UAE Crypto-Asset Reporting Framework (CARF) ​

In detail​

The CARF Circular provides a forward-looking compliance roadmap. Certain details, including the registration deadline and further technical specifications, remain subject to subsequent UAE MoF guidance. The CARF Circular identifies 1 January 2027 as the target effective date for the UAE's CARF implementing legislation, with the relevant Cabinet and Ministerial Decisions expected to take effect from that date.​

Which businesses may be affected?​

The CARF Circular addresses individuals and entities potentially falling within the definition of an RCASP. Under the OECD CARF, this broadly concerns individuals or entities that, as a business, provide services effectuating exchanges of Relevant Crypto-Assets for or on behalf of customers, including by acting as a counterparty or intermediary or by making a trading platform available. Whether a particular exchange, broker, dealer, intermediary or other service provider falls within scope requires an assessment of its actual activities.​

An RCASP legal entity assessment should be undertaken together with the applicable nexus analysis. The CARF Circular specifically directs businesses to consider whether they have a reporting nexus in the UAE, including through a UAE branch. ​

Registration and governance​

• RCASPs are expected to register through the UAE MoF reporting system and disclose their type of UAE nexus. The UAE MoF has not yet confirmed the registration deadline.​

• Where applicable under the CARF nexus rules, RCASPs should notify the UAE MoF if their reporting and due diligence obligations are fulfilled in another CARF jurisdiction.​

• Documented policies, procedures, systems and controls will be required to support ongoing CARF compliance, including due diligence, record-keeping, reporting and governance.​

Due diligence and self-certification

RCASPs will be required to conduct due diligence on New Crypto-Asset Users and Preexisting Crypto-Asset Users and, where applicable, Controlling Persons of certain Entity Crypto-Asset Users. This includes obtaining valid self-certifications, collecting required tax residence and Taxpayer Identification Number (“TIN”) information, and confirming the reasonableness of self-certifications.​

For New Crypto-Asset Users, the CARF Circular indicates that valid self-certifications must be obtained and their reasonableness confirmed at the time the relationship is established. For Preexisting Crypto-Asset Users, the corresponding procedures are to be completed within 12 months of the effective date, currently envisaged as 31 December 2027.​

Identifying reportable activity​

The CARF Circular requires RCASPs to identify Relevant Crypto-Assets, Relevant Transactions, Reportable Users and, where applicable, Controlling Persons. Businesses must determine which assets and exchange activities fall within scope, identify the relevant user populations, and ensure that the necessary transaction and user information can be captured for reporting.​

RCASPs will be required to submit an Annual CARF Report or Nil Return in accordance with UAE requirements. The CARF Circular anticipates reporting using the CARF XML Schema and expects systems capable of compiling, validating and transmitting the required information to be fully operational by 31 December 2027.​

Key milestones set out by UAE MoF

RCASPs should therefore build their compliance and reporting capabilities before the first submission date, rather than treating June 2028 as the starting point for implementation.​

CARF readiness extends beyond the annual filing​

For UAE-based crypto-asset businesses, the CARF Circular marks a significant step forward in the operational implementation of CARF. Businesses potentially within scope should consider CARF across their legal entity structures, customer onboarding processes, transaction systems and compliance frameworks.​

Practical areas requiring attention​

• Entity classification and nexus: review each relevant entity’s business model, services, branches and jurisdictional connections to establish whether it is an RCASP and where its obligations arise.​

• Customer onboarding: evaluate whether current onboarding processes capture the self-certification information needed for new users at relationship establishment and whether reasonableness checks can be evidenced.​

• Existing customers: identify pre-existing user populations, potential gaps in tax residence and TIN information, and a practical remediation plan ahead of the anticipated 31 December 2027 deadline.​

• Transactions and data: map Relevant Crypto-Assets and Relevant Transactions, identify reportable users and determine whether transaction and customer data can be linked, aggregated, validated and extracted for reporting.​

• Technology and controls: assess data fields, system integrations, CARF XML output capabilities, audit trails, record retention, staff training and allocation of governance responsibilities.​

Relationship with existing reporting frameworks​

Businesses with established CRS compliance frameworks may be able to leverage their existing due diligence procedures, governance arrangements and reporting infrastructure to support CARF implementation. However, CARF introduces additional requirements relating to customer due diligence, crypto-asset transactions and reporting, which will need to be assessed separately.​

The detailed application of the CARF framework in the UAE remains subject to the domestic implementing decisions and further UAE MoF guidance. Businesses should monitor these developments and refine their implementation plans as they evolve.​

Key takeaways​

With the 31 December 2026 readiness milestone approaching, potentially affected businesses should consider the following steps:​

• Perform an RCASP classification and UAE nexus assessment across relevant legal entities and branches, including whether partner-jurisdiction notification rules may apply.​

• Identify the Relevant Crypto-Assets and Relevant Transactions effectuated for or on behalf of Crypto-Asset Users and assess which user populations may be reportable.​

• Review current onboarding and self-certification forms for individuals, entities and relevant Controlling Persons; develop processes for reasonableness checks and remediation of pre-existing users.​

• Undertake a technology and data gap assessment covering required customer and transaction fields, data quality, record-keeping, extraction, validation and CARF XML reporting.​

• Establish or update CARF policies, procedures, governance, controls and training, with clear accountability for compliance and reporting.​

• Monitor the issuance of UAE implementing decisions and further MoF guidance on registration, reporting and technical specifications, and prepare to register once the process opens.​

How PwC can help​

PwC Middle East is well-placed to support crypto-asset businesses in assessing their classification under CARF, evaluating UAE nexus and cross-border reporting obligations, conducting CARF impact and gap assessments, developing due diligence and self-certification procedures, assessing data and technology readiness, and establishing implementation roadmaps, policies and controls to support ongoing compliance.​