CARF does not just send transaction data to SARS in isolation. It sends structured, machine-readable data that SARS’s systems can reconcile directly against your tax returns. If you bought R1 million of Bitcoin and sold it a year later for R1.5 million, CARF captures the buy date, the sell date, the rand amounts, and your tax file number. SARS can feed this into its data matching engine and compare it against your ITR12 capital gains declaration. If you declared R200,000 in gains and your actual gain was R500,000, the mismatch is immediate and automated.
This is the data matching problem. Before CARF, SARS could see transaction data only if it initiated an audit. Now the data arrives continuously, and SARS’s systems can flag discrepancies without human investigation. For investors whose returns are accurate, the matching process is invisible and reassuring. For investors whose positions are incomplete or wrong, it is the mechanism through which they are identified.
How the Data Matching Works
Every FSCA-licensed Bitcoin exchange sends SARS the following annual information for each client: transaction date, transaction type (buy or sell), amount in Bitcoin, rand value at execution, rand proceeds, and the cost basis if the exchange has recorded it. This data is structured in a standard format and matches the information the exchange holds in its own systems.
SARS’s data matching systems run this incoming CARF data against the taxpayer’s own reported position. The comparison asks simple questions. If SARS’s CARF data shows that you bought R500,000 of Bitcoin on 15 January 2025, did you disclose that transaction? If you sold Bitcoin on 20 March 2025 for R750,000, did you report a capital gain? If the CARF data shows a gain and your return shows zero, that is a match exception.
The system is not looking for minor discrepancies or timing differences. It is looking for material gaps. If CARF shows a R500,000 transaction and your return makes no mention of Bitcoin, that flags immediately. If CARF shows a R300,000 capital gain and you reported R50,000, the system notes the variance.
SARS’s systems also cross-reference the exchange data with the taxpayer’s declaration of assets and liabilities. At the time of onboarding with an exchange, you declare your tax file number and your source of funds (where larger amounts are involved). SARS can verify that the declared source of funds aligns with your tax history. If you claim the funds came from salary and your tax record shows no income for that period, the mismatch is flagged.
What SARS’s Automatic Exchange of Information Adds
The data matching problem becomes more complex when SARS receives data about your Bitcoin holdings on foreign platforms. The OECD’s Automatic Exchange of Information (AEOI) framework links SARS to 50+ tax authorities. If you hold Bitcoin on a foreign exchange, that exchange reports you to its home tax authority, and that authority exchanges the data with SARS.
The practical effect is that SARS can now see your Bitcoin activity across multiple jurisdictions. If you have Bitcoin on a licensed platform in the United States and also hold Bitcoin on a South African exchange, SARS receives data from both. The combined picture shows your total exposure, not just your local holding.
This creates a second layer of reconciliation. If CARF shows a Bitcoin purchase on a US platform and you have not disclosed that foreign asset on your ITR12 or your assets and liabilities statement, SARS identifies the gap. South African tax residents are required to declare foreign financial assets above certain thresholds. Bitcoin is now a reportable foreign asset.
AEOI works differently in different jurisdictions. Some countries have fully reciprocal agreements and send SARS equivalent data on all financial assets. Some have partial agreements limited to certain asset classes. The key principle is that your information flows from your Bitcoin provider to its tax authority to SARS. The networks are joined.
The Reconciliation Timeline
The CARF data reaches SARS once a year, usually in the second or third quarter following the tax year. For 2025 transactions, SARS will receive CARF data in mid-2026. SARS does not immediately initiate audits on every mismatch. Instead, it runs the data matching and creates a list of discrepancies. These discrepancies feed into SARS’s compliance and audit prioritisation systems.
How long before SARS acts on a mismatch depends on SARS’s capacity and the severity of the gap. If you have a minor reporting error, SARS may send a query allowing you to correct it. If you have undeclared capital gains of R1 million, your file will move through the audit queue. The timeline is not fixed, but it is now predictable in a way it was not before CARF.
Some taxpayers ask whether they can correct prior years’ returns to align with CARF data before SARS identifies a mismatch. The answer depends on how many years have passed. If the error was made in 2024 and discovered before SARS raises a query, you can amend your return. If SARS has already issued a notice of assessment for that year, the amendment process is more complex and may trigger penalties.
The key point is that CARF creates a deadline. Before CARF, you could delay correcting Bitcoin tax errors indefinitely. After CARF, SARS has structured data that will force the issue within a defined window. The rational response is to correct errors before SARS’s data arrives, not after.
What Voluntary Disclosure Means in This Context
SARS’s Voluntary Disclosure Programme (VDP) provides a mechanism for taxpayers to come forward and correct prior errors. The VDP requires you to lodge a voluntary disclosure application identifying the years and amounts involved, and to pay the tax, interest, and penalties owing.
The VDP is not a pardon. You are paying all the tax that was due. But it provides legal closure. Once SARS accepts your disclosure, the years covered by that disclosure are settled. SARS cannot subsequently raise an audit for those years.
The timeline of the VDP matters in relation to CARF. If you lodge a voluntary disclosure before SARS’s data matching systems have identified your discrepancy, the process is straightforward. You disclose, you pay, the years are closed. If you lodge a disclosure after SARS has already identified the mismatch and is preparing an audit notice, you are no longer in voluntary disclosure territory. SARS may reject your application as not genuinely voluntary.
The window for voluntary disclosure in relation to Bitcoin is narrowing now that CARF data is arriving. For investors with prior-year gaps, the rational decision point is within the next few months, not later in the year.
What Happens If Your Record Includes Self-Custody
Self-custody Bitcoin (Bitcoin held in a personal wallet rather than on an exchange) is not reported through CARF. If you hold Bitcoin only in self-custody and have never used a licensed SA exchange, your Bitcoin activity is not automatically visible to SARS through CARF.
However, you are still required to declare your Bitcoin holdings and any gains from disposing of them. SARS assesses Bitcoin as a capital asset. If you realise a capital gain from selling Bitcoin, that is a taxable event. The source of the gain (whether you bought on an exchange or received the Bitcoin from another source) does not affect its tax treatment.
The practical issue with self-custody is disclosure. If you hold Bitcoin in a private wallet and do not declare it anywhere, SARS has limited visibility unless you are directly audited or you disclose voluntarily. The regulatory risk does exist, but it is lower than the risk of holding Bitcoin on a visible exchange without declaring it.
For family offices and institutional investors, the self-custody question is more complex. A trust holding Bitcoin in self-custody must still declare that asset to SARS and include it in the trust’s income tax return. The trustee’s personal liability under the Trust Property Control Act requires proper documentation and record-keeping. A trust with undeclared self-custody Bitcoin faces greater personal liability than a trust holding Bitcoin on a licensed exchange.
The Three Compliance Scenarios
For South African Bitcoin investors, CARF creates three distinct compliance scenarios. First, you have completely compliant records: all Bitcoin is held on licensed SA providers or properly declared foreign platforms, all transactions are documented, and all tax returns are accurate. For you, CARF is invisible. Your records match SARS’s data. No audit will result.
Second, you have partial compliance: you have declared some Bitcoin positions and some gains, but you have undeclared activity on foreign platforms, or you have prior-year positions you did not declare, or you have minor documentation gaps. For you, CARF will identify the gaps within months. The gap is fixable now through voluntary disclosure or amended returns. It becomes harder and more expensive if you wait for SARS to identify it.
Third, you have substantial undeclared positions: Bitcoin holdings that exist entirely outside your tax history, or gains that were never declared, or self-custody Bitcoin that has never appeared on any return. For you, CARF represents a material shift in compliance risk. The disclosure window exists now. After SARS’s data matching process completes and queues your file for audit, the cost and complexity are substantially higher.
The Documentation Challenge
Even if your Bitcoin history is documented, SARS needs to reconcile your records with the exchange’s records. This reconciliation requires clear documentation: your cost basis, your transaction dates, your disposal proceeds. If your records are messy, that creates friction in the reconciliation process.
The reference article on SARS taxation explains what you should keep. For each Bitcoin transaction, you need: the date acquired, the acquisition cost (in rand, at the time of purchase), the date sold (if applicable), the disposal proceeds (in rand), and the cost basis calculation. If you have bought Bitcoin multiple times, you need to understand cost base allocation methods (either FIFO or weighted average, depending on your chosen method).
The documentation is most important if SARS raises a query. If SARS has CARF data showing a sale, and your return shows no gain, SARS will ask you to justify the discrepancy. If your records are absent or unclear, you will need to reconstruct them. If they are clear, the reconciliation is fast.
Practical Steps
First, pull your complete transaction history from every Bitcoin provider you have ever used. If you have a SimplB account, download the full transaction export. If you have used foreign exchanges, download those histories as well.
Second, reconcile these histories against your tax returns for the past three to five years. Identify any Bitcoin transactions that do not appear in your declared gains or losses. Even small gaps compound. If you have 20 undeclared trades, that is a systematic pattern, not a rounding error.
Third, if you identify gaps, decide: are you going to correct this through amended returns or through the Voluntary Disclosure Programme? The answer depends on the size of the gap, the number of years affected, and your comfort level with the audit process. A tax professional can model both paths.
Fourth, if your records are complete and accurate, no action is required. You can be confident that CARF’s data will match your history, and any SARS reconciliation will proceed smoothly.
This article is for general educational purposes only and does not constitute financial, legal, tax, or exchange control advice. The information reflects the regulatory position as at the date of publication. Your individual circumstances may differ and you should seek qualified professional advice before making any decisions.
