to the relevant tax authorities. All new customers will be required to provide their tax residence(s) for tax purposes, and their TIN. Without this information, Swissquote will be unable to offer Crypto Assets services to the applicant.
Please be advised that Swissquote Bank Europe SA is not authorised to provide tax advice to its clients. For questions with regard to the identification of your tax residence status, please contact your tax advisor or competent tax authority.