The CARF 60-day rule: reminders, cure periods, and blocking users

The cadence

When a self-certification is missing or fails validation, you have to chase it. In practice that means at least two reminders across a 60-day window. The clock and the reminders aren't a nice-to-have; they're the documented steps you point to if a regulator asks why an account was, or wasn't, restricted.

The cure period

The 60 days is a cure period: the user's chance to fix the gap. Provide a valid certification inside the window and nothing happens, they carry on normally. The point isn't to punish anyone, it's to make sure you either have the tax data CARF requires or you've stopped the reportable activity that needs it.

The block

If the cure period lapses with no valid certification, you have to prevent the user from carrying out further reportable transactions until they comply. And the moment they do certify, the restriction lifts. It's a gate, not a ban.

Why automation matters here

This is a workflow that has to run per user, on a per-user clock, forever. Doing it by hand across a large book is where teams slip, and a missed block is exactly the kind of gap that surfaces in an audit. The self-certification and validation that feed this are covered in our CARF onboarding workflow piece. Our CARF and DAC8 reporting platform runs the whole cadence: it tracks each user's certification status, sends the reminders, blocks reportable transactions when the window closes, and clears the block the instant a valid certification lands. For where this fits in a venue's stack, see exchanges and custodians, and the OECD exchange-of-information hub for the source framework.