CARF Puts the Tax ID at the Front Door

For ten years the taxpayer identification number lived at the back end of CRS compliance. A bank collected it on a self-certification form, stored it, and found out at reporting time that some of the numbers were missing, mistyped or in a format the country never issued. The remedy came later: a remediation project, letters to customers, and a return that said “TIN not available” more often than anyone liked. 

The Crypto-Asset Reporting Framework moves that problem to the start of the relationship. In the jurisdictions now writing CARF into law, the tax ID is something a customer has to get right before they can trade. 

From reporting defect to trading condition 

Singapore gazetted its CARF regulations on 11 August 2026. From 1 January 2027, new users of any crypto exchange, broker or trading platform with a Singapore nexus declare their tax residency, TIN and date of birth at onboarding. Existing users have until 31 December 2027 to do the same. From 1 January 2028 a platform may not execute trades for a user who has no valid self-certification on file. 

Hong Kong is close behind. The bill gazetted on 22 May 2026 brings CARF in from 1 January 2027, and the government’s consultation paper was explicit on the point: a service provider should not rely on a self-certification it has reason to believe is incorrect, and the example it gave was a missing taxpayer identification number. The provider has to obtain a valid self-certification, or a reasonable explanation with documentary evidence, before providing services. Some of the proposed penalties scale with the number of users affected, in one case HK$1,000 per user. 

The UK regulations have applied since 1 January 2026. Austria’s bill asks crypto providers to collect self-disclosures from existing users by 1 January 2027. Nigeria went further than CARF itself requires: guidelines issued by the Nigeria Revenue Service in early August tell virtual asset providers to verify a user’s Tax ID before the account is activated. 

A wrong TIN used to cost a correction cycle after year-end. Under these rules it delays an account opening, and from 2028 in Singapore it stops an existing customer from trading. 

CRS 2.0 makes the gap visible 

The amended CRS is arriving in parallel, in most places a year after CARF. Ukraine has applied it since 1 July 2026, Hong Kong will from 1 January 2028. 

It widens the population of reporting firms. Holders of e-money and central bank digital currency accounts become depository institutions, and entities managing crypto for clients can fall in as investment entities. India’s revised FATCA and CRS guidance note, published by the CBDT on 24 July 2026, already points out that mobile wallet operators may now be inside the CRS net. Many of these firms have never run a CRS onboarding flow.

It also changes what gets reported. Under CRS 2.0 the institution declares, account by account, whether a valid self-certification was obtained. A weak collection process used to stay an internal matter. Now it is a field in the file that goes to the tax authority. 

People who prepare these files already know where they break. A November 2025 review of CRS 2.0 readiness put schema validation failures and outdated self-certifications among the leading causes of rejected submissions and audit findings. 

What a check at capture can and cannot tell you 

Most bad TINs at onboarding are not fraud. A digit is dropped, a national ID number goes into the tax number field, or a customer resident in France types their UK number. Each jurisdiction defines what its TINs look like, many of them with a check digit, and the OECD publishes this information per jurisdiction. A number that does not fit that structure cannot be valid whoever entered it, and it can be sent back while the customer is still on the form, which is the cheapest moment to fix it. 

A structural check has a clear limit and it is better to say it plainly. It tells you a number can be a TIN of that country. It does not tell you the tax authority issued it, or issued it to this person. That question belongs to the reasonableness test against the AML/KYC documents, and in a handful of countries to matching services run by the authority itself. Nobody should present a format check as proof of identity, and the regulators have not asked for one. What they have asked is that providers do not accept information they know, or have reason to know, is wrong. A number that cannot exist is the easiest case of that. 

For a platform onboarding users from dozens of residence countries this is a lookup across dozens of different rule sets. A regular expression written for the five largest markets does not hold up once the customer base is international, and CARF customer bases usually are. 

Where this leaves the new reporters 

The exposure is highest for the firms for whom all of it is new: exchanges, brokers, wallet providers and e-money issuers who built solid KYC for anti-money laundering purposes and now have to add tax residency to it. Banks have ten years of CRS practice behind them. A crypto platform in Singapore has a few months before new customers must be certified, and until the end of 2027 for the existing book. 

The reporting software market has noticed. Platforms built for FATCA and CRS are being extended to CARF, and several announced partnerships with advisory firms this year to reach financial institutions in new regions. 

Compared to the rest of a CARF programme, the step at onboarding is a small one. Check the TIN against its country’s structure when it is captured, keep a record that the check was made, and send back what fails before the account opens. This does not make a self-certification reasonable by itself. It removes the class of error that is easiest to prevent, and from 2028 the most expensive one to leave in place.

Open Automation’s OpenTIN API checks the structure of individual and entity tax identification numbers for 107 jurisdictions that issue them. It is available on AWS Marketplace, AWS Data Exchange and Azure Marketplace, with no minimum commitment. Learn more at open-automation.io/opentin-api.