TL;DR
ไทยเข้าร่วม OECD CARF (Crypto-Asset Reporting Framework) ตั้งแต่ 10 พ.ย. 2566 — เริ่มแลกเปลี่ยนข้อมูลครั้งแรก ก.ย. 2570; VASP ทุกแห่งที่ได้รับใบอนุญาตจากก.ล.ต. (Bitkub, Bitazza, Orbix, InnovestX, Upbit) กลายเป็น Reporting FI; ต้องเก็บ + รายงาน 12 รายการต่อลูกค้าต่อปี (ชื่อ, ที่อยู่ tax residency, TIN, ประเภทเหรียญ, จำนวน, มูลค่ายุติธรรม, transaction volume, อื่นๆ); ลูกค้าต่างชาติจะถูกส่งข้อมูลกลับไปประเทศบ้านเกิดอัตโนมัติทุกปี; ใช้คู่กับ CRS (ที่เริ่มแล้วตั้งแต่ ก.ย. 2566) ครอบคลุมทั้งบัญชีธนาคารและบัญชี crypto
Thailand joined the OECD CARF on 10 Nov 2023 with first exchanges in September 2027. All SEC-licensed VASPs become Reporting Financial Institutions, collecting and transmitting 12 data fields per foreign client per year (name, tax-residence address, TIN, asset type, quantity, fair value, gross transaction volume, etc.). Foreign clients face automatic disclosure to home tax authorities. CARF stacks on top of CRS (live since Sep 2023) — together covering bank, brokerage, and crypto positions of Thai-resident foreigners and Thailand-based foreign tax residents.
Legal architecture in Thailand
**OECD CARF Model Rules (Mar 2023)** — endorsed by Thailand 10 Nov 2023 alongside 47 jurisdictions in the Joint Statement.
**Domestic implementation:** Act on the Exchange of Information for Tax Compliance, B.E. 2566 (2023) — primary legislation covering both CRS and CARF; Ministerial Regulations expected late 2026 to set CARF technical schemas.
**Regulator:** Revenue Department (CARF reporting) + SEC (VASP licensing) coordinated under MOU 2025.
**EU DAC8 alignment:** Directive (EU) 2023/2226 mirrors CARF in EU — Thailand's CARF reporting will be automatically usable by EU receivers without re-formatting.
Who counts as a Reporting Crypto-Asset Service Provider (RCASP)
Any entity providing one or more 'relevant services': exchange between crypto and fiat; exchange between crypto and crypto; transfer of crypto (custodial); transaction-effecting on behalf of customers; brokerage; OTC desk.
**In Thailand:** all 9 SEC-licensed Digital Asset Exchanges (DAE), 4 Brokers, 7 Dealers, and 13 Fund Managers as at end-2025.
**Out of scope:** pure self-hosted wallet providers (e.g., MetaMask), pure node-operating validators, pure smart-contract auditing — provided they never custody or off-ramp.
The 12 reportable data fields per client per year
(1) Full legal name. (2) Date of birth. (3) Country/countries of tax residency. (4) Address. (5) Tax Identification Number (TIN) per residency.
(6) Account number / wallet identifier on the platform.
(7) Aggregate gross fair-market value received during the year.
(8) Aggregate gross fair-market value paid during the year.
(9) Number of units of each crypto-asset held at end of year + closing fair-market value.
(10) Transaction count.
(11) Total fair-market value of crypto-to-fiat transactions.
(12) Total fair-market value of reportable retail-payment transactions ≥ USD 50K.
Fair-market value: use end-of-day spot in USD on a reference exchange (CoinMarketCap top-20 weighted average), converted to local currency at central-bank rate.
Onboarding KYC under CARF
**Pre-existing clients (opened pre-1 Jan 2027):** RCASP must apply CARF due diligence retroactively by 31 Dec 2027. Self-certification form (residence + TIN) required.
**New clients from 1 Jan 2027:** self-certification at onboarding mandatory; account opening blocked without valid TIN per residency.
**Reasonableness test:** RCASP must compare self-certified residency against on-file KYC documents (passport, utility bill). Discrepancies trigger enhanced due diligence + potential reporting under multiple jurisdictions.
**Cure period:** 90 days from discovery to obtain corrected self-certification; otherwise account frozen.
Exchange mechanics — where the data goes
**Thai RCASP** → submits XML schema to Revenue Department by 30 June each year for prior calendar year.
**Revenue Department** → aggregates + transmits via OECD Common Transmission System (CTS) by 30 September each year.
**Receiving authority** → home tax authority of each foreign-residency client. Treaty basis: bilateral CAA (Competent Authority Agreement) — Thailand has CAAs with 60+ jurisdictions covering CRS + CARF combined.
**First Thai CARF exchange:** September 2027 (covering calendar year 2026 if Thailand opts for one-year retroactive scope, or 2027 only).
Practical implications for foreign holders
**EU residents:** holdings on Bitkub etc. will be auto-reported to home tax authority (DE Finanzamt, FR DGFiP, IT Agenzia). Crypto gains under home rules become unavoidably visible.
**US persons:** FATCA already covers fiat balances. CARF adds crypto. Combined disclosure stack is effectively total.
**Thai LTR-resident foreigners:** crypto held on Thai VASPs but classified as foreign-source asset on disposal (gains realized offshore) may still attract home-country tax under CARF disclosure — even if Thai LTR exempts the remittance side.
**Non-resident foreigners trading on Thai VASPs:** still reportable under CARF based on their home tax residency, even though they owe no Thai tax. Disclosure asymmetry: Thailand reports you out; you don't necessarily owe Thailand anything.
Penalty regime
**RCASP failure to report:** Act § 22 — fine up to THB 500,000 per default + THB 5,000/day continuing penalty.
**Wilful misreporting:** § 24 — imprisonment up to 5 years + fine up to THB 1M.
**Client failure to self-certify:** account closure + holdings frozen pending TIN production.
**Anti-avoidance rule (§ 19):** RCASP must look through any structure designed to avoid reporting (e.g., interposing shell entities); SEC + Revenue jointly empowered to disregard.
คำถามที่พบบ่อย
Does self-custody (private wallet) escape CARF?+
Pure non-custodial self-hosted wallets (MetaMask, Trust Wallet, Ledger) are out of CARF scope. But every off-ramp through a Thai VASP triggers CARF reporting at that VASP — the on-chain → fiat conversion is the reportable event. Sustained self-custody with no off-ramp is unreported; the moment you bridge to fiat, you re-enter CARF.
What about DeFi positions held via Thai-resident wallets?+
Pure DeFi smart-contract positions (Uniswap LP, Aave deposits, Lido stETH) are presently out of scope. OECD published a CARF Phase 2 consultation in 2025 considering DeFi inclusion — likely live by 2029. For now, only centralized RCASP-managed positions are CARF-reported.
Will CARF affect my Thai Privacy / PDPA rights?+
PDPA § 24(6) exempts disclosure required by law — CARF reporting is statutorily mandated, no PDPA consent required. RCASP must, however, notify clients at onboarding that data will be reported under CARF (transparency obligation under PDPA § 23).
If I'm UK-resident trading on Bitkub, when does HMRC see my data?+
First exchange: September 2027 covering calendar year 2026 or 2027 (Thailand's election). HMRC then cross-checks against your UK Self Assessment for CGT under TCGA 1992 + crypto-asset reporting standards. Voluntary disclosure before HMRC contact via DDS is strongly advisable.
Can my Thai VASP refuse to onboard me if I'm tax-resident in a non-cooperative jurisdiction?+
Yes — RCASP risk-rating policies typically blacklist or enhanced-DD jurisdictions on the OECD's non-cooperative list (currently 11 jurisdictions including Anguilla, Bahamas, Belize, BVI, Panama, Seychelles, Trinidad & Tobago, Turks & Caicos, US Virgin Islands, Vanuatu, Russian Federation). Onboarding refusal is discretionary but increasingly common.
