DAC8 vs CARF: Key Differences

While DAC8 is based on the OECD's CARF, the EU has implemented several significant extensions and modifications. Understanding these differences is crucial for CASPs operating in multiple jurisdictions.

Framework Origins

CARF

CARF is an international standard developed by the OECD:

• Model rules for voluntary adoption
• Jurisdictions transpose into domestic law
• Implementation varies by country
• 48+ jurisdictions committed

DAC8

DAC8 is binding EU legislation:

• Directive requiring transposition
• Mandatory for all 27 member states
• Enforced by EU institutions
• Consistent baseline across EU

Scope Differences

Reporting Entity Scope

Aspect	CARF	DAC8
Non-resident CASPs	Report only if nexus exists	Must register if serving EU residents
Registration requirement	Varies by jurisdiction	Mandatory for all reporting CASPs
MiCA coordination	N/A	Integrated licensing framework

Asset Coverage

DAC8 extends coverage beyond base CARF:

• E-money tokens: DAC8 covers certain e-money tokens excluded from CARF
• NFTs: Broader NFT coverage based on EU approach
• Utility tokens: Included if meeting crypto-asset definition

Reporting Variations

Additional Data Elements

DAC8 requires data beyond CARF minimum:

• User nationality (not just residency)
• Birth place for undocumented TINs
• Account identifiers per EU standard

Exchange Mechanism

• CARF: Bilateral and multilateral exchanges via CRS infrastructure
• DAC8: Automatic exchange via EU Common Communication Network

Reporting Deadlines

• CARF: Set by each jurisdiction (typically Q2)
• DAC8: Harmonized deadline by end of Q2 following reporting year

Due Diligence Variations

TIN Validation

• CARF: Reasonable effort standard
• DAC8: Mandatory validation using EU TIN verification module

Self-Certification

• CARF: Required but format flexible
• DAC8: Prescribed form content under EU rules

Penalty Structures

CARF Penalties

Each jurisdiction sets penalties independently - significant variation expected.

DAC8 Penalties

Minimum standards established:

• EUR 20,000 minimum for late reporting
• Up to EUR 1,000,000 for serious violations
• Criminal liability provisions
• License revocation powers

Compliance Implications

For Global CASPs

Organizations operating globally must:

• Track both CARF and DAC8 requirements
• Implement superset of data collection
• Maintain separate reporting streams where needed
• Monitor for divergence as rules evolve

For EU-Focused CASPs

Compliance with DAC8 generally ensures CARF compliance, but:

• Non-EU jurisdiction requirements may differ
• Additional reporting may be required outside EU

System Design

Build systems that accommodate:

• DAC8's broader data requirements
• Multiple output formats
• Different deadline tracking
• Jurisdiction-specific validation rules

Conclusion

While DAC8 is built on CARF, its extensions make it the more demanding regime. CASPs should design compliance programs around DAC8 requirements where EU operations are significant, adapting for other jurisdictions as needed.