UAE Crypto Reporting Rules (CARF) Applicable From Jan 1, 2027

CARF stands for the Crypto-Asset Reporting Framework. The OECD wrote it with the G20 countries, and it works the way the Common Reporting Standard works for bank accounts. A crypto business collects tax details from its customers and reports their trades once a year to its own tax authority. That authority sends the data on to the countries where those customers are tax resident.

CARF adds no new tax on crypto. It is a reporting rule, and the reporting falls on the businesses that carry out trades for customers. A person who holds crypto for themselves reports nothing.

Where the UAE stands

The Ministry of Finance signed the CARF agreement with other tax authorities on Jul 21, 2025. It consulted the market from Sep 15 to Nov 8, 2025. Federal Decree No. 60 of 2026 ratified the agreement on May 4, 2026.

In October 2026 the Ministry published a readiness circular and a set of FAQs. Its CARF page, updated on Nov 10, 2026, says the implementing rules take effect on Jan 1, 2027. The page does not yet name that instrument or link to its text, and the Ministry has not set a registration deadline.

Is your business in?

The rules apply to a Reporting Crypto-Asset Service Provider, or RCASP. That is any person or company that, as a business, carries out exchanges of crypto for customers. Acting as the counterparty counts. So does acting as a broker or running a trading platform.

The exchanges in scope are crypto for money, such as AED or USD, and crypto for other crypto. Transfers of crypto are reported too.

You also need a link to the UAE. The tests, in this order, are UAE tax residence, being set up under UAE law, being managed from the UAE, and having a regular place of business here. Trades that run through a UAE branch count as well. If you are linked to more than one country, the order decides where you report. If it points to a partner country and you report there, you tell the Ministry.

The Ministry's FAQs also settle these points:

• Holding crypto for yourself does not make you an RCASP.
• A business that takes crypto as payment for its own goods or services is not an RCASP for that reason. A single payment above USD 50,000, about AED 183,500, can still be reported by the provider that processes it.
• A license is not the test. What the business does decides it.
• A platform can be in scope even if it never holds its customers' crypto.
• Customers in the UAE do not, on their own, give you a UAE link. Serving only customers abroad does not take you out if your link is here.

What counts as crypto

Any crypto-asset that can be used for payment or investment. NFTs traded on a marketplace count. Stablecoins usually count too. A stablecoin falls outside only if it qualifies as a Specified Electronic Money Product, which means, among other things, that holders can redeem it at any time at face value for the one currency it represents.

Central bank digital currencies are out. So are tokenized financial assets that can only be held and moved through custodians. Those may fall under the Common Reporting Standard instead.

What gets reported

For each customer who is tax resident in a reportable country, the report gives name, address, tax residence and tax number. For individuals it adds date and place of birth. For some companies you also report the people who control them.

Trades go in as yearly totals for each crypto-asset: buys and sells against money, swaps with other crypto, payments above USD 50,000, and other transfers in and out. Transfers to wallets that you cannot link to another provider or a financial institution are shown on their own.

The file follows the OECD's CARF XML schema. You do not have to work out whether your customers pay the right tax.

The dates

1. By Dec 31, 2026. Decide whether you are an RCASP and where your link sits, including any UAE branch. List the crypto-assets and transactions you handle. Put the policies, procedures, controls, record keeping and training in place.
2. From Jan 1, 2027. Each new customer gives you a self-certification when the account opens. That is a short form stating their tax residence and tax number. You check that it makes sense against your KYC file.
3. During 2027. Register on the Ministry's Reporting System and state your type of UAE link. The Ministry will confirm the deadline. If you report in a partner country instead, tell the Ministry.
4. By Dec 31, 2027. Hold a valid self-certification for every customer who was with you before Jan 1, 2027. Have systems that can build, check and send the report.
5. By Jun 30, 2028. File the first Annual CARF Report for 2027, or a Nil Return.
6. Sep 1, 2028. The UAE makes its first exchange with partner countries.

Where to start

Start with the customers you already have. Each one needs a self-certification by Dec 31, 2027, and each answer has to be checked against what you hold on file. New customers are easier, because the form becomes part of onboarding.

If you already report under the Common Reporting Standard, parts of that work can be reused. The Ministry's FAQs say so, and they also say CARF has its own requirements on top.

Some pieces are still missing. The documents published so far do not give the registration deadline, the lists of partner and reportable countries, or the penalties.

If you are not sure whether your business is in, send us a short note on what you do for customers and where the business is set up and run.