Rule 244 - Due diligence procedures for crypto-asset reporting

Due diligence procedures under section 509. 244. (1) A crypto-asset user becomes a reportable user from the date identified as such under this rule's due-diligence procedure. (2) For an individual crypto-asset user, on establishing the relationship (or, for pre-existing users, within twelve months from 1 January 2026), the provider must obtain a self-certification of tax residence and confirm its reasonableness against information already held (including AML/KYC documentation); if circumstances later change such that the provider knows or has reason to know the self-certification is incorrect, it must stop relying on it and obtain a fresh valid self-certification or a reasonable supporting explanation. (3)-(7) For an entity crypto-asset user, an equivalent self-certification and reasonableness process applies to determine its own tax residence (defaulting to place of effective management or principal office address if it certifies no tax residence), and, unless it is an excluded person or active entity, to identify any controlling persons who are reportable persons - relying on AML/KYC-equivalent procedures consistent with the FATF's 2019-updated virtual-asset-service-provider recommendations, or substantially similar procedures where AML/KYC does not otherwise apply; the same change-of-circumstances refresh obligation applies here too. (8)-(9) A valid self-certification for an individual (or controlling person) must be signed/affirmed, dated no later than receipt, and state name, address, country(ies) of tax residence, TIN(s), and date of birth; for an entity, it must state legal name, address, country(ies) of tax residence, TIN(s), and (unless an active entity or excluded person) the same details for each controlling person and their specific controlling role, plus any basis claimed for active-entity or excluded-person status. (10) A TIN need not be collected where the relevant country does not issue one, or its law does not require collection of one issued by it. (11)-(12) A provider may rely on a third party to perform these due-diligence obligations (while remaining itself responsible), and must retain all related documentation and data for at least seven tax years after the relevant rule-243 reporting period. (13) Detailed sub-clauses further specify: multi-residency individuals/entities are reported against every declared country; "reasonableness" is confirmed where the provider has no actual or constructive knowledge the self-certification is wrong; specific criteria establish when a provider has "reason to know" a self-certification is unreliable (incompleteness, internal inconsistency, conflicting file information, or knowledge held by a relied-upon service provider); documentation that doesn't reliably establish identity or is otherwise inconsistent cannot be relied on; a change of circumstances invalidates the affected part of a self-certification until updated, with a 90-day grace window (during which the user may be treated per the original certification, adjusted for the known change) to obtain a fresh valid certification or confirmation; inconsequential self-certification errors curable from the provider's own file do not invalidate it; and "publicly available" information (for entity residence/status determinations) includes tax-administration lists, public government registers, and established-securities-market disclosures. (14) Exchange of any crypto-asset transaction information under rules 241-244 is for the limited purpose of tax administration by the relevant jurisdiction.