Your crypto just joined the bank statement

For a decade, one sentence propped up an entire relocation industry: your home tax authority cannot see your crypto. It was never quite true. As of 1 January 2026 it is not true at all.

On that date the OECD's Crypto-Asset Reporting Framework (CARF) and an amended Common Reporting Standard (CRS) both entered into force across the first wave of committed jurisdictions. Exchanges are collecting the data now. The first automatic cross-border exchanges of crypto account information are due in 2027. If your mobility plan quietly assumed that a wallet is a private thing, this is the year the assumption expires.

What actually changed

CARF does to crypto what the CRS did to bank accounts in 2016. It obliges reporting crypto-asset service providers — exchanges, brokers, certain wallet operators and some payment processors — to identify their users, establish their tax residence, and report transaction data to the local authority. That authority then swaps the file with the user's home authority automatically, once a year, under the same plumbing that already moves bank data between tax offices.

The mechanics mirror the bank regime deliberately. Onboarding now carries a self-certification of tax residence. The provider cross-checks it. The report captures acquisitions, disposals and transfers. Sit in the reporting flow and you generate a data trail that lands, unprompted, on the desk of whichever revenue service claims you as resident.

Two quieter changes matter as much as CARF itself. First, the CRS was expanded for the first time to reach beyond conventional accounts — pulling in certain e-money products and central bank digital currencies. Second, the two frameworks were designed to interlock, so an asset that escapes one is increasingly likely to be caught by the other. The gaps that arbitrage lived in are being stitched shut on purpose.

Here is the uncomfortable part. Everyone fixates on the 2027 exchange date as if there is breathing room. There is not. Providers are gathering residence and transaction data today, in 2026, to have something to report next year. The record of where you claimed to live, and what you moved, is being written in the present tense.

Who is in the first wave — and who bought a year

The rollout is staggered, and the stagger is the only real planning variable left.

Read that table carefully, because the popular reading is wrong. The second wave is not a set of havens. It is a set of latecomers. Switzerland, Singapore, the UAE and Hong Kong have all committed; they simply start exchanging in 2028 rather than 2027. Choosing a provider in one of them does not buy privacy. It buys a single reporting cycle of delay, after which the same file gets built and sent.

The whole EU implementing in lockstep, through DAC8, is the part that should reset expectations. There is no soft interior of the bloc to drift toward. Portugal, Malta, Cyprus — jurisdictions that spent years as the crypto-founder default — are inside the same directive as Germany. The "move to a friendly EU state" play does nothing for reporting.

Why this bites relocators specifically

Ordinary investors face a compliance chore. People who moved — or are about to — face something sharper, because CARF reports the one field they were most casual about: tax residence.

Relocation stories are messy in the middle. You spend part of a year in the old country and part in the new one. You keep an exchange account opened under the old address. You tell one platform you live in Lisbon and another still has you in London. CARF does not need to prove where you really lived. It simply reports what each provider recorded — and hands both files to both authorities, who can now compare notes.

That turns a soft narrative into a hard, cross-checkable dataset. If your on-chain activity says one thing and your day-count says another, the mismatch surfaces automatically. For anyone who used crypto precisely because it sat outside the bank-reporting net during a messy transition year, the net just closed over it too.

The expansion into e-money and CBDCs removes a fashionable side exit. The instinct — route value through a prepaid or e-money rail to dodge both the bank CRS and CARF — now runs straight into the widened CRS. The designers watched the last decade of workarounds and pre-empted the obvious ones.

What still works, and what only looks like it does

Let me separate the durable from the theatrical.

Durable. Being genuinely, cleanly resident where you say you are. CARF reports residence; it does not tax you. If your residence is real, your presence supports it, and your affairs sit in a territory whose actual rules suit you, reporting is just paperwork confirming a true story. The frameworks punish ambiguity, not relocation. A well-built move — right country, honest day-counts, coherent facts — survives all of this intact.

Durable. Genuinely self-custodied assets that never touch a reporting provider are outside CARF's direct collection today. But treat that narrowly. The moment those coins meet an exchange to be priced, spent, swapped or cashed, they re-enter the reported world — and the widened CRS is closing the fiat-adjacent gaps around the edges. Self-custody is a way to hold, not a way to disappear.

Theatrical. Picking a second-wave jurisdiction for its 2028 start date and calling it privacy. It is a one-year deferral with a paper trail attached.

Theatrical. Routing through e-money or a CBDC to sidestep the bank net. That specific door was named and shut.

Theatrical, and dangerous. Filing a residence self-certification that does not match how you actually live. You are now signing a statement that gets machine-matched against your own transaction history across borders. This is the behaviour the system is built to catch.

The verdict

On-chain privacy from your home tax authority is over as a strategy. What remains is a scheduling problem — who reports when — and a diminishing one, because the second wave joins in 2028 and the committed pool already runs to around 67 jurisdictions. There is no durable "somewhere quiet" left to relocate a wallet to; there are only jurisdictions that have not started yet.

My view: this is clarifying, and for the right client it is good news. The people hurt by CARF are the ones who were relying on invisibility — a strategy that was always one policy cycle from collapse, and has now had its collapse scheduled. The people untouched by it are the ones who moved for real reasons to real places and can withstand a file landing on a desk.

So stop shopping for the next unreported venue; it does not exist, and looking for it in 2026 leaves a trail that argues against you. Spend the effort instead on making your residence a fact rather than a claim — because CARF has turned the honest version of relocation into the only version that works. Your crypto just joined the bank statement. Plan as though everything you hold is already visible, because within a reporting cycle or two, it is.