In one line

From 1 January 2027, UAE crypto-asset service providers must capture and report their users' transactions (crypto-to-fiat, crypto-to-crypto, and transfers including aggregate flows to self-hosted wallets) under CARF, while CRS 2.0 simultaneously brings e-money, CBDCs and indirect crypto exposure into bank reporting. First exchanges with foreign tax authorities happen in 2028, covering 2027 data.

What is changing, and when

Two instruments arrive together. The UAE signed the CRS 2.0 addendum on 11 August 2025, effective 1 January 2027 with first exchanges in 2028. And on 21 July 2025 it signed the multilateral agreement for the OECD's Crypto-Asset Reporting Framework (CARF), on the same timetable: UAE crypto-asset service providers must capture 2027 transaction data for exchange in 2028. Together they close the gap that has existed since CRS was designed for bank accounts in a pre-crypto world.

What CARF makes reportable

CARF applies to crypto-asset service providers, in the UAE that means the VARA-licensed exchanges and brokers, ADGM's FSRA-regulated platforms and other in-scope intermediaries, and requires them to identify users' tax residencies (CRS-style self-certification arrives at crypto onboarding) and report, per user, per year:

  • Crypto-to-fiat transactions: acquisitions and disposals against dirhams, dollars or any fiat, at gross values.
  • Crypto-to-crypto transactions: swapping BTC for ETH is a reportable exchange even though no fiat ever appears.
  • Transfers: movements of crypto to and from the platform, including aggregate values transferred to self-hosted wallets.

That last item deserves emphasis. Withdrawing to a hardware wallet does not remove activity from the report: the platform reports the aggregate value it saw leave to self-hosted addresses. The on-platform history, the off-ramp and the exit to self-custody are all visible to the receiving tax authority.

What CRS 2.0 adds on the banking side

In parallel, the updated CRS brings into ordinary financial account reporting: e-money products and central bank digital currencies; indirect crypto exposure, so funds, structured products, derivatives and custodial arrangements referencing crypto no longer sit outside; and richer data fields, including controlling person roles, joint account details and the status of self-certifications. It also instructs financial institutions to apply explicit scrutiny to residence-by-investment claims, which closes the gap between a purchased residence certificate and the facts in the file.

Who is actually exposed

The reporting trigger is unchanged: foreign tax residence. A person who is genuinely and solely UAE tax resident is not the target of either instrument, and the UAE's non-reciprocal stance (data flows out, none flows in) continues. The exposed populations are: individuals who moved to the UAE but have not cleanly exited home tax residence; holders relying on residence-by-investment paperwork that does not match their indicia; foreign-resident controlling persons behind passive UAE vehicles that hold crypto through custodians; and anyone whose UAE exchange history, off-ramps and wallet exits will be described to a home tax authority whose earlier years were never declared. The 2027 data set is also a retrospective problem: it will invite questions about how positions arose, reaching back into years that predate the reporting itself. Our companion guide to the CRS perimeter for UAE residents covers the residence mechanics.

The window. Between now and 1 January 2027, holders can still resolve residence positions, regularise historical tax affairs where needed under home-country voluntary disclosure programmes, and structure holdings deliberately. After the data flows in 2028, the same steps happen under enquiry rather than by choice, on worse terms.

What VASPs must build

For VARA and FSRA licensees the obligations are operational and arrive faster than 2027 suggests, because systems must be capturing compliant data from day one of that year: tax residency self-certification at onboarding and remediation of the existing book; transaction categorisation engines for the three reportable classes; aggregation logic for self-hosted transfers; and governance, filing and record-keeping that will sit alongside existing VARA compliance obligations. Licensees who leave this to 2026's fourth quarter will be retrofitting under deadline. This sits naturally with the compliance frameworks we already build for licensed VASPs.

What holders should do now

Three moves, in order. First, resolve tax residence properly: the value of UAE residence comes from actually exiting the home regime, and every home country has its own rules on ties and timing (see our exit tax comparison). Secondly, audit what 2027 will show: exchange accounts, custodial arrangements, entity-held positions and historical funding flows, and fix classification and documentation gaps while they are still choices. Thirdly, where past years are unclean in a home jurisdiction, take advice on voluntary disclosure before 2028 makes the disclosure involuntary. None of this is about hiding; the era in which crypto was invisible is closing, and the winners will be the holders whose affairs simply reconcile.

How we help

Neo Legal sits on both sides of this change: we advise VASPs on VARA and FSRA compliance builds, and individuals and family offices on residence, structuring and pre-2027 preparation, with home-country counsel and our accounting arm coordinated where disclosure or filings are needed.

This article is general information as at September 2026 and is not legal or tax advice. CRS outcomes turn on individual facts and self-certifications; take advice before acting.