CRS Sees Your Bank, Not Your Keys: What Automatic Exchange Actually Reports When Your Wealth Is in Self-Custody

Somewhere on X right now, a Bitcoiner is ending a tax-privacy argument with one line: the Common Reporting Standard (CRS) cannot see my cold storage. The line is true. It has been true since the standard was written. And almost nobody who deploys it can answer the three questions that actually matter: what does CRS report, where exactly does its visibility end, and what happens to that boundary now that the crypto-asset reporting era has started? The meme is a half-sentence from a real map. If you are structuring a second citizenship, a banking setup, or a decade of self-custodied wealth around it, you want the whole map.

CRS was built to see accounts, and self-custody is not an account. Both halves of that sentence are true. Neither one is the whole story.

What The Standard Actually Reports

CRS is the OECD framework for automatic exchange of financial account information, approved in 2014, with the first exchanges flowing in September 2017. As of mid-2026, 119 jurisdictions have actually exchanged data under it, with more than 125 committed. It is not a treaty you opt into as a person; it is plumbing between tax authorities. You never see it operate.

The mechanics are precise, and the precision is the point. Four categories of financial institution must report: depository institutions, custodial institutions, investment entities, and specified insurance companies. Once a year, automatically, they report every account held by a non-resident: the holder’s name, address, jurisdiction of tax residence, tax identification number, and date and place of birth; the account number; the year-end balance or value; and the money the account produced, interest, dividends, and, for custodial accounts, gross proceeds from sales of financial assets. That file goes to the institution’s tax authority, which forwards it to the tax authority where you are resident. Open a bank account in Zurich as a Madrid resident and Spain hears about it every year without asking.

One giant sits outside the system. The United States never joined CRS; it runs its own regime, the Foreign Account Tax Compliance Act (FATCA), which pulls data on US persons from foreign institutions with only limited traffic in the other direction. Keep that asymmetry in mind; it matters later, because the US has now committed to the crypto-asset framework with first exchanges by 2029.

What CRS Was Never Built To See

Now the half of the meme that is correct. CRS reports accounts at financial institutions. A hardware wallet is not an account. There is no institution, no custodian, no year-end statement, and no entity anywhere with a reporting obligation attached to your keys. Coins you hold yourself simply do not generate a CRS record, not because anyone carved out an exemption, but because the 2014 framework was written for banks and brokerages, years before self-custodied digital assets held serious wealth.

The OECD itself said so when it finally moved to close the gap, noting that crypto-assets can be held in cold wallets or on exchanges that fall outside the standard’s definitions, and were therefore unlikely to be reported reliably. Even coins sitting on a custodial exchange lived in a gray zone for years: whether that platform counted as a reporting financial institution depended on classification questions the standard never anticipated. Some reported. Many did not. The asset class as a whole sat largely outside the world’s account-reporting plumbing, and the part of it held in self-custody sat entirely outside.

So the slogan survives contact with the source documents: CRS sees your bank, not your keys. What the slogan skips is everything around the keys.

The Perimeter Runs Through The Ramp

Self-custody is dark to CRS. Your life around it is not. Sell Bitcoin and wire the proceeds to a bank in a CRS jurisdiction, and you have created a depository account with a year-end balance and interest, reported automatically. Sell through a platform that qualifies as a custodial institution, and gross proceeds are a named, reportable line item. Buy the dip from your foreign brokerage, hold a yield product, or run fiat through an investment entity, and the amounts paid to you travel home in the annual file. The standard never needed to see the coins to see the money that bought them and the money they became.

This is the first correction to the meme: CRS visibility was never about Bitcoin at all. It is about where your fiat touches an institution, and a Bitcoiner with a mortgage, a salary account, or an exit into euros touches institutions constantly. The keys are a vault inside a glass house; the vault is opaque, the house never was.

It is worth being precise about what the annual file contains, because the precision cuts both ways. CRS reports balances and income categories, not an itemized ledger of your wires. When a client funds a São Tomé donation from a bank account in a CRS jurisdiction, that account’s existence and year-end balance were already in the file; the transfer itself is not a separately reported event. And a contribution settled directly in Bitcoin, as El Salvador’s Freedom Passport requires, never touches a depository account at all: there is no CRS event anywhere in the payment, which is part of why a Bitcoin-denominated program is structurally different from a wire-denominated one. None of that hides the wealth from a source-of-funds review; the program’s own due diligence sees everything, on purpose. It just means the automatic-exchange plumbing was never the mechanism watching the purchase.

The second correction to the meme is more recent, and it has a start date.

The Perimeter Is Moving: CARF

In October 2022 the OECD published the Crypto-Asset Reporting Framework (CARF), a parallel standard built specifically for the gap. As of the OECD’s February 2026 list, 76 jurisdictions have committed to it: 47 with first exchanges by 2027, 28 more by 2028, and the United States by 2029. In the European Union, the implementing directive known as DAC8 applies from January 1, 2026, which means the data collection is no longer pending; it is running now, with the first exchanges due by 30 September 2027. Note what the commitment list means: even the country that never joined CRS will be exchanging crypto-asset data by 2029, and most of the traditional financial world will be exchanging it before that.

CARF attaches obligations to Reporting Crypto-Asset Service Providers (RCASPs): exchanges, brokers, dealers, and platforms that execute crypto-asset transactions. They must collect tax-residence self-certifications from users and report annually: crypto-to-fiat and crypto-to-crypto trades in aggregate, large retail payments, and transfers. Including, and this is the line every self-custody Bitcoiner should read twice, the aggregate value and number of units a user withdraws to wallet addresses not known to belong to another service provider. In plain terms: from the 2027 exchange cycle, the fact that you moved coins from your exchange account to your own cold storage becomes part of your annual reportable footprint. The wallet addresses themselves are not in the automatic file, but the service provider must keep them on record for at least five years and produce them if your tax authority asks.

What CARF still does not do is reach the keys themselves. No reporting obligation attaches to an individual who holds their own coins and transacts peer-to-peer without touching a service provider. Pure self-custody remains outside both CRS and CARF. The boundary has not disappeared; it has been redrawn, tightly and deliberately, at the service-provider door, and the bridge between your exchange history and your cold storage is now documented from the institutional side.

Reporting Is Not Tax, And The Difference Is Everything

Here is where the meme does real damage if you let it think for you. CRS and CARF are reporting systems. They create visibility, not liability. Your tax obligations are set by the law of your country of tax residence, and they exist whether or not anyone reports anything. A German resident owes German tax on a realized gain from a cold wallet the state cannot see; the darkness of the wallet changes detection, not the debt. Deliberately relying on a reporting gap to hide taxable income is evasion, and no serious advisor, this firm included, will build you that. And if you are American, none of this map moves your federal bill at all: the United States taxes its citizens on worldwide income no matter where they live or what reports.

What jurisdiction and custody choices legitimately buy is something different: data minimization. Fewer automatic flows of your name, balances, and movements through foreign databases. Less exposure to leaks, breaches, and bureaucratic overreach. Privacy as a posture, fully compatible with paying every cent you owe, and paired, when a citizenship file is on the table, with the source-of-funds documentation that proves it. That is the honest version of the argument, and it is strong enough that it does not need the dishonest version.

The Map, Jurisdiction By Jurisdiction

Lay the slate over the reporting map and the structure gets concrete. Vanuatu participates in CRS and has exchanged since 2018, reaching 67 partner jurisdictions; it has not committed to CARF. Türkiye participates in CRS and has committed to CARF in the 2028 wave. Argentina has exchanged under CRS since the first 2017 cycle and has signaled CARF intent without yet formally committing. São Tomé and Príncipe appears on none of the lists: no CRS commitment, no CARF commitment, not a Global Forum member at all. El Salvador participates in neither CRS nor CARF, though honesty requires the footnote: the Global Forum has formally identified it as relevant to CARF, which means it is on the radar and under pressure, and a posture that exists today is not guaranteed forever.

What does Non-CRS actually mean, stated factually? Accounts you open in São Tomé or El Salvador are not automatically reported to your country of tax residence, because those jurisdictions are not in the exchange network. That is a privacy fact, not a tax outcome, and it pairs with the same caveat as everything above: your residence country’s law still applies to you, and a US passport carries its obligations everywhere. For how all of this scores jurisdiction by jurisdiction, tax treatment, reporting posture, and the rest, the Bitcoin Passport Index weighs reporting frameworks across 87 jurisdictions in its inaugural 2026 edition.

Design For The Map That Exists

Strip it to the decision logic. If your priority is minimizing automatic data flows, the structural moves are real: a Non-CRS citizenship like São Tomé or El Salvador, banking arranged where it is not auto-reported, self-custody kept clean and documented. If your priority is something else, speed, mobility, cost, the reporting map is one input among several, and pretending it is the only axis produces bad passports. Either way, build for the 2027 map, not the 2016 one: assume your exchange history, including withdrawals to your own wallets, becomes part of the reportable record in CARF jurisdictions, and let your structure be one that survives that visibility because it was never hiding anything.

The slogan was right all along, just smaller than it sounded. CRS sees your bank, not your keys. CARF will see your exchange, still not your keys. Nothing sees a tax obligation out of existence. Sovereignty is not the art of being invisible; it is the art of owing exactly what the law says, structured in jurisdictions you chose on purpose, with documents that prove it. If you want the map applied to your own stack and residence, book a confidential advisory session. Encrypted, no obligation, and no payment required to start the conversation.

This is general information, not tax or legal advice for your situation. Reporting frameworks and jurisdiction commitments change; the statuses described here are as of June 2026. Consult a qualified tax advisor regarding your specific circumstances before you act.