Old Tricks for New Dogs, Part II

The OECD’s Cryptoasset Reporting Framework

By Peter A. Cotorceanu & Paul Foster Millen, 8 Apr, 2024

This article was originally published in Tax Notes International, April 8, 2024, p. 203    

Meet the “new dogs”! There are packs of them. As we mentioned in our previous article in this series,¹ “old tricks” refers to the fact that the OECD’s cryptoasset reporting framework (CARF²) is based heavily on the OECD’s common reporting standard (CRS³), which was published almost a decade ago. “New dogs” refers to the fact that CARF’s due diligence and reporting obligations fall on a whole new set of players, almost none of whom have had any experience with CRS or any similar type of automatic exchange of information regime.

In Part I of this series, we introduced CARF by describing CRS’s basic structure and the challenges faced by the OECD in adapting CRS’s rules — designed for conventional financial activities — to the world of digital assets. In this article we introduce CARF’s new dogs, the individuals and entities with due diligence and reporting obligations under CARF. As we will see, there are many different breeds of new dog — far more than one might expect. So many, in fact, that lots of them will howl to learn that CARF imposes due diligence and reporting obligations on them.

CARF’s New Dogs

Who exactly are CARF’s new dogs? They are what CARF refers to as Reporting Crypto-Asset Service Providers (RCASPs).

RCASPs are CARF’s analog to CRS’s financial institutions (FIs). Just as all of CRS’s due diligence and reporting obligations fall on FIs — and only FIs — all of CARF’s due diligence and reporting obligations fall on RCASPs — and only RCASPs.

The definition of RCASP is broad, capturing any individual or entity⁴ that, “as a business, provides a service effectuating Exchange Transactions for or on behalf of customers, including by acting as a counterparty, or as an intermediary, to such Exchange Transactions, or by making available a trading platform.” This is very different from the definition of FI under CRS, which comprises custodial institutions, depository institutions, investment entities, and specified insurance companies, each of which has its own separate definition.⁵

One obvious difference between an RCASP and an FI is that the latter must be an entity, while both individuals and entities can be RCASPs under CARF.

Another major difference is that RCASPs are entities and individuals that effectuate transactions, while FIs hold accounts and may or may not be involved in effectuating transactions regarding the assets in the accounts they hold.⁶

This difference is likely because of the decentralization of the blockchain and the fact that beneficial owners of digital assets such as crypto holdings can remain hidden until they actually engage in transactions involving those holdings.⁷ Compare that with account holders at FIs. Most non-crypto financial assets must be — or, by long-standing custom, are — held in an account maintained at an FI, and no account may be opened at an FI without it knowing the identity of the account holder. In contrast, given that cryptoassets are not held in traditional accounts, owners can only be spotted when they engage in transactions. Thus, under CARF, beneficial owner identification occurs at the time of an exchange transaction, rather than at the time of account opening.

Further, CARF requires that the relevant services be provided “as a business,” which “excludes individuals and Entities who carry out a service on a very infrequent basis for non-commercial reasons.”⁸ In addition, the requirement that the services be provided for or on behalf of customers means that “an individual or Entity that is solely engaged in validating distributed ledger transactions in Relevant Crypto-Assets⁹ is not a Reporting Crypto-Asset Service Provider, even where such validation is remunerated,” because crypto miners work for themselves, not on behalf of clients.

Finally, the prospective RCASP — whether an individual or an entity — operating as a business on behalf of one or more customers must “effectuate” an “Exchange Transaction.” Exchange transactions are exchanges of relevant cryptoassets and fiat currencies and exchanges of different forms of relevant cryptoassets. So far, so good. But what does it mean to effectuate one of those? Surprisingly, CARF doesn’t define effectuate as such. Instead, it gives guidance on who can be said to effectuate exchange transactions. Thus, for any set of crypto-related activities, we must reason by analogy from the examples of those that can effectuate exchange transactions as to whether the activities in a particular case actually amount to “effectuating” a transaction.

CARF’s commentary on the definition of an RCASP gives the following examples of which individuals and entities may be said to effectuate exchange transactions “by acting as a counterparty or intermediary to the Exchange Transactions”:

•  Dealers acting for their own account to buy and sell relevant cryptoassets to customers.

•  Operators of cryptoasset ATMs, permitting the exchange of relevant cryptoassets for fiat currencies or other relevant cryptoassets through those ATMs.

•  Cryptoasset exchanges that act as market makers and take a bid-ask spread as a transaction commission for their services.

•  Brokers in relevant cryptoassets in which they act on behalf of clients to complete orders to buy or sell an interest in relevant cryptoassets.

•  Individuals or entities subscribing to one or more relevant cryptoassets. While the sole creation and issuance of a relevant cryptoasset would not be considered a service effectuating exchange transactions as a counterparty or intermediary, the direct purchase of relevant cryptoassets from an issuer, for resale or distribution to customers, would be considered effectuating an exchange transaction.

The individuals and entities described in these examples go well beyond the types of parties one would normally think of as actually effectuating transactions based on the plain meaning and common usage of the term. For example, the online Cambridge Dictionary defines effectuate as “to do something or make something happen.” The Merriam-Webster online dictionary defines effectuate as “to cause or bring about (something): to put (something) into effect or operation.” Finally, while Black’s Law Dictionary does not define effectuate, it does define its shorter variant (the verb “effect”) as follows: “to bring about; to make happen.”

As the U.S. Chamber of Commerce pointed out in its comments on the proposed regulations implementing the United States’ analogous cryptoasset domestic reporting regime, “to ‘effect’ a transaction, one must cause it to occur.

Attenuated or indirect causation should not suffice.”

Certainly, the first parties listed by CARF in the above list (dealers acting for their own account that buy cryptoassets and sell them to customers) truly effectuate the relevant transactions. The same can be said of the last parties in the above list— individuals and entities that subscribe to cryptoassets by purchasing them for resale and distribution to customers.

However, it’s a bit of a stretch to say that operators of cryptoasset ATMs, cryptoasset exchanges acting as market makers for a fee, and brokers acting on behalf of clients effectuate exchange transactions. While they certainly facilitate exchange transactions by providing means by which the transactions can be consummated, they don’t effectuate (cause) the transactions any more than, say, the owner of a stadium in which a football game is played effectuates the game.10

CARF’s definition of RCASP also expressly includes “making available a trading platform.”

Per the CARF commentary:

A “trading platform” includes any software program or application that allows users to effectuate (either partially or in their entirety) Exchange Transactions.

However, the commentary helpfully clarifies that merely providing a bulletin board for posting buy, sell, or conversion prices of cryptoassets does not make one an RCASP because it would not provide a service allowing users to effectuate exchange transactions. Similarly, the mere creation or sale of cryptoasset trading software and apps does not make one an RCASP as long as the individual or entity in question is not using the software or app itself to effectuate exchange transactions.

One more condition must be satisfied for a trading platform to qualify as an RCASP: control (or, at a minimum, influence).¹¹ The commentary clarifies that a trading platform is not an RCASP unless the individual or entity exercises “control or sufficient influence” over the platform to comply with CARF’s due diligence and reporting obligations regarding the transactions concluded on the platform. This assessment is to be made consistent with the 2012 Financial Action Task Force (FATF) recommendations, as amended in June 2019 on virtual assets, virtual asset service providers, and related FATF guidance.

Unfortunately, neither the CARF commentary nor the FATF recommendations as amended for virtual assets and virtual asset service providers explain what it means to exercise control or sufficient influence over the platform to comply with CARF’s due diligence and reporting obligations. Fortunately, some insight can be gleaned from the proposed U.S. broker regulations. Under those regulations, a person is considered to have sufficient control or influence over a facilitative service to enable it to determine customer identities or the nature of transactions (which would allow it to conduct due diligence and fulfil reporting obligations) if that person “has the ability to set or change the terms under which its services are provided,” which includes “the ability to change the fees charged for the facilitative services.”

Presumably, a similar standard can be applied under CARF because the ability to change the terms of service, including any fees charged, gives a service provider enough leverage to convince reticent customers to cough up the required information. Even then, though, the determination of control is both uncertain and at risk of manipulation. A clear example can be found in the emergence of decentralized crypto exchanges, which function like automated peer-to-peer trading platforms with no intermediary between the user and the blockchain. The software programs (smart contracts) governing these decentralized crypto exchange transactions may be locked or subject to modification solely by governance token holders. Together, these token holders constitute a decentralized autonomous organization that may not function as a collective or qualify as an entity. In such cases, the exchange— once set up — may run in a way such that no identifiable party exercises “control or sufficient influence” over it.

Finally, CARF states that an individual or entity may be an RCASP in other ways as long as it “functionally provides a service, as a business, effectuating Exchange Transactions for or on behalf of customers,” regardless of the technology involved in providing that service. Given the breadth of the rest of CARF’s definition of an RCASP, it’s not entirely clear what, if anything, this language captures.¹²

The Risks of New Dog Definitional Ambiguity

For prospective RCASPs, the ambiguity of the core definition of CARF reporting delivers a double whammy. At first, it leaves them uncertain as to the scope of the definition, which will ineluctably result in under- and over-compliance, of both the canny and inadvertent kinds. To some degree, that is common in many new tax regimes. Under the Foreign Account Tax Compliance Act¹³ and CRS, for example, the application of the investment entity-type FI category was uncertain from the text, but after a few years the affected industries (banks, asset managers, and fiduciary services providers) muddled through to a common understanding to which the regulators acquiesced. That was a single whammy.

The second whammy from CARF is that the ambiguous state of the RCASP definition will push local authorities to clarify the scope of the term in their legislation or guidance notes. This reclarification may lead to a deviation from the plain meaning of the text in favor of the reporting regime’s strategic aims. CARF is not a regulation of the crypto industry, but of taxpayers exploiting the crypto industry to conceal taxable income. As such, the RCASP definition is a means to an end. Accordingly, the rules will bend in furtherance of the practical purpose of the definition: to identify the parties best situated to determine the identity of the beneficial owners and collect their information. Because most CARF jurisdictions are presumably governed by the rule of law, CARF implementation cannot breezily ignore the RCASP definition in drafting the local legislative text. However, if the text is unclear and malleable, the overarching aims of the regime will tend to determine which way it bends.

To that end, the scope for RCASPs may veer from the current understanding to capture parties involved in any relevant crypto transaction that are positioned to have better access to information on the ultimate beneficial owners of the cryptoassets involved. This aim may explain the broader definition of virtual asset service provider (VASP) under the anti-money-laundering recommendations adopted by the FATF.¹⁴ The list of activities that could qualify a party to a crypto transaction as a VASP seems designed to ensure that the compliance burden extends to parties that have access to the necessary information. Perhaps with this end game in mind, the EU’s CARF-equivalent regime, DAC8, adopted a far more expansive definition of the term “Crypto-Asset Service Provider.” That definition incorporates the definition of the same term in EU Regulation on Markets in Crypto-assets (article 3(1), point (15) of Regulation (EU) 2023/1114), which includes services as far afield as “providing advice on crypto-assets” and “providing portfolio management on crypto-assets.” Likewise, CARF’s definition of an RCASP is not as broad as the U.S. broker reporting regulations’ definition of a broker, which also includes, for example, digital asset payment processors. In short, parties active in the crypto-sphere but seemingly outside the scope of the CARF RCASP definition should not breathe their sighs of relief just yet.

Where the New Dogs Are Kenneled

Not all RCASPs are bound by CARF, only those that have a sufficient nexus to a jurisdiction that has adopted CARF. With CRS, the nexus determinations were relatively straightforward and static. FIs tended to be governed under CRS where they were established under law or had employees and buildings and, moreover, these key features tended to remain unchanged. In addition to being commonsensical, this setup provided leverage to the local authorities to compel compliance by domestic financial institutions.

In light of the higher mobility of RCASPs, CARF adopts a more expansive approach to jurisdictional nexus. To that end, an RCASP is caught by CARF jurisdiction only if it:

•  is tax resident in the jurisdiction;

•  is incorporated or organized under the laws of the jurisdiction and has legal personality there or is subject to tax reporting requirements in it;

•  is managed from the jurisdiction; or

•  has a regular place of business in the jurisdiction.

If an RCASP is subject to the CARF laws of two or more jurisdictions, it must comply with only the reporting and due diligence requirements of the jurisdiction with highest priority according to the above list, in descending order. For example, an entity that is tax resident in one CARF country (and thus meets the first condition listed above) and both is incorporated in and has legal personality in a second CARF country (and thus meets the second condition listed above) does not need to fulfil its CARF obligations in the latter country, provided that it fulfils those obligations in the former country.

Similarly, an individual who is tax resident in one CARF country and has a regular place of business in another CARF country needs to fulfil its CARF due diligence and reporting obligations in only the former.

These jurisdictional nexuses for CARF provoke multiple reactions. The first reaction is, good luck to whichever local dogcatchers are charged with policing their domestic new dogs. With no physical infrastructure needed, licensing requirements in only some jurisdictions for only some parties, no natural gatekeepers like banks to serve as deputy sheriffs, and, above all, the minimal fingerprints crypto transactions leave behind, it will be challenging to identify the parties qualifying as RCASPs and practically impossible to determine which ones may be domestic parties unless resident or incorporated in the jurisdiction.

The second reaction is that this will squeeze the gray out of the market. Increasingly, jurisdictions are enacting securities laws (or reinterpreting existing security laws) to require registration of, for example, crypto brokers and dealers.¹⁵ As such, unlicensed brokers and dealers will be violating securities laws and, presumably, concealing their place of operations in the jurisdiction for CARF purposes. Therefore, the legion of licensed and CARF-compliant crypto exchanges will be segregated from and have no operational overlap with the legion of unlicensed and CARF-noncompliant crypto exchanges. A crypto user with qualms about being reported will have few doubts about where to go.

Further, CARF itself has no provisions to prevent its own abuse. Cleverly, CRS introduced a look-through treatment for investment vehicles formally established in a nonparticipating jurisdiction. But that enforcement check relied upon reputable banks being located overwhelmingly in CRS-compliant jurisdictions. CARF has no leverage for such provisions or hasn’t figured it out yet. In CARF, nothing prevents a single user from toggling between compliant and noncompliant exchanges depending on the user’s wish for his or her home tax authorities to be made aware of the particular transaction. Without a concept akin to the expanded affiliate group for FATCA, a single company could operate a CARF-compliant and regulated exchange in, say, Switzerland, and a CARF-noncompliant and unregulated exchange someplace misbegotten, thereby providing a halo to the unregulated exchange through its regulated business.¹⁶

Finally, an RCASP is caught by CARF if it effectuates relevant transactions through a branch based in the jurisdiction. However, the RCASP does not need to fulfil its due diligence and reporting obligations in that jurisdiction if it fulfils those obligations in another CARF jurisdiction.

Conclusion

You’ve now met CARF’s various breeds of new dogs. As you can see, the scope of RCASPs, under the fundamental CARF definition, is ambitious, confusing, and perhaps unstable.

While the same invective may be hurled at the original CRS definitions of FIs, leeway to construe the FI ambiguities based on bald self-interest were constrained by conventions and understandings from outside the CRS regime that could not easily be refuted (for example a firm operates where it has office space and employees, a bank holds financial assets for customers, etc.). These constraints are less apparent in the CARF and crypto context, and thus one may anticipate a running dogfight between regulators and affected parties over the scope of relevant activities, functional control, and jurisdictional nexuses for RCASPs.

In the next articles in this series, we turn to the “old tricks.” Part III will examine the identification and documentation of reportable cryptoasset users and reportable controlling persons, including the principles evolved under CRS and the long-standing anti-money-laundering rules. In our fourth article, we will cover reportable transactions and valuation techniques. Finally, the fifth and concluding article in this series will discuss enforcement and the best practices and tools available for demonstrating an effective CARF compliance program.

¹ Paul Foster Millen and Peter A. Cotorceanu, “Old Tricks for New Dogs: The OECD’s Cryptoasset Reporting Framework,” Tax Notes Int’l, Oct. 16, 2023, p. 345.

² As used in this article, “CARF” refers to OECD, “Crypto-Asset Reporting Framework and Amendments to the Common Reporting Standard” (Oct. 10, 2022). This article focuses primarily on Part I of that document, which is titled “Crypto-Asset Reporting Framework.”

³ As used in this article, “CRS” refers to OECD, “Standard for Automatic Exchange of Financial Account Information in Tax Matters” (July 21, 2014; second ed. published Mar. 27, 2017). Being a mere publication of the OECD, CRS as such has no legal effect. However, well over 100 countries have implemented CRS by incorporating it — or a version of it — into their local law.

⁴ As used in CARF (and CRS), “entity” means a “legal person or a legal arrangement, such as a corporation, partnership, trust, or foundation.” To this extent, CARF’s definition of RCASP is arguably narrower than the definition of the corresponding party under U.S. Treasury Department, “Gross Proceeds and Basis Reporting by Brokers and Determination of Amount Realized and Basis for Digital Asset Transactions,” 88 F.R., at 59576-59659 (Aug. 29, 2023) (the U.S. cryptoasset broker regulations). Under those proposed regulations, and consistent with the U.S. tax code’s definition of person, a broker can include “an unincorporated group or organization through which any business, financial operation or venture is carried on.” Id. at 58588. Thus, for example, a broker includes an operator of a digital asset trading platform that is an individual, a legal entity, or “a group that shares fees from the operation of the trading platform . . . even though there is no centralized legal entity through which trades are carried out.” Id.

⁵ FIs are not irrelevant under CARF. Indeed, CARF contains dozens of references to FIs, and both CARF and CRS define FI in identical terms. However, FIs as such are not reporting entities under CARF. We will explore their critical role in the CARF due diligence process in Part III of this series.

⁶ The CRS FI categories may be summarized briefly as follows:

•   depository institution, which holds money on behalf of clients in the ordinary course of banking or a similar business;

•   custodial institution, which earns at least 20 percent of its gross income from holding securities and other financial assets on behalf of clients;

•   specified insurance company, which issues designated types of insurance policies; and

•   investment entity, which has two variations, as follows:

•   managing investment entity, which earns at least 50 percent of its gross income from investing, managing, or administering financial assets on behalf of clients; and

•   professionally managed investment entity, which is managed by an FI other than a professionally managed investment entity and earns at least 50 percent of its gross income from financial assets.

⁷ For a further elaboration of these points, see Millen and Cotorceanu, supra note 1.

⁸ Like CARF, both the U.S. cryptoasset broker regulations and the EU’s cryptoasset reporting regime require a business nexus. See the proposed regulations in U.S. Treasury Department, supra note 4, at 59588, defining a broker as “any person that in the ordinary course of a trade or business stands ready to effect sale to be made by others”; and Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023, on markets in cryptoassets, and amending EU Directive on Administrative Co-operation 8 (DAC8), defining a cryptoasset service provider by cross-reference to the definition of that term in article 3(1), point (15) of Regulation (EU) 2023/1114: “a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis.”

⁹ A “Crypto-Asset” is “a digital representation of value that relies on a cryptographically secured distributed ledger or a similar technology to validate and secure transactions.” A “Relevant Crypto-Asset” is “any Crypto-Asset that is not a Central Bank Digital Currency, a Specified Electronic Money Product or any Crypto-Asset for which the Reporting Crypto-Asset Service Provider has adequately determined that it cannot be used for payment or investment purposes.” OECD CARF standard, Section IV.A.

¹⁰ Interestingly, under the proposed U.S. regulations requiring brokers to report certain cryptoasset transactions, a broker includes a person that acts as a “digital asset middleman” for a party in a sale of digital assets. Subject to some limitations, a digital asset middleman includes any person that provides a “facilitative service” with respect to a sale of digital assets. Thus, the U.S. regulations expressly include facilitation as a means of effectuating a transaction, while CARF accomplishes the same thing but through verbal legerdemain.

¹¹ For detailed analyses of the control element as a precondition for reporting under CARF, see Noam Noked, “Ending the Crypto tax Haven,” SSRN, at Section III.A2 (2023). For the proposed U.S. broker reporting regulations, see New York State Bar Association Tax Section, “Report on Proposed Regulations Concerning Information Reporting for Digital Asset Transactions,” Report No. 1483, at Section II (Nov. 13, 2023).

¹² Of course, what is unclear today might make perfect sense tomorrow. It is not uncommon for tax regulations to include a broad miscellaneous category at the end of a list of specific categories so as to grant leeway to the regulators to adapt to future developments on their own volition.

¹³ FATCA was enacted as part of the Hiring Incentives to Restore Employment Act of 2010 (P.L. 111-147) on March 18, 2010, but didn’t go into effect until July 1, 2014. FATCA consists of five parts, only the first of which is relevant to this article: Part I — Increased Disclosure of Beneficial Owners, enacted as sections 1471-1474 of the IRC. FATCA also refers to U.S. Treasury regulations adopted under the statute (reg. sections 1.1471-1, et seq.); additional IRS interpretive guidance, including IRS “FATCA FAQs” (last updated Feb. 7, 2023); the FATCA intergovernmental agreements between the United States and over 100 countries; and local legislation, regulations, and guidance adopted in various counties to implement FATCA.

¹⁴ E.g., the list of activities relevant to qualifying as a VASP includes the near-limitless scope of the “administration of virtual assets.” FATF, “12-Month Review Virtual Assets and VASPs” (2020).

¹⁵ See, e.g., the EU’s Markets in Crypto Assets (“MiCA,” or DAC7); the July and December 2023 holdings by J. Rakoff in SEC v. Terraform Labs Pte. Ltd. et al., No. 23-cv-1346 (S.D.N.Y. Jul. 31, 2023) (“Terraform I and II”).

¹⁶ Such a maneuver would not be unprecedented in the crypto-sphere. FTX operated an SEC-regulated U.S. subsidiary alongside its far larger, unregulated Bahamian exchange. Presumably, the former reassured parties transacting on the latter that the unregulated exchange was not criminally minded toward its customer deposits.

Disclaimer: This article is intended for general informational purposes only and does not constitute legal or regulatory advice. Parties should seek qualified legal counsel regarding their specific obligations under the applicable CARF/DAC8 regulations.