Old Tricks for New Dogs, Part I

Old Tricks for New Dogs: The OECD’s Cryptoasset Reporting Framework

By Paul Foster Millen and Peter A. Cotorceanu, 16 Oct, 2023

This article was originally published in Tax Notes International, October 16, 2023, p. 345

Why “old tricks”? Because the OECD’s cryptoasset reporting framework (CARF¹) is based heavily on another automatic exchange of information regime that was published almost a decade ago: the OECD’s common reporting standard (CRS²). Why “new dogs”? Because CARF’s due diligence and reporting obligations fall on a whole new set of players, almost none of whom have had any experience with CRS or any similar type of automatic exchange of information regime.

This article is the first in a series aimed at pinpointing, addressing, and easing the anxiety of the many entities and individuals that will soon have to implement CARF.

This article introduces CARF by describing CRS’s basic structure and the challenges faced — and solutions adopted — by the OECD in adapting CRS’s rules, which are designed for conventional financial activities, to the world of digital assets. Subsequent articles will build on this foundation:

•  the second article will probe the definitions and roles of the reporting and non-reporting parties under CARF and how those compare to and contrast with the analogous parties under CRS;

•  the third article will examine the identification and documentation of reportable persons under CARF, including the principles evolved under CRS and the long-standing anti-money-laundering (AML) rules;

•  the fourth article will cover reportable transactions and valuation techniques, which are steady sources of friction among reporting parties, reportable persons, and regulators; and

•  the fifth and final article will discuss enforcement and the best practices and tools available for demonstrating an effective compliance program.

Background to the CARF

“If I have seen further, it is by standing on the shoulders of giants.”³

CARF stands on the shoulders of CRS, which in turn stands on the shoulders of the Foreign Account Tax Compliance Act.⁴ FATCA pioneered the strategy for cross-border disclosure of asset holdings. The FATCA statute and Treasury regulations identified the non-U.S. banks and other financial entities needed to enforce the regime and conscripted them to serve as the IRS’s deputies. The stick for this extraterritorial deputization was an effective bar on access to the U.S. capital markets for a financial entity and all of its clients for any firms unwilling to do the IRS’s bidding. The carrot was the status quo. Faced with this highly effective form of persuasion, a handful of European governments⁵ entered into agreements with the United States to codify FATCA’s requirements into their own domestic laws in exchange for ostensibly lighter compliance duties and an agreement that the United States would support a global version of FATCA at the OECD. The FATCA intergovernmental agreements provided the blueprint for the more universal FATCA, known as CRS.

The banks and other financial entities qualifying as financial institutions (FIs)⁶ for purposes of FATCA and CRS were selected — in part — for their access to ownership information on the assets that the FIs held or managed.⁷ The FIs could disclose the owner information because they already knew it or had to collect much of it in accordance with banking and other local laws, most notably anti-money-laundering and know-your-customer (AML/KYC) rules. AML/KYC rules were especially expeditious to this end because they typically oblige FIs to look past the legal owner (the named owner) to the beneficial owner (the person enriched by the assets). As such, much of the obfuscation that had previously shielded beneficial owners from identification — such as the use of nominees or agents, but above all the use of passive investment entities (companies with no operations other than holding an investment portfolio) and fiduciary structures like trusts and foundations — had already been de-fogged.

The broad scope of FIs, bolstered by the sharp tools of AML/KYC, worked more or less as intended from the jump. Initial loopholes were ruthlessly exploited, but many were subsequently closed. Fraud is not unknown, but no one reasonably expected folks who had cheated on their taxes to draw the line at an information disclosure regime.⁸ Ultimately, the mechanics for the identification and disclosure of the beneficial owners of assets held overseas function reasonably well.⁹ So when the competent authorities realized that a massive new financial sector had emerged in the intervening years and that it was nearly wholly untouched by FATCA/CRS, the intuitive conclusion must have been: Let’s copy CRS for digital assets.

The Challenges for aDigital CRS

“Money ain’t got no owners, only spenders.”¹⁰

At first glance, two immediate problems with copying CRS for digital assets¹¹ emerge: (1) The digital asset industry operates differently from the conventional finance industry; and (2) most governments had not as yet determined how to comprehensively regulate the digital asset industry.¹² Accordingly, the architects of CARF needed — first and foremost — to determine which roles different parties played in the cryptosphere before they could begin to analogize those parties to their conventional FI counterparts. The first realization should have been that the key drivers of market activity for digital assets are not the same as they are in the non-digital financial industry.

While payment processing remains a backbone of the banking industry, the revenue it generates amounts to a sliver in comparison with the cash management, investment, and wealth management industry, which the payment processing function had enabled banks to dominate. The non-digital financial industry mainly entails the conversion of the means of payment that do not yield income streams (currency, money, and legal tender) into financial products that can yield income streams (shares, funds and other equity holdings, credit, insurance products, and other derivative instruments), with the support of parties trusted to preserve its value (banks, insurers, asset managers, and fiduciaries). In contrast, the digital asset industry is awash in currencies that rarely operate as payment media because, outside El Salvador and a few industries, digital currencies tend not to be exchanged directly for goods and services.¹³ As such, the tradition of depositing money in a bank for indefinite periods so as to use the bank’s systems to pay for things is absent in the digital sphere.

Further, digital assets are not natural income stream assets, like bonds, stocks, or insurance annuities, which yield annual or periodic income to their owners.¹⁴ Instead, the value of a digital asset as an investment depends overwhelmingly, if not completely, on the appreciation in its value (though interest-bearing depository accounts are emerging). As such, the powerful incentive to hold assets with a custodial bank to process the regular income payments generated by investment assets (for example, dividends or interest payments) is missing for digital assets. Finally, as a practice for keeping assets safe, a “cold wallet” appears far safer than entrusting digital assets to a “hot wallet” in light of the risk of cyber theft or corporate fraud.¹⁵ In sum, the age-old concept of keeping money and other assets in accounts at financial institutions seems outdated in the digital world and certainly appears inadequate as the cornerstone assumption of a digital asset regulatory regime.

Accordingly, a digital asset reporting regime must rely on alternative sources of ownership information. The trick is that the owners of digital assets are hard to spot in the wild. Thanks to the intrinsic decentralization of the blockchain, the capacity for it to process transactions on a peer-to-peer basis and the proliferation of cold and other noncustodial wallets, digital asset holdings may be hidden away, held on personal property, and not visible to tax and regulatory examiners without a search warrant. With an infinite digital mattress under which to stash crypto holdings outside banks, when and how does a disclosure regime identify the beneficial owners of those assets? Like submarines, you wait for them to surface.

Because the options to purchase goods and services with crypto directly are still limited, crypto assets tend to be converted into fiat currencies before most usages.¹⁶ So a crypto investor may own millions of dollars in digital assets, but until spent, they’re functionally worthless (except perhaps as debt collateral). To be spent, they need to be converted into fiat currencies in most circumstances and for that you typically need an exchange. Accordingly, a clever, albeit obvious, method for identifying the potentially reportable parties is to ignore them until they seek to convert the digital investment assets into more prosaic currencies or analog assets. For that, the owners of digital assets tend to go to an exchange, either by themselves or via an intermediary. To that end, CARF targets crypto exchanges as the backbone of the digital financial system. Crypto exchanges qualify as the core reporting parties under CARF (referred to as reporting cryptoassets service providers, or RCASPs¹⁷), like banks and other FIs under CRS. Crypto exchange clients are the parties to be reported under CARF (referred to as cryptoasset users¹⁸), like account holders under CRS. Crypto exchange transactions (referred to as relevant transactions¹⁹) generate the financial information to be reported under CARF, like payments and account balances and values under CRS. At risk of belaboring the point, exchanges that convert digital assets into fiat currencies are the coal face of CARF, where the relevant financial information is to be found.

However, crypto exchanges alone are insufficient for the collection of the client information. Another reason why banks fulfill their CRS roles so well is their relationship with the customer. Not only do the banks establish, maintain, and nurture their account holder relationships, but the aforementioned AML/KYC rules oblige them to peer behind any structures, fiduciaries, or nominees being used to obscure beneficial ownership of the account. Crypto exchanges do not enjoy this level of familiarity with their clients. Although many exchanges are subject to AML/KYC regulations on the cryptoassets they hold or trade on behalf of clients, few have the experience or resources to match the standards at banks and other FIs. For administrative reasons, therefore, the OECD needed to rope in other parties with closer proximities to the crypto beneficial owners.

Accordingly, the definition of RCASPs encompasses not only the digital asset exchanges that “effectuate” the trade of crypto for fiat currencies, but also the parties that operate as counterparties or intermediaries in those transactions. They are the parties to a relevant transaction that are most likely privy to beneficial ownership information when the crypto exchange is not.²⁰

The Hunt for Reportable Information

“$300 million in crypto is buried out here, somewhere.”²¹

Many of the future RCASPs with direct access to the beneficial owners of cryptoassets ready and willing to be disclosed under CARF have never collected the reportable information required by CARF²² because they never had to.²³ As such, they lack the necessary forms and cannot reasonably count on a tax authority or industry group to prepare templates for widespread CARF usage.²⁴ Many RCASPs have never established an effective form-collection process, including the persuasive solicitations necessary to obtain forms from hesitant clients. Many RCASPs have never developed an effective method for verifying the information collected. Many RCASPs have never set up an effective monitoring system for identifying any relevant changes to the client’s tax profile. Many RCASPs have never instituted an effective mechanism for archiving documents to ensure their ready availability upon demand for audits of the internal and external varieties. More colloquially, many of the crypto firms that will need to report clients under CARF do not yet know from whom to collect information, on what form to collect the information, how to validate that information upon collection, and how to ensure it remains fresh and accessible after collection. The build-out of an information collection process may not seem like a mighty engineering challenge to the masters of the blockchain, but it depends heavily on human responses to requests, which makes it among the more frustrating activities under CRS.

Moreover, the information collected on reportable users needs to be appropriately formatted and timely filed. That seems straightforward enough, right? Well, it should be, but it rarely is, specifically because there will probably not be one single unified CARF report format or annual deadline. To the extent that its precursor regimes, like the FATCA IGAs and CRS, set the pattern for CARF, then each jurisdiction will devise its own CARF reporting format and reporting deadline. First and obviously, this fragmentation of the rules complicates matters enormously for multijurisdictional enterprises that cannot centralize and unify their CARF reporting. Second, it tends to result in quirky local rules, like limits on portal registration or de-registration, bulk uploads, or nil reports, plus a host of IT idiosyncrasies and other integration issues.

The fragmentation of rules and standards will not only be the bane of multinational enterprises but might lead to a rash of idiosyncratic rules that can gum up the whole works. One example of the latter is the CRS client-notice requirement.²⁵ Similarly under CARF, some jurisdictions may impose a pre-reporting notice requirement so that clients have a meaningful opportunity to contest the disclosures. And contest them they will, especially when the alternative is a handover of inculpatory or inconvenient evidence to the client’s home tax authorities. In fact, many will come armed with lawyers and aggressive arguments against reporting. That is fine. That is their right, and that is the purpose of notifying reportable users before the submission of the reports. However, this regulatory approach relies on adequate pushback from the reporting firms. Their legal and compliance departments need to stand firm against clients and client advisers to ensure the firm’s compliance with the law is not subordinated to client demands.

In sum, the reporting function ought not to get bogged down in the paper chase for reportable information from clients and other third parties. Nonetheless, it remains consistently underestimated as a time drain, even for those parties with experience in reporting under a similar regime or even the very same regime in a subsequent year. None of the above points is a showstopper. All the operational obstacles are surmountable, but they require resources, planning, trained staff, and testing; even more so when there is no existing institutional infrastructure on which to erect the new CARF-mandated processes. Furthermore, in a decentralized system designed to allow for anonymous financial transactions,²⁶ unconstrained by the national boundaries that limit the reach of local tax laws and reared on a theology of disruption, any efforts at enhanced transparencies must be elegant. And elegance requires much preparation and practice.

Conclusion

“There is nothing new under the sun.”²⁷

A more apt quote for the conclusion to this article could well be André Breton’s definition of his own Surrealist Movement as “the chance encounter of a sewing machine and an umbrella on an operating table.”²⁸ We have two distinct financial systems—one analog and one digital— that could happily operate in fully non-overlapping ways. To that end, we could also deploy the Rudyard Kipling quote, “never the twain shall meet”²⁹ to describe this situation, and in a more laissez-faire point in time that could have been true—except that both financial systems can facilitate the concealment of taxable assets from tax authorities and thus are subject to the ongoing campaign for greater cross-border disclosure and financial transparency. FATCA/CRS for conventional financial assets came first, so it also set the blueprint for the regulation of digital assets, despite the material differences between the two financial systems. Perhaps a reference to Ralph Waldo Emerson’s observation on the danger of “a foolish consistency”³⁰ might make most sense. We choose instead to stand by the insight from Ecclesiastes because the gaps between a CRS-derived CARF and the protocols and operations of the crypto world are vast but not unbridgeable. If you know how FATCA/CRS functions across multiple asset classes and their accompanying FIs, then you can read the runes of CARF for digital assets as well.

¹ As used in this article, “CARF” refers to OECD, “Crypto-Asset Reporting Framework and Amendments to the Common Reporting Standard” (Oct. 10, 2022). This article focuses primarily on Part I of that document, which is titled “Crypto-Asset Reporting Framework.” We also discuss Part II, which addresses amendments to the common reporting standard but only to the extent those amendments are relevant to cryptoassets and CARF. A full examination of Part II and its impact on firms and clients of both the conventional financial and digital communities is planned for another article.

² As used in this article, “CRS” refers to OECD, “Standard for Automatic Exchange of Financial Account Information in Tax Matters” (July 21, 2014; second edition published Mar. 27, 2017). Being a mere publication of the OECD, CRS as such has no legal effect. However, well over 100 countries have implemented CRS by incorporating it — or a version of it — into local law.

³ Letter from Sir Isaac Newton to Robert Hooke (1675).

⁴ FATCA was enacted as part of the Hiring Incentives to Restore Employment Act of 2010 (P.L. 111-147) on March 18, 2010, but didn’t go into effect until July 1, 2014. FATCA consists of five parts, only the first of which is relevant to this article: Part I — Increased Disclosure of Beneficial Owners, enacted as sections 1471-1474 of the Internal Revenue Code. FATCA also refers to U.S. Treasury regulations adopted under the statute (reg. sections 1.1471-1 et seq.); additional IRS interpretive guidance, including IRS, “FATCA FAQs” (last updated Feb. 7, 2023); the FATCA intergovernmental agreements between the United States and over 100 countries; and local legislation, regulations, and guidance adopted in various counties to implement FATCA.

⁵ See U.S. Treasury, “Joint Communique by France, Germany, Italy, Spain, the United Kingdom and the United States on the Occasion of the Publication of the ‘Model Intergovernmental Agreement to Improve Tax Compliance and Implement FATCA’” (July 26, 2012).

⁶ These are called foreign financial institutions under FATCA. This article drops the “foreign” modifier and sticks to the simpler and non-U.S.-centric CRS terminology (“financial institutions” or FIs), except when a material difference pertains, in which case we note it.

⁷ The CRS FI categories may be summarized briefly as follows:

• depository institution, which holds money on behalf of clients in the ordinary course of banking or a similar business;

• custodial institution, which earns at least 20 percent of its gross income from holding securities and other financial assets on behalf of clients;

• specified insurance company, which issues designated types of insurance policies;

• investment entity, which has two variations, as follows:

• managing investment entity, which earns at least 50 percent of its gross income from investing, managing, or administering financial assets on behalf of clients; and

• professionally managed investment entity, which is managed by another FI and earns at least 50 percent of its gross income from financial assets.

⁸ Adrian Baron, the former CEO of Loyal Bank Ltd., may have a different viewpoint. In 2018 he was convicted in federal court for aiding undercover federal agents to conceal their assets from FATCA reporting. See DOJ release, “Former Executive of Loyal Bank Ltd Pleads Guilty to Conspiring to Defraud the United States by Failing to Comply With Foreign Account Tax Compliance Act (FATCA)” (Sept. 11, 2018).

⁹ This article expresses no views whatsoever on the appropriateness, cost-effectiveness, or usefulness of the collection of information related to cross-border asset holdings. Just that it functions.

¹⁰ Omar Little speaking to Marlo Stanfield while robbing him (The Wire, Season 4, Episode 4).

¹¹ In all likelihood, the obstacle looming most menacingly at the onset of drafting CARF was the absence of a functional and consistent definition for the digital assets to be covered by a prospective CRS-like information disclosure regime. For FATCA and CRS, the definition of financial assets had been simple: Make a list of things that you want covered, like equities, partnership interests, and derivative instruments. For crypto, that option was unavailing, and there was scant consensus around the regulatory water cooler on the appropriate scope and wording of the definition at the time. Serendipitously, key parties such as the EU, the OECD, Switzerland, and the United States had started to coalesce around a consensus formula. The definition adopted by the CARF reads as follows: “The term ‘Crypto-Asset’ means a digital representation of value that relies on a cryptographically secured distributed ledger or a similar technology to validate and secure transactions.” OECD, CARF, supra note 1, Section IV.A.1.

¹² While a handful of jurisdictions have produced crypto tax and regulatory guidance of stellar quality (or at least, Switzerland has), none has yet set up an enforcement regime targeting digital assets. Further, while many jurisdictions apply AML/KYC rules to activities related to crypto holdings (for example, Australia, Hong Kong, Japan, Singapore, South Korea, and the United States), the rules do not actually regulate the lion’s share of crypto transactions either because the transactions are peer-to-peer or because the rules are not obeyed (see infra note 23 for further elaboration of this point).

¹³ Some countries, like China and Saudi Arabia, have banned the use of cryptocurrencies entirely for any transactions.

¹⁴ Digital assets can be engineered to yield income streams by creating derivative products with underlying digital assets but, unlike debt or equity, do not tend to yield income payments prior to sale if left on their own.

¹⁵ Cold wallets are storage devices for holding blockchain keycodes that are not connected to the internet; they operate like USB sticks. In contrast, hot wallets are storage devices for holding blockchain keycodes that are offered to account holders by many fintech apps and held online. The former amounts to the digital equivalent of keeping money under the mattress, and if misplaced, a cold wallet is uninsured and nonrecoverable. Hot wallets, though, are intensely attractive targets for cyber thieves (for example, Japan’s Mt. Gox, the largest crypto exchange in the world at the time, was hacked in 2013-2014, allegedly by a Russian hacking consortium (Anna Baydakova, “Where the Mt. Gox Money Went,” CoinDesk, June 9, 2023) or direct fraud by the wallet provider (for example, FTX allegedly loaned out digital assets it held in custody despite contractual provisions that barred security lending practices (David Yaffe-Bellany, “Prosecutors Detail Evidence Against Sam Bankman-Fried,” The New York Times, Aug. 14, 2023).

¹⁶ Moreover, as a consequence of the volatility in and correlation across the price movements of many cryptoassets, they do not satisfy several of the fundamental principles for the long-term safeguarding of wealth.

¹⁷ RCASPs are defined as “any individual or Entity that, as a business, provides a service effectuating Exchange Transactions for or on behalf of customers, including by acting as a counterparty, or as an intermediary, to such Exchange Transactions, or by making available a trading platform.” OECD, CARF, supra note 1, Section IV.B.1.

¹⁸ Cryptoasset users are defined as any “individual or Entity that is a customer of a Reporting Crypto-Asset Service Provider for purposes of carrying out Relevant Transactions.” Id., Section IV.D.2.

¹⁹ An “Exchange Transaction” consists of an “a) exchange between Relevant Crypto-Assets and Fiat Currencies; and b) exchange between one or more forms of Relevant Crypto-Assets,” but other transactions, such as transfers between wallets and retail transactions paid for in crypto valued at over $50,000, may also be reportable transactions. Id., Section IV.C.2 and.3.

²⁰ Sharp-eyed readers may notice a class of service provider not covered by the RCASP definition: asset managers and administrators. As digital asset markets expand, one likely direction of development is to mirror the diverse financial services provided for conventional financial assets: external asset managers that advise on crypto, fund managers that focus on crypto, trustees that hold crypto, derivative sellers that issue instruments referencing crypto, or payment processors handling payments in crypto. All these types of asset management/administration already exist in the digital asset marketplace, so to predict their continued growth is no precognitive feat. Why would the OECD omit those service providers from CARF when it had so carefully included them in CRS? Because it added them to the CRS definition of an FI instead, expanding the definition of financial assets and thus of an FI to cover parties that provide asset management and administrative services for digital assets. (OECD, “International Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023 Update to the Common Reporting Standard,” Section VIII.A.6, 7 (as adopted June 8, 2023).)

²¹ Russ Hanneman, while hunting through a garbage dump for the USB stick that was in his jeans, which his housekeeper had thrown out (Silicon Valley, Season 5, Episode 7).

²² The personal information reported under CARF includes the name, address, jurisdiction(s) of residence, taxpayer identification number(s), date of birth, and place of birth of each reportable person. OECD, CARF, supra note 1, Section II.A.1.

²³ That is not simply because CARF reporting requires information in addition to AML/KYC documentation. It is also because, in many jurisdictions, AML/KYC rules are not effectively implemented or enforced for digital assets. Some readers may find that sentence objectionable, and some may find it an outdated view, but many will see it as an objective statement of fact. A 2022 Financial Action Task Force (FATF) review of AML/KYC operations for digital asset service providers across 98 jurisdictions concluded that 73 of the jurisdictions (more than 75 percent of them!) were not enforcing AML/KYC at an acceptable level. (See FATF, “Targeted Update on Implementation of the FATF Standards on Virtual Assets and Virtual Asset Service Providers” (June 2023).) Less systematic evidence can be found atop the crypto food chain. John Ray III, a long-time bankruptcy specialist who handled Enron’s liquidation, described FTX’s “compromised systems integrity and faulty regulatory oversight” as “unprecedented” in his rich experience (Declaration of John Ray III, In re FTX Trading Ltd. (Bankr. Del. Nov. 17, 2022), at para. 5). Another crypto exchange, Bitzlato, was shut down (and senior management arrested) by pan-European police authorities on the grounds, in part, of disregarding AML/KYC rules in order to facilitate the processing of criminal proceeds. (See Europol release, “Bitzlato: Senior Management Arrested” (Jan. 23, 2023).)

²⁴ Self-certification forms are self-explanatory: They are the documents on which clients communicate mandatory information to banks and other FIs for purposes of CRS, FATCA, and other regulatory regimes. The best-known (and most widely detested) versions are from the IRS’s Form W series, which cover an array of taxpayer situations and profiles. Many large FIs and some IGA jurisdictions developed their own modified versions. For CRS, the OECD — the central organizer of the regime — lacked sufficient will or status to produce and impose its own forms on the participating countries as the IRS had for FATCA. As such, CRS self-certification forms vary significantly. Some jurisdictions published template forms for use in-country (for example, the Cayman Islands) and some industry groups, such as the British and Swiss bankers’ associations, produced self-certification form templates for their members. However, most banks and large FIs developed their own self-certification forms in-house and insisted that all their clients use them, which was necessary, but a tremendous nuisance for clients of multiple FIs. Our assumption is that likewise each RCASP will need to prepare its own form.

²⁵ See, e.g., article 14 of the Swiss CRS law and IEIM402510 of the HM Revenue & Customs CRS regulations.

²⁶ See, e.g., Satoshi Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System,” at section 10 (2008).

²⁷ Ecclesiastes 1:9.

²⁸ Adopted by Breton from Isidore-Lucien Ducasse (aka Comte de Lautréamont), Les Chants de Maldoror (1869).

²⁹ Kipling, The Ballad of East and West (1892).

³⁰ Emerson, Self-Reliance (1841).

Disclaimer: This article is intended for general informational purposes only and does not constitute legal or regulatory advice. Parties should seek qualified legal counsel regarding their specific obligations under the applicable CARF/DAC8 regulations.