CARF deadlines and penalties: what CASPs are working against

The timeline

Collection has been running since the start of 2026, and the first reports come due in 2027. The early movers cluster there: the UK's first reports are due by 31 May 2027, New Zealand by 30 June, and the EU under DAC8 by 30 September. Other jurisdictions phase in on their own schedules, with the US joining later. The practical point is that the data quality you need in 2027 depends on the collection you do today.

Why penalties vary

There isn't one CARF penalty, because CARF is implemented through each jurisdiction's own law. The EU sets expectations through DAC8, and member states legislate the specific fines; other countries set theirs directly. So the exposure for a late or defective filing is a national question, and a provider in scope across several jurisdictions faces several regimes at once.

What actually triggers them

The common triggers are consistent even where the amounts differ: filing late, filing data that fails validation, or failing to apply due diligence, including the self-certification and blocking cadence. A rejected file that you don't fix in time can count as a missed filing, which is why validation before submission matters as much as the deadline itself.

Staying ahead of it

Because the risk compounds across jurisdictions, the goal is to be filing-ready well before each date, not scrambling at it. Our CARF and DAC8 reporting platform tracks each authority's deadline, validates ahead of submission, and runs the due-diligence workflow that keeps you out of the penalty triggers in the first place. For where you fall in scope, see nexus under CARF, and the EU tax cooperation pages for the DAC8 framework.