CRS 2.0 went live. Here's what changed for founders.
Crypto is now reportable. CBI passports are flagged. Digital wallets are visible. The rules changed in January 2026 — most founders haven't noticed yet.
By Alex Diaz
CRS 2.0 went live in January 2026. If you hold crypto, use digital wallets, or got a second passport through a CBI program — the rules just changed and nobody sent you a memo.
The original CRS (Common Reporting Standard) from 2014 was about bank accounts. Your bank tells your country of tax residence how much money you have. Over 100 countries participate. That part hasn’t changed.
What changed: CRS 2.0 added crypto assets, digital wallets, e-money products, and CBDCs to the reporting scope. It also introduced a new framework called CARF (Crypto-Asset Reporting Framework) that runs alongside CRS. And it flagged CBI/RBI passport holders for the first time.
Key takeaways:
- Crypto assets, digital wallets, and e-money (Wise, Revolut) are now reportable under CRS 2.0 and CARF
- CBI passport holders are flagged — banks must report your CBI status to your tax authority
- Cold storage itself isn’t reportable, but exchanges report withdrawals to self-hosted wallets
- 67+ countries signed on to CARF. First automatic exchange: September 2027.
- Structures built on substance survive. Structures built on secrecy don’t.
If you run a 7 Flags structure, this matters. Here’s what actually changed and what you need to do about it.
The three changes that matter
1. Crypto is now reportable
The Crypto-Asset Reporting Framework (CARF) requires Reporting Crypto-Asset Service Providers (RCASPs) — exchanges, custodians, brokers — to report your crypto holdings and transactions to your country of tax residence.
What gets reported:
- Exchange transactions (buy, sell, swap)
- Crypto-to-fiat conversions
- Crypto-to-crypto trades
- Transfers to cold storage wallets — the CARF XML schema includes a field for wallet transfers and flags whether the destination is a self-hosted wallet or someone else’s
That last point is the one people miss. When you withdraw from an exchange to your hardware wallet, the exchange reports that transfer. They report the amount, the destination type (self-hosted), and your KYC identity. Your tax authority now has a link between your verified identity and an on-chain move.
They can’t see what you do with the crypto after it hits your cold wallet. But they know it left the exchange, they know how much, and they know it went to a wallet you control. That’s enough to ask questions.
67+ countries have signed on to implement CARF, including most of the jurisdictions founders use: UK, EU member states, Switzerland, Singapore, Australia, Canada. The first reporting period is calendar year 2026, with the first automatic exchange happening in 2027.
2. CBI passport holders are flagged
This is new. Under CRS 2.0, financial institutions must identify and flag clients who obtained residency or citizenship through investment programs.
If you opened a bank account using a passport from St. Kitts, Dominica, Antigua, Grenada, Malta, or any other CBI program — the bank now reports your CBI status alongside your account information.
Why this matters: CBI passports were historically used to open bank accounts in jurisdictions that wouldn’t share information with your original country of tax residence. CRS 2.0 closes that gap. The receiving country’s tax authority now sees not just your account balance but the fact that your identity document was obtained through investment.
This doesn’t make CBI illegal. But it removes the privacy arbitrage that made some CBI programs attractive. A second passport from Dominica is still useful for travel, for optionality, for genuine relocation. It’s no longer useful as a way to bank anonymously.
3. Digital wallets and e-money are in scope
CRS 1.0 covered traditional bank accounts and investment accounts. CRS 2.0 extends to:
- E-money products — Wise, Revolut, PayPal balances
- Digital wallets with stored value
- CBDCs (Central Bank Digital Currencies) — when they launch
- Specified electronic money products — basically anything that holds a balance and can be used for payments
If you use Wise as your multi-currency account, Wise now reports your balances under CRS 2.0 to your country of tax residence. Same for Revolut. Same for any EMI (Electronic Money Institution) that holds your money.
This was a gray area under CRS 1.0. Under CRS 2.0, it’s explicitly in scope.
What structures survive
Not everything changed.
Still fine
| Structure | Why It Survives |
|---|---|
| Territorial tax residency (e.g., Dominican Republic, Panama, Paraguay) | CRS reports go to your country of tax residence. If your country doesn’t tax foreign income, the report is informational — nothing to tax. |
| Multi-jurisdictional banking (declared) | Having accounts in multiple countries was never the problem. CRS reports are automatic. If you’re declaring everything, the reports just confirm what you already reported. |
| Companies with real substance | PoEM and CFC rules haven’t changed under CRS 2.0. A company with genuine substance in its jurisdiction of incorporation is treated the same as before. |
| Cold storage crypto (self-custodied) | CARF only applies to reporting entities (exchanges, custodians). Pure self-custody with no intermediary has no one to report. The exposure is at the on-ramp and off-ramp. |
Newly exposed
| Structure | What Changed |
|---|---|
| CBI passport used for banking privacy | Banks now flag CBI status. Your original country’s tax authority can see the flag. |
| Crypto held on exchanges in “friendly” jurisdictions | CARF is jurisdiction-agnostic. If the exchange is in a participating country, it reports. 67+ countries signed on. |
| E-money balances (Wise, Revolut) as banking alternative | Now explicitly reportable under CRS 2.0. Previously gray area. |
| Undeclared exchange-to-cold-wallet transfers | The exchange reports the withdrawal, including the self-hosted wallet flag. Your tax authority sees the outflow. |
The timeline
This is important because CRS 2.0 is live but the first reports haven’t been exchanged yet.
| Date | What Happens |
|---|---|
| January 1, 2026 | CRS 2.0 and CARF go live. Financial institutions start collecting data under new rules. |
| Throughout 2026 | Every transaction, account balance, and wallet transfer from Jan 1 onward is logged under the new framework. |
| May 31, 2027 | First reporting deadline. Institutions submit 2026 data to their local tax authority. |
| September 2027 | First automatic exchange between participating jurisdictions. Your country of tax residence receives the data. |
| 2028+ | Second wave of countries begin CARF exchanges. Full global coverage builds over 2-3 years. |
You have until September 2027 before the first data reaches your tax authority. That’s not a window to hide — it’s a window to get your structure right.
Countries that still don’t participate in CRS
Over 100 countries participate in CRS. A significant number don’t. Here are the non-CRS jurisdictions that are relevant to founders — the places you might actually consider living, banking, or incorporating.
- United States — The US doesn’t participate in CRS. It has its own system (FATCA) that’s one-directional: the US demands information from the world but doesn’t reciprocate through CRS. This is the single biggest gap in global tax transparency.
- Dominican Republic — No CRS participation. Combined with territorial taxation in practice, no CFC rules, and a cheap residency path, this is the setup I use personally.
- Paraguay — Territorial tax, no CRS. One of the easiest residencies in Latin America ($5K investment).
- Guatemala — Territorial tax, no CRS. Growing expat scene in Antigua and Guatemala City.
- El Salvador — No CRS. Bitcoin legal tender. Territorial tax on foreign income for non-residents.
- Cambodia — No CRS. Territorial tax. Dollar-based economy. Popular with digital nomads.
- Vietnam — No CRS. Growing tech scene, excellent cost of living.
- Philippines — No CRS. Large expat community, reasonable infrastructure.
- Armenia — No CRS. Growing tech scene in Yerevan, easy residency.
The OECD maintains the full list of participating jurisdictions. Wikipedia’s CRS page tracks both non-signatory countries and countries in the Global Forum that haven’t adopted CRS. Dozens more countries don’t participate — most are not realistic options for founders.
Important: not participating in CRS doesn’t mean invisible. FATCA still applies to US persons globally. Bilateral information-sharing agreements exist outside CRS. And some countries on this list may join in the future — the OECD actively pressures non-participants. Verify current status before making structural decisions.
For founders evaluating where to bank, CRS participation status matters — but it’s one factor, not the only one. A non-CRS jurisdiction with terrible banking infrastructure is worse than a CRS jurisdiction where you’re fully compliant.
What you should do
If you hold crypto on exchanges: Accept that every transaction from January 2026 onward will be reported to your country of tax residence. If you’re tax resident in a territorial tax jurisdiction that doesn’t tax foreign income, this is informational — nothing to worry about. If you’re in a worldwide taxation country, make sure your tax returns match what the exchange will report.
If you use CBI passports for banking: The privacy argument is dead. Keep the passport for travel, optionality, and genuine relocation. Stop using it as a banking identity if your goal was opacity.
If you rely on Wise/Revolut as your main account: These are now fully in scope. Treat them the same as a traditional bank account from a reporting perspective. Declare them. CRS 2.0 just confirmed what most tax advisors already assumed.
If you self-custody crypto: Your cold wallet isn’t reportable. But the path to it (exchange withdrawal) is. The on-ramp and off-ramp are visible. What happens on-chain between those points is not — for now.
If your structure has substance: Nothing changed for you. CRS 2.0 didn’t alter PoEM, CFC, or substance requirements. A well-structured international setup with real substance in each jurisdiction is exactly as legal and defensible as it was in December 2025.
The real takeaway
CRS 2.0 didn’t change the game for founders who were already playing by the rules with substance. Territorial tax residency still works. Multi-jurisdictional banking still works. Companies with real operations in their jurisdiction of incorporation still work.
What CRS 2.0 killed is the gray area between legal and visible. The structures that relied on “nobody can see this” rather than “this is genuinely legal” — those are done.
The move was always substance over secrecy. CRS 2.0 just made that distinction impossible to ignore.
FAQ
Does CRS 2.0 affect my crypto in cold storage?
Not directly. CARF only applies to reporting entities — exchanges, custodians, brokers. A hardware wallet with no intermediary has no one to report. But the exchange reports when you withdraw to a self-hosted wallet, including the amount and the fact that the destination is self-custodied. The on-ramp and off-ramp are visible.
Which countries participate in CRS 2.0?
Over 100 countries participate in CRS, and 67+ have signed on for CARF specifically. Notable non-participants: the United States (uses FATCA instead), Dominican Republic, Paraguay, Guatemala, Philippines. The US is the largest gap — it demands information through FATCA but doesn’t reciprocate through CRS.
Does CRS 2.0 mean territorial taxation doesn’t work anymore?
No. CRS reports go to your country of tax residence. If that country uses territorial taxation and doesn’t tax foreign income, the report is informational — there’s nothing to tax. Panama and Costa Rica participate in CRS but don’t tax foreign-source income. The report arrives, confirms your foreign accounts exist, and there’s nothing to assess.
Is my CBI passport now a liability?
Not a liability — but no longer a privacy tool. Banks flag CBI status under CRS 2.0. If you used a CBI passport primarily for banking opacity, that advantage is gone. If you got it for travel, genuine relocation, or optionality, nothing changed.
When do the first CRS 2.0 reports get exchanged?
First reporting deadline: May 31, 2027. First automatic exchange between countries: September 2027. Everything from January 1, 2026 onward is being collected now.
CRS 2.0 doesn’t require you to change your structure. It requires you to make sure your structure was built on substance, not on secrecy. If you’re not sure where you stand, the 7 Flags Framework walks through each jurisdiction choice and what it needs to survive scrutiny. The Flag Theory skill on GitHub runs a scored analysis of your specific setup.