Compliance in Practice: Data, Technology, and Operations

Key Takeaways

• Due diligence ≠ KYC: From 1 January 2026, firms will need tax-residency-level data — including self-certifications, TINs, entity classifications, and controlling persons — to know where to report. Many crypto-native firms haven’t built for this yet.
• CRS experience helps, but isn’t enough: Banks can leverage existing CRS workflows, but CARF introduces new complexity for entities, tokenised products, multi-booking models, and clients appearing across multiple business lines.
• Jurisdictional divergence matters: EU DAC8, UK CARF, Swiss timelines, GCC adoption — all are moving on different clocks. Global groups must document country-by-country variations rather than applying a single “strictest rule” globally.
• Data is the real bottleneck: CARF requires granular transaction-level reporting, not just balances. Firms must map products, wallets, and transfers — and classify assets like stablecoins or tokenised instruments — before reporting engines can run.
• Build vs. buy will shift under CARF: Unlike CRS, where many firms built internally, CARF’s complexity will drive hybrid models: internal tax/product analysis paired with specialist reporting technology.
• Customer communication is critical: Without clear explanations for why more data is needed — or why activity may be restricted without a valid self-cert — firms should expect customer friction.
• The core message: CARF may still have grey areas, but waiting for “final-final” guidance is a risk. Compliance, tax, product, and data teams need to collaborate now to meet the timelines.

Speakers:

Corinna Hedtke – Standard Chartered Bank

Jessalyn Dean – Dune Consultants

Layla Majed – Société Générale

Erin Fennimore – Taxbit