Commentary on the Cryptoasset Reporting Framework (CARF) draft regulations

Bitcoin Policy UK published this commentary on the UK government's draft Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025, which implement the OECD's Cryptoasset Reporting Framework (CARF). CARF requires cryptoasset service providers to carry out due diligence on their customers and report their transactions to tax authorities, who may share the information internationally. The commentary focuses on two areas: the scope of the rules and the risks to privacy and personal safety. On scope, it asks for clear wording, similar to that in the EU's anti-money laundering rules, confirming that open source software such as Bitcoin Core and the developers of self-hosted wallet software are not covered by the reporting obligations.

On privacy, it warns that the names, home addresses and dates of birth collected under CARF, combined with wallet address data gathered under the FATF Travel Rule, could be cross-referenced after a hack or data leak to show where holders live and how much they hold, exposing them and their families to physical harm. It suggests limiting reporting to users whose disposals exceed a material threshold, keeping the data for a shorter period, setting appropriate de minimis levels and not sharing real names and addresses in plain text. It concludes that these privacy and safety risks outweigh the compliance benefits.