Crypto-Asset Reporting Framework (CARF) in the Cayman Islands

Cayman CARF reporting applies to Reporting Crypto-Asset Service Providers with a Cayman nexus. Since 1 January 2026, they must register with the Tax Information Authority, collect self-certifications from users, keep written due diligence procedures and file an annual return or nil return through the DITC portal by 30 June after each calendar year. Funds that only trade for their own account are generally users, not reporters.

Key takeaways

• The Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (SL 51 of 2025) came into force on 1 January 2026.
• The Regulations apply to a Cayman Reporting Crypto-Asset Service Provider: one resident in the Islands, or a Cayman branch of a non-resident provider.
• Each provider must register, appoint a principal point of contact in the Islands, notify changes within 30 days and file a return, or a nil return, by 30 June of the following year.
• Pre-existing users had to give self-certifications within twelve months of commencement; new users must do so on or before the relationship starts.
• Directors and similar officers can be liable for offences committed by the entity unless they show reasonable diligence to prevent the contravention.

What CARF is and why the Cayman Islands adopted it

The Crypto-Asset Reporting Framework is a standard developed by the Organisation for Economic Co-operation and Development for the automatic exchange of tax information about crypto-asset transactions. It sits beside the Common Reporting Standard, which has applied in the Cayman Islands since 2016, and closes the gap left by assets that do not pass through traditional financial accounts.

The Cayman Islands implemented CARF through regulations made by Cabinet under section 25 of the Tax Information Authority Act (2021 Revision). The CARF Regulations and the companion Tax Information Authority (International Tax Compliance) (Common Reporting Standard) (Amendment) Regulations, 2025 (SL 50 of 2025) were published in the Legislation Gazette on 27 November 2025. The Government has stated that entities in scope complete their first reporting cycle in 2027, submitting 2026 information to the Department for International Tax Cooperation, the body that performs the functions of the Tax Information Authority.

The amended CRS rules are relevant to the same businesses. According to the Government's announcement, they bring certain electronic money products and central bank digital currencies within CRS and capture indirect crypto-asset exposure through derivatives and investment vehicles. Managers already handling FATCA classification and reporting for a Cayman vehicle should expect CRS and CARF questions to arise together.

Who is a Reporting Crypto-Asset Service Provider

The framework defines a Reporting Crypto-Asset Service Provider as any individual or entity that, as a business, provides a service effectuating exchange transactions for or on behalf of customers. That includes acting as a counterparty or intermediary to those transactions, or making available a trading platform. Exchange transactions are exchanges between relevant crypto-assets and fiat currencies, and exchanges between one or more forms of relevant crypto-assets.

The Cayman nexus

A provider is a Cayman Reporting Crypto-Asset Service Provider if it is resident in the Islands, other than its branches outside the Islands, or if it is a Cayman branch of a provider resident elsewhere. The Regulations treat a provider as resident in the Islands if it is incorporated, registered or established in the Islands, has its place of effective management in the Islands, or is subject to financial supervision in the Islands. The schedule also contains relief where the same obligations are completed in a partner jurisdiction under a substantially similar nexus.

What counts as a relevant crypto-asset

A crypto-asset is a digital representation of value that relies on a cryptographically secured distributed ledger or similar technology. A relevant crypto-asset excludes central bank digital currencies, specified electronic money products and any crypto-asset that the provider has adequately determined cannot be used for payment or investment purposes. The Government's announcement describes the scope as covering payment tokens, including stablecoins, utility tokens, certain non-fungible tokens and security tokens.

Where funds and token projects sit

Classification turns on the definition, not the label. A Cayman fund that buys and sells digital assets for its own account through third-party venues is, on the definition alone, a customer of those venues rather than a provider of exchange services to customers. A Cayman entity that operates a trading platform, brokers trades for clients or acts as counterparty to customer exchanges is likely to be in scope. Businesses registered or licensed under the virtual asset regime, described in our guide to Cayman VASP registration and licensing, should review CARF status as part of the same exercise, because the two regimes use different tests.

Registration and the principal point of contact

Regulation 8 requires a registration form stating the provider's name and any number issued by the General Registry, CIMA or another supervisor; the name, address, position and contact details of a person in the Islands authorised as principal point of contact; details of a further person authorised to give change notices for that contact, except where the Authority specifies otherwise; and the date on which the entity became a Reporting Crypto-Asset Service Provider.

• A provider already in scope before commencement had to register on or before the date in regulation 8(1). The DITC can adjust timing by industry advisory, so the date that currently applies should be confirmed on the DITC CARF pages before relying on it.
• A provider that comes into scope on or after 1 January 2026 must register by 31 January following the year in which it came into scope.
• Any change to the registered information must be notified within thirty days of the change.

Registration and change notices are given electronically in the manner the Authority posts on its official website. The principal point of contact is a named person in the Islands, so the board should decide early who holds the role and how instructions reach them.

Due diligence and self-certification

Every Cayman Reporting Crypto-Asset Service Provider must establish, implement and comply with written policies and procedures covering the reporting and due diligence requirements, including identification of each jurisdiction in which a user or controlling person is resident for tax purposes. It must keep records of the steps taken and the evidence relied on.

Self-certifications follow paragraph C of Section III of the framework. For pre-existing individual and entity users, meaning relationships established as of 31 December 2025, the Regulations allowed twelve months from commencement. For users onboarded after commencement, the self-certification must be obtained on or before the relationship is established. Giving a self-certification that is false in a material particular is an offence under regulation 14, whether or not the person knew it was false.

The CARF due diligence sits alongside the AML customer due diligence the business already performs. Our article on AML obligations for relevant financial business covers the separate identification rules; CARF adds tax residence and taxpayer identification.

What is reported, and when

For each user who is a reportable user, or an entity with controlling persons who are reportable persons, the return covers identity details (name, address, jurisdiction of residence, taxpayer identification number and, for individuals, date and place of birth where required) and, for each type of relevant crypto-asset, aggregate figures for:

• acquisitions and disposals against fiat currency;
• acquisitions and disposals against other relevant crypto-assets;
• reportable retail payment transactions;
• transfers to and by the user, subdivided by transfer type where known; and
• transfers to wallet addresses not known to be associated with a virtual asset service provider or financial institution.

Under regulation 9, the return, or a nil return where there were no reportable users or controlling persons, is due on or before 30 June of the year following the calendar year to which it relates, with a declaration that the information is adequate, accurate and current. Returns are submitted through the Authority's electronic portal. The DITC also maintains the CARF Legislation and Resources and Press Room pages on ditc.ky, which carry guidelines, reportable jurisdiction lists and advisories.

Records, agents and enforcement

Records relating to reportable information must be kept for not less than six years, and the Authority may require production or inspection, including bringing records held outside the Islands into the Islands. A provider may appoint an agent to carry out its CARF duties but remains responsible for the agent's failures, and reliance on an agent is not a reasonable excuse for an offence.

Part 4 gives the Authority power to impose primary penalties and daily continuing penalties, subject to a breach notice process that allows at least thirty days for representations. For failures to submit returns under regulation 9, the Authority may proceed directly by penalty notice. Regulation 20 attributes offences committed by an entity to its directors, managers and similar officers, which is why boards of in-scope entities should see the CARF procedures and the annual filing confirmation. The board's wider oversight role is covered in our note on crypto fund governance priorities for independent boards.

Frequently asked questions

Does a Cayman crypto fund have to register under CARF?

Not because it holds crypto-assets. Registration follows from providing a service effectuating exchange transactions for customers as a business. A fund trading for its own account is ordinarily a crypto-asset user of its trading venues. Its CRS position should still be reviewed under the amended CRS rules.

When is the first Cayman CARF return due?

Returns cover a calendar year and are due by 30 June of the following year. The Government has stated that the first reporting cycle is in 2027, covering 2026 information.

Is a nil return required?

Yes. Regulation 9 requires a nil return where the provider had no reportable users and no controlling persons who are reportable persons in any reportable jurisdiction during the year.

Who can be the principal point of contact?

The Regulations require a person in the Islands authorised by the provider to be the principal point of contact for compliance. The registration form records that person's name, address, business entity where applicable, position and contact details.

Are investors taxed differently because of CARF?

CARF is an information exchange standard and does not itself impose tax. Users and controlling persons may be taxed in their own jurisdictions, and the information exchanged supports those jurisdictions' tax administration.

Where Bell Rock fits

Bell Rock Group Financial Services Limited is licensed by the Cayman Islands Monetary Authority as a Company Manager under the Companies Management Act (As Revised), Licence No. 633916. Through its Cayman FATCA and CRS service, Bell Rock coordinates CARF classification reviews, DITC portal registration, principal point of contact arrangements and the annual filing calendar for Cayman entities. Any director appointed through Bell Rock acts in a personal capacity.

Related reading

• Setting up a Cayman crypto and blockchain fund
• Asset tokenisation: structuring and governance
• CIMA fund governance guidance: board responsibilities
• Digital Asset Custody for Cayman Funds: What Boards and CIMA Expect
• Cayman VASP Application: Scope, Registration or Licence and Steps
• Tokenised Fund Structures in the Cayman Islands

Bell Rock coordinates automatic exchange of information filings through its Cayman FATCA and CRS service.