CARF in Africa: Six Countries and Reporting Deadlines

The OECD Global Forum refreshed its Crypto-Asset Reporting Framework commitment list on 23 June 2026. Seventy-six jurisdictions now appear on it: 46 undertaking first exchanges by 2027, 29 by 2028, and the United States by 2029. Six of those seventy-six are African.

Africa has 54 sovereign jurisdictions, and CARF reaches six of them. South Africa and Uganda sit in the first wave, with first exchanges due in 2027 and domestic collection already under way, from January 2026 in Uganda and from March 2026 in South Africa. Kenya, Mauritius, Nigeria, and Seychelles sit in the second wave, exchanging in 2028 on 2027 data. No African jurisdiction appears on the Global Forum's short list of countries identified as relevant to CARF that have not yet committed, which contains only Argentina, El Salvador, Georgia, India and Viet Nam.

That reach is narrow against the continent's wider record. African jurisdictions have been among the more active in taxing fintech and Web3, through digital services VAT, excise duty on transaction fees, and e-levies on transfer values. Appetite for taxing crypto activity has not translated into participation in the framework built to exchange information about it.

Non-resident exchanges, custodians and brokers with African customers face a narrower question than the headline suggests. CARF allocates reporting obligations by where the provider is established, not by where its users live. A jurisdiction can commit, legislate, and still receive nothing about its own residents. Understanding that distinction is the difference between a compliance plan that works and one that assumes coverage it does not have.

Where Africa Sits on the Commitment List

The first-wave African jurisdictions are South Africa and Uganda. Both committed through the CARF Multilateral Competent Authority Agreement rather than through a regional directive, since nothing equivalent to the European Union's DAC8 exists on the continent. Their reporting providers were required to begin due diligence and data collection from the start of the 2026 calendar year, with reports due to the domestic tax authority during 2027 and exchanges following in the same year.

Uganda's presence in the first wave is the surprise. It is the only low-income economy in a group otherwise made up of European Union member states, the United Kingdom and its Crown Dependencies, Japan, Korea, Brazil, and the major offshore financial centers. Uganda committed alongside jurisdictions with decades of automatic exchange infrastructure behind them, and it did so while its domestic virtual asset licensing regime was still taking shape.

The second wave is larger and more predictable in composition. Kenya, Mauritius, Nigeria and Seychelles will collect data across calendar 2027 and exchange in 2028. Mauritius and Seychelles are there for the same reason the British Virgin Islands and Bermuda are: they host financial services activity that the Global Forum considers material. Kenya and Nigeria are there because of domestic market size. Between them, they account for the bulk of retail crypto activity in sub-Saharan Africa outside South Africa.

Everything else on the continent sits outside the framework, though not because it weighed CARF and declined. The Global Forum's list covers jurisdictions it identified as relevant to the framework in the first place, and the five that were identified but have not committed are Argentina, El Salvador, Georgia, India, and Viet Nam. Ghana, Egypt, Morocco, Tanzania, Rwanda, Zambia, and Botswana were never in that pool. Their tax administrations will neither report nor receive until the question is put to them or they raise it themselves.

How CARF Decides Who Reports

CARF applies to Reporting Crypto-Asset Service Providers, defined as entities and individuals effectuating exchange transactions in crypto-assets for or on behalf of customers as a business. Exchanges are the obvious case. Brokers, dealers, and certain wallet providers and intermediaries fall in as well.

The nexus rules are where practitioners should concentrate. A provider is subject to reporting in a jurisdiction where it is incorporated or organized, where it is managed from, or where it maintains a regular place of business, applied through a hierarchy designed to prevent the same transactions being reported twice. Customer location does not create a reporting nexus. An exchange incorporated in Singapore with a million Kenyan users has no Kenyan CARF reporting obligation. It reports to Singapore, and Singapore passes Kenyan-resident data to Kenya once an exchange relationship between them is activated.

This is the structural difference between CARF and the VAT rules the same providers already navigate. Under a destination-based VAT regime for digital services, serving customers in a market is itself the trigger. Under CARF, serving customers in a market is irrelevant to whether you report there. The two frameworks pull in opposite directions, and a provider that has built its tax function around consumption-based registration will find CARF's establishment-based logic counterintuitive.

What gets reported is standardized: identity and tax residency data collected through self-certification, taxpayer identification numbers, and annual transaction totals covering crypto-to-fiat exchanges, crypto-to-crypto exchanges, transfers to external wallets where the provider cannot confirm the destination, and retail payment transactions above the prescribed threshold. CARF runs in parallel with the amended Common Reporting Standard, which absorbed certain digital money products and central bank digital currencies into its own scope.

South Africa Is the Only African Jurisdiction Actually Live

South Africa incorporated CARF into its domestic framework with effect from 1 March 2026. SARS published the final External Business Requirements Specification, version 1.5, on 16 February 2026 for implementation on that date, which gave reporting providers roughly two weeks between the final technical specification and the start of obligations.

Under the SARS framework, reporting obligations rest entirely with the provider. Individual taxpayers do not report under CARF, though the data SARS receives will inform assessments against them. SARS has stated that it is engaging local providers directly to obtain crypto-asset transaction information and that the data will be analyzed to identify non-compliance and support compliance action. That is a risk-assessment posture rather than an assessment-raising one, which matches how CARF is being used elsewhere: the framework produces the signal, and the domestic law produces the liability.

The scope covers providers with a South African nexus that facilitate crypto-asset transactions for customers, including exchanges, brokers, and dealers. SARS set commencement at 1 March rather than 1 January, aligning CARF with the start of the South African tax year. Providers should confirm how the first reporting period is bounded, since the first-wave collection year is otherwise calendar 2026.

The 2028 Group and Kenya's Legislative Sequence

Kenya offers the clearest picture of what second-wave preparation looks like, because its legislative build-out has been visible and sequential.

The Finance Act 2025 repealed the digital asset tax and replaced it with a 10% excise duty on virtual asset transaction fees, shifting the charge from gross transfer value to intermediary revenue. The Virtual Asset Service Providers Act 2025 established a licensing and supervisory regime, with regulations under it following.

The Finance Act 2026, assented to on 23 June 2026, did three things that matter here. It introduced a framework allowing Kenya to enter into agreements with other countries for the automatic exchange of information relating to virtual asset transactions. It required virtual asset service providers to file annual information returns with the Kenya Revenue Authority, and made it an offence to falsify such a return or to fail to file one, including a nil return. And it refined the 10% excise so that the charge attaches to fees levied by virtual asset service providers, including exchanges, trading platforms, brokers, and other intermediaries, rather than to participants in the sector generally.

The annual information return is the provision to watch. It creates the domestic reporting channel between providers and the revenue authority that a CARF regime needs, and it does so two years ahead of the first exchange date.

Read together, those three instruments move Kenya from regulating virtual assets purely for licensing and anti-money-laundering purposes toward an integrated regime covering supervision, taxation, and cross-border information exchange. The AEOI framework in the Finance Act 2026 is the enabling provision without which a 2028 first exchange is not legally possible. Kenya's remaining work is the operational layer: competent authority designation, confidentiality and data safeguards assessment by the Global Forum, provider registration, and a reporting schema.

Nigeria, Mauritius, and Seychelles are in the same 2027 collection year, though their published implementation detail is thinner. Nigeria's position is complicated by the fact that its 2026 tax reform package already brings crypto exchanges within the VAT net as digital service providers, so Nigerian-facing platforms are being pulled into two separate reporting relationships with the same authority on different legal bases.

Committing to Report Is Not the Same as Receiving

The distinction that matters most for African revenue authorities is between the outbound and inbound halves of CARF.

The outbound half is straightforward. A jurisdiction legislates, its resident providers report, and it transmits data to partners. The inbound half is harder. To receive data about its residents from other jurisdictions, a country must have an activated exchange relationship with each sending jurisdiction, and it must satisfy the Global Forum's confidentiality and data safeguards standard before those relationships are switched on. That assessment covers legal frameworks, information security management, and enforcement of confidentiality breaches.

In most African markets, the inbound half is where the revenue is. Domestic crypto activity in Kenya, Nigeria, and Uganda runs substantially through platforms established elsewhere. A Kenyan CARF report on Kenyan-established providers captures a fraction of Kenyan residents' offshore holdings. What captures the rest is a report arriving from Singapore, the Cayman Islands, or the United Arab Emirates about Kenyan-resident account holders, and that only happens once the relationship is live.

The forty-eight African jurisdictions outside the framework face a different problem, which is that they get neither half. Their residents trade on offshore platforms, those platforms report to their own authorities, and the data moves to partner jurisdictions that have completed the process. The framing matters here. Most of these countries have not refused CARF, because the Global Forum never identified them as relevant to it. Sitting outside the framework is a status they inherited rather than a policy they adopted, and changing it means asking to be assessed rather than simply signing an agreement.

What CARF Data Means for Indirect Tax

CARF is direct-tax infrastructure, built to help authorities assess income and gains. Its indirect-tax value is secondary but real, and it is underexplored.

A CARF report identifies providers by name, legal form, and place of establishment. For a VAT administration trying to determine which non-resident platforms have a taxable presence in its market, that is a register it does not currently have. The same is true for excise regimes that attach to transaction fees rather than to transaction value, as Kenya's does. Kenyan practice already shows how contested the classification of payment intermediaries can be: the High Court's treatment of payment processing commissions turned on the nature of the service rather than the technology delivering it. A provider reporting under CARF has, by definition, disclosed the fee-generating activity that the excise charge attaches to.

The reverse also holds. Jurisdictions that already operate simplified VAT registration for non-resident digital service providers have a list of registered platforms that can be tested against CARF data once it starts arriving. Discrepancies in either direction point to something worth examining.

None of this happens automatically. It requires that the competent authority handling CARF data and the domestic VAT function are permitted to share information, and the confidentiality conditions attached to exchanged data restrict downstream use. That is a legal design question African administrations building CARF capability should resolve now rather than in 2028.

Conclusion

CARF's African footprint is six jurisdictions, two deadlines, and one live regime. South Africa is operating. Uganda is collecting. Kenya, Mauritius, Nigeria and Seychelles have until the end of 2026 to complete the legal and operational work that a 2027 collection year requires.

Reporting providers should start with establishment. Each group entity has a CARF nexus somewhere under the incorporation, management, and place-of-business hierarchy, and the risk worth testing for is a structure where no entity ends up reporting at all. Onboarding is the second problem: self-certification has to capture tax residency to the standard CARF sets, and most flows currently fall short

African administrations outside the six face a different decision. Almost none were asked to join CARF, so the live question is whether to seek the relevance assessment that would bring them in, while the data flow they sit outside continues to grow.