EU DAC8 Directive Explained: Crypto Tax Reporting Rules for CASPs

DAC8 is no longer a future compliance project. The first EU crypto reporting period began on 1 January 2026, and the technical plumbing arrived just before it: Commission Implementing Regulation (EU) 2025/2263, published in the Official Journal on 26 November 2025, set the standard forms and computerized formats for exchanging crypto-asset information and applies from the same date.

For an in-scope provider, that means the work is now operational rather than preparatory. DAC8 requires it to:

• Identify its reportable users;
• Collect tax-residence self-certifications;
• Identify which crypto activity is reportable;
• Retain the data those determinations rest on;
• File in line with the national reporting process;
• Feed the automatic exchange between Member States.

DAC8 is an EU tax-reporting regime, not an additional crypto tax and not an AML rule. It changes what a provider must know about its users and record about their activity — not what anyone owes.

Quick Facts

• DAC8 applies from 1 January 2026.
• 2026 is the first crypto reporting period.
• Pre-existing users must be remediated for tax self-certification by 1 January 2027.
• Member States exchange first-period information by 30 September 2027.
• The USD 50,000 threshold applies specifically to Reportable Retail Payment Transactions and is not a general exemption for smaller crypto transfers.
• DAC8 reporting is closely aligned with CARF but remains a distinct EU legal regime.

What Is DAC8 and What Changed on 1 January 2026?

DAC8 is Council Directive (EU) 2023/2226. It amends the Directive on Administrative Cooperation, the framework EU tax authorities already use to exchange information automatically, and extends that machinery to crypto-assets. Member States had to transpose it by 31 December 2025 and apply its provisions from 1 January 2026.

DAC8 does not determine how much tax a user owes. It creates information-collection and exchange obligations. DAC8 crypto reporting applies from 1 January 2026, making 2026 the first reporting period for crypto-asset information under the Directive.

One timing point is worth separating carefully, because it is widely misstated. The 2026 reporting period is the first DAC8 crypto reporting year. Member States must exchange the corresponding information by 30 September 2027, while domestic filing deadlines for Reporting Crypto-Asset Service Providers may be earlier. In practical terms, 30 September 2027 is the date tax authorities deal with each other; the date your business file is set by the Member State you report in, and several have set it months earlier. DAC8 is a directive, so filing procedures, penalties and certain implementation details operate through national law.

For the wider picture of meeting crypto tax reporting requirements for businesses across several regimes at once, our pillar guide covers the architecture side.

Which Crypto Businesses Fall Within DAC8?

DAC8 does not use “CASP” as its reporting term. It uses Reporting Crypto-Asset Service Provider, and that definition is wider than the MiCA authorization list. DAC8 covers both relevant MiCA CASPs and certain Crypto-Asset Operators outside the standard MiCA authorization route.

MiCA-Authorised CASPs

For a provider authorised under MiCA — or operating through the Article 60 notification route available to certain regulated financial entities — that authorisation or notification is itself one of the grounds that brings it within DAC8 reporting. The two regimes are separate in purpose: MiCA governs whether the business may operate, DAC8 governs what it reports to tax authorities.

This article does not cover the authorization process; MiCA CASP authorization is a separate subject with its requirements. What matters here is that holding the authorization is a route into DAC8, not a substitute for working out what DAC8 asks of you.

Crypto-Asset Operators Outside the Standard MiCA Route

A provider can meet the Reporting Crypto-Asset Service Provider definition without holding ordinary MiCA authorization, where the Directive's conditions are satisfied. The relevant EU connections include:

• tax residence in a Member State;
• incorporation or organization under a Member State's law, with legal personality or an obligation to file tax returns there;
• management from a Member State;
• a regular place of business in a Member State;
• Reportable Transactions effectuated through a branch in a Member State.

In practical terms, this is why “we are not MiCA-authorised” is not an answer to a DAC8 question. The test runs on activity and EU connection, and a business can be outside the licensing perimeter while sitting squarely inside the reporting one.

Non-EU Providers and Single Registration

Certain non-EU Crypto-Asset Operators with Reportable Users resident in the EU can fall within the DAC8 registration and reporting framework. For those operators the Directive provides a single registration in one Member State rather than registration in each one where users happen to live.

There are also reliefs. Where equivalent reporting is carried out in a Qualified Non-Union Jurisdiction and the appropriate exchange arrangement is in place, the EU-side obligation can be satisfied through that route instead.

A user's EU tax residence is important for reportability, but it does not by itself determine where a Reporting Crypto-Asset Service Provider must report. User tax residence matters, but DAC8 scope cannot be determined from user residence alone — one EU customer does not automatically oblige every offshore exchange to register.

Which Users, Crypto-Assets, and Transactions Are Reportable?

Reportable Users

A Reportable User is a relevant Crypto-Asset User resident in a Member State, subject to the exclusions and definitions the Directive sets out. Residence here means tax residence established through the DAC8 due diligence process, not the country on a shipping address or the IP the user last logged in from.

Reportable Crypto-Assets

DAC8 uses the concept of a Reportable Crypto-Asset and covers a broad range of crypto-assets capable of being used for payment or investment purposes.

The Directive excludes Central Bank Digital Currencies, Electronic Money, and crypto-assets for which the Reporting Crypto-Asset Service Provider has adequately determined that they cannot be used for payment or investment purposes. Certain decentralized assets and certain NFTs can fall within scope depending on their characteristics — which is a different statement from “all NFTs are reportable.” Asset classification is therefore a per-asset determination the provider has to be able to evidence, not a label applied to a whole product category.

Reportable Transactions

Reportable Transactions fall into four groups:

• exchanges between a Reportable Crypto-Asset and fiat currency;
• exchanges between Reportable Crypto-Assets;
• transfers of Reportable Crypto-Assets;
• Reportable Retail Payment Transactions.

The USD 50,000 figure belongs only to the last of these. The USD 50,000 threshold applies specifically to the definition of a Reportable Retail Payment Transaction; it is not a general exemption for crypto transfers below USD 50,000. A transfer of USD 2,000 is not out of scope — it simply reports as a transfer rather than as a retail payment.

DAC8 Tax Due Diligence and Self-Certification

DAC8 due diligence is tax due diligence, and it answers a question AML onboarding does not ask: which Member State may tax this user? AML/KYC data can support DAC8 verification, but AML onboarding does not replace DAC8 tax self-certification.

New Users

For relationships established in the applicable DAC8 period, the provider must obtain a valid self-certification that allows the user's tax residence to be determined. The relevant fields include:

• name or legal name;
• address;
• the Member State or States of tax residence;
• taxpayer identification numbers where required;
• date of birth for individual users.

The self-certification is then tested for reasonableness against the information the provider already holds, including customer due diligence information gathered for AML purposes. AML/KYC customer information can support DAC8 due diligence, but it does not replace tax-residency self-certification. The two processes collect overlapping data for different legal purposes, and a CDD file that establishes identity does not establish tax residence. This distinction is worth understanding properly, and we cover how AML/KYC data differs from tax-residency due diligence in more detail.

Pre-Existing Users

A pre-existing user is a relationship that existed as of 31 December 2025. Pre-existing crypto users must be remediated for DAC8 tax-residency self-certification by 1 January 2027.

For most providers this is the dominant operational task of the first reporting year, because it is a back-book exercise rather than a flow process: every account opened before the regime started has to be brought up to the same evidential standard as a new one, on a fixed deadline, usually while the user has no particular incentive to respond. DAC8 requires remediation of pre-existing user tax data, not retroactive reporting of pre-2026 crypto transactions.

Does DAC8 Require Historical Transactions Before 2026?

No — the DAC8 crypto reporting period begins from 1 January 2026. The Directive provides for the first information to be reported for relevant periods as from that date.

DAC8 does not require retroactive reporting of crypto transactions before 1 January 2026 solely because the customer is a pre-existing user. Historical user remediation and historical transaction reporting are different requirements under DAC8. The confusion is understandable, since both involve the word “existing,” but they operate on different objects: one on the user record, one on the transaction record. A customer who opened an account in 2022 needs a self-certification; their 2022 trades do not enter the 2026 report.

Restriction on Reportable Transactions When Self-Certification Is Missing

The Directive attaches a consequence to a missing self-certification rather than leaving it to provider discretion. After two reminders and at least 60 days without required self-certification information, a Reporting Crypto-Asset Service Provider must prevent the user from performing Reportable Transactions.

The sequence is specific: an initial request, then two reminders, then a period of not less than 60 days. What the Directive requires at the end of it is prevention of Reportable Transactions — not closure of the account, and not a blanket freeze of everything the user can do. In practical terms, that means the restriction should be scoped to the transaction types DAC8 covers and lifted once a valid self-certification arrives, which is easier to build if the restriction is driven by the self-certification status field rather than by a manual account action.

What Information Must Be Reported Under DAC8?

DAC8 reporting uses structured user and crypto-asset transaction data rather than requiring a simple raw export of every blockchain transaction. It splits into two parts.

User and Entity Information

The user side covers name, address, the Member State or States of residence, taxpayer identification numbers, date of birth for individuals, entity information, and controlling individuals where applicable.

Place of birth is not a universal mandatory field. The consolidated Directive provides an exception where domestic law does not otherwise require it, so this is one of the fields to confirm against the implementation in your reporting Member State rather than collecting everywhere by default.

Crypto Transaction Information

Reporting is organized by Reportable Crypto-Asset and by transaction category rather than by individual transaction. Depending on the category, what is reported can include aggregate gross amounts, aggregate units, the number of transactions, acquisitions and disposals, transfers, retail-payment categories, and the fair-market-value calculations those figures rest on.

DAC8 reporting is based on structured user information and annual crypto-asset transaction aggregates rather than a simple export of every blockchain transaction. The tax authority does not receive a raw blockchain transaction export, and submitting every TxID and timestamp as a separate line is not what the Directive asks for. What it does ask for is figures a provider can reproduce and explain — which is a data-engineering requirement rather than a disclosure one.

How to Build a DAC8 Reporting Workflow

Collect and Link the Required Data

The reporting dataset is a chain of joins: User → Tax Residence → TIN → Entity or Controlling Person → Crypto Asset → Transaction Category → Reporting Period. Every link has to hold for the aggregates at the end to mean anything.

In practical terms, this is where most DAC8 projects actually fail. Identity data lives in the onboarding system and transaction data lives in the ledger, and if the two cannot be joined on a stable user key, the reporting period turns into a manual reconciliation exercise repeated every year.

Validate the Data Before Reporting

Validation should run before aggregation, not after submission. The checks that matter most:

• missing self-certification;
• missing or invalid TIN where applicable;
• contradictory tax residence across records;
• duplicate customer records;
• missing asset classification;
• incorrect transaction category;
• incorrect fiat valuation;
• unresolved change-of-circumstances cases.

DAC8 compliance requires reporting-grade data quality, not merely storing additional onboarding fields. A tax-residence field that is populated but unverified is not compliance; it is an unvalidated string in a database.

Preserve an Audit Trail

The Directive requires records of the steps undertaken and the information relied upon, which in practice means preserving the self-certification itself, the date it was received, the reasonableness check applied, any subsequent changes, the user classification that resulted, the transaction aggregation logic, corrections made, and the reporting history for prior periods.

For businesses running this across several regimes and higher volumes, our pillar guide covers how to build scalable crypto tax-reporting infrastructure.

DAC8 XML and Integration With Internal Systems

Commission Implementing Regulation (EU) 2025/2263, which amends Implementing Regulation (EU) 2015/2378, sets the standard forms and computerized formats for the mandatory automatic exchange of information on reportable crypto-assets. It applies from 1 January 2026.

At EU level, those standardized computerized formats cover Reporting Crypto-Asset Service Provider identification, Reportable Users, Controlling Persons, crypto-asset information, the reported amounts and categories, and the exchange and validation process itself. Knowing that structure is useful because it fixes the shape your internal data has to be able to produce.

What it does not do is give every provider a single universal XML upload process valid in every Member State. National tax authorities can set their own filing interface, format variations and submission process, and they do. The safest DAC8 integration model is to keep reporting data independent from a single national submission portal so that the same validated dataset can support different filing interfaces. Concretely, that means storing normalized source data, running validation against it, generating the required national reporting format as an output step, and retaining the reporting and audit history separately from whichever portal was used this year.

How DAC8 Works Across Multiple EU Member States

A provider does not automatically report everything to its MiCA home state. The reporting Member State is determined by the DAC8 rules, not by where a MiCA passport was issued — and for multi-entity groups those two answers can diverge.

At a high level, the flow works like this:

• the provider reports to the competent tax authority of the Member State where DAC8 requires it to report;
• that tax authority exchanges the relevant information with the other Member States concerned;
• relief from duplicate reporting can apply in the circumstances the Directive specifies, so the same transactions need not be reported twice;
• certain Crypto-Asset Operators report through the single registration described above.

Member States must exchange the information relating to the first 2026 period by 30 September 2027. For a group with entities in several Member States, the practical consequence is that the reporting-Member-State determination has to be made per entity before the data model is built, because it decides which national format and deadline each dataset has to satisfy.

DAC8 vs CARF

DAC8 is an EU legal regime closely aligned with CARF, but it contains its own EU-specific scope, nexus, registration, due-diligence, enforcement, and exchange rules. It is not simply CARF implemented in Europe, and treating it that way is how EU-specific obligations — the single registration route, the 60-day restriction, the Member State exchange mechanics — get missed.

A business operating under both can run one data foundation for identity, tax residence, TIN, entity classification, controlling people, asset data and transaction data. DAC8 and CARF can share underlying data infrastructure, but they remain separate legal and reporting frameworks. The legal mapping and the reporting workflow are verified separately for each. For the international standard itself, see our guide to OECD CARF reporting requirements.

What Crypto Businesses Should Do During the First DAC8 Reporting Year

1. Determine whether the business meets the Reporting Crypto-Asset Service Provider definition, based on activity rather than on its licence.
2. Identify the Member State or States where the DAC8 reporting obligation arises.
3. Confirm that valid tax-residence self-certification is being collected for new users.
4. Complete remediation of pre-existing users before 1 January 2027.
5. Set up classification of Reportable Crypto-Assets and Reportable Transactions.
6. Prepare a validated reporting dataset and confirm the national filing procedure and deadline that applies to you.

On enforcement: DAC8 requires Member States to lay down penalties that are effective, proportionate and dissuasive, with the amounts and mechanics set in national law. There is no EU-wide minimum DAC8 fine, and MiCA penalty percentages are not DAC8 penalties. For certain Crypto-Asset Operators, a separate DAC8 registration can be revoked after continued reporting of non-compliance, and as a last resort the Directive contemplates coordinated measures to prevent such an operator from operating in the Union. That is a different mechanism from losing a MiCA passport.

Conclusion

DAC8 is already in its first reporting year. The immediate task for crypto businesses is no longer preparation for 2026, but producing complete and defensible 2026 reporting data. The working sequence is: scope → reporting Member State → self-certification → reportable users → assets and transactions → validation → reporting → EU exchange. Most of the difficulty sits in the middle of that chain rather than at the filing step, which is why the back-book remediation deadline of 1 January 2027 deserves more attention than the exchange date everyone quotes.

FAQ

What Is DAC8 for Crypto Businesses?

DAC8 is the EU tax-transparency regime that extends automatic exchange of information to crypto-assets. It requires in-scope Reporting Crypto-Asset Service Providers to carry out tax-residency due diligence on their users and report prescribed user and crypto-transaction information to their national tax authority, which then exchanges it with other Member States.

When Did DAC8 Crypto Reporting Start?

1 January 2026. That makes 2026 the first crypto reporting period under the Directive. The first exchanges between Member States relating to that period must take place by 30 September 2027, while the domestic deadline by which a provider must file with its tax authority may be earlier, depending on national implementation.

Which Crypto Companies Are Subject to DAC8?

Not only MiCA CASPs. DAC8 covers relevant MiCA-authorised crypto-asset service providers and certain other Crypto-Asset Operators that meet the Directive's Reporting Crypto-Asset Service Provider definition and its EU nexus rules. Exact scope depends on the activity performed and the EU connection, not on the license a business happens to hold.

Does DAC8 Apply to Crypto Companies Outside the EU?

Potentially. Certain non-EU Crypto-Asset Operators serving EU Reportable Users can fall within the registration and reporting framework, with a single registration in one Member State. Scope depends on the DAC8 nexus and registration rules and on Qualified Non-Union Jurisdiction relief — not simply on having one EU customer.

Does DAC8 Require Reporting Crypto Transactions From Before 2026?

No, not as part of the DAC8 crypto reporting period. DAC8 reporting starts with periods beginning 1 January 2026. Pre-existing users still need tax-residency remediation by 1 January 2027, but that does not make their pre-2026 crypto transactions retroactively reportable. The two requirements are separate.

What Information Must DAC8 Self-Certification Contain?

The relevant fields are the user's identity, address, Member State or States of tax residence, taxpayer identification numbers where required, date of birth for individual users, and entity information where applicable. The provider must also assess whether the self-certification is reasonable against the information it already holds, including customer due diligence data.

What Happens if a User Does Not Provide DAC8 Self-Certification?

After the initial request, two reminders and at least 60 days, the Reporting Crypto-Asset Service Provider must prevent the user from performing Reportable Transactions if the required information is still missing. The Directive requires prevention of those transactions, not permanent closure of the account, and access can be restored once a valid self-certification is received.

What Crypto Transactions Are Reportable Under DAC8?

Four categories: exchanges between crypto-assets and fiat currency, exchanges between crypto-assets, transfers of Reportable Crypto-Assets, and Reportable Retail Payment Transactions. The USD 50,000 threshold applies only to that last retail-payment category. Smaller transfers are not exempt — they are reported under the transfer category instead.

Does DAC8 Require a Separate Report for Every Crypto Transaction?

Not in the sense of sending a raw transaction ledger. DAC8 requires structured reporting that combines user information with aggregated information by Reportable Crypto-Asset and transaction category, including aggregate amounts, units and transaction counts. The exact domestic submission mechanics depend on national implementation.

What Is the Difference Between DAC8 and CARF?

CARF is the OECD international standard. DAC8 is an EU legal regime closely aligned with CARF but containing EU-specific rules for scope, reporting nexus, registration, due diligence, exchange and enforcement. A business can share one data foundation across both, but the legal mapping and reporting workflow have to be done separately for each.