Self-certification and TIN validation: the CARF onboarding workflow

Step one: self-certification

At onboarding, each user provides a self-certification of their tax residence and taxpayer identification number. For an entity account, you also need to identify the controlling persons and their residences. This is the spine of the whole regime: everything downstream depends on knowing which jurisdictions a user is reportable to.

Step two: the reasonableness check

You can't just store the self-certification, you have to confirm it's reasonable against the rest of what you hold. If a user certifies residence in one country but every signal you have, address, phone country code, IP, points somewhere else, that's a conflict CARF expects you to resolve before you rely on the certification.

Step three: TIN validation

A taxpayer identification number has a defined structure in each jurisdiction: length, allowed characters, sometimes a checksum. Validating the format at capture catches a large share of errors before they ever reach a filing, where an invalid TIN is one of the most common reasons a report gets rejected. We go deeper on that in our piece on the CARF XML errors that get filings rejected.

What happens when it's missing

If a user never provides a valid self-certification, you can't just carry on indefinitely. CARF sets a cure period with reminders, and if it lapses, you have to restrict the account. The mechanics of that are worth their own read: see the CARF 60-day rule.

Building it once

The reason to treat this as one workflow, rather than three bolted-on checks, is that they share data and they feed the filing directly. Our CARF and DAC8 reporting platform captures self-certifications, runs the reasonableness and TIN checks at onboarding, and carries the validated result straight through to the report, so the same facts you collected at signup are the ones you file. If you're scoping this for an exchange, the exchanges and custodians overview shows where it sits in the stack. The OECD's exchange-of-information hub has the source rules.