CARF in the Cayman Islands – What you need to know

New regulations have been adopted in the Cayman Islands to implement the OECD's Crypto-Asset Reporting Framework from 1 January 2026. This update provides a quick guide to what this will mean for Cayman Islands virtual asset service providers.

Background

Investments and transactions in crypto will, in most instances, not fall under the OECD's Common Reporting Standard (the CRS), potentially eroding the existing global tax transparency frameworks. To address this gap in reporting obligations, the OECD published the Crypto-Asset Reporting Framework (CARF) legislation and commentary in July 2023, as well as amendments to the CRS, known as 'CRS 2.0', both of which will be implemented via Cayman Islands domestic legislation from 1 January 2026.¹

What will CARF look like in the Cayman Islands?

New regulations

Following the approach it took in implementing the CRS and other automatic exchange of information (AEOI) frameworks, the Cayman Islands has adopted new secondary legislation implementing CARF in the form of regulations.

However, whilst the CRS covers traditional financial assets such as money, securities and other financial products, the CARF is concerned with Crypto-Assets². Crypto-Assets are distinguishable from traditional financial assets as they rely on cryptography and distributed ledger technology, particularly blockchain technology, to be issued, recorded, transferred and stored.

Timing

The Tax Information Authority (International Tax Compliance) (Crypto-Asset Reporting Framework) Regulations, 2025 (the CARF Regulations) were gazetted on 27 November 2025 and will take effect on 1 January 2026. This will mean that in-scope entities will need to start collecting the required information under CARF in the 2026 calendar year (ie, from 1 January 2026), to submit reporting for that period before the stated deadline in 2027.

Further references in this Update to 'CARF' are references to CARF as implemented in the Cayman Islands by the CARF Regulations.

Who and what will CARF apply to?

Cayman RCASPs

CARF will apply to Cayman Reporting Crypto-Asset Service Providers (Cayman RCASPs) which include Reporting Crypto-Asset Service Providers resident in the Cayman Islands; ie, which:

• are incorporated, registered or established in the Cayman Islands;
• have a place of effective management in the Cayman Islands; or
• are subject to financial supervision in the Cayman Islands,

and Cayman Islands branches of Reporting Crypto-Asset Service Providers not resident in the Cayman Islands.

A Reporting Crypto-Asset Service Provider includes any individual or entity that, as a business, provides a service effectuating Exchange Transactions (see below) for and on behalf of customers, including by acting as a counterparty or intermediary to such transactions, or by making an exchange platform available.

The OECD's Commentary on CARF³ provides that the phrase 'as a business' excludes individuals or entities who carry out a service on a very infrequent basis for non-commercial reasons.

Applicable transactions

A Cayman RCASP must report on Relevant Transactions, which include 'Exchange Transactions' and 'Transfers'.

Exchange Transaction means any: (a) exchange between 'Relevant Crypto-Assets' (as defined below) and fiat currencies;⁴ and (b) exchange between one or more Relevant Crypto-Assets.

A service effectuating Exchange Transactions therefore includes any service through which a customer may receive Relevant Crypto-Assets for fiat currencies (or vice versa), or through which a customer may exchange Relevant Crypto-Assets for other Relevant Crypto-Assets. An 'exchange' also includes the movement of a Relevant Crypto-Asset from one wallet address to another, in consideration of another Relevant Crypto-Asset or fiat currency.

Crypto trading platforms (including any software program or application which allows users to effectuate Exchange Transactions) are clearly within-scope of CARF. Other examples of in-scope services include the following:

• Crypto-Asset exchanges that act as market-makers and take a bid-ask spread as a transaction fee for their services;
• brokers effecting orders/instructions from customers to buy or sell an interest in Relevant Crypto-Assets; and
• persons subscribing for Crypto-Assets for resale or onward distribution.

The creation and issuance of a token constituting a Relevant Crypto-Asset, in and of itself, would not be considered in-scope of CARF.

Transfer means a transaction that moves a Relevant Crypto-Asset from or to the Crypto-Asset address or account of one user (other than an address maintained by the Cayman RCASP on behalf of the same customer) where the Cayman RCASP cannot determine that the transaction is an Exchange Transaction.

Transfers also include:

• a user receiving an airdrop of a newly issued Crypto-Asset, including the receipt of newly issued Crypto-Assets in connection with a hard fork;
• a retail transaction involving a transfer of Relevant Crypto-Assets in consideration of goods or services for a value exceeding USD50,000;
• loans of Crypto-Assets; and
• income derived from staking Crypto-Assets.

Carve-out for investment funds

The OECD's Commentary provides that the activities of an investment fund investing in Relevant Crypto-Assets do not constitute a service effectuating Exchange Transactions, since such activities do not permit the fund's investors to effectuate Exchange Transactions.

Relevant Crypto-Assets

Relevant Crypto-Assets are Crypto-Assets in respect of which Cayman RCASPs must fulfil reporting and due diligence requirements.

Relevant Crypto-Assets means any Crypto-Asset which is not:

• a Central Bank Digital Currency (ie, any digital fiat currency issued by a Central Bank);
• a Specified Electronic Money Product, being any product which is:
  • a digital representation of a single fiat currency;
  • issued on receipt of funds for the purpose of making payment transactions;
  • represented by a claim on the issuer denominated in the same fiat currency;
  • accepted in payment by a natural or legal person other than the issuer; or
  • by virtue of regulatory requirements to which the issuer is subject, redeemable at any time upon the holder's request at par value for the same fiat currency; or
• any Crypto-Asset that the Cayman RCASP has adequately determined cannot be used for payment or investment purposes.

The OECD considers that Central Bank Digital Currencies and Specified Electronic Money Products can be considered functionally similar to, and entail similar tax compliance concerns to, traditional bank accounts. Accordingly, to ensure consistent reporting outcomes, the Cayman Islands CRS Regulations⁵ have been amended to implement CRS 2.0 with effect from 1 January 2026, to cover Central Bank Digital Currencies and Specified Electronic Money Products.

What are the key obligations of a Cayman RCASP under CARF?

Registration and appointments

Cayman RCASPs in existence on the date of commencement of the Cayman Islands CARF legislation (ie, 1 January 2026) must register with the Tax Information Authority (the TIA) in the prescribed form on or before 30 April 2026. A person which becomes a Cayman RCASP on or after 1 January 2026 must register with the TIA on or before 31 January in the year following the year in which the relevant person became a Cayman RCASP.

Registration will require the provision of certain information to the TIA, including:

• the name, address and any number given to the Cayman RCASP by the General Registry, the Cayman Islands Monetary Authority or any other Cayman Islands regulatory or supervisory body;
• the full name, address, position and contact details of:
  • a person in the Cayman Islands authorised to be the Cayman RCASP's principal point of contact (PPoC); and
  • another person authorised to submit change notices with respect to the PPoC; and
• the date on which the person became a Cayman RCASP.

If any required information changes, the Cayman RCASP is required to file a change notice with the TIA within 30 days of the change occurring.

Policies and procedures

A Cayman RCASP must:

• establish, maintain, implement and comply with written policies and procedures complying with the due diligence and reporting obligations under CARF; and
• keep records of steps taken and evidence relied upon to perform those procedures.

Due diligence

Cayman RCSAPs must obtain a self-certification from each individual or entity Crypto-Asset User. The self-certification must be obtained at the time of establishing the relationship or, in relation to pre-existing relationships, within 12 months of the CARF Regulations taking effect.

A self-certification must:

• provide the required information regarding the relevant Crypto-Asset User;
• be signed or otherwise positively affirmed and dated;
• enable the Cayman RCASP to determine the Crypto-Asset User's residence(s) for tax purposes; and
• for entity Crypto-Asset Users, enable the Cayman RCASP to determine whether the Crypto-Asset User has Controlling Persons that are Reportable Persons.

In addition, the Cayman RCASP, or its service provider, must be able to confirm that the information provided in the self-certification is reasonable based upon the certification or the information in their possession (including information collected for AML/KYC purposes).

If a Cayman RCASP becomes aware, or has reason to know, that a self-certification is incorrect or unreliable, then that certification cannot be relied upon and the Cayman RCASP must obtain an updated or valid self-certification or, where applicable, an explanation and supporting documentation.

Crypto-Asset Users and Reportable Users

A Crypto-Asset User is an individual or entity that is a customer of a Cayman RCASP for the purposes of carrying out relevant transactions (ie, Exchange Transactions or transfers of Relevant Crypto-Assets), including any 'user' of the Cayman RCASP's services, irrespective of whether the Cayman RCASP conducts safekeeping/custody activities or the legal characterisation of the relationship.

The CARF Commentary provides that RCASPs must look through relationships where an individual or entity is using the service for the benefit or account of another individual or entity, whether as agent, custodian, nominee, signatory, investment advisor or intermediary. In such cases (other than where the user is itself an RCASP or a financial institution), the RCASP must treat the underlying individual or entity as the Crypto-Asset User.

A Crypto-Asset User will be a Reportable User if they are resident for tax purposes in a reportable jurisdiction and are not an Excluded Person.⁶ The TIA is yet to publish a list of reportable jurisdictions for the purposes of CARF.

Reporting

A Cayman RCASP must submit to the TIA in respect of each calendar year (commencing with the 2026 calendar year):

• a return of the Crypto-Asset Users that are Reportable Users under CARF or, where applicable, the Controlling Persons of such Users which are Reportable Persons;
• a nil return, if there were no Reportable Users or are Reportable Persons; and/or
• if the Cayman RCASP submitted a return in a partner jurisdiction, a return advising the TIA of that fact.

The annual deadline for submission of CARF reporting is 30 June in the year following the calendar year to which the report relates, with penalties for non-compliance. Accordingly, the first return relating to Reportable Users under CARF for the 2026 calendar year must be submitted to the TIA on or before 30 June 2027.

Information contained within the return made to the TIA must be adequate, accurate and current, with accurate defined as meaning correct and reliable, and adequate meaning (in essence) that all details/information specified in the applicable provision of the CARF Regulations have been provided.

The information required to be reported to the TIA in a return will include:

• information regarding each Reportable User and Controlling Person that is a Reportable Person, including their name, address, jurisdiction(s) of residence, tax identification number(s) (TINs), their date and place of birth and whether a valid self-certification has been provided by that person; and
• information regarding each type of Relevant Crypto-Asset which is the subject of Relevant Transactions during the reporting period, including details of the nature and value of the assets and transactions conducted.

A nil return must be filed if the Cayman RCASP did not have any:

• Crypto-Asset Users that are Reportable Users; or
• Controlling Persons that are Reportable Persons,

in any reportable jurisdiction during the year.

There are provisions within CARF aimed at avoiding duplicative reporting, meaning that certain Cayman RCASPS may not need to comply with the Cayman Islands reporting and due diligence obligations where those obligations are completed by the Cayman RCASP in a 'partner jurisdiction'. The TIA will be required to publish a list of partner jurisdictions and reportable jurisdictions for CARF at least once a year.

Record retention

Books, documents and other records (including electronic records) relating to information required to be reported under CARF must be maintained for at least six years.

Service providers

Cayman RCASPs may engage service providers to assist with their obligations under the CARF Regulations. However, the obligations will remain the responsibility of the Cayman RCASP notwithstanding any reliance on a third-party service provider.

Penalties and enforcement

The CARF Regulations contain numerous offences, including:

• providing false self-certifications;
• contravening Part 2 of the CARF Regulations, which includes the obligations on Cayman RCASPs to register, conduct due diligence, report and comply with requests made by the TIA; and
• hindering the TIA's performance of its obligations.

Offences under the CARF Regulations may give rise to liability for a maximum fine of US$60,976 and daily default penalties for continued non-compliance may be applied in certain circumstances. The regulations set out the process for imposing fines and any appeal.

As with the regulations implementing the CRS in the Cayman Islands, the CARF Regulations provide that, where an offence is committed by an entity, the directors, managers, secretaries, members (if the entity is a limited liability company), partners or trustee (as applicable) also commit the same offence and are liable to the same penalty, unless they can provide that reasonable diligence was exercised to prevent the offence.

How can you prepare?

• Determine if you will be a Cayman RCASP under the CARF Regulations and, if so, allocate resources and adopt appropriate policies and procedures, including as to training, to ensure compliance.
• Monitor the OECD website to keep track of which jurisdictions are implementing CARF, and when. This will determine the scope of an RCASP's Reportable Users on an ongoing basis.
• Monitor the TIA's website to keep abreast of ongoing developments within the Cayman Islands.

Next steps

Mourant has dedicated teams of legal and governance services professionals who can help you with understanding your obligations under CARF. Please reach out to your usual contact or one of the contacts named below for more information.

¹ See out Update for more information on CRS 2.0.

² Crypto-Asset under CARF means 'a digital representation of value that relies on a cryptographically secured distributed ledger or a similar technology to validate and secure transactions'.

³ See the OECD's website here.

⁴ Fiat currency under CARF means 'the official currency of a jurisdiction …. as represented by physical banknotes or coins or by money in different digital forms, including bank reserves and Central Bank Digital Currencies. The term also includes commercial bank money and electronic money products (including Specified Electronic Money Products)'.

⁵ The Tax Information Authority (International Tax Compliance) (Common Reporting Standard) Regulations (2021 Revision), as amended by the Tax Information Authority (International Tax Compliance) (Common Reporting Standard) (Amendment) Regulations, 2025.

⁶ An excluded person includes (a) an entity which is publicly traded on an established securities market (or a related entity thereto), (b) a governmental entity, (c) an international organization, (d) a central bank or (e) a financial institution other than a managed investment entity (eg, an investment fund).