FATCA, CRS, DAC8 & CARF: Every Reporting Obligation for German Financial Institutions, in One Map

Four acronyms turn up in almost every German reporting conversation — FATCA, CRS, DAC8 and CARF — and they are nearly always explained one at a time, each in its own dense set of BZSt guidance, as if they were four unrelated problems. They are not. They are four versions of a single job: telling a tax authority, on a schedule, who holds what.

This piece puts the whole landscape on one page. One map of the four regimes — what each covers, who is in scope through a German-institution lens, where it is filed, and what is actually changing — so you can see where your obligations sit without reading four sets of guidance to find out which ones apply to you.

Two of these regimes are live today and have been for years. Two are new: they arrive with the 2026 reporting year and bring a cohort of crypto-asset providers into cross-border tax reporting for the first time. The map makes that split obvious.

The map: FATCA, CRS, DAC8 and CARF at a glance

Regime	What it covers	Who’s in scope (German-FI lens)	Filed in Germany to	Status & first reporting period
FATCA	Accounts held by US persons	Reporting Financial Institutions — banks, funds, custodians, many payment and e-money institutions	BZSt → IRS (Model 1 IGA), on the DIP rail	Live. Annual; filed by 31 July for the prior calendar year
CRS	Accounts held by tax residents of 100+ partner jurisdictions	The same Reporting Financial Institutions, via the FKAustG	BZSt, on the DIP rail	Live. Annual; filed by 31 July, partitioned by jurisdiction
DAC8	Crypto-asset transactions — the EU’s transposition of CARF	Reporting crypto-asset service providers and operators — broader than MiCAR-licensed CASPs	BZSt, under the KStTG, on the DIP rail	New. Rules apply from 2026; first report due 31 July 2027
CARF	Crypto-asset transactions — the OECD global standard behind DAC8	Reporting crypto-asset service providers	BZSt (via the KStTG), on the DIP rail	New. 48 jurisdictions committed; first exchanges 2027 (a further wave from 2028)

One point the table makes visually is worth saying out loud: for a German institution, DAC8 and CARF are not two separate filings. CARF is the OECD’s global model; DAC8 is how the EU implements it; and Germany implements DAC8 through a single law — the Kryptowerte-Steuertransparenzgesetz (KStTG). A German provider files once, not twice. And all four regimes land at the same place, the Bundeszentralamt für Steuern (BZSt), increasingly over the same programmatic rail.

FATCA and CRS: what’s live today

If you carry a filing obligation now, it is almost certainly one of these two — and often both.

FATCA is a United States law. It asks German institutions to identify and report accounts held by US persons. Germany implements it through a Model 1 Intergovernmental Agreement: you report to the BZSt, and the BZSt transmits the consolidated data to the IRS. The German filing is generally due by 31 July for the preceding calendar year.

CRS is the part people forget is not American. It is the OECD’s Common Reporting Standard, implemented in Germany through the Finanzkonten-Informationsaustauschgesetz (FKAustG), and it covers tax residents of more than one hundred participating jurisdictions — the entire EU included. “All our clients are in Europe” is not a reason CRS does not apply; it is precisely the case CRS was built for.

The obligation to file both comes from what you are — a Reporting Financial Institution — not from whether a given year’s review turns up anyone reportable. If you are unsure whether you are even obligated, we wrote a separate guide to exactly that question: FATCA & CRS Filing: Do You Actually Have to File?

DAC8: what actually changes, and who is newly in scope

DAC8 is Council Directive (EU) 2023/2226, which extends the EU’s automatic exchange of tax information to crypto-assets. It was adopted in October 2023; Member States had to transpose it by the end of 2025, and its rules apply from 2026. The first reporting period is the 2026 calendar year.

Germany has transposed it through the Kryptowerte-Steuertransparenzgesetz (KStTG), promulgated in December 2025. Under it, the first report covering 2026 is due to the BZSt by 31 July 2027 — the same July rhythm FATCA and CRS filers already know — with onward exchange between authorities following that autumn.

Two things about the scope catch people out.

First, who is caught is broader than “MiCAR CASPs.” DAC8 reaches reporting crypto-asset service providers and operators, and it applies to providers serving EU users regardless of where the provider itself is established. Many of these entities have never filed anything with the BZSt, because under the pre-DAC8 definitions they were not financial institutions at all. Their engineering is built around custody and trading, not tax-reporting integrations; their compliance teams have spent the last two years on MiCAR authorisation and AML build-out, not on FATCA-style filing.

Second, DAC8 reaches domestic users. FATCA and CRS were designed to find non-resident account holders. DAC8 and CARF are not so limited — a German exchange reports on its German customers as well as its EU and third-country customers. For a provider whose compliance model assumed “we only serve locals, so cross-border reporting is not our problem,” that is a meaningful expansion.

CARF: the global standard behind DAC8

CARF — the OECD’s Crypto-Asset Reporting Framework — is the international model that DAC8 puts into EU law. The OECD published it alongside a 2023 update to the CRS, and — in a joint statement that year — 48 jurisdictions committed to begin exchanging crypto-asset information by 2027, with a further wave following from 2028 (the group has since grown well beyond the original 48). Providers begin gathering the data in 2026.

For a German institution, the practical relationship is simple: you do not file CARF and DAC8 separately. CARF is the standard, DAC8 is the EU’s transposition of it, and the KStTG is how it lands in German law. Reporting uses the OECD CARF XML schema, submitted to the BZSt — the same authority, and the same programmatic interface, that receives your FATCA and CRS data. The four regimes converge on one filing surface, which is exactly why it makes sense to see them on one map rather than four.

What a German financial institution should do now

None of this needs to be alarming, and there is time. But the useful moves are the early ones, and they are the same moves whether you are an established bank adding a regime or a crypto provider filing for the very first time.

If you want the full technical treatment — the DIP API transition, the XML schemas, how Germany compares with Luxembourg, Ireland and the Netherlands — that is the subject of our FATCA, CRS and DAC8 whitepaper.

One authority, one rail

The reason to hold all four regimes on a single map is that, for a German institution, they end in the same place. FATCA, CRS, DAC8 and CARF each ask a version of the same question, and each is answered by filing schema-valid data to the BZSt — increasingly over the same DIP interface.

That is the premise Regfiler is built on. It runs FATCA and CRS filing on the BZSt’s DIP rail today, and it is being built to carry DAC8 and CARF as those regimes come online — so that the crypto-asset reporting wave lands as another filing on a rail you already trust, not as a second system to stand up from scratch. The obligations will keep arriving; the place they are filed, and the discipline that makes them audit-defensible, does not have to change with each one.