SARS and your crypto data: how CARF reporting actually works

If you hold crypto on Luno, VALR, or an exchange in another country, you've probably heard some version of this line lately: SARS now sees everything. It comes up in every crypto WhatsApp group and under every exchange post. Sometimes it lands as a warning, sometimes as a shrug. Either way, it's worth pinning down what's actually true, because the real story comes with specific dates attached, and those dates change what you should be doing this year.

The reason people are talking about it is a set of rules called CARF, short for the Crypto-Asset Reporting Framework. Here's what it does, and what it doesn't do yet.

The claim: exchanges already report everything to SARS

The popular version goes like this. Every trade you make gets handed to SARS automatically, in real time, so there's no point trying to hide anything. The first half of that is becoming true. The timing is where it falls apart.

CARF took effect in South Africa on 1 March 2026. From that date, crypto service providers have to collect reportable information about their users and transactions. They're collecting it right now. But collecting is not the same as reporting. The first CARF returns only reach SARS by 31 May 2027, covering the period from 1 March 2026 to the end of February 2027. And the first time that information gets shared automatically between countries is September 2027.

So "reports everything, right now" is not quite it. The collecting is live. The reporting is on a schedule. That gap matters, and not in the comforting way most people assume, as you'll see further down.

Who actually does the reporting

Here's the part that gets lost in the noise. Under CARF, the reporting duty sits with the platform, not with you.

A Crypto-Asset Service Provider is an exchange, broker, dealer, or custodial wallet provider with a real connection to South Africa. That means it's tax-resident here, incorporated here, centrally managed here, or running a regular place of business here. For most South Africans, Luno and VALR are the obvious examples. They collect the data and they file the CARF return.

You don't file anything under CARF. You never did. Your obligation is the one you already had, which is to declare your own crypto gains and income on your tax return. CARF adds no step for you. What it changes is how easily SARS can line up what you declared against what the platform reported.

What about offshore exchanges?

This is where a lot of people assume they're in the clear. If your coins sit on an exchange registered in another country, surely SARS can't reach them.

Not for long. CARF is an international framework, and participating jurisdictions share data with one another. From September 2027, that first automatic exchange includes data about South African users on platforms in participating countries. The offshore exchange doesn't report to SARS directly. It reports to its own tax authority, and that authority passes the South African-user information across. Different route, same destination.

The practical takeaway is simple. "Offshore" is not the shield it used to be. If you've been treating an international account as invisible, that assumption has an expiry date on it now.

Why "they can't see me yet" misses the point

Read the timeline once and it's tempting to conclude you've got until 2027 to worry about any of this. That reading is wrong, for two reasons.

First, SARS doesn't need CARF to get exchange data. It already gets it through other channels. SARS can issue information requests to exchanges, and it has broad third-party data powers to pull records. CARF makes that flow automatic and routine. The flow itself already exists.

Second, and this is the one people skip over, everything you've done on a South African exchange since 1 March 2026 is already being recorded for that first CARF return. The reporting date is 2027. The activity being reported reaches back to 1 March 2026. So the window to get your history clean is not "sometime before 2027". It's now, before the first returns land and before your declared figures start getting checked against a second set of records.

The direction of travel here isn't really in doubt. Betting on staying invisible is a poor wager when the whole system is being wired up to make you visible.

What to actually do about it

None of this is a reason to panic. It's a reason to get your records straight while it's still on your terms rather than SARS's.

Start with the history. Pull your full transaction record from every exchange and wallet you've touched, including closed accounts and the old CSV files you'd forgotten about. Then check it for completeness, because missing deposits, unmatched transfers, and unexplained gaps are exactly what turn a straightforward return into a mess. Once the history holds together, declare it properly on your return for the 2026 year of assessment (1 March 2025 to 28 February 2026), the one you file during Filing Season 2026.

One trap to sidestep. If you get an auto-assessment and it says nothing about crypto, that's not a green light. Auto-assessments are built from third-party data like employer and bank records, and crypto activity generally isn't in that data yet. Silence is not the same as "you owe nothing". If you had disposals or crypto income during the year, you may need to edit or reject the auto-assessment and file it properly.

If there are earlier years where crypto went undeclared, look hard at the Voluntary Disclosure Programme before SARS gets to you first. The VDP can waive understatement penalties and protect you from criminal prosecution for the default you disclose. The tax and the interest still stand, but that beats penalties that can climb to 200% of the tax in the worst cases. The catch is right there in the name. It only works while it's voluntary, which means before SARS notifies you of an audit or investigation into that issue. We walk through the requirements and the process in the crypto VDP guide.

For the wider picture on how SARS treats crypto, from the revenue-versus-capital split through to capital gains tax, the South African crypto tax guide covers the ground.

How Coinfig fits in

Rebuilding years of history across three exchanges and a couple of wallets by hand is grim work. That specific job is what we built Coinfig for.

You connect Luno, VALR, and Kraken with read-only API keys, or bring anything else in by CSV. Coinfig turns that jumble into filing-ready output: capital gains summaries, transaction schedules, an income breakdown, and an export your accountant can actually work from. The completeness check flags missing history, unmatched transfers, and odd balance changes before you file rather than after. The free report covers up to 100 transactions, so you can see where you stand before paying anything.

To be plain about what it is, Coinfig runs the calculation and produces the reporting. It doesn't hand out tax advice and it doesn't file on your behalf. You or your tax practitioner stay in charge of the final call. If you want to see your own numbers, start at coinfig.tax.

The real clock on this isn't 2027. It's getting your history in order before the first CARF returns turn your crypto past into someone else's record.

This article is general information, not tax advice. Crypto tax outcomes depend on your specific circumstances. For complex situations, consult a qualified tax practitioner.