Is CARF the End of Crypto Tax Invisibility in Canada?

For Canadian crypto exchanges, OTC desks, brokerages, ATM operators, investors, and traders, 2026 is a year worth paying attention to.

This is the year Canada has proposed as the start of mandatory annual reporting under the OECD’s Crypto-Asset Reporting Framework (CARF), subject to enabling legislation being enacted. Under CARF, crypto intermediaries collect verified identity and transaction data from every user and report it to their domestic tax authority. Those authorities then exchange that data automatically with the CRA.

The practical effect is straightforward. Crypto activity that was previously difficult for the CRA to see systematically, including transactions on foreign platforms, crypto-to-crypto swaps, and transfers to self-custody wallets, becomes part of a structured annual record flowing directly to Canadian tax authorities.

For operators, that means compliance infrastructure needs to exist before the first reporting year begins. For investors and traders, it means the window to address past non-compliance is tied to a proposed timeline that is already moving.

Neither of those problems gets easier to solve the longer they sit.

The CRA Is Getting a New Set of Eyes

CARF does not change what is taxable. It changes what the CRA can see.

The existing tools that exposed offshore banking had no reach into crypto. CARF is the upgrade. Developed by the OECD together with G20 countries and finalized between 2022 and 2023, it requires crypto intermediaries to collect verified identity and transaction data from every user and report that data to their domestic tax authority annually. Those tax authorities then transmit the data automatically to the tax authorities of every other participating jurisdiction.

The Common Reporting Standard applies to traditional financial assets and fiat currencies held in accounts with financial institutions. Crypto-assets held in wallets or on exchanges fall outside CRS scope in most circumstances. CARF closes that gap, covering the intermediaries, transaction types, and asset classes the CRS was never designed to reach. The framework runs on three interlocking components:

Component	What It Is	What It Does
Rules & Commentary	Model domestic legislation	Each participating jurisdiction transposes into local law; establishes who reports, what, and how
Multilateral Competent Authority Agreement (MCAA)	Treaty instrument	Activates automatic annual cross-border data exchange between tax authorities
XML Schema	Standardized electronic format	Makes exchange machine-readable and automated at scale

Under the MCAA framework, a jurisdiction’s first reporting year is the year it notifies other competent authorities that it has implementing legislation in place. The nine-month transmission timeline in the MCAA then produces a data exchange approximately nine months after the close of that calendar year. Canada’s actual first reporting year depends on when Canada enacts the required legislation and provides that notification. No Canadian statute or notification has been confirmed at the time of publication.

If You Move Crypto for Customers, You Report

CARF targets a defined class of businesses, and the definition is deliberately broad.

A Reporting Crypto-Asset Service Provider (RCASP) is any individual or entity that, as a business, provides a service effectuating exchange transactions in relevant crypto-assets for or on behalf of customers, whether acting as counterparty, intermediary, or by making available a trading platform.

In the Canadian market, the following business models fall within that definition:

·          Centralized exchanges operating order books or acting as counterparty to trades

·          OTC desks and crypto brokers facilitating transactions for customers

·          Crypto ATM operators

·       Any platform making available a trading interface where customers execute crypto-to-crypto or crypto-to-fiat transactions

The following fall outside the RCASP definition:

·    Pure validators and miners who do not effectuate exchange transactions for customers

·         Investment funds trading for their own account without offering exchange services to investors

·         Software developers who do not themselves provide exchange services

·     Bulletin board or price-posting services facilitating information flow rather than transaction execution

Canadian operators already registered with FINTRAC will find much of the identity-collection infrastructure familiar. The new build is transaction-level classification and annual reporting, not KYC from scratch. The heavier adjustment falls on foreign platforms that have not operated under equivalent requirements, and on the investors who used them.

Jurisdiction is determined by where a business actually operates, not where it is incorporated. A provider becomes subject to CARF obligations in any jurisdiction where it is tax resident, incorporated and carrying tax filing obligations, managed from, maintaining a regular place of business, or operating a branch. A business incorporated in one jurisdiction but operated and managed from another may carry CARF obligations in the jurisdiction where it is actually managed.

Under the MCAA, a foreign exchange operating in any jurisdiction that has enacted CARF and entered an exchange agreement with Canada becomes subject to equivalent reporting obligations in that jurisdiction. The data that platform collects flows to the CRA subject to three conditions: the platform has nexus in a CARF-adopting jurisdiction, that jurisdiction has enacted the Rules, and an exchange agreement between that jurisdiction and Canada is in effect.

Canadian investors and traders who have transacted on foreign exchanges under the assumption that foreign-platform activity is outside the CRA’s view are exposed, to the extent those platforms operate in participating jurisdictions with active exchange agreements with Canada.

The Data Is More Detailed Than Most People Expect

The data CARF delivers is comprehensive, structured, and annual. Three categories of transactions trigger reporting:

·          Exchanges between relevant crypto-assets and fiat currencies

·          Exchanges between one or more forms of relevant crypto-assets

·          Transfers of relevant crypto-assets

Reporting is organized by asset type, with inbound and outbound flows distinguished and crypto-to-fiat and crypto-to-crypto activity broken out separately. For each reportable user, the RCASP files the following with the relevant tax authority each year:

Data Point

Full legal name, residence address, date of birth, place of birth (where domestic law requires), and all jurisdictions of tax residence

Tax identification number for each reportable jurisdiction

Aggregate gross amount, unit count, and transaction count — crypto-to-fiat acquisitions

Aggregate gross amount, unit count, and transaction count — crypto-to-fiat disposals

Aggregate fair market value in fiat, unit count, and transaction count — crypto-to-crypto acquisitions

Aggregate fair market value in fiat, unit count, and transaction count — crypto-to-crypto disposals

Inbound and outbound transfers by type where known, including airdrops, staking income, and loan receipts

Aggregate fair market value and unit count of transfers to unhosted wallet addresses

Two mechanics within that data set deserve specific attention.

Moving assets to a self-custody wallet does not remove them from the reporting record. When a user transfers assets from a platform to an unhosted wallet, the RCASP must report the aggregate fair market value and unit count of those transfers, even without knowing who controls the destination address. Tax authorities can then use existing exchange-of-information channels to request detailed wallet-level data where compliance concerns arise. Off-platform does not mean off-record.

Every crypto-to-crypto swap generates two reportable events, not one. Each swap is treated as a disposal of the outgoing asset, valued in fiat at the time of disposal, and an acquisition of the incoming asset, valued in fiat at the time of acquisition. Investors and traders whose own records do not reflect each swap in that format will face a reconciliation gap against the exchange’s annual filing.

Most Stablecoins Do Not Get a Pass

Most stablecoins are in scope for CARF, and the default rule is inclusion. A stablecoin is excluded only if it qualifies as a Specified Electronic Money Product (SEMP), and qualification requires satisfying all five statutory criteria simultaneously:

#	Criterion	Practical Trap
(a)	Represents a single fiat currency	Multi-currency stablecoins fail here
(b)	Issued on receipt of funds for payment purposes
(c)	Represents a claim on the issuer denominated in that same fiat currency
(d)	Accepted in payment by persons other than the issuer
(e)	Redeemable at par value at any time as a matter of regulatory requirement imposed on the issuer	Unregulated stablecoins fail here

Criterion (e) is where most stablecoins will fail. Redemption at par must be a regulatory requirement imposed on the issuer, not a commercial practice or contractual commitment. A stablecoin that pegs to a fiat currency but operates outside any framework imposing that obligation as a matter of regulation does not satisfy the criterion, regardless of how it is marketed.

The distinction is narrower than it sounds. A USD-pegged stablecoin issued outside a regulatory framework mandating par redemption fails criterion (e) even where the issuer redeems at par in practice and has never failed to do so. Issuers operating under a framework that imposes redemption as a regulatory obligation — including issuers regulated under Canada’s new Stablecoin Act — are the narrower class.

An RCASP must positively determine that an asset qualifies for exclusion. Without that determination, the asset is in scope. Qualifying SEMPs and Central Bank Digital Currencies are addressed under the amended Common Reporting Standard rather than CARF, as reporting on those assets is ensured under the CRS in respect of amounts held in Financial Accounts.

DeFi: The On and Off-Ramps Are Already Monitored

Purely decentralized protocols with no identifiable operator fall outside CARF’s current scope. The OECD has explicitly acknowledged that decentralized finance will require further technical work and potentially future amendments to address adequately. That acknowledgment is not a compliance carve-out.

Where an entity exercises sufficient control over a decentralized platform such that it could in practice fulfill the due diligence and reporting obligations, that entity falls within the RCASP definition. Entities that mischaracterize their degree of control to avoid that classification attract specific anti-circumvention rules. The classification test is functional, not formal.

For most DeFi users, the centralized on-ramp and off-ramp are already fully captured. The aggregate reporting obligation for transfers to unhosted wallets applies regardless of what the user does with those assets afterward. A user who moves assets from a platform to a self-custody wallet and then deploys them into a DeFi protocol has generated a reporting event at the platform: the transfer out is documented, and the fiat value at the time of transfer is on record. The absence of a CARF filing from the protocol itself does not create a gap. The gap was closed at the exchange.

Build It Before the First Reporting Year or Remediate Under Pressure

Operators that underestimate the lead time required will find themselves remediating under pressure once enabling legislation is in force. The core obligations are not optional enhancements. They are baseline requirements that need to be built, tested, and operational before the first reporting year begins.

The main obligations are these:

Obligation	What Is Required
Asset classification	Classify every crypto-asset offered or traded against the relevant crypto-asset definition. Exclusion requires a positive determination. Default is inclusion.
User self-certifications	Collect a signed, dated self-certification from every user: at account opening for new users; within 12 months of the rules taking effect for pre-existing users. Required content: full legal name, residence address, all jurisdictions of tax residence, TIN for each reportable jurisdiction, and date of birth. Where the self-certification conflicts with the platform’s AML file, it cannot be relied upon.
Annual reporting	File an annual return per reportable user, organized by crypto-asset type and transaction category, covering the full data set above.
Record retention	Retain all due diligence documentation and data for a minimum of five years after the close of the reporting period.
Delegated due diligence	A provider that engages a third party to carry out due diligence functions remains legally responsible for those obligations. Delegation does not transfer liability.

Platforms that have not yet mapped their user bases against CARF due diligence requirements, reviewed asset classification processes for every listed asset, or assessed what their annual reporting infrastructure needs to produce have material work ahead before the first reporting year begins.

Investors and Traders: Your Records Are About to Be Tested

The most urgent and underappreciated risk under CARF falls to investors and traders, not operators.

Once CARF data begins reaching the CRA, covering the first calendar year for which Canada has implementing legislation in place, the CRA will hold a structured, platform-generated annual record of each Canadian user’s crypto transactions across every RCASP in every participating jurisdiction with an active exchange agreement with Canada. Where an investor or trader’s own records do not reflect that same activity, the discrepancy can become a basis for CRA inquiry. Accurate personal records become the only documentation available to counter what the exchange has already filed.

The risk compounds for those with unreported activity on foreign platforms, and the mechanism is worth stating precisely.

Under Canada’s Voluntary Disclosures Program, a taxpayer can correct past non-compliance before the CRA takes certain enforcement actions. Once an audit or enforcement action commences against the taxpayer, VDP relief is no longer available. The CRA holding data is not itself disqualifying. Taxpayers routinely disclose unreported income the CRA could have discovered from the other side of the transaction — bank records, purchaser filings — and those disclosures are accepted.

CARF does not automatically bar a disclosure. It gives the CRA the information to open the audits that will.

Under the MCAA, the nine-month transmission timeline means that once a jurisdiction’s first reporting year closes, the data flows to the CRA within nine months. Those with unreported foreign-platform activity, who may have been relatively free from CRA scrutiny until now, are running out of time to disclose on their own terms and on the more favourable footing the VDP provides.

Two Laws, One Architecture

CARF does not arrive in isolation. In the same legislative cycle, Canada enacted the Stablecoin Act as Division 45, Part 5 of the Budget Implementation Act, 2025, the country’s first federal prudential framework for stablecoin issuers. The two frameworks are complementary rather than overlapping: 

	Stablecoin Act (BIA 2025, Division 45, Part 5)	CARF
Level of operation	Product level	Transaction level
What it governs	What a Canadian stablecoin is and how issuers must behave	How crypto activity is reported to tax authorities
Who it targets	Stablecoin issuers	All RCASPs and their users
Key requirements	Capital adequacy, reserve obligations, governance standards, yield prohibition	Identity collection, annual transaction reporting, record retention
Administered by	Bank of Canada	CRA (via automatic data exchange)

One framework governs the instrument. The other governs the activity. Together, the Stablecoin Act and CARF mark the end of the period in which Canadian crypto markets operated without a comprehensive federal framework addressing both product integrity and tax transparency.

The CRA Is Levelling Up

CARF does not change the CRA’s enforcement posture. What it does is eliminate the structural information deficit that has constrained the CRA’s reach, particularly with respect to foreign-platform activity.

The enforcement infrastructure was already in place. What it lacked was data:

Existing CRA Tool	Current Coverage	What CARF Adds
FINTRAC registration / KYC	Canadian-registered exchanges	Foreign platforms in participating jurisdictions captured automatically
Unnamed persons requirements	Court-ordered data production from specific Canadian exchanges	Automatic annual data, no court order required
J5 coordination	Cross-border blockchain analytics with US, UK, Australia, Netherlands	Structured platform-reported transaction data to cross-reference against on-chain activity
Banking trail analysis	CAD deposits and withdrawals to and from crypto accounts	Full transaction-level crypto data from foreign platforms

CARF is the unlock. When the data pipeline activates, the CRA moves from a regulator that could see fragments of the picture to one that holds a systematic, annual, structured record of Canadian crypto users’ activity across every participating jurisdiction.

The tools were already loaded. CARF gives them ammunition.

The answer to the question in the title of this article is yes. For Canadian crypto exchanges, OTC desks, brokerages, ATM operators, investors, and traders, the time to act is before that answer becomes self-evident to the CRA.

Solstice Law works with Canadian crypto businesses and investors on CARF compliance, regulatory positioning, and crypto tax exposure. If CARF raises questions about your business or your filing position, contact us before the pipeline activates.

Get in Touch → solsticelaw.io/contact

Written by Anish Kamboj (Founder and Principal, Solstice Law), Jonathan Buckle (Crypto Regulatory and Tax Associate, Solstice Law), and Mattheus Lawford (Associate, Solstice Law).

This article is general information, not legal advice. For guidance on your specific situation, contact us directly.