Anyone who holds crypto on a platform in Dubai, Singapore or Hong Kong should expect a new question in the coming weeks: where are you resident for tax, and what is your tax number? From 1 January 2027, platforms in all three places are scheduled to apply the OECD's Crypto-Asset Reporting Framework, or CARF. They will collect that information from every customer, report it to their local tax authority, and the authority will pass it on to the customer's country of residence from 2028.
The Brief wrote about the framework's purpose in 2025, in the endgame behind global transparency laws. What has changed since is that the rules have become dates, forms and deadlines. The UAE's Ministry of Finance published a readiness circular in October 2026, Singapore has enacted its regulations, and Hong Kong has its bill before the Legislative Council.
Who is in, and when
The OECD's Global Forum keeps the official list. Its latest version, updated 14 September 2026, sorts jurisdictions into three waves:
- First exchanges by 2027 (46 jurisdictions), including Japan, Korea, Indonesia, New Zealand, Kazakhstan, South Africa, Uganda, the Cayman Islands, the United Kingdom, Brazil and every EU member state except Cyprus, which is in the 2028 wave.
- First exchanges by 2028 (27 jurisdictions), including the United Arab Emirates, Bahrain, Singapore, Hong Kong, Australia, Canada, Israel, Kenya, Malaysia, Mauritius, Mongolia, Nigeria, the Philippines, Seychelles, Switzerland, Thailand and Türkiye.
- First exchanges by 2029 (4): Argentina, Azerbaijan, Mexico and the United States.
The Global Forum lists only four relevant jurisdictions as not yet committed: El Salvador, Georgia, India and Viet Nam, with a note that India is in the process of committing.
The pattern is that information collected during one calendar year is exchanged the following year. That is why the 2028 wave matters now: for the UAE, Singapore and Hong Kong, the collecting starts on 1 January 2027.
What a platform will collect from you
The core of CARF is the self-certification: a statement by the customer of every jurisdiction where they are resident for tax, with the tax identification number for each. Singapore's regulations, which reproduce the OECD text in full in their Schedule, require the platform to obtain it:
- for new customers, when the relationship is established;
- for existing customers, within 12 months after the rules take effect.
The platform must also confirm that the self-certification is reasonable, based on what it already knows from its anti-money-laundering checks. A customer who declares residence in one country while every address, phone number and bank account points to another should expect questions.
The answer is not given once and forgotten. Under the framework, if a change of circumstances gives the platform reason to know that a self-certification is wrong or unreliable, it can no longer rely on it. It must obtain a new self-certification, or a reasonable explanation with supporting documents where appropriate. A customer who moves from Singapore to Dubai in the middle of 2027, updates their address and keeps the old tax residence on file is exactly the case the rule is written for. In practice, that means the self-certification should be updated at the same time as the address, not when the platform asks.
Singapore's regulation 11 adds a detail worth knowing: the platform must establish all of a customer's tax residences, even where the customer's country is not one Singapore reports to. In other words, the question is asked of everyone.
What gets reported
Under Section II of the framework, for each customer who is resident in a reportable jurisdiction, the platform reports:
- name, address, jurisdiction(s) of residence, TIN(s) and date of birth, and place of birth only where domestic law already requires it;
- for each type of crypto-asset, the aggregate amounts, units and number of transactions for purchases and sales against fiat currency;
- the aggregate fair market value, units and number of transactions for exchanges between crypto-assets;
- retail payment transactions, meaning transfers in payment for goods or services worth more than USD 50,000;
- transfers in and out of the customer's account, broken down by type where known;
- transfers to wallet addresses not known to belong to a crypto service provider or financial institution, in aggregate value and units.
The last item is the one that surprises people. Moving coins from a platform to your own wallet does not make them disappear from view. The withdrawal itself is reported.
What is excluded is narrow: central bank digital currencies, certain regulated electronic money products pegged to a single currency, and crypto-assets that the platform has determined cannot be used for payment or investment.
The UAE: dates set by the Ministry of Finance
The UAE has moved in clear steps. According to the Ministry of Finance, it signed the CARF multilateral agreement on 21 July 2025. It consulted on domestic implementation from 15 September to 8 November 2025. The Cabinet approved ratification on 29 March 2026, and the agreement was ratified by Federal Decree No. 60 of 2026 on 4 May 2026.
The Ministry's readiness circular then sets out the timetable:
| Date | Milestone |
|---|---|
| By 31 December 2026 | Platforms complete operational preparations |
| 1 January 2027 | Target effective date of the Cabinet Decision and Ministerial Decisions implementing CARF; due diligence starts for new customers |
| During 2027 | Platforms register on the Ministry's reporting system (deadline to be confirmed) |
| By 31 December 2027 | Valid self-certification obtained for every existing customer |
| 30 June 2028 | First annual CARF report, or nil return, for 2027 |
| 1 September 2028 | First automatic exchange of information |
The circular describes this as the current implementation timeline, and the implementing Cabinet and Ministerial Decisions are still to come. The direction, though, is fixed by a ratified treaty.
Singapore: already law
Singapore is further along. Its Income Tax (International Tax Compliance Agreements) (Crypto-Asset Reporting Framework) Regulations 2026 were published in the Government Gazette on 11 August 2026 as S 551/2026 and come into operation on 1 January 2027.
A platform falls under the regulations if it is tax resident in Singapore, incorporated there, managed from there, has a regular place of business there, or acts through a Singapore branch. It must file a return with the tax authority for calendar year 2027 and every following year, by 31 May of the next year. Singapore appears in the OECD's 2028 wave, so the first exchange of that data follows in 2028.
The same date brings Singapore's amended Common Reporting Standard for bank and investment accounts, which the Brief covered in Singapore offshore banking from 2027. From 2027, a customer with both a bank account and a crypto account in Singapore will give two self-certifications, and they had better match.
Hong Kong: a bill with the same start date
Hong Kong's Inland Revenue Department states that the Inland Revenue (Amendment) (Crypto-Asset Reporting Framework and Amended Common Reporting Standard) Bill 2026 was gazetted on 22 May 2026 and introduced into the Legislative Council on 3 June 2026. According to the IRD, CARF obligations will apply from 1 January 2027, and the amended CRS from 1 January 2028, both subject to the passage of the bill.
The IRD's outline follows the same structure: platforms register by 31 January of the year after they first fall within the rules, new customers self-certify on onboarding, existing customers within 12 months, and Hong Kong starts exchanging crypto information in 2028.
What this means for a customer
Five practical points follow.
Answer the question accurately. The self-certification is a statement you sign. Declaring a residence that you cannot support with facts is worse than useless: the platform must test it for reasonableness, and the receiving tax authority may test it again.
Expect it more than once. Every platform you use will ask. Banks already ask the same question under the CRS, as the Brief explained in opening a bank account abroad. The answers should be the same everywhere.
Self-custody is not invisible. Withdrawals to private wallets are reported in aggregate. What happens afterwards on-chain is outside CARF, but the exit from the platform is not.
A report is not a tax bill. CARF moves information. Whether anything is owed depends on the tax law of the country receiving it. A genuine resident of a country that does not tax the gains will see little practical change. Someone who lives in Dubai on paper while remaining resident somewhere else under that country's own tests will find the information arriving where it matters. The UAE's tax picture for residents is on the Dubai and UAE country page, and the Brief's essay on why the tax-free Gulf is a policy, not a promise explains why even that picture is not permanent.
Geography buys only time. The United States joins in 2029. The handful of jurisdictions that have not committed are small and shrinking. Moving a portfolio to stay ahead of CARF is a plan with a short shelf life.
The shape of things
The Common Reporting Standard brought bank accounts into automatic exchange years ago. CARF does the same for crypto platforms, on almost the same template, and the main Asian and Gulf hubs join in 2027. For anyone whose residence position is sound, it is paperwork. For anyone whose position relies on nobody comparing notes, 1 January 2027 is the date that stops being true.
Work with Sebastian
If you hold crypto through platforms in the Gulf or Asia and want your residence, your self-certifications and your home-country position to tell the same story before reporting starts, that is the kind of cross-border planning Sebastian works on with internationally mobile clients. Book a consultation.
