Self-Certifications: where CARF reports succeed or fail
By Paul Foster Millen and Peter Cotorceanu
Under the Crypto-Asset Reporting Framework (CARF), every report you file, in 2027 and every year thereafter, is only as good as the documentation you collected from your users in your due diligence process. That documentation starts with the Self-Certification form. If a form is missing, incomplete, or does not match what you already know about the user, the report built on it will be wrong too. That is why the Self-Certification is where many CARF reports will succeed or fail.
Below, we set out what CARF due diligence requires, where it tends to go wrong, and what it takes to get it right.
1. What CARF due diligence requires
CARF obliges every Reporting Crypto-Asset Service Provider (RCASP) to establish the tax residency and CARF status of its Crypto-Asset Users (CAUs). In practice that means:
A valid Self-Certification from every user. For recording basic information on CAUs and controlling persons: Names, residential addresses, jurisdictions of tax residence, Taxpayer Identification Numbers (TINs) and more.
A classification decision for every entity user. Is an entity CAU an Excluded Person? An Active Entity? Neither? These determinations dictate whether the RCASP must report or look through the entity CAU to identify its controlling persons and obtain a Self-Certification on each of them as well.
A reasonableness test. A certification is not valid simply because it was signed. The RCASP must confirm its consistency with the AML/KYC information already collected, and must chase, challenge or re-paper where it is not.
Ongoing monitoring. Changes in circumstances can invalidate a Self-Certification on file. A process must be established to detect them, cure them, and to retain evidence that you did.
Records that survive scrutiny. Certifications and the due diligence steps taken with respect to them must be retained and produced to regulators upon request. Penalties apply where reports are inaccurate, incomplete or unverified.
The documentation obligation applies to your entire customer base; not just for the CAUs you end up reporting.
2. How CARFtools’ products support you
CARFtools provides ready-to-deploy Self-Certification forms and the review guidance needed to validate them, written by Paul Millen and Peter Cotorceanu, the authors of the five-part series of articles known as Old Tricks for New Dogs.
Self-certification forms (like all our tools, available here) —
• CARF Individual Self-Certification Form
• CARF Entity Self-Certification Form
• CARF Controlling Person Self-Certification Form
Standardised forms covering the required data points and the certifications and declarations that make a submission valid. Drafted against the CARF rules and commentary because CRS Self-Certification forms are not valid for CARF without substantial overhaul. Deploy them as they are or embed them in your own electronic onboarding system using the code snippets included with each form.
Review guides and operational checklists (also available here) —
• CARF Individual Self-Certification Review Guide and Operational Checklist
• CARF Entity Self-Certification Review Guide and Operational Checklist
• CARF Controlling Person Self-Certification Review Guide and Operational Checklist
The forms tell your users what to provide. The review guides tell your team what to do with what they get back: How to test a submission for validity and reasonableness, where the common failure points sit, and when to accept, query or reject any inconsistencies. Each guide pairs with its form, so the questions asked at onboarding and the test applied at review are the same questions.
Procedural consistency is imperative at scale. A reviewer in their first week and a reviewer in their third year should reach the same conclusion on the same file, and should leave behind the same audit trail when a regulator asks how it was reached.
Each resource is available individually, or as part of the Operational Module alongside a third-party delegation agreement, client notification letter, and a CARF reporting repository.
3. Acquiring these yourself would cost lot of time and/or money
Drafting a CARF self-Certification form is not a formatting exercise. It is a legal drafting exercise that requires scrutinising the OECD rules and commentary, the XML reporting schema and the OECD’s CARF FAQs — then reducing all of it to something a retail user will complete correctly without assistance.
Six documents have to be built, not one: Three forms and three review procedures, each internally consistent with the others. Commissioned externally, this is specialist work. Tax experts at law firms and large accounting practices bill in the hundreds of dollars per hour or more, and a drafting and review exercise of this scope runs up many, many hours of their expensive time. That is a hefty cost before a single user has been onboarded. Built internally, the cost is the same work done by a team who will do it once, against a deadline, with no benchmark against which to check themselves. Even if all goes smoothly, the peace of mind that everything is correct will be elusive. In comparison, the CARFtools’ Self-Certification forms and review guides are available immediately for just $549 and $249, respectively.
Not sure whether CARF applies to you? Start with the free RCASP assessment (a free account is all it takes).
Disclaimer: This article is intended for general informational purposes only and does not constitute legal or regulatory advice. Parties should seek qualified legal counsel regarding their specific obligations under the applicable CARF/DAC8 regulations.