Australia's Draft CARF Bill: What Crypto Tax Reporting Means for Firms
Australia's Treasury has released a draft bill that would embed the OECD's Crypto-Asset Reporting Framework (CARF) into domestic law, setting a 2028 start date for automatic international exchanges of crypto tax data. For accounting firms, auditors, and CFOs serving clients with digital asset exposure, this is the most significant Australian crypto reporting development since the country first committed to CARF in late 2023. The consultation window is short: submissions close on 28 October 2026.
What the Draft Bill Actually Does
The full title is the Treasury Laws Amendment Bill 2026: Tax information reporting. At its core, the bill has two distinct but related objectives.
Implementing CARF in Australian Law
The first objective is to give legal effect to the OECD's Crypto-Asset Reporting Framework, a global standard developed in August 2022 to address the tax evasion risks created by the rapid growth of crypto assets. CARF requires qualifying crypto service providers, broadly, exchanges, brokers, and certain wallet operators, to collect standardised data on their users' transactions and report it to the relevant tax authority. That authority then shares the data automatically with the tax administrations of other participating jurisdictions where those users are tax-resident.
Australia is one of 77 jurisdictions that have committed to adopting CARF. The bill translates that international commitment into enforceable domestic obligations, defining which entities must report, what data must be collected, and the timelines for doing so.
Establishing a Domestic Crypto Reporting Regime
The second objective is distinct from the international exchange mechanism. The bill would also create a domestic crypto reporting regime, meaning Australian-resident users of qualifying platforms would have their transaction data reported to the Australian Taxation Office (ATO) regardless of whether a cross-border exchange is triggered. This mirrors the approach taken with the existing third-party reporting regime for bank interest and share transactions, where the ATO receives data directly from institutions and pre-populates tax returns accordingly.
Together, these two limbs mean that crypto activity in Australia would face both inbound reporting (the ATO receiving data from platforms about Australian residents) and outbound exchange (the ATO sending data about foreign residents to their home tax authorities).
The Policy Timeline: From OECD Standard to Draft Law
Understanding where this bill sits in the longer policy arc helps firms calibrate how much urgency to apply.
Key Milestones
The OECD finalised CARF in August 2022 as a direct response to the perceived gap between the rapid adoption of crypto assets and the limited visibility tax authorities had over related income and gains. Australia signalled its intention to adopt the framework in November 2023, making it one of the earlier committed jurisdictions. A further policy announcement in late 2024 confirmed both the CARF implementation and the parallel domestic reporting regime. The government then formally allocated the measure in its 2025-26 Mid-Year Economic and Fiscal Outlook, with the international data exchanges scheduled to begin in 2028.
The release of the draft bill in October 2026 is therefore the legislative step that converts those policy commitments into a text that can be scrutinised, amended, and ultimately enacted. The 28 October 2026 consultation deadline is tight, which means firms that want to shape the final design need to act immediately.
Who Bears Reporting Obligations Under CARF
The OECD's framework targets what it calls Reporting Crypto-Asset Service Providers (RCASPs): entities that, as a business, provide services enabling customers to exchange crypto assets, transfer crypto assets, or participate in initial offerings. The Australian bill is expected to define RCASPs consistently with the OECD model rules.
Entities Likely in Scope
Based on the OECD model, the following types of entities should assume they are in scope until the final bill confirms otherwise:
- Centralised exchanges with Australian customers or an Australian nexus
- Brokers and dealers executing crypto transactions on behalf of clients
- Operators of crypto ATMs
- Certain DeFi platforms where a controlling person can be identified
- Businesses that facilitate crypto-to-fiat or crypto-to-crypto conversions
Data Fields RCASPs Must Collect
The OECD model rules require RCASPs to collect and report, at minimum: the full name, address, and tax identification number of each user; the jurisdiction of tax residence; transaction-by-transaction data covering the type of crypto asset, the number of units, and the gross proceeds or fair market value; and details of any transfers to or from the platform. This level of granularity goes well beyond what most Australian platforms currently capture in a format ready for regulatory submission.
Practical Implications for Accounting Firms and CFOs
The 2028 exchange date may feel distant, but the data collection requirements will need to be operational before that date. Platforms and their advisers should treat 2026-2027 as the build phase.
Client Onboarding and KYC Uplift
CARF reporting is underpinned by the same know-your-customer logic as existing AML/CTF obligations, but the data requirements are more granular in some respects, particularly around tax identification numbers for foreign residents. Accounting firms advising crypto platforms should audit current onboarding flows now to identify gaps. Any platform that cannot reliably collect a tax file number or foreign TIN at account opening will face a remediation problem closer to the go-live date.
Data Architecture and Crypto Bookkeeping Software
CARF compliance is fundamentally a data problem. Platforms need to record transaction-level data in a format that can be aggregated, validated, and submitted to the ATO in the prescribed schema. Firms evaluating crypto accounting software or digital asset accounting software for their own operations or for client advisory work should be asking vendors now whether their products support CARF data fields and ATO submission formats. The bill's passage will likely trigger a surge in vendor updates; getting ahead of that cycle reduces implementation risk.
Transfer Pricing and Group Reporting
For multinational groups with Australian crypto operations, CARF sits alongside existing transfer pricing documentation requirements. The automatic exchange mechanism means that a discrepancy between data reported by an Australian RCASP and a foreign tax return is now far more likely to be detected. CFOs should ensure that intercompany crypto flows are documented and priced on an arm's-length basis, and that the group's tax positions are defensible against data the ATO will receive from overseas counterparts under reciprocal CARF exchanges.
Audit and Assurance Considerations
Auditors of entities that will be classified as RCASPs face a new area of compliance risk to assess. If the reporting obligation is enacted, failure to report accurately is likely to carry penalties. Audit teams should consider whether CARF compliance will need to be addressed as part of going concern or regulatory compliance assessments in financial statements prepared for periods ending after the bill's expected commencement date. This connects directly to the broader agenda flagged by the IAASB in its work on crypto assets and audit.
The Global Context: CARF as a Coordinated Standard
Australia's bill does not exist in isolation. With 77 jurisdictions committed to CARF, the framework is on track to become the global baseline for crypto tax information exchange, comparable to what the Common Reporting Standard (CRS) did for financial account information. The OECD designed CARF explicitly to complement CRS, covering crypto assets that fall outside the traditional financial account definition.
For firms with cross-border operations, this has a direct consequence: data reported in one jurisdiction will, from 2028, be visible to tax authorities in other participating jurisdictions. A client who holds crypto on an Australian-based platform while being tax-resident in the UK, Germany, or Singapore should expect their home tax authority to receive a CARF report. This reinforces the need for consistent and accurate reporting across all jurisdictions, a theme running through the FSB's parallel work on cross-border digital asset risks.
Australia's own domestic crypto regulatory perimeter has been expanding on several fronts simultaneously. A separate ASIC consultation on crypto-settled CFD protections illustrates how reporting obligations, product regulation, and consumer protection are converging around the same asset class.
What Firms Should Do Before 28 October 2026
The consultation deadline is not just a formality. The design choices made in the final bill, around which entities are in scope, what data must be collected, and how due diligence on tax residence is conducted, will directly affect compliance costs. Firms with a material interest in the outcome should consider the following steps.
Immediate Actions
First, read the draft bill and the accompanying explanatory memorandum in full. The Treasury's published text will contain definitions that determine scope, and early reading prevents assumptions based on the OECD model rules that the Australian version may not replicate exactly.
Second, identify all clients or group entities that are likely RCASPs under the proposed definitions. This scoping exercise should be completed well before the consultation closes, because it informs whether a submission is warranted and what specific provisions to target.
Third, assess the gap between current data collection practices and the CARF data requirements. This gap analysis will drive the timeline and budget for system changes, whether those are enhancements to existing crypto bookkeeping software or procurement of new infrastructure.
Fourth, consider making a submission to Treasury. Submissions from accounting firms and professional bodies have historically influenced the design of Australian tax reporting regimes. The 28 October 2026 deadline means there is limited time, but a focused, technically grounded submission on specific provisions carries weight.
Frequently Asked Questions
When will CARF reporting obligations start in Australia?
The Australian government has indicated that international exchanges of crypto tax information are expected to begin in 2028. The domestic reporting regime is likely to have a similar commencement date, though the final bill will specify exact dates. The consultation period closes 28 October 2026.
Which crypto service providers will need to report under the draft bill?
The bill is expected to follow the OECD model rules, capturing entities that facilitate crypto exchanges, transfers, or initial offerings as a business with an Australian nexus. Centralised exchanges, brokers, ATM operators, and some DeFi platforms with an identifiable controlling person are likely in scope. The final definitions will be confirmed once the bill is enacted.
What data will reporting entities need to submit to the ATO?
Based on the OECD CARF model, reportable data includes user identification details (name, address, tax identification number, jurisdiction of residence), the type and quantity of crypto assets transacted, and the gross proceeds or fair market value of each transaction. Transfers to and from the platform also fall within the reporting perimeter.
How does CARF interact with Australia's existing AML/CTF obligations?
CARF and AML/CTF obligations share a common foundation in customer identification, but they are separate regimes with different purposes and different regulators. AML/CTF compliance is supervised by AUSTRAC and focuses on preventing financial crime. CARF reporting is administered by the ATO and focuses on tax compliance. A platform that is already collecting TFNs and verifying customer identity for AML purposes is better positioned for CARF compliance, but the data formats, submission processes, and due diligence standards differ and will need to be addressed separately.
Will foreign-resident users of Australian crypto platforms be affected?
Yes. One of the two limbs of the bill specifically enables the ATO to share data about foreign-resident users with their home tax authorities under the CARF automatic exchange mechanism. Foreign residents using Australian platforms should expect their home tax authority to receive transaction-level data from 2028, consistent with the reciprocal obligations of all 77 CARF-committed jurisdictions.
Source: Cointelegraph