UAE Crypto-asset reporting framework readiness circular

In October 2026, the UAE Ministry of Finance (the Ministry) issued the Crypto-Asset Reporting Framework (CARF) Readiness Circular (the Circular) as a call to action. The Circular reiterates that UAE is on track to implement CARF with effect from 1 January 2027 and provides an overview of the key implications for affected businesses together with implementation milestones to be met by 31 December 2026.

Introduction

CARF is a new information exchange regime developed by the OECD in 2023 to address the risks posed by crypto-assets with respect to transparency for tax purposes. It is built on the basis of, and aims to address gaps in, the Common Reporting Standard (the CRS) by covering certain types of ‘higher risk’ crypto-ssets (Relevant Crypto-Assets) (which exclude crypto-assets that do not have capacity of being used for payment or investment purposes, Central Bank Digital Currencies and Specified Electronic Money Products). CARF sits alongside the enhancements to the CRS commonly known as CRS 2.0.

Under CARF, intermediaries and other service providers facilitating exchanges between Relevant Crypto-Assets, as well as between Relevant Crypto-Assets and fiat currencies for or on behalf of customers as a business (including by acting as a counterparty, intermediary or by making available a trading platform) are considered Reporting Crypto-Asset Service Providers (RCASPs).

Key obligations under CARF

The Circular outlines that, at a high level, RCASPs will be subject to the following obligations:

• Registering for CARF purposes through the Ministry’s Reporting System;
• Where applicable, notifying the Ministry where the RCASP fulfils its reporting and due diligence obligations in a CARF partner jurisdiction in accordance with the applicable CARF nexus rules;
• Establishing documented policies, procedures, systems and controls to support ongoing CARF compliance;
• Performing due diligence on new crypto-asset users and pre-existing crypto-asset users, including controlling persons of certain entity crypto-asset users, where applicable;
• Obtaining valid self-certifications from all crypto-asset users and, where applicable, the required self-certification information in respect of controlling persons of certain entity crypto-asset users, including Taxpayer Identification Numbers (TINs) where required, and confirming the reasonableness of those self-certifications;
• Identifying Relevant Crypto-Assets, relevant transactions, reportable users and, where applicable, controlling persons; and
• Submitting an annual CARF Report or nil return, in accordance with the applicable UAE reporting requirements.

Key milestones

Based on the Circular, the key milestones relevant to CARF implementation for RCASPs are as follows:

• 21 July 2025:The UAE signed the CARF MCAA.

• 4 May 2026: The CARF MCAA was ratified pursuant to Federal Decree No. 60 of 2026.

• By 31 December 2026: RCASPs should complete their operational preparations for CARF implementation, including putting in place policies, procedures and controls required to support due diligence, self-certification and record-keeping.

• 1 January 2027: Target effective date of the Cabinet Decision and Ministerial Decisions implementing CARF in the UAE.

  From the effective date, RCASPs will be required to apply the prescribed CARF due diligence procedures, including obtaining a valid self-certification in respect of each crypto-asset user and confirming its reasonableness within the following timelines:

  • Pre-existing crypto-asset users: within 12 months of the effective date, ie 31 December 2027.
  • New crypto-asset users: at the time of the establishment of the relationship with the crypto-asset user.

• During 2027: RCASPs to register on the Reporting System and disclose their type of nexus in the UAE. The registration deadline will be confirmed by the Ministry. Where applicable, RCASPs to notify the Ministry where they fulfil their reporting and due diligence obligations in a CARF partner jurisdiction in accordance with the applicable CARF nexus rules.

• By 31 December 2027: RCASPs will be required to have obtained a valid self-certification for each pre-existing crypto-asset user and confirmed its reasonableness.

  RCASPs should have fully operational systems in place to compile, validate and transmit the information required to be reported under the CARF to the Ministry in the required CARF XML Schema format.

• 30 June 2028:RCASPs will be required to submit their first annual CARF Report or nil return in respect of the 2027 Reporting Period.

• 1 September 2028: The UAE will undertake its first automatic exchange of information under the CARF on 1 September 2028.

Penalties

Neither the Circular nor earlier issued decisions outline specific penalties and fines for CARF. There is an expectation that the existing CRS penalties regime will be extended to CARF. This includes the following sanctions:

• AED 1,000 for opening an account without obtaining a self-certification or without verifying the accuracy / reasonability of the self-certification provided.
• AED 50,000 for failure to timely and duly submit the required report.
• AED 250,000 for intentional violation of relevant provisions.
• Licence suspension or withdrawal.

Timely implementation of CARF

By 31 December 2026, individuals and entities who may fall within the scope of the RCASP definition should assess whether they specifically meet this definition and if so, undertake the following preparatory steps:

• Assess whether they have a nexus for reporting purposes in the UAE under the CARF, including through a branch in the UAE;
• Identify the Relevant Crypto-Assets and relevant transactions they effect for or on behalf of crypto-asset users;
• Prepare to apply the required CARF due diligence procedures, including the ability to obtain valid self-certifications for new crypto-asset users and pre-existing crypto-asset users and collecting TINs and other required information as applicable; and
• Assess whether their systems, policies, procedures, record-keeping arrangements, training and governance are sufficient to support CARF compliance.

The Circular also recommends that RCASPs monitor further Ministry guidance on registration, reporting and technical specifications and prepare to register once the UAE registration process opens.

Comment

Based on our extensive experience with the implementation of similar frameworks for traditional financial intermediaries (such as FATCA and CRS), advanced planning and timely implementation of adequate processes and systems for onboarding of new customers and review of the position of existing customers is critical to mitigate or minimise potential penalties and fines associated with non-compliance (which may otherwise aggregate to a material exposure or require extensive and costly remediation efforts). We note the preparatory steps outlined by the Circular need not only to be assessed but should be implemented by in-scope businesses (RCASPs) by 31 December 2026 to be ready to comply from the 1 January 2027 effective date.

RCASPs who are also in scope of the CRS may be able to leverage their existing compliance frameworks to support compliance with the CARF. To the extent possible and appropriate the CARF due diligence rules were drafted by the OECD to be consistent with the CRS and the CARF allows RCASPs that are also subject to the CRS to rely on CRS due diligence completed for new accounts. RCASPs should also pay attention to assets that may qualify under both the CRS and CARF to ensure that these are reported appropriately and to avoid duplication of reporting.

For additional information, assessment of, or support with the implementation of, the CARF please do not hesitate to contact a member of the team.