DAC8 Explained: EU Crypto Tax Reporting Rules

DAC8 closes the information gap that let crypto activity sit outside the reach of EU tax authorities. This page explains what it requires, how it compares to CARF, who is affected, the timeline that matters, and the practical steps to be ready.

DAC8 and CARF: the relationship

DAC8 and CARF are parallel frameworks, one being the EU implementation of the other. CARF is the OECD’s global model for crypto-asset reporting, published in October 2022; it defines what an RCASP is, which transactions are reportable, and how information is exchanged. DAC8 transposes CARF into binding EU law — adopted in October 2023 as Council Directive 2023/2226 — and applies CARF-equivalent rules across all 27 member states through the existing DAC cooperation mechanism. Where CARF is a model each country chooses to adopt, DAC8 is mandatory: every member state must transpose it into domestic legislation. Our CARF explainer covers the global framework in full.

DAC8 is stricter in places. It explicitly captures e-money tokens (stablecoins such as USDC and USDT when offered by EU-licensed providers) and certain NFTs, and it mandates EU-wide automatic exchange. A crypto exchange operating in Ireland reports a German customer’s transactions, and that data automatically reaches the German tax authority.

Who is affected

RCASPs under DAC8

DAC8 requires reporting by any entity that is a Reporting Crypto-Asset Service Provider (providing crypto-asset services as defined in MiCA, or facilitating crypto transactions for customers) and has an EU nexus — incorporated, resident, managed or controlled in the EU, or operating through an EU permanent establishment.

• Centralized crypto exchanges with EU registration or EU nexus
• Crypto brokers and dealers
• Custodian wallet providers
• Crypto payment processors
• Operators of crypto ATMs in the EU

The nexus rule. An exchange incorporated outside the EU with EU customers is not automatically an RCASP under DAC8. Its EU-resident customers may still be reported where another RCASP in the chain has EU nexus, or where the customer’s home country receives CARF data from the exchange’s country of incorporation. DAC8 is designed to close gaps.

Non-EU platforms with EU customers. Operating from Dubai or Singapore without an EU entity keeps you outside direct DAC8 scope, yet under CARF’s wider rollout and bilateral exchange agreements EU tax authorities receive your customers’ data through other channels. The gap that existed until now is closing regardless of where you are incorporated.

Reportable users

DAC8 applies to EU-resident individuals, EU-incorporated entities holding crypto accounts, and beneficial owners of EU-resident entities. Residency is the test, not citizenship — a US citizen living in Germany is a reportable person for German tax purposes.

Implementation timeline

The collection obligation starts on 1 January 2026, or when your country’s transposition law enters into force if that is earlier. Your KYC systems must be able to collect TINs by then, 2026 transactions must be recorded in a DAC8-compatible format, and onboarding must be updated before the collection period opens.

Reporting obligations in detail

What must be reported

Customer identification: full legal name, address, date and place of birth (individuals), TIN for each country of residence, country of tax residence, and the crypto account identifier.

Per-asset transaction data (annual aggregate): each crypto asset traded or held; total fiat proceeds from crypto-to-fiat exchanges; total fiat equivalent from crypto-to-crypto exchanges; fair market value of crypto received in retail payments; value and units transferred out and in; and the year-end balance in units and fair market value.

In practice you need to produce an annual statement per customer per asset type showing volume, value and transfers in and out. For a platform with high-frequency traders, that is a substantial aggregation exercise.

Format and submission

Each member state specifies its technical format, typically an XML schema aligned with the DAC8 reporting schema, submitted through an online portal. Large RCASPs may submit directly; smaller ones can use approved intermediary service providers.

Due diligence

RCASPs must verify customer tax-residency declarations, validate TINs against OECD rules, and identify controlling persons of entity customers. Where a customer provides inconsistent or insufficient information, reporting still stands: DAC8 requires you to document the due-diligence failure and apply the indicia-of-residence approach, using whatever information you hold to determine likely residence.

How DAC8 interacts with MiCA

MiCA (Markets in Crypto-Assets Regulation) is the EU’s crypto licensing framework, applying progressively since 2023. The two are complementary: MiCA governs what you can do and how (licensing, consumer protection, stablecoin reserves), while DAC8 governs tax reporting on the activity MiCA permits.

DAC8 definitions cross-reference MiCA definitions on purpose — a “crypto-asset service” in DAC8 points to the same term under MiCA. If you hold or seek a MiCA license, your regulator expects DAC8-compliant reporting as part of the fitness test, and running a MiCA-regulated exchange without that infrastructure is a gap ESMA and national regulators have flagged explicitly. From a regulatory standpoint the two are inseparable.

Penalties for non-compliance

DAC8 requires member states to impose effective, proportionate and dissuasive penalties. Amounts are set nationally, and early transposition legislation shows the range.

Figures reflect early national transposition legislation and vary by member state. Beyond fines, regulators can suspend or revoke MiCA licenses for repeated or systematic non-compliance — an existential risk for a crypto business.

How to prepare

Frequently asked questions