Privacy, KYC and wallet anonymity

What CARF changed

From 1 April 2026, New Zealand applies the OECD's Crypto-Asset Reporting Framework, and this is the single most significant change to crypto visibility here in years.

Reporting Crypto-Asset Service Providers — broadly, any individual or entity carrying out the exchange or conversion of cryptoassets on behalf of users as a business, including counterparties, intermediaries and trading platforms — must collect identification and tax residency information from users, together with transaction details including the types of trades and their values. That information is reported annually to Inland Revenue in a specified electronic format, with the first reports due by 30 June 2027, and shared both domestically and internationally.

Note carefully what is and is not in scope. Your self-custody wallet is not a reporting provider. Nobody reports your holdings, your addresses or your internal transfers. What is reported is your activity at the businesses either side: the purchase, and eventually the sale.

The practical implication is about records rather than privacy. IRD sees both ends of your activity and not the middle, so your own records are what reconcile them. If a substantial amount left an exchange in 2026 and reappeared somewhere in 2030 with no accounting for what happened in between, you are the one explaining it. Our tax and CARF guide covers what to keep. General information, not tax advice.

The honest limits of on-chain privacy

We want to be straight about this, because a lot of writing on the subject overstates what is achievable and leaves people with a false sense of security.

Everything on-chain is public and permanent. Any address's complete balance and full transaction history is readable by anyone with a browser, forever. There is no deletion.

Addresses cluster. Spending coins from two addresses in one transaction proves the same person controls both, and analysis software records that. Change outputs, amount patterns and timing add more. A single disclosure can therefore reveal substantially more than one address.

Account-based chains are worse. Ethereum, Solana and most others use one persistent address per account, so every transaction you ever make is publicly attached to the same identifier. There is no clustering to defeat because there is nothing to cluster.

The identity link is made at the edges. If you bought through a verified account and will eventually sell through one, then your on-chain activity is realistically identifiable to anyone who can obtain those records through proper legal process. That describes nearly every crypto holder in New Zealand.

None of this is a reason not to use crypto. It is a reason to stop thinking of a wallet as private in the way a bank statement is private, and to make decisions on an accurate model. Full mechanics in our traceability guide.

What genuinely improves your privacy

Measures that actually work, in rough order of effect for effort.

Use a fresh receiving address for every payment. Free, automatic in most Bitcoin wallets, and it prevents the simplest cross-linking. Just use the address your wallet offers rather than reusing one you saved.

Use coin control and avoid consolidating unrelated coins. This is the single most effective on-chain measure and it is desktop-only in practice. Sparrow and Electrum let you choose which coins to spend; almost no phone wallet does. See our desktop wallets page.

Connect your wallet to your own node. By default your wallet asks a third-party server for your balance, which discloses every address you own to that server. Running your own node removes that disclosure entirely, and New Zealand's fibre network makes it painless.

Keep your street address out of vendor databases. Not on-chain privacy, and arguably the most consequential item on this list. Ledger's July 2020 breach exposed roughly 270,000 customers' names, phone numbers and physical addresses, and a further exposure through its payment processor Global-e was disclosed on 5 January 2026. Some owners subsequently received extortion letters and counterfeit devices in the post. Buy hardware from a New Zealand reseller — GROOV in Christchurch, The Bitcoin Shop in Tauranga — or ship to a parcel locker. Trezor's official store also accepts Monero. See our buying guide.

Hold Bitcoin in a Bitcoin-only wallet. Fresh addresses per payment, coin control availability, and no smart-contract interactions leaking information. BlueWallet and Blockstream Jade are both good here.

Claims to be sceptical of

Four things we would examine carefully before believing.

"Fully anonymous wallet." The wallet part is accurate and trivially true of every wallet. The anonymity part depends on the chain and on your behaviour, not on the software.

"Buy crypto with no ID, no limits." Any service serving New Zealanders at scale without identity verification is either not doing what it claims, operating outside the law, or a scam designed to take a deposit. There is no clever loophole.

"Untraceable transactions." On Bitcoin, Ethereum or Solana, no. Privacy techniques exist and vary in effectiveness; none makes a public ledger stop being public.

"Privacy tokens will keep you compliant and invisible." Those two goals are in tension, and platforms in regulated markets increasingly restrict assets they cannot trace. We are not going to advise you on this either way — but be aware that privacy choices can affect your ability to use regulated on-ramps and off-ramps.