On 30 January 2026, the European Commission opened infringement procedures against member states that had failed to transpose DAC8 (Directive (EU) 2023/2226) and DAC9 (Directive (EU) 2025/872) into national law by the required deadline, with those directives applying EU-wide from 1 January 2026. Companies operating across the EU – particularly crypto-asset service providers, multinational groups subject to Pillar Two, and financial intermediaries – face immediate compliance uncertainty where national implementing rules remain pending. Portugal enacted Law No. 26/2026 on 3 June 2026, becoming one of the states that has completed transposition, though the landscape across other jurisdictions remains uneven.
What DAC8 and DAC9 Require – and Why Timing Matters
DAC8 extends the EU's administrative cooperation framework to cover crypto-asset reporting, aligning it with the OECD's Crypto-Asset Reporting Framework (CARF). From 1 January 2026, crypto-asset service providers (CASPs) operating in the EU are required to collect, verify and report information on their clients' transactions to the competent tax authority of the relevant member state. That authority then exchanges the data automatically with other EU tax administrations. The directive draws on standards developed in coordination with bodies such as ESMA and EBA, which have published guidance on the scope of regulated crypto-asset activities.
DAC9 addresses the information exchange dimension of Pillar Two / GloBE rules. Large multinational groups already subject to the global minimum tax framework must now exchange qualifying domestic top-up tax and income inclusion rule information through a harmonised EU mechanism. DAC9 does not alter the underlying tax rates established under Pillar Two; its purpose is to ensure that tax authorities across the EU receive consistent, standardised data to verify compliance with the GloBE rules.
Both directives were required to be transposed and operative from 1 January 2026. Where a member state has not enacted implementing legislation by that date, the practical result is a gap: CASPs and multinationals may face conflicting or absent national guidance on reporting formats, penalties and tax residency determination rules, even though the substantive EU obligations already apply.
The Commission's Infringement Procedures
Under Article 258 of the Treaty on the Functioning of the European Union, the Commission may refer non-transposing member states to the Court of Justice of the European Union (CJEU) and seek financial penalties. The procedures opened on 30 January 2026 represent a formal escalation: affected states were placed on notice that continued non-transposition could lead to CJEU proceedings. The Commission's position, as reflected in communications available on EUR-Lex, is that delays in implementing DAC8 and DAC9 undermine the integrity of the EU's automatic exchange of information architecture and create competitive distortions.
The status of transposition across individual member states should be treated with caution. Some states may have enacted partial measures, transitional provisions, or draft legislation that does not yet constitute full transposition. Companies relying on local counsel assessments from early 2025 should verify whether those assessments remain current given the January 2026 deadline and subsequent procedural developments.
If your organisation operates in multiple EU jurisdictions and you are assessing transposition risk, the team at Ferraz & Whitmore can assist with a cross-border gap analysis. Reach us at info@ferrazwhitmore.com or visit our contacts page.
Portugal: Law No. 26/2026 and What It Introduces
Portugal completed transposition through Law No. 26/2026, enacted on 3 June 2026. The law implements both Directive (EU) 2023/2226 (DAC8) and Directive (EU) 2025/872 (DAC9) into Portuguese law. Key operational points include:
- Crypto-asset information returns: CASPs with reporting obligations in Portugal must file annual returns covering the preceding calendar year. The first return – covering data from the 2026 reporting period – is due by 31 May 2027.
- No change to tax rates: Law No. 26/2026 is a reporting and administrative cooperation measure. It does not alter Portuguese income tax rates, withholding tax rates, or the substantive Pillar Two rates applicable to multinational groups.
- Strengthened penalty regime: The law increases penalties for non-compliance with the new reporting requirements. Specific penalty thresholds are set out in the implementing provisions; groups and CASPs should review their internal compliance programmes against the updated schedule.
- Alignment with CARF: The Portuguese framework reflects the OECD CARF methodology for classifying reportable assets and identifying reportable users, meaning international groups familiar with CARF should find the Portuguese rules broadly consistent in scope.
For CASPs and multinational groups with a Portuguese nexus, the 3 June 2026 enactment date means that implementation planning for the 2026 reporting year should be underway now. Waiting until early 2027 to assess reporting obligations creates unnecessary risk given the enhanced penalty framework.
Further guidance on the practical compliance steps for CASPs operating in the EU is available in our DAC8 compliance guide for crypto-asset service providers.
Who Is Affected Across the EU
The combined scope of DAC8 and DAC9 is broad. The following categories of entities should treat these developments as a priority:
- Crypto-asset service providers authorised or operating under MiCA, including exchanges, custodians and transfer service providers with EU-resident clients.
- Multinational enterprise groups with consolidated revenues meeting the Pillar Two threshold and entities in two or more EU member states, which must now exchange GloBE information through the DAC9 channel.
- Financial intermediaries – banks, brokers and payment institutions – that custody or transfer crypto-assets as part of broader service offerings and may fall within the DAC8 reporting perimeter.
- Investment funds and asset managers holding or facilitating client access to crypto-assets, particularly where tax residency of investors spans multiple EU jurisdictions.
- Holding companies and treasury centres located in member states where transposition is still pending, which face the risk of divergent national guidance emerging in late 2026 or early 2027.
Entities in states subject to infringement procedures face a specific practical difficulty: the applicable national reporting format, submission channel and penalty structure may not yet be formally defined, even though the substantive EU-level obligation to collect and report data runs from 1 January 2026. Legal advice on how to document good-faith compliance efforts during the gap period is advisable.
Immediate Actions for International Companies
Given the pace of developments, a structured response is preferable to a wait-and-see posture. The following steps are relevant for most affected organisations:
- Map your EU footprint against transposition status. Identify in which member states your group has reporting entities or CASPs obligations, and verify the current transposition status of each – distinguishing between states that have fully implemented, partially implemented, or are subject to infringement proceedings.
- Audit data collection readiness for DAC8. CASPs must be able to collect and verify client identification and transaction data from 1 January 2026. If onboarding and KYC processes were not updated ahead of that date, a remediation programme should be initiated without delay.
- Review GloBE reporting infrastructure for DAC9. Multinational groups should confirm that their qualified domestic minimum top-up tax filings and GloBE information returns can be exchanged through the DAC9 mechanism in each relevant jurisdiction, particularly where national implementing rules are still being finalised.
- Update internal penalty risk assessments. Portugal's enhanced penalty regime under Law No. 26/2026 is likely indicative of the direction other member states will take. Internal audit and compliance functions should revisit risk registers to reflect the higher penalty environment across the EU.
- Engage local counsel in non-transposing states now. Where a member state has not yet enacted implementing legislation, obtaining documented legal advice on how to approach the transitional period reduces exposure if regulators subsequently scrutinise a group's conduct during the gap.
Our tax law practice advises clients on the cross-border implications of DAC8 and DAC9, including reporting obligations, penalty mitigation and coordination with competent authorities across EU jurisdictions.
The Broader Regulatory Context
The Commission's infringement actions reflect a wider pattern of enforcement assertiveness around the automatic exchange of information. DAC8 and DAC9 follow earlier expansions of the DAC framework – covering financial accounts, advance tax rulings, country-by-country reports and intermediary disclosures – each of which generated similar implementation lags in some member states. The CJEU has confirmed in prior proceedings that member states cannot invoke domestic legislative difficulties as justification for transposition delays, and financial penalties imposed in such cases have been material.
For international companies, the lesson from prior DAC cycles is that the substantive compliance obligation does not wait for national implementing rules to be perfected. Where EU directives have direct effect or where national courts interpret domestic law in conformity with EU law, enforcement risk arises even in the absence of full national transposition. Groups should factor this into their risk assessments for jurisdictions where implementing legislation remains outstanding.
The corporate law team at Ferraz & Whitmore works closely with the tax practice to advise on the structural implications of DAC8 and DAC9 for holding and operating entities across EU member states, including where group structures may need to be reviewed in light of new transparency obligations.
To discuss how these developments affect your organisation's specific circumstances, contact Ferraz & Whitmore at info@ferrazwhitmore.com or use our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.