Self-certification and TIN validation: the CARF onboarding workflow

People treat CARF as a reporting problem. It is mostly a due-diligence problem that ends in a report. The framework expects a reporting CASP to know, for each user, where they are tax resident and what their tax ID is, and to have that from the day the account opens, not gathered the week a filing is due. Get onboarding right and the yearly report is straightforward. Get it wrong and no amount of XML tooling will fix the filing.

This guide walks the workflow end to end: the self-certification you collect, the reasonableness check you apply, how you validate a tax ID, the extra step for company accounts, and what happens when a user never provides one.

Step one: collect a valid self-certification

At account opening, each user provides a self-certification: a statement of their jurisdiction or jurisdictions of tax residence and the corresponding taxpayer identification number, along with the identity details the report needs (name, address, date and place of birth for individuals). This is the spine of the whole regime, because everything downstream, who is reportable and to which jurisdiction their data flows, depends on knowing residence correctly.

A self-certification has to be more than a checkbox. It has to be signed or clearly affirmed, dated, and collected before you treat the account as documented. An account that trades without a valid self-certification stores up a problem for filing time.

Step two: the reasonableness test

You cannot just file away whatever the user typed. CARF asks you to confirm the self-certification is reasonable against the rest of the information you hold. If a user certifies residence in one country but every other signal, their address, phone country code, IP, the currency they fund with, points somewhere else, that is a conflict you have to resolve before you rely on the certification. The reasonableness test keeps self-certification from being a box-tick, and it is exactly the kind of control an auditor will look at.

Step three: validate the TIN

A taxpayer identification number is not free text. Each jurisdiction defines its structure: length, allowed characters, and in many cases a checksum. Validating that structure at the moment of capture catches a large share of errors while the user is still in the flow and can fix them, rather than at filing time when an invalid TIN is one of the most common reasons a record is rejected. The downstream consequences of a bad TIN are covered in the errors that get filings rejected.

There are defined situations where a TIN is not required, for instance where the jurisdiction of residence does not issue one, and your workflow has to encode those exceptions rather than block a user who legitimately has no TIN to give.

Entity accounts and controlling persons

An entity account carries an extra layer. Beyond the entity's own residence and identification, you have to identify its controlling persons, the individuals who ultimately own or control it, and capture their residence and tax IDs too. Passive entities in particular can pull in individuals who never appear on the account, and missing them is a due-diligence failure that is easy to make.

When the certification never comes

Due diligence has to handle the user who opens an account and never provides a valid self-certification. You cannot let them transact indefinitely. CARF sets a cure period with reminders, and if it lapses you have to restrict the account until they comply. The mechanics of that cadence, the reminders, the window and the block, are worth their own read in the CARF 60-day rule.

Why it has to be one workflow

Self-certification, the reasonableness test and tax-ID validation are one workflow, not three separate checks. They share data, run in order, and feed the report directly: the identity block of each CARF XML record is exactly what this workflow produces. Our CARF and DAC8 reporting platform captures self-certifications, runs the reasonableness and TIN checks at onboarding, handles controlling persons and the cure-period cadence, and carries the validated result straight through to the filing, so the facts you collected at signup are the facts you file. For where this fits a venue, see exchanges and custodians, and the OECD exchange-of-information hub for the source rules.

About the author

Sukesh Tedla

Founder & CEO