Old Tricks for New Dogs, Part V

CARF Enforcement and Compliance

By Paul Foster Millen & Peter A. Cotorceanu, 9 Dec, 2024

 This article was originally published in Tax Notes International, December 9, 2024, p. 1517   

Over the past year, we have introduced the readers of our “Old Tricks for New Dogs” series to the compliance activities (the “old tricks”) that the incoming crypto reporting regime will impose on the regulated parties (the “new dogs”).

Throughout our series on the OECD’s incoming cryptoasset reporting framework (CARF),¹ we focused on how the rules that were developed for traditional asset classes under the OECD’s common reporting standard (CRS)² are supposed to function in a digital-asset world. Now, we come to perhaps the most intriguing questions of all: How effectively can local tax authorities adjust their existing CRS enforcement methods for CARF? And, considering these expected enforcement techniques, what are the sound strategies for CARF compliance?

In Part I, we introduced CARF by describing CRS’s basic structure and the challenges faced by the OECD in adapting CRS’s rules — designed for conventional financial activities — to the world of digital assets.³ In Part II, we introduced CARF’s “new dogs,” specifically the individuals and entities with due diligence and reporting obligations under CARF.4 In parts III⁵ and IV,⁶ we turned our attention to the “old tricks,” namely the methods of customer documentation to identify the proper beneficial owner of the digital assets so that the reporting on the reportable crypto transactions — the ultimate goal for CARF— may be appropriately concluded.

We close out the series with the enforcement mechanisms: the reactions in the marketplace to the new compliance demands; the methods by which we expect local tax authorities to ensure compliance; the penalties for noncompliance; and, most valuable of all, advice on approaching compliance so as to efficiently minimize the risks of these penalties.

Fiat Enforcement in aDigital World

The Foreign Account Tax Compliance Act⁷ was not the first attempt to dislodge bank secrecy. For years, Switzerland’s European neighbors tried to undo the laws that facilitated tax evasion by their citizenries. They exerted government-to-government pressure to that end. This pressure went nowhere, however, because Swiss domestic constituencies, namely the financial industry, staunchly opposed any concessions. In a prime example of realpolitik, the European neighbors’ outrage eventually waned, and they shifted their political demands to other matters for which Bern was willing to make concessions. The pro-secrecy constituency meanwhile remained steadfast in their opposition to any bank disclosures. So, what changed in 2012 with FATCA?

Well, it was not just that the party demanding concessions, the United States, could swing a bigger stick at Switzerland; rather, it was that the United States knew better where to aim that stick. Rather than beseech Bern for negotiations with threats of diplomatic countermeasures, the United States enacted a law in FATCA that would impose crippling costs on Swiss banks and their clients investing in U.S. markets. That is, unless Switzerland agreed to let them participate in FATCA. As those banks and their customers were now part of a globalized financial industry, deprivation of access to the U.S. capital markets would be fatal to the banks. Accordingly, the Swiss banks started petitioning their government to end Switzerland’s vaunted bank secrecy for their U.S. clients, rather than thwarting any efforts to do so.

This pattern of enforcement continued once FATCA entered its operational phase. Under FATCA, the banks and other financial institutions functioned as deputy sheriffs for the IRS. To preserve their own good standing under FATCA, financial institutions must identify and reject noncompliant customers, or risk withholding on all their clients’ U.S. investments.⁸ In fact, many nonbank financial institutions first learned of FATCA only when their bankers insisted in 2015 and 2016 that they comply with FATCA documentation obligations or face the forced closure of their accounts. This deputy-sheriff financial institution approach was buttressed by the responsible officer certification duty, which requires financial institutions to nominate an individual representative to certify personally⁹ to the IRS on an ongoing basis that the financial institution’s compliance program is effective.¹⁰

The FATCA enforcement approach was bluntly effective, but doubtlessly resulted in plenty of slippery avoidance cases, which the IRS could not police centrally. So, for CRS, the OECD left the methods of enforcement open to the participating jurisdictions. Thus, compliance with CRS became a national law matter, meaning each state has an intrinsic interest in the respect shown for its own CRS rules. While some jurisdictions nevertheless seem to prioritize their local financial magnates over their own rule of law, the tools for effective enforcement of CRS were developed in line with (or borrowed from) other sectors of the domestic tax apparatus.

Several components of CRS enforcement will likely be carried over to the CARF regime, like registration plus nil reports,¹¹ mandatory written policies and procedures,¹² annual compliance certifications,¹³ and, of course, the long-time and undefeated compliance champion: audits.¹⁴ For CRS, these were enacted by the local authorities, and any given jurisdiction’s CRS enforcement arsenal might feature none, some, or all of these components.

The OECD also attempted to enhance CRS enforcement by introducing mandatory disclosure rules (MDRs),¹⁵ which were enacted in the EU (as part of its DAC6 protocol¹⁶) but virtually nowhere else. These rules compelled advisers and other intermediaries to disclose cross-border financial transactions that had certain risky characteristics. Because of low adoption and light enforcement, the EU-wide implementation of the MDRs via DAC6 faltered, yielding a far lower volume of reports than anticipated. Whether the OECD (or EU) has the appetite to try another intermediary reporting regime is unknown.¹⁷

The question is whether any of these approaches — alone or in combination — will be adequate for CARF enforcement.

What Will CARF Do?

In Part I of this series, we pointed out some of the enforcement challenges that differentiate the regulation of digital assets from those of conventional assets under CRS. A primary concern is that reporting cryptoasset service providers (RCASPs) are not beholden to their local jurisdiction in the same way that banks and other financial institutions are. The absence of a brick-and-mortar address dilutes the control that local authorities can exercise over RCASPs through the mere threat of showing up and knocking on the door. Moreover, the singular emphasis on cryptoasset trading for most RCASPs limits the leverage that tax authorities can exert through pressure on other operations. Simultaneously, as the state authorities’ pressure eases, the pressure from the market rises. The fungibility of RCASPs’ business offerings permits reportable cryptoasset users to move to other RCASPs rather than endure the strict CARF disclosure demands of their existing RCASPs. This mobility provides some incentives to RCASPs that are losing customers to jump countries by relocating their operations. But, above all, the inherently transient nature of the relationships between RCASPs and cryptoasset users licenses greater experimentation by all parties.

Consider the following: When a taxpayer holds securities at a conventional custodial financial institution, the assets remain with the bank on a quasi-permanent basis. Thus, most taxpayers risk substantial amounts of wealth over a long period of time with a single counterparty bank. They must therefore assess multiple risks stemming from that relationship, including the jurisdictional risk of the legal system and currency where the bank operates, as well as the counterparty risk of the bank itself. In these situations, a large glass-and-steel office building on the high street of a major financial center with a long-standing reputation for excellence and fairness provides valuable levels of assurance. In exchange for psychological comfort, the typical trade-off nowadays is not just higher fees, but also a more intrusive regulatory regime. But if you only transferred the assets to the bank for the brokerage services, then only the specific assets to be traded and then only until the trade is made, the calculus might well shift. You could conclude that you ought to try out a spryer financial institution in a shadier jurisdiction with laxer rules, rather than subject yourself to reporting to your home authorities (especially if you have not been remitting the income tax due on those assets up until now). If you could then stash all your assets under your own mattress until the next trade, it would be far more tempting to try out a broker offering better incentives like lower fees, faster settlement times, and less disclosure of your confidential information, wouldn’t it?

Well, of course, that is the situation for those crypto investors who use noncustodial wallets to hold their digital assets.¹⁸ Thus, rather than wager their life savings on the integrity of the courts or the durability of a bank in a faraway land, a crypto investor bets only up to the ante amount on those factors. For certain folks, a fly-by-night operation in a Wild West town promising deals too good to be true might be worth a flutter, mightn’t it?

Rather than risk their cryptoasset users deserting them in droves for exchanges in non-CARF climates, RCASPs may weigh the risks of cutting corners. To wit, which of the compliance duties painstakingly listed in the “Old Tricks for New Dogs” series could be neglected, disregarded, or applied with a feathery light touch? At the onset, probably several. However, to the extent CRS is the prologue to CARF, the space for creative compliance will gradually shrink as the unblinking gaze of the state identifies loopholes or incomplete guidance and asserts its remedies. For an early example of regulatory agility, Switzerland’s draft CARF law enlarges the registration and reporting rules to capture RCASPs with a stronger connection to one or more other states as a way to ensure that parties in the Swiss marketplace abide by minimal standards.¹⁹ One can imagine other CARF jurisdictions adopting similarly minded rules, like the penalization of local taxpayers trading digital assets in non-CARF jurisdictions or the operation of a disclosure facility for whistleblowing on noncompliant RCASPs.²⁰ This way, the CARF jurisdiction can ensure that it is not simply damaging its own firms with CARF as all the customers flee. Once the regulatory anaconda tightens and plausible compliance options are incrementally squeezed out, the choice distills to full compliance or penalties.

Penalties under CRS vary tremendously. Luxembourg imposes fines reaching €250,000 plus a percentage of the unreported amounts.²¹ Yikes. Bermuda threatens fines and possible prison sentences of up to six months.²² Double yikes. Singapore treats violations of CRS like an offence under the general Singaporean Income Tax Act — akin to cheating on your taxes — and provides a range of penalties accordingly.²³ Triple— well you get the point. Most jurisdictions just impose fines of various amounts.²⁴

Plainly, reasonable monetary penalties seem like the appropriate punishment absent intentional and gross malfeasance. These regulatory matters are intended to deter any regulated parties from regarding the amount of the fines as a cost of doing business that can be paid out if you don’t wish to follow the rules. In the course of CRS implementation, jurisdictions have adjusted their fine amounts, inevitably upward, presumably to generate a stronger deterrent effect. How will they calculate the cost of doing business for RCASPs? My guess is they will miscalculate and overshoot, guided in part by the realization that any fine set in fiat currency can be both an underdeterrence and an overdeterrence for RCASPs, dependent upon factors outside governmental control, like the value of bitcoin and the overall health of the cryptocurrency market. My experience with tax regulators (mostly with the U.S. tax authorities) is that uncertainty leads them to overdo things.

Overall, I expect the penalties set for noncompliance to provide more deterrence than is likely needed, but only for the RCASPs that elect to continue doing business in a CARF jurisdiction.

Lower-Cost CARF Compliance

If resistance to full compliance for RCASPs in CARF jurisdictions is futile, what is the best way to go about compliance? Typically, the surest route to full compliance is reliance on internal or external experts to shape and guide an institutional compliance program. This approach appears tricky for CARF. First, as we have studiously emphasized in this series, CARF requires both conventional tax expertise and digital asset knowledge. Both skill sets tend toward nonoverlapping Venn diagrams.

Accordingly, it will be difficult to identify or recruit new personnel who can develop a CARF compliance strategy from scratch. When internal resources are lacking, many enterprises turn to legal and consulting firms. One reason these external experts offered the clear default alternative for CRS was their preexisting knowledge of the business’s operations and the key figures through prior engagements. If they advised you on FATCA, it made sense for them to advise you on CRS because they know the FATCA protocols and the folks running them. However, thanks to the novelty of the CARF regime — both in the regulation of digital assets and the parties regulated — these historical legacies vanish. Is an RCASP best served by an external consultant hired to replicate for CARF the CRS compliance program that the consultant helped implement at a bank?

You might presume from the tenor of these articles that our answer would be a resounding yes, but it is not. Although CARF rests on CRS, it is not CRS. A CRS compliance program will not suffice, especially if it is not interoperable with existing internal protocols. Thanks in part to the heaps of CRS precedent, CRS expertise is more widespread and easily accessible. Key points and answers to difficult questions can be picked up by nonexperts because the experts have so thoroughly processed it. Thus, counterintuitively, the optimal strategy is to identify or hire your own personnel who can insert CARF into your firm’s operations and culture.²⁵ It is possible to establish and conduct your own program with mainly internal resources, meaning fewer external expenses. Materials, like forms and training tutorials to ensure compliance and avoid obvious penalties, will be needed, but increasingly these materials are available off-the-shelf.²⁶ Historically, tax solutions are closely and expensively tailored to the individual taxpayer’s needs, but the DIY revolution for tax regulation is already underway for CARF.²⁷

Conclusion

The OECD CARF standard devotes a single line to enforcement measures,²⁸ and the accompanying commentary offers none.

Nonetheless, we expect many of the enforcement mechanisms developed by the local authorities for CRS to carry over into CARF, namely mandatory written policies and procedures, training requirements, periodic certification forms, and, above all, audits. Further, we foresee local authorities exercising fewer natural levers of control over the RCASPs than over their financial institution brethren. Thus, we anticipate enforcement mechanisms contoured to digital assets, like the broader sweep of jurisdictional authority claimed by Switzerland. We also expect that digital brokers, exchanges, and other regulated parties that continue to operate out of or within a CARF-participating jurisdiction to commit to full compliance under punitive pressure from their local authorities. Those who design their CARF compliance from the onset based on their own internal protocols and frameworks, rather than one imported from a CRS financial institution, should be able to engineer the most efficient CARF compliance programs. Considering the terra nova nature of the CARF world, RCASPs can expect many operators to promise them teams of specialists to mine nuggets of compliance gold for them. But most miners will benefit from buying top-end picks and shovels and doing the hard digging themselves.

¹ OECD, “Crypto-Asset Reporting Framework and Amendments to the Common Reporting Standard” Part I (Oct. 10, 2022).

² OECD, “Standard for Automatic Exchange of Financial Account Information in Tax Matters” (July 21, 2014; second edition published Mar. 27, 2017). Being a mere publication of the OECD, CRS as such has no legal effect. However, well over 100 countries have implemented CRS by incorporating it — or a version of it — into local law.

³ Paul Foster Millen and Peter A. Cotorceanu, “Old Tricks for New Dogs: The OECD’s Cryptoasset Reporting Framework,” Tax Notes Int’l, Oct. 16, 2023, p. 345.

⁴ Cotorceanu and Millen, “Old Tricks for New Dogs, Part II: The OECD’s Cryptoasset Reporting Framework,” Tax Notes Int’l, Apr. 8, 2024, p. 203.

⁵ Millen and Cotorceanu, “Old Tricks for New Dogs, Part III: Identifying Crypto Beneficial Owners,” Tax Notes Int’l, Sept. 30, 2024, p. 2153.

⁶ Cotorceanu and Millen, “Old Tricks for New Dogs, Part IV: CARF’s Reporting Obligations,” Tax Notes Int’l, Nov. 4, 2024, p. 801.

⁷ FATCA was enacted as part of the Hiring Incentives to Restore Employment Act of 2010 (P.L. 111-147) on March 18, 2010, but didn’t go into effect until July 1, 2014. FATCA consists of five parts, only the first of which is relevant to this article. That part (Part I — Increased Disclosure of Beneficial Owners) is enacted as sections 1471-1474 of the IRC. FATCA also refers to the final and proposed U.S. Treasury regulations adopted under the statute (Treas. reg. sections 1.1471-1 et seq.), additional IRS interpretive guidance including IRS FAQs, the FATCA intergovernmental agreements between the United States and over 100 countries, and local legislation, regulations, and guidance adopted in various countries to implement FATCA.

⁸ Rev. Proc. 2017-16, 2017-03 IRB 501 (2017 FFI Agreement), sections 3,10.05.

⁹ The implicit threat of personal liability for any material failures by the financial institution made the responsible officer role especially unappealing.

¹⁰ Rev. Proc. 2017-16 (2017 FFI Agreement), section 8.03.

¹¹ See, e.g., Bermuda Guidance for The Common Reporting Standard for Automatic Exchange of Financial Account Information in Tax Matters (v.2.0), at 18-19 (2019); British Virgin Islands Guidance Notes on the Common Reporting Standards and Requirements of the Legislation Implementing the Common Reporting Standards in the Virgin Islands, section 2.4.2 (released 2016, updated 2019); Cayman Islands, Tax Information Authority Act, reg. 9(4) (2021 Revision); Swiss Federal Act on the International Automatic Exchange of Information in Tax Matters (EN), article 15.1 (2015); Singaporean IRAS e-Tax Guide Common Reporting Standard (Third Edition), para. 10.4 (2024).

¹² See, e.g., Bermudan CRS Guidance Notes, at 15; British Virgin Islands CRS Guidance Notes, section 3; Cayman CRS Law, reg. 22.

¹³ See, e.g., Bermudan International Cooperation (Tax Information Exchange Agreements) Common Reporting Standard Regulations, reg. 8 (2017); Cayman CRS Law, reg. 12.

¹⁴ See e.g., Luxembourg Law of 16 May 2023 on the Automatic Exchange of Financial Account Information in the Field of Taxation, article 7; Singaporean CRS Guidance Notes, para. 8.1.

¹⁵ OECD, “Model Mandatory Disclosure Rules for CRS Avoidance Arrangements and Opaque Offshore Structures” (2018).

¹⁶ Council Directive (EU) 2018/822 of May 25, 2018, amending Directive 2011/16/EU regarding mandatory automatic exchange of information in the field of taxation for reportable cross-border arrangements.

¹⁷ The text in paragraph 11 of the preamble to the OECD’s CARF standard reads a bit hesitant on this point: “The OECD stands ready to proceed with future amendments to the CARF, in case this is needed to ensure adequate tax reporting with respect to Relevant Crypto-Assets, as well as sufficient global coverage of the CARF.”

¹⁸ Noncustodial wallets will mostly not be subject to CARF reporting (see Cotorceanu and Millen, supra note 3).

¹⁹ Swiss Bundesgesetz Vorentwurf über den internationalen automatischen Informationsaustausch in Steuersachen (AIAG), article 13(a). For a discussion of the hierarchy of jurisdictional nexuses under CARF and the quasi-extraterritorial expansion of Swiss CARF jurisdiction, see Cotorceanu and Millen, supra note 6.

²⁰ For CRS, Singapore operates such a disclosure facility that enables whistleblowing on noncompliant Singaporean financial institutions.

²¹ Luxembourg CRS Law at article 8(3).

²² Bermudan CRS Law, reg. 15.

²³ Singaporean CRS Law, regs. 13(6), 14(8) (referencing section 105M(1) of the Income Tax Act.

²⁴ E.g., fines of up to $100,000 (British Virgin Islands CRS Law, reg.27(2)) set the tone for most financial centers with well-developed CRS rules.

²⁵ Relying on internal personnel also ensures that the institutional knowledge accrued during the course of the project remains in-house and the RCASP does not grow dependent on its adviser for basic tasks (e.g., body leasing).

²⁶ See, e.g., TurboTax and H&R Block for U.S. tax filing aid and GATCA’s CRS & FATCA General Store for assorted forms, documents, and videos.

²⁷ See carftools.com.

²⁸ The OECD CARF standard, Section V on effective limitation reads in full: “A jurisdiction must have rules and administrative procedures in place to ensure effective implementation of, and compliance with, the reporting and due diligence procedures set out above.”

Disclaimer: This article is intended for general informational purposes only and does not constitute legal or regulatory advice. Parties should seek qualified legal counsel regarding their specific obligations under the applicable CARF/DAC8 regulations.