CARF deadlines and penalties, jurisdiction by jurisdiction

Here's the thing about CARF timing: the clock is already running. Collection is live, so the transactions you record now are the ones you file later. Those 2027 deadlines everyone points at aren't the start of the work. They're the moment your 2026 data quality gets tested. This guide lays out the timeline, why penalties differ so much between countries, and what actually sets one off, so you can plan back from each date instead of sprinting at it.

The timeline: collect now, file in 2027

Collection has been running since the start of 2026. First reports come due in 2027, and the early movers bunch up there:

• United Kingdom: first reports due by 31 May 2027.
• New Zealand: first reports due by 30 June 2027, and mind the country's tax-year offset.
• European Union under DAC8: first reporting due by 30 September 2027, with member states registering providers and collecting through 2026.
• Other jurisdictions phase in on their own schedules, and the United States joins later on its own timetable.

The practical takeaway: the report you file in 2027 is only as good as the due diligence and reconciliation you did in 2026. You can't retrofit a year of clean, validated data the month before a deadline.

Why penalties vary so much

There's no single CARF penalty, because CARF isn't self-executing law. It's a common framework, and each jurisdiction implements it through its own statute. DAC8 sets a baseline of expectations across the EU, then each member state legislates the actual fines and enforcement; other participating countries set theirs directly. So exposure for a late or defective filing is a national question. A provider reporting across several jurisdictions faces several penalty regimes at once, each with its own amounts, cure provisions and escalation.

So the sensible planning assumption is a posture rather than a number. Treat every filing jurisdiction as capable of penalising late, incomplete or invalid reporting, and manage to the strictest one you're exposed to.

What actually triggers a penalty

The triggers stay consistent even where the amounts don't. Three buckets: filing late, filing data that fails validation, and failing to apply due diligence. That last bucket covers the self-certification and TIN validation you owe at onboarding and the 60-day cure-and-block cadence for users who won't certify. And a rejected file you don't correct and resubmit before the deadline can count as a missed filing on its own, which is why validating before submission matters as much as the date.

Where you actually owe the filing

A deadline only bites in the jurisdictions where you actually have to file, and that's decided by your establishment, not where your users live. Unsure how many filing obligations you really have? Start with nexus under CARF, which explains why most providers report in a single jurisdiction rather than every country their users sit in.

Staying ahead of every date

The risk compounds across jurisdictions, so the goal is to be filing-ready well ahead of each date. Our CARF and DAC8 reporting platform tracks each authority's deadline, validates before you submit, and runs the due-diligence workflow that keeps you clear of the penalty triggers in the first place, so a deadline turns into a date you clear rather than one you race. The EU tax cooperation pages and the OECD exchange-of-information hub are the primary sources for the framework and the national timelines.

About the author

Sukesh Tedla

Founder & CEO