Already in the collection window

CARF deadline: May 2027. Are you ready?

The Crypto-Asset Reporting Framework requires you to report your crypto clients' tax residency. The data-collection rules are already in force - your first report to HMRC is due 31 May 2027. WhyAML provides the evidence you need.

First report to HMRC due

31 May 2027

Start capturing tax residency evidence now

The basics

What CARF means for your practice

Three things every accountant needs to know before the deadline.

OECD

International standard - UK implementing via Finance Act

All crypto

Covers clients with any crypto holdings

Tax residency

You must report WHERE your client is tax-resident

CARF is the crypto equivalent of CRS (Common Reporting Standard). If you have clients with crypto holdings, you'll need to report their tax residency to HMRC - and you need evidence to back it up.

What CARF actually requires - the legal basis

CARF: the reporting obligation behind this page

The Crypto-Asset Reporting Framework (CARF) is the OECD's reporting standard for crypto-assets - the crypto-asset analogue of the Common Reporting Standard (CRS) that already governs cross-border financial-account reporting. The UK has adopted it into domestic law.

The data-collection and due-diligence obligations have been in force since 1 January 2026. Reporting crypto-asset service providers had to register with HMRC by 31 December 2025, and the first reports to HMRC are due by 31 May 2027, covering the 2026 calendar year. A firm with crypto-holding clients is therefore already inside the collection window - the residency evidence it will report must be captured now, not in 2027.

CARF requires the reported tax residency to be current, verifiable and auditable, rather than self-declared. This is the gap WhyAML fills: it captures economic-residency evidence alongside identity verification, so the firm holds the supporting record at the point of onboarding.

Why documents fall short

The tax residency problem

Traditional documents don't prove residency. A passport shows citizenship. A utility bill can be months old. Self-declaration can be false. HMRC wants evidence of where your client actually conducts economic activity.

Why documents don't prove residency - the legal point

Why a residency determination needs behavioural evidence, not documents

Tax residency turns on where a person actually lives and conducts economic activity - not on citizenship or a mailing address. The documents AML processes traditionally rely on do not establish it: a passport evidences nationality, a utility bill evidences a billing address at a single past date, and a self-declaration is unverified.

CARF expects the reported residency to be supported by evidence consistent with the client's real economic activity. WhyAML produces that evidence by observing current, authenticated behavioural signals - refreshed over time rather than captured once - and expressing the result with a confidence band.

The determination remains the firm's. WhyAML supplies auditable, decision-support evidence to underpin the residency conclusion the firm reaches; it does not issue a legal ruling on residence and does not replace the firm's own judgement.

Passport - shows citizenship, not residency

What fails

The document

Passport - shows citizenship, not residency

A person can hold a UK passport and be tax-resident in Dubai. The passport tells you nothing about where economic activity happens.

Does not satisfy CARF

What CARF needs

Instead, you need

Evidence of economic activity location

HMRC wants to see WHERE your client is economically active. That means behavioural signals - exchange logins, transaction timings, fiat ramps - not a document about who they are on paper.

Satisfies CARF

Utility bill - can be outdated or temporary

What fails

The document

Utility bill - can be outdated or temporary

A bill from six months ago proves nothing about today. A short-let utility bill proves nothing about permanent residency.

Does not satisfy CARF

What CARF needs

Instead, you need

Current, not historical

CARF demands ongoing evidence. WhyAML captures behavioural signals in real time and refreshes them - so the residency evidence is always current, never "as of six months ago".

Satisfies CARF

Bank statement - address may not reflect current residence

What fails

The document

Bank statement - address may not reflect current residence

A client can have a UK bank statement for an address they moved out of a year ago. The paper trail is slower than real life.

Does not satisfy CARF

What CARF needs

Instead, you need

Verifiable, not self-declared

A bank statement is self-reported - the client chooses what to send. WhyAML verifies via the regulated institution directly. You're not relying on the client's choice of document.

Satisfies CARF

What fails

The document

Self-declaration - no verification

Your client says they live in Manchester. You write it down. HMRC asks you to prove it. You can't. Self-declaration is a statement - not evidence.

Does not satisfy CARF

What CARF needs

Instead, you need

Auditable trail for HMRC

If HMRC audits you, self-declaration is worthless. WhyAML produces an on-chain audit trail - immutable, dated, and backed by institutional evidence. Hand it over. Done.

Satisfies CARF

01 / 04

The solution

WhyAML solves the tax residency problem

We determine tax residency through behaviour, not documents. WhyAML analyses where your client's crypto transactions "touch" the real world.

How G-RADE™ determines economic residency

G-RADE™: how economic residency is assessed

G-RADE™ (confidence scoring) assesses economic residency from a set of behavioural dimensions rather than from a declared address. These include the fiat on- and off-ramps a client uses, which regulated institutions they transact with and where those institutions are based, the timing and timezone pattern of activity, and the geography of their counterparties.

The output is an evidence-based indication of economic residency, carried with a confidence band and refreshed in real time - a living assessment, not a one-off snapshot that ages the moment it is taken.

G-RADE™ is decision-support evidence for the obliged entity. It informs, but does not displace, the firm's own residency determination, and it is not a legal opinion on the client's residence.

Behavioural Geolocation (G-RADE™ Algorithm)

Our algorithm examines multiple factors to determine where your client actually lives and conducts economic activity:

Fiat ramps

Where does your client convert between crypto and traditional currency?

Institutional connections

Which regulated exchanges do they use, and where are those exchanges based?

Transaction patterns

What times are they active? What timezone patterns emerge?

Network behaviour

Who do they transact with, and where are those counterparties?

This produces tax residency evidence that is verifiable, current, and auditable.

The client you're reporting on

The UK crypto client market - at a glance.

Millions of adults now hold crypto. If you have any of them as clients, CARF reporting applies. Here's what the market looks like today.

Why the regulated-rails roadmap matters

Why the regulated-rails roadmap strengthens the evidence

The numbers tell you the exposure: several million UK adults now hold crypto, and a single one of them on the books brings CARF reporting into play. The more useful point for a firm is what's happening underneath those figures.

Crypto activity is moving under formal UK regulation - the Financial Services and Markets Act (Cryptoassets) Regulations 2026 bring the platforms clients use inside the FCA's perimeter. As that happens, the institution behind a client's account becomes a supervised, accountable source rather than an unregulated venue.

That is precisely the source the Witnessing Model™ draws on. Regulation 28 asks for a reliable and independent source; an FCA-supervised institution is one. So the roadmap doesn't threaten the method - it compounds it: the more the rails are regulated, the stronger the evidence WhyAML witnesses becomes.

~6M

UK crypto owners

approx. 11% of UK adults

Derived from FCA 2025 ownership rates (8%) applied to ONS 2024/25 population data.

£1,842

Average holding

per crypto owner

FCA 2025 data noting a shift toward higher average holdings among active investors.

42%

Millennials (29-44)

of all UK crypto owners

FCA 2025 age-stratified research.

57%·43%

Bitcoin · Ethereum

CARF-ready compliance output

Four artefacts per client. Generated automatically. HMRC-shaped.

What the Broker Compliance Certificate is - and what it satisfies

The Broker Compliance Certificate: audit-grade record for HMRC inspection

The Broker Compliance Certificate is the immutable, dated record produced for the obliged entity at the conclusion of every verification. It evidences the identity check performed, the G-RADE™ (confidence scoring) band achieved, the fact that the verification was anchored to a regulated institution, and the date and time of the check. It does not expose the institution's name, the wallet, or the underlying behavioural detail.

The Certificate is the document the firm presents to HMRC during an MLR 2017 inspection. Together with the Technological Due Diligence (TDD) document, it satisfies both the verification requirement of Regulation 28 and the record-keeping requirement of Regulation 40.

The firm retains the Certificate; the underlying personal data does not transfer to the firm. This separation is fundamental to WhyAML's data-minimisation architecture.

Tax Residency Evidence

Behavioural geolocation report showing economic residency determination

Broker Compliance Certificate

Dated, documented record of customer due diligence

On-chain Audit Trail

Immutable record of verification - can't be altered or lost

Perpetual Monitoring

Alerts if your client's risk profile or residency indicators change

The regulators

Meets CARF, MLR 2017, GDPR & DUAA 2025

Regulation 28 vs 19(4)(c) - the legal hierarchy

Regulation 28: the substantive basis for identity verification

Regulation 28 of the Money Laundering Regulations 2017 requires customer identity to be verified from a reliable and independent source. This is the substantive legal foundation on which WhyAML's verification methodology stands.

A regulated financial institution that has performed customer identity checks under its own regulatory obligations is such a source. At present these are FCA-registered crypto-asset firms, supervised for anti-money-laundering purposes under the Regulations; a later phase extends this to FCA/PRA-authorised banks, accessed through read-only Open Banking. WhyAML does not adopt or rely on that institution's due diligence - Regulation 39 (reliance on third parties) is not engaged - it independently witnesses the individual's authenticated, ongoing control of the relationship.

What the method produces is a verification anchored in a real, regulated relationship with genuine economic activity: a fraud-traceable record at an accountable institution, rather than a static document that can be forged. This is what the anti-money-laundering regime exists to enable.

Regulation 28 is the rule that makes the method lawful. It is distinct from Regulation 19(4)(c), which is the procedural rule under which a firm records its decision to adopt the technology.

CARF

Tax residency evidence for crypto clients

The Crypto-Asset Reporting Framework requires accountants to report the tax residency of clients with crypto holdings. That evidence must be current, verifiable, and auditable - not self-declared.

How WhyAML satisfies

✓

Behavioural geolocation determines economic residency

Patent Protected

Behavioural geolocation. Patent Protected method.

The way WhyAML builds CARF-ready tax-residency evidence is Patent Protected.

The Patent Protected method, explained

Institutional provenance: the patented method

Institutional provenance is WhyAML's core verification method, patented in the EPO, USPTO, and via the PCT. It verifies identity by confirming an individual's authenticated control of an account at a regulated financial institution that has already performed customer identity checks under its regulatory obligations - at present FCA-registered crypto-asset firms, and in a later phase FCA/PRA-authorised banks.

Control is confirmed by witnessing observable, authenticated evidence of the relationship - including on-chain activity history, a DKIM-verified communication from the institution, and an authenticated control check - without retrieving, copying or storing the underlying identity documents. The method observes whatever rail the institution operates: on-chain for crypto-asset firms; read-only Open Banking for banks.

It satisfies the reliable-and-independent-source requirement of MLR 2017 Regulation 28 by independently witnessing the individual's authenticated control of a regulated relationship - not by collecting and storing identity documents, and not by relying on the institution's own due diligence (Regulation 39 is not engaged).

The deadline doesn't move

Get CARF-ready before the deadline

Tax residency evidence included. No contract.

WhyAML adds this capability alongside your existing AML and onboarding checks - identity verification through the Witness Model, without document custody. It runs with your current tools, it doesn't replace them.

How WhyAML fits alongside your existing stack

An added capability - designed to run alongside your existing checks

WhyAML is built to sit alongside a firm's existing AML and client-onboarding stack - tools such as SmartSearch, Thirdfort or Credas - and alongside the firm's tax process. It adds two things those tools do not provide: identity verification through the Witnessing Model™, performed without taking custody of identity documents, and CARF-ready economic-residency evidence.

It is not a rip-and-replace. The firm keeps its existing controls, its risk-based approach and its professional judgement; WhyAML adds a capability - document-free verification plus residency evidence - that complements them.

For the obliged entity this means WhyAML can be adopted without unwinding an existing compliance arrangement: it is an additional, regulator-ready evidence source, not a substitute for the firm's framework.

See pricing Sign up