Global Crypto Tax Reporting and AML Compliance Scrutiny Intensifies as UAE Prepares for CARF

{getToc}$title={Table of Contents}

UAE crypto firms face CARF reporting from 2027 and tighter VARA AML rules as 76 jurisdictions join the global tax transparency net.

The OECD's Crypto-Asset Reporting Framework now has commitments from 76 jurisdictions, with the first automatic exchanges of crypto transaction data due between 2027 and 2028.
The UAE signed the CARF Multilateral Competent Authority Agreement in July 2025 and ran a public consultation on domestic implementation through November 2025.
VARA released strict 2026 AML guidance on 12 June requiring three-month risk review cycles, FATF blacklist integration and formal documentation of AI-related risks.
Federal Law No. 10 of 2025, effective from October 2025, overhauls the UAE's AML regime with updated offences, broader powers and higher penalties for non-compliance.
The FATF's June 2025 targeted update flagged uneven Travel Rule adoption globally and called for stronger oversight of stablecoins and decentralised finance.
Chainalysis estimates the UAE received more than USD 56 billion in on-chain value in the 2024-2025 reporting window, a 33 per cent increase year-on-year.

A Convergence of Global Tax Transparency and UAE Virtual Asset Oversight

The global regulatory landscape for crypto-asset taxation and anti-money laundering compliance has shifted decisively in 2025-2026. The OECD's Crypto-Asset Reporting Framework, combined with tightened FATF virtual asset standards and the UAE's own legislative reforms under Federal Law No. 10 of 2025, is creating a multi-layered compliance environment that touches every licensed virtual asset service provider in the country.

For UAE-based crypto businesses and their advisors, this convergence carries practical weight. VARA AML compliance expectations are rising and the UAE Financial Intelligence Unit is receiving a growing volume of suspicious reports linked to virtual assets. At the same time, the Ministry of Finance has committed the country to automatic cross-border information exchange by 2028.

CARF Moves from Framework to Deadline as 76 Jurisdictions Commit

The OECD's Crypto-Asset Reporting Framework has advanced from a G20-endorsed concept to a concrete implementation programme. By early 2026, 76 Global Forum members had announced their intention to commence exchanges, up from 67 formal commitments recorded in May 2025. CARF requires trading platforms, brokers and custodians to collect identifying information on account holders, verify beneficial owners and report transaction data covering acquisitions, disposals and wallet-to-wallet transfers.

Jurisdictions fall into two implementation waves. The first - including the United Kingdom, Germany, France, Canada, Japan and Switzerland - targets first exchanges by 2027, with data collection starting from 1 January 2026. A second wave, which includes the UAE, the United States, Singapore and Hong Kong, has committed to first exchanges by 2028. Several major markets, including Australia, India and Argentina, have not yet formally committed.

CARF does not replace the Common Reporting Standard but extends it into crypto-specific territory. The OECD has encouraged jurisdictions to integrate CARF within existing CRS infrastructure, enabling tax authorities to cross-reference crypto-asset holdings with traditional financial accounts for improved detection of undeclared gains.

UAE Signs CARF Agreement and Tightens AML Rules for Crypto

The UAE Ministry of Finance signed the CARF Multilateral Competent Authority Agreement on 21 July 2025, according to PwC analysis. A public consultation ran from 15 September to 8 November 2025, inviting feedback from advisory firms, exchanges, custodians and technology providers. The focus was on how CARF should interact with existing licensing frameworks under VARA, ADGM FSRA and the Capital Market Authority.

In parallel, the UAE enacted Federal Law No. 10 of 2025, Concerning Combating Money Laundering, Terrorism Financing, and the Financing of Proliferation. Effective from 14 October 2025, the law replaces Federal Decree-Law No. 20 of 2018 with updated offence definitions, broader investigative powers and enhanced asset-freezing provisions. For VASPs, this federal baseline operates alongside VARA's rulebook, CBUAE guidance and ADGM FSRA rules, meaning a single compliance failure can trigger exposure under multiple regimes.

On 12 June 2026, VARA released updated AML/CFT guidance mandating three-month risk review cycles for licensed VASPs. Firms must integrate FATF high-risk jurisdictions into real-time risk scoring, formally document AI-related threats, and account for anonymity-enhanced transactions. Personal liability now extends to senior management, board members and Money Laundering Reporting Officers. VARA's enforcement record shows multiple cease-and-desist orders and financial penalties against unlicensed operators since 2025, with a notice of fines dated 21 June 2026 confirming continued action.

Global AML Pressure Builds Around Travel Rule and Stablecoins

The FATF's sixth targeted update on virtual assets, published 26 June 2025, flagged uneven Travel Rule adoption as a persistent weakness. Many jurisdictions have yet to apply wire transfer traceability standards to virtual asset transfers in practice. The update also identified emerging risks from stablecoins and decentralised finance, where identifying responsible parties remains difficult. Accompanying Best Practices on Travel Rule Supervision offered practical guidance for regulators.

Within the UAE, the NAMLCFTC issued Decision No. 25 of 2026 on the Virtual Assets Travel Rule, establishing a coordinated approach to ensuring originator and beneficiary information accompanies transfers. The UAE Financial Intelligence Unit's December 2025 report disclosed 512 suspicious reports related to virtual assets between July 2021 and June 2025. As more VASPs enter the regulated perimeter, reporting volumes are expected to climb. Chainalysis estimates the UAE received more than USD 56 billion in on-chain value during the 2024-2025 reporting window, a 33 per cent increase year-on-year.

Practical Steps for Crypto Compliance and Advisory Teams

Firms operating under VARA licences should review their risk assessment frameworks against the three-month review cycle mandated in the June 2026 guidance. FATF blacklist integration, AI risk documentation and anonymity-enhanced transaction monitoring must be embedded in day-to-day operations rather than treated as periodic exercises.

Advisory firms serving crypto clients face equally pressing obligations. Tax advisors must begin factoring CARF reporting into cross-border structuring advice, particularly for clients holding crypto assets across multiple jurisdictions. With the UAE's first CARF data collection due from January 2027, the preparation window is narrowing. Grant Thornton's 2026 analysis notes that authorities are expanding AML, sanctions and tax reporting frameworks simultaneously, meaning compliance functions must treat these as interconnected obligations rather than separate workstreams.

What Clients are Asking their Advisors

When does CARF crypto reporting start in the UAE?

The UAE has committed to begin collecting crypto-asset data from reporting providers in respect of calendar year 2027, with the first automatic exchanges of information between tax authorities expected by 2028. The Ministry of Finance signed the CARF Multilateral Competent Authority Agreement in July 2025 and ran a public consultation on implementation through November 2025.

Which UAE regulators enforce AML rules for crypto businesses?

Multiple regulators share responsibility. VARA oversees virtual asset service providers in Dubai, the ADGM FSRA regulates digital asset firms in Abu Dhabi, and the CBUAE supervises licensed financial institutions including banks that interact with crypto businesses. The UAE Financial Intelligence Unit receives and analyses suspicious transaction reports, while the NAMLCFTC coordinates national AML policy, including the Virtual Assets Travel Rule under Decision No. 25 of 2026.

What penalties do UAE crypto firms face for AML non-compliance?

Federal Law No. 10 of 2025 provides for criminal and administrative penalties including fines, potential imprisonment for individuals, and asset confiscation. At the sectoral level, VARA can issue cease-and-desist orders, financial penalties, licence suspensions and revocations. The CBUAE recently imposed an AED 20 million fine on a foreign bank branch for AML failures, signalling the escalating scale of enforcement across the financial sector.

How does CARF differ from the existing Common Reporting Standard for UAE financial accounts?

CRS covers traditional financial accounts such as bank deposits, equities and certain debt instruments held with financial institutions. CARF extends automatic information exchange to crypto-asset transactions handled by exchanges, brokers and custodians. In the UAE, CARF will operate alongside CRS, giving tax authorities a combined view of both traditional and digital asset holdings for cross-border transparency.