A UK-based crypto group serves customers resident in the European Union and Brazil through one app and several affiliated companies. Customers can buy and exchange cryptoassets, hold them in custody and transfer them to other wallets. The companies performing those services face overlapping tax-information duties. This hypothetical case study follows their 2026 reporting decisions under the EU’s DAC8 rules, national implementation of the OECD Crypto-Asset Reporting Framework and Brazil’s DeCripto requirements. It compares a single UK executor, separate Irish and UK execution businesses, and a Brazilian introducer that acquires operational functions. The central question is which legal entity must collect information and report each activity, and when a filing can discharge another obligation.
Executive Summary
- Genuine regional execution gives this group the clearest allocation. An authorised Irish company should contract with EU customers and provide their exchange and custody services. A UK company should execute the non-EU business, with a separate UK custodian providing that business’s custody and transfers. Each reporting allocation depends on those companies actually performing the stated services. (Directive 2011/16/EU, Annex VI, I and IV.B; UK S.I. 2025/744, regs. 2–4.)
- A shared app, brand and ledger can support several reporting entities. The operator of the exchange service, the custodian and the owner of the software require separate classification. Pure licensing, technical support or customer introduction does not automatically make an affiliate a reporting provider. Actual control of a trading platform can change that result. (CARF Commentary, IV, paras. 21–28; IN RFB nº 2.291/2025, Annex I, items 17–18.)
- Irish and UK providers report their own required populations to their respective tax authorities. Ireland permits complete same-provider CARF information to be included in its DAC8 return. That coordination does not combine separate companies into one filer or automatically discharge Brazilian duties. (Taxes Consolidation Act 1997, ss. 891M and 891HA(17); UK S.I. 2025/744, reg. 6; IN RFB nº 2.291/2025, arts. 7–9.)
- Brazil-directed advertising brings the two assumed UK service businesses into a separate DeCripto analysis. Brazil expressly covers custody and transfers, so the UK custodian can owe Brazilian reports even while remaining outside the UK CARF exchange-service definition. The pure Brazilian marketer remains an introducer until its own conduct crosses the provider test. (IN RFB nº 2.291/2025, art. 5(I)(e), §1(IV), Annex I, items 17–18.)
- A Brazilian resident’s qualifying activity through foreign providers can create a separate user return. From July 2026, the relevant combined monthly value must exceed R$35,000. Foreign-provider reporting does not expressly remove that user duty. Temporary travel and additional wallets do not create new thresholds. (IN RFB nº 2.291/2025, arts. 5(II), §3, and 9.)
- Irish and UK 2026 information is due from the providers by 31 May 2027. Irish first-year registration is due by 31 December 2026; initial UK registration is due by 31 May 2027. Brazilian monthly reporting already applies, and applicable annual information is due by the last business day of January 2027. The EU authority-exchange timetable is a separate stage. (Taxes Consolidation Act 1997, s. 891M(2)–(6); UK S.I. 2025/744, regs. 6 and 10; IN RFB nº 2.291/2025, arts. 12 and 19; Directive 2011/16/EU, art. 8ad(6).)
- The group needs one traceable record of the customer and economic event, with distinct legal-provider and national-reporting decisions. It must preserve all relevant tax residences and controlling persons, classify wallet movements, and substantiate each exclusion. Required overlapping disclosures must remain; unsupported copies of the group ledger must not become additional filings. (Directive 2011/16/EU, Annex VI, II–IV; CARF, II–IV; IN RFB nº 2.291/2025, arts. 6–9 and Annex II.)
The business and customers in the case
The group’s customer-facing identity is a single crypto platform. A customer downloads its app, completes registration, funds an account and sees trades and wallet balances in one interface. Behind that interface, different companies can contract for and perform the exchange, custody and transfer services. The company appearing on the app-store listing therefore need not be the company that buys cryptoassets from the customer or holds the customer’s private keys.
The companies and arrangements described here are hypothetical. Their names identify their functions rather than real businesses. The common facts place ParentCo, UK ExchangeCo and UK CustodyCo in the United Kingdom, where they are incorporated, tax resident and managed. Brazilian MarketingCo is incorporated and resident in Brazil. The regional alternative adds an Irish-incorporated, Irish-resident and Irish-managed company, called Irish ExchangeCo. These locations make the relevant domestic laws concrete; a platform based elsewhere would need its own home-country analysis.
ParentCo owns the app, brand and software. It maintains the group’s customer-information service and transaction storage under instructions from the operating companies. Its assumed role is technical and contractual licensing. It does not decide which customers may trade, set the operative exchange parameters, select counterparties or route customer orders. The operating companies exercise those powers over their own services. This distinction matters because control over exchange operations can make a software owner a provider in its own right.
UK ExchangeCo contracts with customers to exchange fiat money for cryptoassets and one cryptoasset for another. It actually executes the orders and controls that service’s admission, execution and settlement decisions. The shared ledger identifies UK ExchangeCo as the executor of the trades it completes. Naming a subsidiary in customer terms does not resolve another company’s provider status where that other company actually operates the exchange business.
UK CustodyCo separately contracts for custody and transfers. It controls the private keys for the assets it holds and carries out customers’ deposit and withdrawal instructions. It does not offer conversions, match exchange orders or operate a trading venue. An exchange and a withdrawal can therefore appear in the same customer history while belonging to different service providers. Each company has access to the records necessary to identify its own activity.
Brazilian MarketingCo introduces Brazilian customers to both UK services. Its campaigns specifically advertise the UK exchange and UK custody businesses to residents of Brazil. It passes leads to the relevant onboarding process but accepts no execution instructions, holds no customer assets and controls no transfers. A lead’s Brazilian address or language preference gives the marketer commercial information. Tax residence is collected and checked through the responsible service provider’s customer relationship.
The group is considering three arrangements. Arrangement A uses UK ExchangeCo as the single contracting and executing company for exchanges, including for EU customers. In A, UK CustodyCo separately provides custody and transfers for that same EU and non-EU customer book. UK ExchangeCo itself has a genuine staffed regular place of business in Ireland from 1 January 2026. Arrangement B gives EU execution and custody to a genuine Irish business and keeps the non-EU exchange and custody businesses in the UK. Arrangement C tests the consequence of the Brazilian marketer beginning to participate in execution or transfers.
Under B, Irish ExchangeCo has the authorisation needed for its services under the EU Markets in Crypto-Assets Regulation, or MiCA. It contracts with EU customers, executes their orders and provides their custody. It controls its own business even though the app and record storage remain shared. The UK companies in B have no Irish branch, place of management or regular place of business. The Irish premises belong to Irish ExchangeCo.
Each arrangement is a separate hypothetical operating from 1 January to 31 December 2026. A real change later in the year would require a different allocation. Transactions before the change belong to the companies that actually performed them. A new contract or later migration cannot make the Irish company the historical executor of the UK company’s trades.
The customer population includes an Irish tax resident using the non-EU app, a Brazilian tax resident trading during a temporary trip abroad, and a customer resident for tax purposes in both countries. It also includes a Brazilian corporate customer with an Irish-resident controlling person. Customers may use several hosted wallets and withdraw to self-hosted wallets, where they control their own keys. The group must connect those wallets and services to the relevant legal customer and tax-residence evidence.
The shared information service stores certifications against the relevant legal customer relationship. The executor must be able to retrieve its customer’s tax-residence evidence. The custodian needs the evidence required for its separate obligations. ParentCo may administer the storage and collection process, but each responsible company must be able to substantiate the information it uses and the transactions it reports. Delegating collection is different from transferring statutory responsibility. (Directive 2011/16/EU, Annex VI, III.D(2); UK S.I. 2025/744, reg. 4, incorporating CARF III.D(2); IN RFB nº 2.291/2025, Annex II, item 41.)
Three reporting systems apply through different legal routes
The OECD Crypto-Asset Reporting Framework, or CARF, supplies an international standard for collecting and exchanging cryptoasset tax information. A country’s implementing law gives providers their binding duties. The UK regulations expressly incorporate CARF rules and commentary, with UK modifications, and provide for reporting to HM Revenue and Customs, or HMRC. Ireland implements CARF through section 891HA of the Taxes Consolidation Act 1997. A country’s announcement that it intends to join CARF does not establish that its provider duties have commenced. (UK S.I. 2025/744, regs. 1–3 and 6; Finance Act 2025, s. 92.)
DAC8 is the EU directive that extends administrative cooperation in taxation to cryptoasset information. It adds provider reporting and due-diligence rules, followed by exchanges between tax authorities. Member States implement those duties in national law. Ireland’s section 891M provides the operative domestic reporting route used in this case. The Irish company files with Ireland’s tax authority, Revenue; the applicable authority-exchange arrangements determine onward transmission. The presence of customers in several Member States does not itself direct the company to copy its return to every customer’s tax office. (Directive (EU) 2023/2226; Directive 2011/16/EU, art. 8ad and Annex VI; S.I. No. 584/2025, reg. 2(g).)
DeCripto is Brazil’s own declaration system, administered by its federal tax authority, Receita Federal. Its governing normative instruction is IN RFB nº 2.291/2025. It combines monthly information about operations, annual balance information and a separate annual CARF layer. It also imposes duties on specified Brazilian users. Those layers differ in their populations and commencement dates. A foreign provider’s annual CARF filing cannot be treated as the answer to every Brazilian reporting question. (IN RFB nº 2.291/2025, arts. 5–9, 12 and 19.)
The platform must therefore answer two separate questions for each company. Its functions determine whether it is the kind of provider covered by a regime. Its connection to a country determines whether that country’s reporting rules attach. A customer’s residence then helps determine which users and controlling persons belong in the report. Keeping these questions distinct prevents a Brazilian customer, an Irish office or a shared group database from being treated as interchangeable connecting facts.
Possible CARF connections include tax residence, formation with the prescribed legal-personality or tax-return condition, management, a regular place of business, and transactions through a branch. Hierarchy and branch rules can reduce overlapping obligations of the same provider. An equal-rank connection can require an election or notification. An incorporated affiliate is a separate legal person; it does not become another company’s branch merely through common ownership. (CARF, I; OECD CARF Frequently Asked Questions, December 2025, I.2; Taxes Consolidation Act 1997, ss. 891M(3), (9)–(11) and 891HA(3)–(4), (8)–(9).)
The provider definition follows the service actually performed
The UK exchange company satisfies CARF’s functional test because it carries on a business of effectuating exchanges for customers. The standard covers acting as a counterparty, an intermediary or the provider of a trading platform. Those descriptions reach beyond the entity named in a customer contract. They require examination of the company’s actual part in making the exchange happen. (CARF, IV.B(1); UK S.I. 2025/744, regs. 2–3.)
UK CustodyCo has a different function. Its assumed custody and transfer services do not, by themselves, satisfy CARF’s exchange-service threshold. Once a company qualifies as a reporting provider, relevant transfers can enter its reporting obligations. That does not mean that every company conducting a transfer first becomes a CARF provider. UK CustodyCo’s UK exclusion ends if it also begins executing conversions, intermediating exchanges or operating the venue. (CARF, IV.B(1) and IV.C(4); UK S.I. 2025/744, regs. 2–3.)
DAC8 requires separate attention to the MiCA-authorised provider limb and the cryptoasset-operator limb. Revenue treats an Irish MiCA-authorised cryptoasset service provider as a reporting provider. A group should not import a general custody-only exclusion into that authorised category. Irish ExchangeCo performs both exchanges and custody, so its classification in this case does not depend on resolving a custody-only boundary. (Directive 2011/16/EU, Annex VI, IV.B(1)–(4); Revenue Tax and Duty Manual 38-03-38, para. 2.2.4.)
Brazil expressly includes custody and transfer services in its provider definition. UK CustodyCo can consequently have Brazilian reporting duties while remaining outside UK CARF on the stated facts. (IN RFB nº 2.291/2025, Annex I, items 17–18.)
ParentCo’s role needs the same functional examination. The CARF commentary incorporated in UK law treats software enabling even partial execution as capable of constituting a trading platform. It identifies the person making the platform available through control or sufficient influence. ParentCo’s assumed technical role supports its exclusion only while the operating companies actually control the exchange services. If ParentCo determines trading access, operative parameters or order routing, subsidiary contracts do not remove that issue. (UK S.I. 2025/744, reg. 2(1); CARF Commentary, IV.B(1), paras. 26–28.)
The shared ledger is evidence for this examination. It should identify the contracting company, actual executor, custodian, transfer initiator and owner of the relevant records. A single transaction identifier can connect those records. It cannot decide which company performed the legal service. The reporting decision must be supported by mandates, permissions and the actual processing of the transaction.
Assets and transactions need their own classification
Provider status does not make every product or customer event reportable. DAC8 uses the term “Reportable Crypto-Asset”; CARF uses “Relevant Crypto-Asset”. Both exclude central bank digital currencies, specified electronic money meeting the conditions, and assets adequately determined incapable of payment or investment use. A stablecoin or NFT label does not establish an exclusion. Brazil expressly addresses investment-capable NFTs and asset-referenced tokens. (Directive 2011/16/EU, Annex VI, IV.A; CARF, IV.A; IN RFB nº 2.291/2025, Annex I, items 1–8.)
The platform therefore needs an asset record describing the token’s rights, payment or investment use and classification date. An exclusion needs its supporting evidence. MiCA’s product perimeter serves a separate regulatory purpose and cannot simply become the tax-reporting filter. A product outside one MiCA category still requires examination under the tax definition. (Directive 2011/16/EU, Annex VI, IV.A; CARF, IV.A.)
The covered activity includes fiat exchanges, crypto-to-crypto exchanges and prescribed transfers. DAC8 and CARF have no general minimum transaction value. Their US$50,000 threshold belongs to the defined retail-payment category for goods or services. Smaller exchanges and ordinary transfers require their own analysis. (Directive 2011/16/EU, Annex VI, IV.C and II.B(3); CARF, IV.C and II.A(3).)
A customer buying bitcoin with euros and later exchanging part of it for ether creates different reporting categories. The first transaction is an acquisition of bitcoin against fiat currency. The swap produces disposal information for one asset and acquisition information for the other. Those are required descriptions of the asset legs of the same exchange. Treating them as an accidental duplicate would remove required information; counting both descriptions as two independent economic purchases would also distort reconciliation. (Directive 2011/16/EU, Annex VI, II.B(3); CARF, II.A(3).)
A withdrawal requires a further decision even when the customer retains ownership. The provider must determine who performs the transfer, whether the destination is internal, another hosted service or an external address, and what it knows about consideration. The existence of a transfer record does not establish that a sale occurred. (CARF, IV.C(4); IN RFB nº 2.291/2025, arts. 6–8.)
One UK executor with its own Irish business place
Arrangement A concentrates customer contracting and exchange execution in UK ExchangeCo. Its UK tax residence supplies the UK CARF connection. Its own staffed Irish business place supplies the stated Irish operator connection. Its exchange services are also advertised to Brazilian residents through Brazilian MarketingCo. The same company can therefore encounter UK, Irish and Brazilian duties for legally distinct reasons. (UK S.I. 2025/744, reg. 3; Taxes Consolidation Act 1997, s. 891M(3)(a)(ii)(IV); IN RFB nº 2.291/2025, art. 5(I)(e).)
On those facts, UK ExchangeCo registers in Ireland and prepares the required information for EU reportable users. Its own Irish regular place also requires a separate check for non-EU users and controlling persons reportable under Irish CARF. The applicable statutory registration exceptions, foreign-reporting exclusions and relief remain material. UK ExchangeCo also prepares its HMRC report and its own applicable Brazilian returns. (Directive 2011/16/EU, art. 8ad(7), Annex VI, I and V.F; Taxes Consolidation Act 1997, ss. 891M(3)–(11) and 891HA(3)–(9), (17).)
Ireland’s CARF registration election requires its own statutory conditions and notice. Section 891HA(8)(a) expressly refers to connection limbs (i)–(iii), without the regular-place limb (iv). UK residence alone therefore does not establish that particular exemption for A’s stated Irish connection. Section 891HA(17) separately permits all required CARF information to be included in the same provider’s section 891M return. An additional reporting population does not invariably require a second Irish return. (Taxes Consolidation Act 1997, s. 891HA(3)(a)(iv), (4), (8)–(9), (17).)
The Irish premises in A belong to UK ExchangeCo’s own business. An office used only by another group company would require a different application. Nor does an Irish customer’s use of a wholly remote foreign app, by itself, establish this particular Irish connection. DAC8’s non-Union registration and qualifying-reporting provisions must be applied to the actual operator and national route. A’s result rests on the expressly stated Irish business place, not merely on the customer’s address. (Directive 2011/16/EU, art. 8ad(7), (11)–(12), Annex VI, I and V.F; Taxes Consolidation Act 1997, s. 891M(3)–(11).)
For an Irish-resident individual trading with UK ExchangeCo under A, the UK company is the executor and holder of the relevant customer relationship. It must obtain the required residence evidence and assess that customer in its Irish and UK reporting populations. ParentCo’s ownership of the app does not redirect the trade into a parent return. Brazilian reporting is assessed under the separate foreign-provider rules discussed below, including their own population wording.
Separate regional businesses with a common ledger
Arrangement B is the recommended allocation because the actual services can be matched to distinct operating companies. Irish ExchangeCo provides EU execution and custody under its own authorisation and customer contracts. UK ExchangeCo executes the Brazilian and other non-EU business. UK CustodyCo provides the separate custody and transfer service for that non-EU business. The regional companies control their services, and the UK companies do not retain A’s own Irish business presence.
Irish ExchangeCo collects and verifies the information required for its Irish DAC8 and CARF obligations. It reports its own required population to Revenue. UK ExchangeCo collects the information needed for its HMRC and Brazilian obligations and reports its own exchange activity. UK CustodyCo obtains the information required for its Brazilian custody and transfer duties. The parent’s shared team may carry out the collection work under documented instructions, with the responsible providers retaining access and responsibility. (Taxes Consolidation Act 1997, ss. 891M and 891HA; UK S.I. 2025/744, regs. 3–6; IN RFB nº 2.291/2025, arts. 5–8 and Annex II, item 41.)
Brazilian MarketingCo’s campaigns concern the two UK services. They do not establish, without more, that Irish ExchangeCo advertises or provides its own service in Brazil. A dual-resident customer may still have a relationship with the Irish company. That customer’s residence and the Irish company’s Brazilian provider connection are separate questions under Article 5. (IN RFB nº 2.291/2025, art. 5(I)(e), §1.)
B requires genuine operational separation. If Irish ExchangeCo merely forwards orders to a trading platform operated by UK ExchangeCo, both companies may effectuate exchanges in different capacities. The CARF commentary treats a reporting provider using another provider’s platform as the latter’s customer. UK ExchangeCo must then classify Irish ExchangeCo as its customer, including the relevant exclusions and controlling-person rules. It cannot automatically substitute all Irish retail users for an intermediary that is itself a reporting provider. (CARF, IV.D(2); CARF Commentary, III, paras. 54–57, and IV.D(2), para. 38.)
Shared storage can record two independently operated execution businesses. A common execution business with different regional contract names presents a different provider analysis. The decision rests on who admits the customer, performs the exchange service and controls the relevant platform functions.
A later move from A to B must be dated against real operating changes. The group must identify when the Irish company begins executing, when customer contracts migrate and whether UK ExchangeCo retains any Irish presence. New Irish relationships require valid certification at onboarding, including permitted reuse of compliant evidence. The existing-user completion deadline does not give new relationships a grace period. (Directive 2011/16/EU, Annex VI, III.A(1), III.B(1), III.D(1)–(2); Taxes Consolidation Act 1997, ss. 891M(3), (8) and 891HA(3), (7).)
A Brazilian introducer that acquires an operational role
Arrangement C changes one fact with substantial consequences: Brazilian MarketingCo begins accepting exchange instructions, intermediating trades or controlling transfers. Its Brazilian residence or formation already supplies a local connection. Its new conduct must then be tested against the provider definition. The company’s old marketing description cannot determine its later reporting status. (IN RFB nº 2.291/2025, art. 5(I), Annex I, items 17–18.)
If the affiliate begins effectuating exchanges as an intermediary, it can satisfy the CARF functional test. If it only acquires custody or transfer functions, Brazil’s broader definition can still apply. The company must collect the information and report the operations attached to the services it actually performs. The group should record the first operational date and distinguish transactions before and after the change. (CARF, IV.B(1); IN RFB nº 2.291/2025, arts. 5–8.)
UK ExchangeCo or UK CustodyCo may remain involved in the same economic event. Their duties do not disappear because the Brazilian affiliate gains a role. Equally, the affiliate’s participation does not make it the executor of every group trade. The reporting map must show the actual services of each provider. Any additional UK or EU obligation for the Brazilian company still requires the relevant jurisdictional connection. (CARF, I and IV.B; Directive 2011/16/EU, Annex VI, I and IV.B; IN RFB nº 2.291/2025, arts. 5–8.)
Tax registration and permission to provide the service
The regional recommendation requires a separate MiCA decision before the Irish business begins its regulated services. DAC8 registration identifies a tax reporter. MiCA authorisation concerns permission to provide cryptoasset services. Anti-money-laundering (AML) registration and controls serve another function. Completing one of those steps does not establish completion of the others. (Regulation (EU) 2023/1114, arts. 59–61; Directive 2011/16/EU, art. 8ad.)
MiCA generally requires authorisation or an eligible Article 60 notification for services in the Union. Its exclusive-client-initiative exception is narrow; solicitation through an affiliate can defeat it. A tax return for historical EU business does not cure an unauthorised solicited service. A’s tax registration and filings cannot establish MiCA permission to solicit EU customers. B expressly assumes the Irish company has the authorisation its activities require. (Regulation (EU) 2023/1114, arts. 59–61.)
Custody allocation has a further licensing consequence. MiCA restricts an authorised custodian’s use of another cryptoasset custodian to a provider authorised under Article 59. B therefore keeps actual EU custody with Irish ExchangeCo and assigns UK CustodyCo the non-EU business. An outsourcing contract cannot turn actual unlicensed custody into technical support. Licentium’s digital asset licensing service covers the separate token-classification and CASP-authorisation work. (Regulation (EU) 2023/1114, art. 75(9).)
Tax-information reporting also differs from the customer’s substantive tax liability. A transfer can be reportable even where it is not a taxable disposal. The provider’s reported transaction value does not calculate the customer’s taxable gain or decide where that gain is taxed. DeCripto expressly preserves substantive tax rules and separate regulatory authorisation requirements. Customer explanations should describe the information reported and leave the separate tax assessment distinct. (IN RFB nº 2.291/2025, art. 16 and Annex I, item 20.)
Irish and UK reports follow the responsible provider
Under B, Irish ExchangeCo must register with Revenue by 31 December in its first reporting-provider year. For 2026 information, its return is due by 31 May 2027. It must give each reportable user a copy of the information relating to that user by the same date. The population includes reportable EU residents, including Irish residents, and non-EU users or controlling persons reportable under Irish CARF. Revenue’s 2026 list includes the UK and Brazil. (Taxes Consolidation Act 1997, ss. 891M(2)–(7) and 891HA(2)–(7); Revenue, List of Reportable Jurisdictions for CARF and DAC8 Purposes, 10 June 2026.)
The group can coordinate those two Irish populations through section 891HA(17). It must include all information required by that section in the same provider’s section 891M return. It should reconcile the DAC8 and CARF populations to that accepted return, with evidence of completeness. That is a specific domestic coordination rule, rather than a general permission to combine the Irish, UK and Brazilian companies. (Taxes Consolidation Act 1997, s. 891HA(17).)
UK ExchangeCo must submit its 2026 information to HMRC by 31 May 2027. Initial registration is due by that date. Notice to the first reported users and controlling persons is due by 31 January 2027. The UK’s legally effective reportable-jurisdiction notice for 2026 includes Brazil and Ireland. Finance Act 2026 adds domestic UK users and relevant UK controlling persons. Its domestic extension does not carry across the CARF equal-nexus election. (UK S.I. 2025/744, regs. 2(4)(c), 6, 8 and 10; Finance Act 2026, s. 275; HMRC, IEIM8000720.)
The first DAC8 exchange between EU authorities concerns 2026 information and falls within nine months after year-end. The relevant authority deadline is therefore 30 September 2027. The provider’s earlier Irish filing deadline remains 31 May 2027. A platform must distinguish collection during the reporting year, submission to its competent authority and subsequent authority-to-authority exchange. (Directive 2011/16/EU, art. 8ad(6); Directive (EU) 2023/2226, art. 2(1); Taxes Consolidation Act 1997, s. 891M(2), (6).)
Brazil reaches foreign providers through their own services
Both UK operating companies enter the Brazilian analysis because their own covered services are advertised to Brazilian residents. Article 5 expressly reaches services in Brazil and identifies Brazil-directed advertising as a connecting factor. Other listed factors concern a .br domain and specified local receipt, withdrawal or payment arrangements, including PIX. A foreign provider does not need Brazilian incorporation to satisfy the stated service connection. (IN RFB nº 2.291/2025, art. 5(I)(e), §1.)
Brazilian MarketingCo supplies evidence of the two UK providers’ targeting. Pure introduction does not make the marketer the provider of the advertised exchange or custody service. Under C, its changed operational role creates its own analysis. This separates two consequences of the same local affiliate: its campaigns can connect a foreign provider to Brazil, while its own provider status depends on its own conduct. (IN RFB nº 2.291/2025, art. 5, Annex I, items 17–18.)
UK ExchangeCo and UK CustodyCo each assess Article 7 for their own covered operations. The monthly information records individual operations, including dates, types, user identities, assets, quantities and values in reais. Service fees are reported separately. The prescribed categories cover exchanges, specified incoming and outgoing transfers, large retail payments, self-hosted-wallet transfers, involuntary losses and specified asset-referenced-token events. The custodian reports the event it performs and knows; it does not invent an exchange merely because an asset moved. (IN RFB nº 2.291/2025, arts. 6–7.)
Article 7 refers broadly to all operations effected and each user’s year-end balances. It contains no express Brazilian-residence-only filter for a foreign provider within Article 5(I)(e). A territorial argument would tie reporting to the services supplied in Brazil. The broader wording is the stronger textual argument against introducing a residence filter without a legal basis. This case therefore allocates each scoped provider’s own Article 7 operations and users to its Brazilian reporting process. It does not expand that population to every transaction in the group’s ledger. (IN RFB nº 2.291/2025, arts. 5(I)(e) and 7(I)–(II).)
That reading has practical consequences for B. UK ExchangeCo must assess its own exchange business; UK CustodyCo must assess its own custody and transfers. Irish ExchangeCo’s separate EU business does not enter either UK company’s return merely because the records share a database. The privacy, access and transmission arrangements must support the population each legally scoped company actually reports.
Brazilian monthly operations and annual information are separate layers
The first Brazilian layer is the Article 7 monthly operation information. It describes the provider’s covered events individually. Its provider duty has no R$35,000 customer threshold. The threshold belongs to the separate user obligation discussed below. A provider must not remove smaller operations from its own file by importing that customer rule. (IN RFB nº 2.291/2025, arts. 5(II), §3, 7 and 9.)
The second layer is the Article 7(II) annual balance information at 31 December. It concerns each user’s fiat balance in reais, quantities of each cryptoasset and acquisition cost when the user has declared it. A custodian’s year-end holdings and an exchange company’s executed trades answer different questions. UK ExchangeCo should not copy balances that it neither maintains nor owes to customers. (IN RFB nº 2.291/2025, art. 7(II).)
The third layer is Article 8’s annual CARF information. It covers the specified Article 6(I)–(VI) operations for reportable persons. Annex II requires an effective agreement obliging Brazil to supply the information and inclusion in the prescribed jurisdiction list. A person resident only in Brazil does not enter that foreign-reportable-person layer merely because the provider has monthly obligations. The same person can still belong in the annual balance information. (IN RFB nº 2.291/2025, art. 8 and Annex II, items 1–5.)
These layers cannot be merged by assigning every customer a single “Brazil reportable” flag. The data system must decide separately whether an operation belongs in the monthly file, a balance belongs in the year-end information, and a user or controlling person meets the annual CARF test. Each result needs its applicable date and legal basis. (IN RFB nº 2.291/2025, arts. 7–8 and Annex II.)
The 2026 transition makes that separation essential. Article 8 applies from 1 January 2026. The new Article 7 and Article 9 duties apply from 1 July 2026. During January–June, IN RFB nº 1.888/2019 applies: its provider duty covers exchanges domiciled in Brazil for tax purposes, while relevant Brazilian user reports for foreign-platform activity use the greater-than-R$30,000 threshold. The two assumed UK companies do not acquire that old domestic-provider duty solely through Brazilian customers. (IN RFB nº 2.291/2025, arts. 18–19; IN RFB nº 1.888/2019, arts. 6–9, as applicable through 30 June 2026.)
A July system launch cannot justify omitting January–June information from an applicable full-year Article 8 aggregate. Nor can the new R$35,000 user threshold replace the historical R$30,000 rule for earlier months. Reconstruction of 2026 must preserve the old monthly population, the new monthly population and the applicable annual population. (IN RFB nº 2.291/2025, arts. 8 and 19.)
Monthly DeCripto reports are due by the last business day of the following month. Annual balances and applicable Article 8 information are due by the last business day of the following January, by 23:59:59 Brasília time. The official calendar puts September 2026 DeCripto on 30 October 2026. The two UK providers each need their own filing identity and accepted transmission. Brazilian MarketingCo’s corporate tax identifier, or CNPJ, cannot be substituted for the company whose operations the return describes. (IN RFB nº 2.291/2025, arts. 3–4 and 12; RFB, Agenda Tributária, 30 October 2026; Manual de Orientação do Leiaute da DeCripto, v. 1.01, section 4.2, record 0000.)
The Brazilian customer trading abroad has a separate obligation
Consider a customer who remains solely Brazilian tax resident during a temporary trip abroad. In September 2026, the customer makes two qualifying transactions through foreign providers, valued under the Brazilian rules at R$20,000 and R$18,000. One is through UK ExchangeCo and the other through an unrelated foreign platform. These are assumed transaction values for the case; they do not represent taxable profit.
The combined monthly amount is R$38,000, calculated as R$20,000 plus R$18,000. It exceeds the R$35,000 threshold applying from July 2026. The customer must report the qualifying foreign-provider activity under the separate Article 9 user obligation. UK ExchangeCo reports the operation it performs under its own duties. It does not acquire the unrelated platform’s R$18,000 transaction merely because the same customer must aggregate both. (IN RFB nº 2.291/2025, arts. 5(II), §3, and 9.)
The customer’s temporary location does not replace the assumed tax residence. A foreign internet address or travel document may prompt a residence check, but it cannot alone establish cessation of Brazilian tax residence. The platform should give the customer a statement of its own activity that supports the separate user assessment. Article 9 contains no express exemption merely because a foreign provider has itself become a DeCripto filer. (IN RFB nº 2.291/2025, arts. 5(II), 9 and Annex II, items 28–30.)
Several wallets do not multiply the threshold. The user’s relevant operations must be connected to the same legal person. The group can reconcile activity within its own records and explain the scope of the statement it provides. It should not imply that its statement necessarily includes every foreign exchange or self-hosted activity relevant to the customer’s obligation. (IN RFB nº 2.291/2025, art. 5(II), §3, and art. 9.)
Residence changes and dual residence alter the customer analysis
A reportable user is a customer meeting the applicable reportable-person test. DAC8 uses residence in a Member State under that state’s tax law. Domestic CARF laws use their prescribed jurisdictions and any domestic extension. The group therefore needs tax-residence certification for the actual customer relationship, with the required tax identification numbers, or TINs. Nationality, preferred language, wallet location and travel are not interchangeable with tax residence. (Directive 2011/16/EU, Annex VI, III and IV.D–E; CARF, III and IV.D–E.)
Under B, an Irish-resident customer uses the Irish execution and custody business through the group’s UK-owned app. Irish ExchangeCo is the responsible Irish provider on those facts. Under A, the same type of customer uses UK ExchangeCo, whose own Irish presence supplies the assumed Irish connection. The brand remains the same across the alternatives, while the legal service provider and basis for filing differ. (Taxes Consolidation Act 1997, s. 891M(3); UK S.I. 2025/744, reg. 3.)
Suppose a Brazilian customer’s tax residence later changes to Ireland and the group transfers the relationship to Irish ExchangeCo. Two dates matter: the residence change and the actual service migration. The group must preserve the earlier certifications and transactions, collect reliable updated evidence and record which company executes after migration. A later Irish contract cannot rewrite earlier UK execution. The annual reporting treatment follows the applicable residence rules, rather than a database overwriting the old country with the latest address. (CARF, III; Directive 2011/16/EU, Annex VI, III; UK S.I. 2025/744, regs. 2 and 4.)
A customer tax resident in both Ireland and Brazil supplies both residences and the required identifiers. Under B’s EU-customer allocation, Irish ExchangeCo provides the service. It assesses the customer’s Irish DAC8 and CARF reporting treatment, with applicable coordination in the Irish return. The customer’s Brazilian foreign-provider reporting obligation can remain. Dual residence alone does not establish that Irish ExchangeCo advertises its own services in Brazil or uses a local payment arrangement. (Directive 2011/16/EU, Annex VI, III and IV.D; CARF Commentary, III, para. 5; IN RFB nº 2.291/2025, art. 5 and Annex II, items 28–39.)
A tax-treaty residence tie-breaker must not become a universal software instruction to delete one declared residence from all reporting regimes. The provider must apply the relevant self-certification and reporting rules. The system should retain the supporting evidence and the legal reason for each national treatment. (CARF Commentary, III, para. 5; Directive 2011/16/EU, Annex VI, III.)
Corporate customers require a separate controlling-person decision
An ordinary company is not excluded from reporting merely because it has legal personality. Excluded persons include qualifying listed entities and related entities, public bodies and specified financial institutions, subject to the defined investment-entity exception. The provider must first determine the entity’s own status and then decide whether controlling-person look-through applies. These are separate decisions. (Directive 2011/16/EU, Annex VI, IV.D–E; CARF, IV.D–E; IN RFB nº 2.291/2025, Annex II, items 1–7.)
The corporate customer in this case is a Brazilian company with an Irish-resident natural person exercising ultimate control. If it is a non-excluded passive entity requiring look-through, UK ExchangeCo’s HMRC information includes the required controlling-person identity, residence, TIN, birth data and role. If the entity instead meets the Active Entity test, that can remove controlling-person look-through without removing the entity’s own reportability. The provider must establish which branch of the test applies. (UK S.I. 2025/744, regs. 2 and 6, incorporating CARF III.B and IV.D–E; HMRC, IEIM8000720.)
The reported transaction aggregates belong to the entity customer. They are not divided by a controller’s ownership percentage. Brazilian Article 8 inclusion requires its own reportable-jurisdiction analysis for the entity and relevant controlling person. The presence of an Irish controller cannot substitute for the required effective-agreement and list conditions. (CARF, II.A(1), (3) and III.B; IN RFB nº 2.291/2025, art. 8 and Annex II, items 1–7, 31–39.)
Controlling persons are natural persons with ultimate control under the applicable rules. Trust treatment includes settlors, trustees, protectors, beneficiaries or beneficiary classes and other ultimate controllers. A universal 25% ownership field does not resolve every company, partnership or trust. AML evidence can help identify controlling persons where it meets the prescribed standard, but it does not replace the required tax-residence certification. (CARF, IV.D(10); Directive 2011/16/EU, Annex VI, IV.D(9); IN RFB nº 2.291/2025, Annex II, items 6 and 34–35.)
Wallet transfers follow the provider and the movement
A hosted wallet is maintained by a provider; a self-hosted wallet is controlled by the user. A customer withdrawing cryptoassets to a self-hosted wallet can retain ownership throughout. That fact does not remove the transfer from the reporting analysis. DAC8 and CARF exclude an internal movement between accounts or addresses maintained by the same provider for the same user. They do not exclude every transfer between wallets owned by one person. (Directive 2011/16/EU, Annex VI, IV.C(4); CARF, IV.C(4).)
Moving assets between two accounts of the same customer maintained by Irish ExchangeCo can satisfy that internal-movement exclusion. Sending them to another provider requires a separate transfer classification. Common branding does not establish that two accounts are maintained by the same provider. A transfer to an address not known to belong to a virtual-asset provider or financial institution enters the special external-wallet analysis. That category includes unknown destination status as well as established self-custody. (Directive 2011/16/EU, Annex VI, II.B(3)(h)–(i); CARF, II.A(3)(h)–(i); CARF Commentary, II, paras. 25–26.)
For B’s non-EU customer, UK CustodyCo performs a withdrawal under its own custody contract. Its Brazilian reporting follows that service. The transfer does not itself give UK CustodyCo the exchange function necessary for UK CARF provider status. If UK ExchangeCo instead offers and effectuates a transfer through the custodian as its agent, the exchange company’s analysis must reflect that additional service. Contracting obligations, instructions and actual performance decide which situation exists. (CARF, IV.B(1), IV.C(4); IN RFB nº 2.291/2025, arts. 6–8 and Annex I, items 17–18.)
The group should connect the exchange order, any settlement movement and the later withdrawal through one economic-event history. Each service and transfer leg needs its own provider identity. A blockchain transaction hash helps match records but does not prove beneficial ownership or explain an off-chain exchange. Source and destination addresses, known provider status, ownership evidence and the classification date should remain available to substantiate the reporting treatment.
Internal evidence and routine return fields differ. UK CARF reporting uses the prescribed external-wallet aggregates, rather than actual wallet addresses. Brazil requires sending and receiving addresses on a tax-procedure summons under Article 17. The platform should retain the evidence needed to explain a transfer without automatically inserting every address into every national return. (CARF Commentary, II, paras. 25–26; HMRC, IEIM8000585; IN RFB nº 2.291/2025, art. 17.)
Shared collection must preserve each provider’s evidence
The group can collect identity and residence information through one customer-facing process if each responsible provider can substantiate its use. The record should preserve the customer’s legal identity, every relevant tax residence, TINs, entity classification, controlling-person roles and the effective dates of certifications. It must also preserve the checks against other information held by the provider. A blank TIN or birthplace field needs the applicable legal exception; an empty database entry is not evidence of one. (Directive 2011/16/EU, Annex VI, II.C and III; CARF, II.B–C and III.C; IN RFB nº 2.291/2025, Annex II, items 37–41.)
The shared service should show which company requested a certification, which relationship it covers and who can retrieve the evidence. The executor must not assume that the custodian’s AML file contains a valid tax certification for its own purposes. The marketer’s lead information is still further removed. Permitted reliance and delegation require the provider to satisfy the applicable due-diligence rules. (Directive 2011/16/EU, Annex VI, III.D(1)–(2); CARF, III.D(1)–(2); IN RFB nº 2.291/2025, Annex II, item 41.)
New relationships require certification when established. Existing Irish relationships must meet the pre-existing-user deadline by 1 January 2027, making 31 December 2026 the operational completion target. The UK completion date is 31 December 2026. Brazil’s twelve-month rule runs from the instruction’s commencement on 17 November 2025; the group should complete that existing-user population by 17 November 2026. The populations must remain distinct because the regimes use different commencement dates. (Directive 2011/16/EU, Annex VI, III.A(1) and III.B(1); HMRC, IEIM8000470; IN RFB nº 2.291/2025, art. 19, Annex I, items 13 and 16, Annex II, items 29 and 32.)
A change making a certification unreliable requires renewed evidence. An annual review is a useful group control, but a residence-change alert needs action when it occurs. The incorporated CARF commentary supplies a limited cure period ending no later than 90 days. If the change remains uncured, the UK provider must retain both the original and newly indicated jurisdictions for the prescribed treatment. (CARF Commentary, III, para. 17; UK S.I. 2025/744, regs. 2 and 4.)
Ireland separately requires prevention of reportable transactions after the initial request, two written reminders and 60 days from the second reminder. The company must retain the reminder dates and apply the statutory restriction. A generic group deadline or an unsupported assumption that an AML reminder suffices can produce the wrong result. (Taxes Consolidation Act 1997, ss. 891M(12) and 891HA(10).)
One transaction record must support different national outputs
The source ledger should retain the customer, legal provider, asset, date and time, units, consideration, fees and valuation evidence for each event. It should preserve the original fiat amount and currency. Each national reporting process then derives the required fields from that record. This allows the group to explain differences between returns without treating those differences as unexplained errors.
Irish and UK annual reports aggregate the prescribed categories by user and asset. Crypto exchanges and transfers require the applicable transaction-time fair market value. Multiple fiat currencies require a consistent transaction-time conversion method. A price at 31 December cannot replace the price of every trade during the year. Valuation evidence should identify the price source, method, timestamp and conversion used. (Taxes Consolidation Act 1997, ss. 891M(7)(d)–(f) and 891HA(6)(d)–(f); CARF, II.D–F.)
The annual returns identify the reporting provider and include required customer names, addresses, tax residences, TINs and birth data. Relevant controlling persons and roles are included where the rules require them. For each asset, the fiat-acquisition, fiat-disposal, crypto-acquisition, crypto-disposal, retail-payment and incoming or outgoing transfer categories require the prescribed values, units and transaction counts. The special external-wallet subset requires value and unit aggregates; its rule does not add a transaction-count field. (Directive 2011/16/EU, Annex VI, II.B–C; CARF, II.A–C; UK S.I. 2025/744, regs. 2 and 6.)
Brazil requires operation value in reais excluding service fees, with those fees reported separately. Its rules prescribe a valuation sequence where a trading-pair price is unavailable. Foreign-currency conversion proceeds through US dollars to reais using the relevant Banco Central closing PTAX sale rate. The UK process must separately implement the CARF commentary’s transaction-fee treatment. A shared source price can support several outputs while the national rules produce different reported values. (IN RFB nº 2.291/2025, arts. 7(I)(f)–(g), 9(VI)–(VII), 10–11; CARF Commentary, II, paras. 8–19 and 38–41.)
The Brazilian technical layouts make those distinctions operational. The provider is identified in record 0000; individual operations use their applicable blocks; annual balances use records 1000/1010; and record 2000 identifies the provider’s CARF connection. The workbook for activity through a foreign exchange is a Brazilian user layout. Its title does not make it the foreign provider’s own return. The exporter must select the layout for the actual filer and obligation. (ADE Copes nº 2/2025, art. 1; Manual de Orientação do Leiaute da DeCripto, v. 1.01, sections 4.1–4.2 and relevant record specifications.)
Each UK provider must establish its own CNPJ and the registration, representative and access arrangements needed to submit through Coleta Nacional in Receita’s e-CAC portal. The general CNPJ rules require an entity domiciled abroad to have a legally constituted representative domiciled in Brazil. They provide for 14-position alphanumeric identifiers, while DeCripto’s published opening record still specifies a numeric CNPJ field. Each provider should confirm acceptance of its issued identifier and retain the receipt for its declaration. (IN RFB nº 2.119/2022, art. 2, sole paragraph, art. 6, §1, and arts. 12–20; IN RFB nº 2.291/2025, arts. 3–4; Manual de Orientação do Leiaute da DeCripto, v. 1.01, sections 2.3.5 and 4.2.)
Brazil’s large-volume instructions require complete file structures and one transmission of the validated files for the period. The group needs provider-specific preparation, validation and acceptance controls even if one technical team runs the process. A common export folder cannot establish that the correct legal entity’s return was accepted. (Manual de Orientação do Leiaute da DeCripto, v. 1.01, section 2.2.1.)
Relief must identify the particular obligation discharged
A foreign filing reduces another obligation only through the applicable legal provision and its conditions. Under Irish DAC8 law, specified operator information already reported outside the EU can be excluded through the effective qualifying-agreement conditions. Higher or equal connection relief requires the relevant foreign-jurisdiction status, corresponding duties and prescribed confirmation. The statutory conditions concern the same provider’s compliance. UK ExchangeCo’s filing cannot automatically discharge Irish ExchangeCo’s obligation. (Taxes Consolidation Act 1997, s. 891M(7)(g), (9)–(11); Directive 2011/16/EU, art. 8ad(11), Annex VI, IV.F(5)–(6).)
CARF commitments, signatures, domestic reportable-country notices and effective tax-information exchange relationships answer different questions. The multilateral competent-authority agreement requires the applicable notifications and bilateral effectiveness, with coverage dependent on the relevant legislation. DAC8 adds its own equivalence conditions. A group cannot infer a universal filing exemption from the appearance of two countries on a CARF participation list. (CARF Multilateral Competent Authority Agreement, sections 3 and 7; Directive 2011/16/EU, art. 8ad(11)–(12), Annex VI, IV.F.)
Article 8ad(12) dispenses with a Commission determination where the international standard has been determined to be a minimum standard or equivalent and competent-authority agreements cover all Member States concerned. A company relying on that exception must establish the stated conditions. The group’s relief record should identify the provision, provider, branch, reporting period, customer countries, information covered, effective agreement and required determination or exception. It should also retain the foreign return and acceptance evidence where completed reporting is required. (Directive 2011/16/EU, art. 8ad(11)–(12), Annex VI, IV.F.)
Brazil’s Article 8 relief concerns its annual CARF layer. Paragraph 1 specifies particular residence, formation, management and business-place connections. It does not include the services-in-Brazil connection in Article 5(I)(e). The two UK providers in this case are caught through that service connection and report through their head offices. They therefore cannot use paragraph 1 to substitute a UK filing. A provider with a different qualifying connection must assess that route separately; paragraph 2 supplies a distinct branch rule. (IN RFB nº 2.291/2025, art. 8, §§1–2.)
Neither Brazilian provision creates general relief from monthly Article 7 operations, annual balances or the customer’s Article 9 duty. The group must first identify the exact obligation under consideration. Otherwise it risks using an annual foreign-reporting exception to omit a monthly return that the exception never addresses. (IN RFB nº 2.291/2025, arts. 7–9.)
Reconciliation distinguishes required overlap from repeated filing
Some overlap is required by law. The Brazilian customer and the foreign provider can both report their respective information. A crypto swap requires information about two assets. An outbound transfer can contribute to the general transfer aggregate and the specified external-wallet subset. Those relationships need to remain visible in the data. They are not a reason to remove prescribed categories. (IN RFB nº 2.291/2025, arts. 7 and 9; CARF, II.A(3).)
Unsupported duplication arises when two original returns are sent for the same provider-period obligation, when a second Irish CARF return repeats fully coordinated information, or when every affiliate reports the group’s entire ledger without establishing its own service role. The group should reconcile each national output to its provider’s source events, then connect overlapping descriptions to the same economic event. It should not add overlapping category values as if each represented additional economic activity. (Taxes Consolidation Act 1997, s. 891HA(17); OECD, Crypto-Asset Reporting Framework XML Schema, July 2025, pp. 25–32.)
An effective review starts with the complete event population and records the treatment of each event. Inclusion needs a reporting provider, jurisdictional connection, reportable category and customer treatment. Exclusion needs its legal ground and evidence. The resulting reconciliation should expose an unmatched trade, transfer or customer instead of allowing it to disappear between regional systems.
Corrections and retention remain tied to each provider
Every national report needs a preserved source extract, provider approval, transmitted version, acceptance receipt and correction history. The same technical team may prepare several returns, but it must retain which company approved which version. When a shared source error affects several countries, the correction process must identify every affected output before the incident is closed.
A rejected UK file is not presumed filed: the regulations attach significance to successful electronic validation. When an error is discovered, the UK provider must take reasonable steps to inform HMRC. Brazil permits corrective DeCripto submissions and removes the error-or-omission penalty where correction precedes an official procedure. That protection does not erase a separate late-filing breach. Original and corrected records must remain connected. (UK S.I. 2025/744, regs. 7 and 15(c); IN RFB nº 2.291/2025, arts. 13 and 15.)
Retention also needs a rule for each record class and provider. Irish reporting records generally run for six years after the reporting period, with longer retention for relevant Revenue enquiries. The UK regulations require five years’ retention of specified due-diligence records, beginning on the day after the relevant calendar year ends. That year is the one in which the information was collected, generated or relied upon. The incorporated CARF rule also measures its five-year minimum from the end of the period in which reporting is due. Brazil requires at least five years after the end of the period within which the provider must report. (Taxes Consolidation Act 1997, ss. 891M(13) and 891HA(11); UK S.I. 2025/744, reg. 4(3)–(4), incorporating CARF III.D(3); IN RFB nº 2.291/2025, Annex II, item 42.)
A shared certification may support more than one provider and reporting year. Its deletion date must account for the longer applicable obligation, with the reason recorded. Calculating every retention period solely from the original transaction date can destroy evidence while another provider still needs it. Access and deletion controls should operate at record level rather than through one undifferentiated group archive.
Privacy obligations follow the actual collection and disclosure
The operating companies must identify their privacy roles for tax reporting. The relevant laws include the EU General Data Protection Regulation (GDPR), its UK domestic version (UK GDPR) and Brazil’s Lei Geral de Proteção de Dados Pessoais (LGPD). A shared processor receives documented instructions and limited access. Where companies jointly determine purposes and means, joint control needs separate analysis. Notices should identify the responsible providers, reporting purposes, legal bases, recipients, retention and relevant international transfers. The customer must be able to understand why several group entities use the information. (Regulation (EU) 2016/679, arts. 5–6, 13–14, 26 and 28; UK GDPR, arts. 5–6, 13–14, 26 and 28; Lei nº 13.709/2018, arts. 6–9 and 37.)
Mandatory reporting should not be presented as a use that a customer can veto through a consent checkbox. Residence documents, TINs and controlling-person data also require appropriate access controls, encryption and audit logs. The fact that several providers need some of the same information does not give every group employee a purpose for unrestricted access. (Regulation (EU) 2016/679, arts. 5–6 and 32; Lei nº 13.709/2018, arts. 6–7 and 46.)
Collection directly from a Brazilian customer and transfer of information by the Brazilian affiliate are different data flows. Brazil’s data protection regulator, ANPD, distinguishes direct international collection from a transfer between processing agents, while preserving the LGPD’s applicable territorial rules. The group must identify which flow occurs. An onboarding form operated by the UK provider and a marketer sending its own customer file do not become the same legal event because both end in the shared database. (Resolução CD/ANPD nº 19/2024, Annex I, arts. 3, 5–6; Lei nº 13.709/2018, art. 3.)
EU adequacy decisions cover qualifying transfers to the UK and Brazil. Brazil also recognises the EU and specified EEA states as adequate. Those instruments have defined scopes. They do not establish tax-reporting equivalence or automatically resolve transfers between Brazil and the UK. An EU legal-obligation processing basis must rest on EU or Member State law; a foreign reporting demand alone does not satisfy that particular basis. (Regulation (EU) 2016/679, arts. 6(3), 44–48; Commission Implementing Decision (EU) 2021/1772, as amended by Decision (EU) 2025/2574; Decision (EU) 2026/179; Resolução CD/ANPD nº 32/2026; Lei nº 13.709/2018, art. 33.)
Each UK provider’s direct disclosure to Receita Federal needs its own lawful-processing basis and UK international-transfer route. Brazilian reporting law alone does not establish the UK GDPR legal-obligation basis. Current Article 44A requires applicable adequacy regulations, appropriate safeguards or a permitted derogation. Public-interest reliance under Article 49 requires necessity and an important public interest recognised in UK domestic law. Intragroup contractual clauses do not themselves cover disclosure to Receita Federal. The provider must document its actual basis and transfer mechanism before transmission. (UK GDPR, arts. 5(2), 6(1)(c), (3), 44A, 46 and 49(1)(d), (4); Data (Use and Access) Act 2025, s. 85 and Sch. 7; S.I. 2026/82, reg. 2(m), (z9).)
The group’s 2026 implementation and repair sequence
The group should adopt B only with the genuine operating allocation described above. Its first step is to approve a dated service map supported by customer contracts, authorisations, execution records, key-control arrangements and Brazil-directed campaigns. Each reporting company needs an accountable tax owner and access to the evidence underlying its returns. A parent, custodian or introducer excluded under a particular regime needs a documented functional reason for that exclusion.
The map must also record which facts would change the result. Continued use of UK ExchangeCo’s own Irish premises would preserve an additional Irish connection. Order forwarding to a common UK platform would require another provider and customer analysis. A custodian offering conversions or a marketer accepting transfer instructions would require reclassification from the operational change date. These are reporting consequences of changed services, not changes achieved solely by rewriting company descriptions. (Taxes Consolidation Act 1997, ss. 891M(3), (20) and 891HA(3), (18); UK S.I. 2025/744, regs. 3 and 26; IN RFB nº 2.291/2025, art. 5.)
The second step is to reconstruct 2026 using complete source events. Keep January–June Brazilian historical rules, the new monthly rules from July and the applicable full-year Article 8 population separate. Reconcile customers, assets, transfers and values before producing aggregates. If earlier monthly submissions are missing or wrong, repair those periods through the responsible provider’s route. The September DeCripto deadline is 30 October 2026. The group should preserve evidence supporting any pre-procedure correction protection. (IN RFB nº 2.291/2025, arts. 12, 15 and 19; RFB, Agenda Tributária, 30 October 2026.)
The third step is to complete the customer evidence and registrations. Close the Brazilian existing-user certification population by 17 November 2026 and the Irish and UK populations by 31 December 2026. Apply the statutory reminder restrictions where required. Complete applicable Irish first-year registration by year-end. A later service migration requires its own onboarding and dated allocation rather than reliance on the earlier provider’s reporting history. (IN RFB nº 2.291/2025, Annex II, items 29 and 32; Taxes Consolidation Act 1997, s. 891M(3), (8), (12); UK S.I. 2025/744, regs. 4 and 10; Directive 2011/16/EU, Annex VI, III.)
Next, prepare applicable Brazilian annual balances and CARF information for the last business day of January 2027. Prepare the first UK user and controlling-person notices for 31 January 2027. Irish and UK 2026 returns, Irish user copies and initial UK registration follow by 31 May 2027. Each provider’s tax owner should approve the included population, exclusions, values and proposed relief before submission. (IN RFB nº 2.291/2025, art. 12; Taxes Consolidation Act 1997, s. 891M(2), (6); UK S.I. 2025/744, regs. 6, 8 and 10.)
The strongest under-reporting argument is that the contractual allocation conceals the entity that actually operates the platform or performs a transfer. The strongest duplicate-reporting argument is that the same event has been copied into several returns without establishing each filer’s duty. Genuine involvement by several providers answers the latter objection only for the operations each must report. The defensible allocation pairs every inclusion with an actual service and jurisdictional connection, and every exclusion with its legal basis and evidence. Irish and UK anti-avoidance provisions remain relevant where paper arrangements seek to avoid the duties. (Taxes Consolidation Act 1997, ss. 891M(20) and 891HA(18); UK S.I. 2025/744, reg. 26.)