We manage your security to weather the AI storm →
Get a quote

← Resource Hub

Crypto Regulatory Reporting: What Exchanges Must File

By Owen ThurmPublished 14 min read

Crypto Regulatory Reporting: What Exchanges Must File

Quick answer. Exchanges and custodians file recurring returns (DORA registers, NYDFS certifications, BitLicense and VARA financial returns), event-driven reports (incident notices, SARs, MiCA STORs, OFAC reports), annual tax reports (CARF, DAC8, Form 1099-DA), and send travel rule data to counterparty providers with qualifying transfers.

Watch: Crypto Regulatory Reporting: What Exchanges Must File 1:46
Video transcript

Crypto regulatory reporting is no longer one annual return. Exchanges and custodians file on fixed dates and within hours of incidents, and send data with transfers.

Filings fall into four groups: recurring returns, event reports, tax reports, and travel rule data.

EU crypto providers file a DORA register each year, due in March for 2026. NYDFS wants its Part 500 certification by April 15. BitLicense and VARA add periodic financial returns.

Event clocks are tighter. A major DORA incident needs an initial notice within 4 hours of classification. NYDFS allows 72 hours.

In the US, suspicious activity reports are due within 30 days. MiCA market abuse reports go without delay, and OFAC blocked property within 10 business days.

Annual tax reports for 2026 come due in 2027. By our count, 1099-DA statements are due February 16, UK CARF reports May 31, and DAC8 reports by the EU outer date, September 30.

In the EU, sender and recipient data travel with every crypto transfer, with an ownership check for self-hosted wallets above 1,000 euros. The US threshold is 3,000 dollars.

Most filings draw on one data layer. Guardian found a RAAC event reporting zero collateral and a Kairos fee event that could overstate revenue. Both were Low, yet a return built from either event would carry the error.

Read the article for the reporting calendar, or talk to Guardian about testing the systems behind your filings.

Filings Now Run All Year

Crypto regulatory reporting is no longer one annual return. Licensed exchanges and custodians file on fixed dates and within hours of incidents, and send customer data with qualifying transfers.

MiCA's transitional period ended on July 1, 2026. Firms providing crypto-asset services in the EU without MiCA authorisation must now stop, Elvinger Hoss notes; banks and other listed financial entities can notify instead. Elvinger Hoss Prussen, European Securities and Markets Authority

Tax reporting is starting too. DAC8 has applied since January 1, 2026, and UK providers file their first CARF report with HMRC by May 31, 2027. European Commission, DG TAXUD, HM Revenue and Customs (GOV.UK)

This is not legal advice; security controls are in our crypto regulatory compliance guide.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

Recurring Reports

EU CASPs file a DORA register of information each year. For the 2026 cycle, Luxembourg's CSSF set March 31, 2026 and listed CASPs among required filers. Commission de Surveillance du Secteur Financier (CSSF)

In the Netherlands, the AFM required registers in xBRL-CSV through its portal by March 31, 2026; Excel was not accepted. Autoriteit Financiële Markten (AFM)

MiCA adds an indirect duty. CASPs serving asset-referenced tokens above EUR 100 million issued must give the issuer data for its quarterly report, including transactions settled off the DLT. European Securities and Markets Authority

In New York, Part 500 covered entities file a certification of material compliance, or an acknowledgment of noncompliance, by April 15. The highest-ranking executive and the CISO sign it. Cornell Legal Information Institute (text of NYDFS regulation)

Part 504 adds a board resolution or senior officer finding on transaction monitoring and filtering, also by April 15, for Regulated Institutions.

BitLicense holders file quarterly financial statements within 45 days of quarter end, plus audited annual statements with an independent CPA opinion and attestation on internal control.

The CISO's cybersecurity report also goes to the board and to DFS at least annually (200.16(d)); see our BitLicense requirements guide.

Dubai's VARA sets monthly, quarterly and annual returns. Its rulebook's Part I.H names no submission day, so confirm deadlines with VARA. Virtual Assets Regulatory Authority (VARA)

Changed AML/CFT policies, attested by a competent third party, go to VARA within 21 calendar days of taking effect.

VARA cycleReturns include
MonthlyFinancial statements, VA wallet addresses, related party transactions
QuarterlyBoard minutes, financial requirements and reserve assets statement, risk exposure report
AnnualAudited financials, compliance assessment, board certification, first 100 clients' onboarding files

Incident and Event Reports

Under DORA, a major ICT incident needs an initial notice within 4 hours of classification and 24 hours of detection. An intermediate report follows at 72 hours, then a final report within a month. Autoriteit Financiële Markten (AFM)

NYDFS wants notice within 72 hours of determining a cybersecurity incident occurred, and within 24 hours of any extortion payment, with written reasons within 30 days. Cornell Legal Information Institute (text of NYDFS regulation)

Our crypto incident reporting requirements matrix compares these clocks across regimes. Other event reports:

Tax Reporting: CARF, DAC8, 1099-DA

By September 14, 2026, 46 jurisdictions had committed to first CARF exchanges in 2027, including the UK, Japan, Korea and Brazil. OECD Global Forum on Transparency and Exchange of Information for Tax Purposes

Another 27, including Singapore, Hong Kong and the UAE, commit for 2028; four, including the United States, for 2029.

HMRC wants the UK report for calendar 2026 by May 31, 2027, then every May 31. Files are XML in the OECD schema, up to 250MB, and penalties reach £300 per user. HM Revenue and Customs (GOV.UK)

Under DAC8, EU reporting crypto-asset service providers report identification data and aggregate gross acquisitions, disposals and transfers. The first reports, covering 2026, are due by September 30, 2027. European Commission, DG TAXUD

National dates vary. Bulgaria wants first reports by June 30, 2027, while Czechia's transposition bill was still in parliament in November 2026. RegFollower, Poslanecká sněmovna Parlamentu České republiky (Czech Chamber of Deputies)

Providers serving EU users without MiCA authorisation, typically non-EU operators, register for DAC8 in a single Member State.

US brokers report gross proceeds on Form 1099-DA, with de minimis rules for qualifying stablecoins ($10,000 a year), specified NFTs ($600) and digital asset payment processor sales ($600). Internal Revenue Service

Basis is mandatory only for assets acquired after 2025 in an account the broker held in custody.

For 2026 sales, statements are due February 15; by our count, the holiday rule moves that to February 16, 2027. From filing season 2027, IRIS is the only IRS intake system.

Notice 2025-33 lifts backup withholding on 2026 sales. For 2027 sales, relief depends on matching customer names and TINs through the IRS TIN Matching Program.

A Congressional Review Act resolution, signed into law on April 10, 2025, overturned the DeFi broker rule; custodial 1099-DA reporting is unaffected. Proposed rules would allow electronic-only 1099-DA delivery from January 1, 2027, if finalized. House Committee on Ways and Means

Travel Rule

The EU Transfer of Funds Regulation has covered crypto since December 30, 2024 where at least one CASP is in the EU. Originator and beneficiary data travel with every transfer. De Nederlandsche Bank, European Banking Authority

Above EUR 1,000, transfers to or from a self-hosted wallet need a check that the customer owns or controls it.

Incomplete transfers must be suspended or rejected, following the EBA's Travel Rule Guidelines. Missing data may justify a suspicious transaction report to the FIU.

Beneficiary and intermediary CASPs report a counterparty's repeated failures, and the steps taken, to the AML/CFT supervisor (TFR Articles 17(2), 21(2)). Dutch CASPs use the AFM's TFR form, sent to crypto@afm.nl. Springlex (reproduction of OJ L 150, 9.6.2023), Autoriteit Financiële Markten (AFM)

The US rule starts at $3,000: the sending institution passes transmittor and recipient details to the next institution. Cornell Legal Information Institute (text of CFR)

Thresholds differ elsewhere. See our guides to the UAE travel rule and Korea's travel rule expansion.

Crypto Regulatory Reporting Solutions

Most filings draw on one data layer: customer identity, transaction records and totals.

Check onchain events before they feed that layer. In Guardian's RAAC core contracts review, every ERC20 liquidation event reported zero collateral to reconciliation systems (Low, L-08). Guardian

In Guardian's Kairos follow-up review, a fee event emitted the gross fee, so revenue summed from events would be overstated whenever the creator fee share was on (Low, L-09).

A proceeds figure or monthly return built from either event would carry the error.

Travel rule data is personal data crossing firms over APIs. Pentest those endpoints like any API carrying customer records.

IVMS 101 is the shared data model for that data; TRISA is one open source protocol for exchanging it. interVASP Standards Working Group, TRISA (Travel Rule Information Sharing Architecture)

FilingChannel or format
Form 1099-DAIRIS only; the FIRE System is not accepted
UK CARFHMRC online service; OECD XML schema, files up to 250MB
DAC8Standard forms and XML schemas in Regulation (EU) 2025/2263
DORA register (Netherlands, AFM)xBRL-CSV via the AFM portal; Excel not accepted in 2026
MiCA STOR (Ireland)STOR form on the Central Bank Portal
OFAC blocked propertyOFAC Reporting System; email only for unblocking or transfer reports

A Reporting Calendar

Dates use the latest published cycle; recheck them yearly, then work through this list.

  • Confirm each DAC8 country's portal, registration route and national deadline.
  • Reconcile ledger totals to onchain balances before each annual tax file.
WhenFilingWho files
February 16, 2027 (our count)Form 1099-DA statements to customersUS brokers
March; BaFin sets March 31 yearlyDORA register of informationEU CASPs
March 31Form 1099-DA e-file through IRIS (2026 date)US brokers
April 15Part 500 certification; Part 504 findingPart 500 covered entities; Part 504 Regulated Institutions
May 31CARF report to HMRC, first in 2027UK providers
September 30DAC8 report, first in 2027 (EU outer date)EU reporting providers
September 30Annual report of blocked property held as of June 30Holders of blocked property
45 days after quarter endQuarterly financial statementsBitLicense holders
At least annually (no set date)CISO cybersecurity report to DFSBitLicense holders

Frequently Asked Questions

Do all crypto firms file Form 1099-DA?

No. Generally only US digital asset brokers file it. A firm filing 10 or more information returns in a year must file them electronically. Internal Revenue Service

Has the United States adopted CARF?

Not yet. It has committed to first exchanges by 2029. A proposed rule (RIN 1545-BQ82) was targeted for July 2026 but was unpublished as of November 14, 2026, so Form 1099-DA remains the US broker return. OECD Global Forum on Transparency and Exchange of Information for Tax Purposes, Office of Information and Regulatory Affairs (Reginfo.gov)

Which jurisdictions have not committed to CARF?

As of September 14, 2026, the Global Forum named El Salvador, Georgia, India and Viet Nam as relevant but not yet committed. Firms with users there should watch for later commitments. OECD Global Forum on Transparency and Exchange of Information for Tax Purposes

How long must SAR records be kept?

Money services businesses keep each SAR and its supporting documents for five years, and SARs are confidential. For violations needing immediate attention, they must also notify law enforcement by telephone right away. Cornell Legal Information Institute (text of CFR)

Sources

Test the systems behind your filings

Guardian's compliance assessments test the applications, APIs, infrastructure, smart contracts and custody controls your reports depend on, and map the evidence to MiCA, DORA, NYDFS and VARA. Your counsel and compliance team own the filings.

Talk to GuardianExplore the service