The OECD Crypto-Asset Reporting Framework names machine operators directly: paragraph 18 of its introduction states that the functional definition of a Reporting Crypto-Asset Service Provider covers operators of Relevant Crypto-Asset ATMs.¹ In the European Union, the United Kingdom and Canada those rules have applied since 1 January 2026, and the window for completing due diligence on users onboarded before that date closes at the end of 2026.² ³ Here is what the framework asks of operators, and where the dates fall.
Why a crypto ATM is in scope
CARF defines a Reporting Crypto-Asset Service Provider as any individual or entity providing a service effectuating Exchange Transactions for or on behalf of customers, and an Exchange Transaction includes an exchange between crypto-assets and fiat currency in either direction.¹ A one-way machine selling bitcoin for cash falls within that wording, and so does a two-way machine. National rules describe the same activity in their own terms; whether a specific operation is in scope depends on its structure, its customers and local law.
Where the dates fall
|
1 Jan 2026
European Union, United Kingdom, Canada
Due diligence and data collection apply. The first EU report, covering 2026, is due by 31 January 2027. The first UK report is due by 31 May 2027, and registration with HMRC is a separate requirement.⁴ ⁵
|
|
|
31 Dec 2026
Pre-existing users
End of the 12-month window for obtaining a valid self-certification from users onboarded before the rules took effect. Canada expects the same work to be completed before 2027.² ³
|
|
|
1 Jan 2027
Hong Kong, Australia, Switzerland
Hong Kong's bill was gazetted on 22 May 2026 and is subject to passage. Australia's tax authority confirmed a 1 January 2027 commencement on 9 February 2026. Switzerland states that its legal basis does not apply in 2026.⁶ ⁷ ⁸
|
|
|
2028 and later
Further commitments
The Global Forum groups committed jurisdictions by whether they intend a first exchange in 2027 or 2028, and lists relevant jurisdictions that have not yet committed. Argentina committed during 2026 to start by September 2029.⁹ ¹⁰
|
What a report contains
Section II.A splits the report into user identification and transaction aggregates. The identification block is the name, address, jurisdiction or jurisdictions of residence, taxpayer identification number, and date and place of birth for individuals. The transaction block is reported for each type of crypto-asset.¹
| Transaction category | Reported per crypto-asset |
| Fiat to crypto, and crypto to fiat | Gross amount paid or received, units and transaction count, reported separately in each direction |
| Crypto for crypto | Fair market value, units and transaction count |
| Retail payment transactions | Fair market value, units and transaction count, for transfers for goods or services above USD 50,000 |
| Transfers in and out | Fair market value, units and transaction count, by transfer type where known |
| Transfers to external wallets | Aggregate value and units sent on the user's behalf to wallet addresses not known to be associated with a service provider or financial institution |
The last category applies to most machine purchases, which end with a send to the customer’s own wallet. Where a network records fiat amounts without destination data, that part of the report cannot be produced from those records.
The two fields that cannot be added later
|
Self-certification only
Jurisdiction of tax residence and taxpayer identification number
Neither is derived from a transaction. Both come from a self-certification given by the user, required on establishment of the relationship for new users, with 12 months after the effective date for pre-existing users.¹
|
HMRC guidance puts dates on this: a self-certificate is collected when the relationship with a new user is established, and providers have until 31 December 2026 to collect one from pre-existing users. Where a provider fails to obtain a valid self-certificate within the time limits, the guidance says it should stop effectuating relevant transactions for that user.² The regulations set penalties of up to GBP 300 for each user where a valid self-certification is not obtained.⁵ DAC8 goes further than the OECD text: where the information has not arrived after two reminders and more than 60 days, the provider must prevent the user from transacting.¹¹ ¹² How these rules apply to a particular operator depends on its jurisdiction and the national transposition.
The United States is on a separate track
Operators in the United States already report, but not under CARF. The final broker regulations name digital asset kiosks among the brokers that take possession of customer digital assets, with gross proceeds reporting for transactions effected on or after 1 January 2025.¹³ A kiosk operator there files domestically on Form 1099-DA, and the Swiss list of proposed partner states for crypto-asset exchange excludes the United States.¹⁴
What operators can check
Nexus and registration
Establish which of your markets treat your activity as creating a reporting nexus, and whether registration is a separate step from the annual return.⁵ ⁶
Pre-existing users
Identify users served before 1 January 2026 in markets where the rules are in force and check whether a valid self-certification exists for each of them.
Transaction data and the decline path
Confirm that your records hold units and transaction counts per crypto-asset in both directions, and that outbound sends are recorded. Check the configuration of your own BATM Software installation, since what is recorded can depend on software version and setup. Decide in advance what a machine does when a user will not provide a taxpayer identification number.
Questions about supported features
Under CARF the reporting obligation sits with the operator exchanging crypto-assets for customers, not with the equipment vendor. For questions about your machines or BATM Software configuration, contact sales@generalbytes.com.
Sources and references:
1. OECD — International Standards for Automatic Exchange of Information in Tax Matters: Crypto-Asset Reporting Framework and 2023 update to the Common Reporting Standard (approved June 2023; Introduction paragraph 18 on operators of Relevant Crypto-Asset ATMs, Section II.A on reportable information, Section III.A on self-certification, Section IV on definitions), 2. HMRC — International Exchange of Information Manual, IEIM8000470 on self-certificate time limits and IEIM8000475 on a valid self-certificate not being obtained (both updated 31 July 2026), 3. RSM Canada — Proposed crypto-asset reporting pivotal for Canadian digital finance regulation (draft Income Tax Act amendments released August 2025, effective 1 January 2026), 4. PwC Netherlands — From 2026, crypto providers will be required to share data (first report for calendar year 2026 due by 31 January 2027; administrative fine up to EUR 1,030,000), 5. UK — The Reporting Cryptoasset Service Providers (Due Diligence and Reporting Requirements) Regulations 2025 (SI 2025/744, in force 1 January 2026), 6. Hong Kong Inland Revenue Department — Crypto-Asset Reporting Framework (Inland Revenue (Amendment) (CARF and Amended CRS) Bill 2026, gazetted 22 May 2026, first reading 3 June 2026), 7. KPMG — Australia: Commitment to implement CARF and amended CRS (19 February 2026, on the Australian Taxation Office announcement of 9 February 2026), 8. Swiss State Secretariat for International Finance — Framework for the automatic exchange of information on crypto-assets (page published 18 May 2026), 9. OECD Global Forum — Jurisdictions committed to implement the Crypto-Asset Reporting Framework (commitment list, grouped by intended first exchange in 2027 or 2028), 10. OECD Global Forum — Argentina commits to start automatic exchange of information on crypto-asset transactions by 2029 (2026), 11. EU — Council Directive (EU) 2023/2226 amending Directive 2011/16/EU on administrative cooperation in the field of taxation (DAC8) (adopted 17 October 2023), 12. Maples Group — DAC8: EU tax reporting framework for crypto-asset income and revenue (on the requirement to block a user after two reminders and more than 60 days), 13. IRS — Final regulations and related guidance for reporting by brokers on sales and exchanges of digital assets (naming digital asset kiosks among covered brokers), 14. Swiss Federal Council — Dispatch approving the list of 74 partner states for the automatic exchange of information on crypto-assets (6 June 2025)
Disclaimer: This article is for general informational purposes and is not legal, compliance, tax or investment advice. CARF implementation dates, due diligence deadlines and penalties vary by jurisdiction, and several national measures were still before parliaments when this article was written. Confirm the current position with qualified advisers and the relevant product documentation before acting.
