UAE sets CARF readiness timetable for crypto-asset service providers

Who may be a reporting service provider

CARF covers individuals and entities that, as a business, effect crypto-asset exchange transactions for or on behalf of customers, including exchanges, brokers, dealers and other intermediaries. Potential Reporting Crypto-Asset Service Providers must assess whether their activities and UAE nexus bring them within scope, including through a UAE branch. Relevant transactions broadly include exchanges between crypto-assets and fiat currency, exchanges between crypto-assets and transfers; stablecoins, crypto-asset derivatives and some non-fungible tokens can be relevant assets.^[1][2]

Readiness deadline and due diligence

By 31 December 2026, potentially in-scope businesses should complete classification and nexus assessments and prepare policies, systems, controls, record-keeping and governance. The circular gives 1 January 2027 as the target effective date for the Cabinet and Ministerial Decisions implementing CARF. From that date, new users would require valid self-certification and a reasonableness check when the relationship begins; equivalent procedures for pre-existing users are targeted for completion by 31 December 2027.^[1][2]

Registration and first reporting

Registration through the Ministry's reporting system is expected during 2027, including disclosure of the provider's UAE nexus, but the registration deadline remains to be confirmed. Systems should be able to compile, validate and transmit information in the CARF XML format by 31 December 2027. The first annual CARF report—or nil return—is expected by 30 June 2028 for the 2027 reporting period, followed by the UAE's first automatic exchange on 1 September 2028.^[1][2]

Domestic rules are still forthcoming

The UAE signed the CARF multilateral competent-authority agreement on 21 July 2025 and ratified it under Federal Decree No. 60 of 2026 on 4 May 2026. The new circular advances operational preparation, but repeatedly describes 1 January 2027 as a target for the implementing decisions and says further guidance will address registration, reporting and technical specifications. Crypto-asset groups should therefore begin data and onboarding work now while keeping legal-scope conclusions and system specifications under review until those domestic instruments are issued.^[1][2]