Self-certification and TIN validation: the CARF onboarding workflow

People treat CARF as a reporting problem. Really it's a due-diligence problem that happens to end in a report. The framework expects a reporting CASP to know, for every user, where they're tax resident and what their tax ID is, and to have it from the day the account opens rather than scrambled together the week a filing is due. Get onboarding right and the yearly report is easy. Get it wrong and no amount of XML tooling saves the filing.

This guide walks the workflow end to end: the self-certification you collect, the reasonableness check you run against it, how you validate a tax ID, the extra step company accounts bring, and what to do when a user never provides one.

Step one: collect a valid self-certification

At account opening, each user gives you a self-certification: a statement of their jurisdiction or jurisdictions of tax residence and the matching taxpayer identification number, plus the identity details the report needs (name, address, date and place of birth for individuals). This is the spine of the regime. Everything downstream, who's reportable and which jurisdiction their data flows to, hangs on getting residence right.

A self-certification has to be more than a checkbox. Signed or clearly affirmed, dated, and collected before you treat the account as documented. Let an account trade without one and you're banking a problem for filing time.

Step two: the reasonableness test

You can't just file away whatever the user typed. CARF asks you to confirm the certification is reasonable against the rest of the information you hold. Say a user certifies residence in one country while every other signal, their address, phone country code, IP, the currency they fund with, points somewhere else. That's a conflict, and you resolve it before you rely on the certification. The test is what keeps self-certification from being a box-tick, and it's the kind of control an auditor goes straight to.

Step three: validate the TIN

A taxpayer identification number isn't free text. Each jurisdiction defines its structure, length, allowed characters, often a checksum. Validate that structure at the moment of capture and you catch a large share of errors while the user is still in the flow to fix them, instead of at filing time, when an invalid TIN is one of the most common reasons a record gets rejected. What a bad TIN does downstream is covered in the errors that get filings rejected.

Some situations don't require a TIN at all, for instance where the jurisdiction of residence doesn't issue one. Your workflow has to encode those exceptions rather than block a user who genuinely has no TIN to give.

Entity accounts and controlling persons

An entity account adds a layer. Beyond the entity's own residence and identification, you identify its controlling persons, the individuals who ultimately own or control it, and capture their residence and tax IDs as well. Passive entities especially can pull in people who never show up on the account, and missing them is an easy due-diligence failure to make.

When the certification never comes

Due diligence also has to handle the user who opens an account and never provides a valid self-certification. You can't let them transact forever. CARF sets a cure period with reminders, and if it lapses you restrict the account until they comply. The mechanics of that cadence, the reminders, the window, the block, get their own read in the CARF 60-day rule.

Why it has to be one workflow

Treat self-certification, the reasonableness test and tax-ID validation as one workflow. They share data, run in sequence, and feed the report directly. The identity block of each CARF XML record is exactly what this workflow produces. Our CARF and DAC8 reporting platform captures self-certifications, runs the reasonableness and TIN checks at onboarding, handles controlling persons and the cure-period cadence, then carries the validated result straight through to the filing, so the facts you collect at signup are the facts you file. For where this fits a venue, see exchanges and custodians, and the OECD exchange-of-information hub for the source rules.

About the author

Sukesh Tedla

Founder & CEO