DAC8 Reporting Obligations

Exchanges have spent 2026 recording the tax details of every EU customer. Next year they hand the files over, and tax offices start swapping them across borders.

For most of crypto's short history, a tax authority learnt about a trader's gains only if the trader chose to declare them. That arrangement ended on January 1. Since then, crypto-asset service providers with customers in the EU have been obliged to record who those customers are, where they pay tax and what they did with their tokens, under the bloc's eighth Directive on Administrative Cooperation, known as DAC8.

With less than three months of the first reporting year left, compliance teams are moving from building systems to finding out whether those systems hold up. National filing deadlines for 2026 data fall between January and July 2027, depending on the member state. Tax authorities must then exchange the data with each other by September 30, 2027.

A European rulebook with a global template

DAC8 is the EU's transposition of the OECD's Crypto-Asset Reporting Framework, or CARF, finalised in June 2023. The standard does for digital assets roughly what the Common Reporting Standard did for offshore bank accounts a decade ago: providers collect tax-residence data on users and report it to their local authority, which forwards it to the user's home country.

The EU is the largest single bloc in the first wave, but it is not alone. The OECD's commitment list of June 23 counts 76 jurisdictions, of which 46 plan first exchanges by 2027 and 29 by 2028. The early group includes the UK, Japan, Canada, Switzerland, Brazil and South Africa, along with the Cayman Islands, Jersey, Guernsey and the Isle of Man. Singapore, Hong Kong and the UAE follow in 2028.

The US has committed to 2029 and has not yet passed implementing legislation. American brokers are already filing 2026 trades through the domestic Form 1099-DA, so a US platform with European customers is now running two regimes at once.

Who is caught

The obligations fall on "reporting crypto-asset service providers". In practice that means centralised exchanges, brokers, dealers, custodial wallet providers and crypto ATM operators. DAC8 takes its definitions from MiCA, the EU's crypto licensing regime, so a firm holding a MiCA authorisation is in scope by default.

Reach follows the customer's tax residence, wherever the platform is incorporated. A US or Asian exchange with EU-resident users carries substantially the same collection and reporting duties as one based in Paris or Frankfurt. Non-EU operators without a MiCA licence must register in a single member state before their first reporting period ends; that one registration covers the whole bloc.

Firms that already report bank-style accounts under the CRS get some relief. Where a provider is both a crypto reporter and a CRS financial institution, the rules allow limited simplifications to avoid filing the same data twice.

What goes in the file

Every customer must give the platform a self-certification. At a minimum it lists name, address, each country of tax residence with the matching tax identification number and, for individuals, date of birth. New users have had to supply it at onboarding since January; existing accounts have to be documented as well.

The reporting itself is transactional, which is where it departs from the CRS model of year-end balances. For each user and each token, platforms report aggregated, fair-value figures for three kinds of activity: crypto-to-fiat trades, crypto-to-crypto swaps and transfers. Transfers to external addresses, including self-hosted wallets, are captured. Retail payments for goods and services become reportable above roughly $50,000.

DAC8 goes further than the OECD model in one respect. It also brings e-money and central bank digital currencies into automatic exchange, which means stablecoins can turn up in more than one stream of data.

The 60-day switch

The provision operators worry about most has no counterpart in the OECD text. If a customer has not returned a valid self-certification after two reminders, and 60 days have passed since the first request, the platform must stop that customer from carrying out reportable transactions.

For an exchange with a long tail of dormant or reluctant accounts, that turns a paperwork gap into lost trading volume. Platforms have had to wire automated reminder sequences and blocking logic into the account stack, and to square the extra data they hold with GDPR retention limits. Advisory firm RSM pointed out last year that neither the OECD nor Brussels had published a draft self-certification form, leaving platforms to design their collection flows without one.

One directive, 27 enforcers

Brussels wrote the rules, but each capital enforces them. During negotiations member states could not agree on the Commission's proposed minimum penalties, so that article was dropped and fines are set nationally. Transposition was due by December 31, 2025. Most countries had laws in place by April, though some had still not published a filing date.

Italy transposed the directive through Legislative Decree 194 of December 10, 2025. The Agenzia delle Entrate set out the operating rules in a decision dated June 22, 2026: providers send XML files through its Entratel and Fisconline channels, with the first filing due by June 30, 2027. Non-resident operators register online to obtain an identification number, and those who ignore reminders to file can have their registration revoked.

Luxembourg adopted its law on March 19, applied retroactively from January 1, with first reports also due by June 30, 2027. Outside the bloc, the UK runs its own CARF rules and expects first reports by May 31, 2027. Brazil published CARF-aligned regulations in November 2025.

What the net misses

The regime sees only what passes through an intermediary. Coins held in self-custody and trades on decentralised exchanges sit largely outside it, although a withdrawal from a reporting platform to a private wallet is logged on the way out. Marino Longoni, writing in ItaliaOggi when Rome approved its draft decree, questioned whether an EU-only rule could curb evasion in a global market, or would mostly add to operators' paperwork.

The answer will start to arrive next year. Platforms file their 2026 data with national authorities between January and July, and the first cross-border exchange inside the EU is due by September 30, 2027, in the same year as the first CARF exchanges among the 46 early adopters.