Portugal enacted Law No. 26/2026 on 3 June 2026, transposing both DAC8 (Directive (EU) 2023/2226 on crypto-asset reporting) and DAC9 (Directive (EU) 2025/872 on Pillar Two information exchange) into national law. The legislation does not alter existing tax rates but introduces new mandatory reporting obligations and strengthened penalty provisions that affect crypto-asset service providers, multinational groups within the scope of Pillar Two, and their advisers operating in Portugal. Companies and service providers that have not yet assessed their exposure should treat this as an immediate compliance priority.
What Law 26/2026 Changes – and What It Does Not
Law No. 26/2026 is a transposition measure. Its primary effect is to bring Portugal into conformity with two EU directives that expand the automatic exchange of tax information between member states. It does not increase income tax, corporate tax, withholding tax, or capital gains rates. What it does introduce is a structured framework under which new categories of financial and crypto-asset data must be collected, reported to the Autoridade Tributária e Aduaneira (AT), and exchanged with the competent authorities of other EU member states and, where applicable, third-country partners.
The two pillars of the law operate independently but are brought into force simultaneously. DAC8 aligns Portugal's reporting infrastructure with the OECD's Crypto-Asset Reporting Framework (CARF), requiring crypto-asset service providers (CASPs) to collect and report user data. DAC9 creates the exchange mechanism for the GloBE (Global Anti-Base Erosion) information return associated with the Pillar Two top-up tax regime already operative under EU law.
DAC8: Crypto-Asset Reporting in Portugal
From 1 January 2026 – the EU-wide application date for DAC8 – CASPs serving customers who are tax-resident in Portugal, or who are constituted under Portuguese law, fall within the scope of the new reporting regime. The Autoridade Tributária e Aduaneira is the designated recipient of DAC8 returns in Portugal.
Under Law 26/2026, CASPs are required to file an annual crypto-asset information return covering the preceding calendar year. The deadline for the first return – covering data for the 2026 tax year – is 31 May 2027. Subsequent returns will follow the same cycle: data for year Y must be filed by 31 May of year Y+1.
The information required broadly follows the CARF model: identification of the reporting entity, identification and tax residency details of each user, and transaction-level data including the type of crypto-asset, the nature of each transaction, and aggregate values. Entities that are uncertain whether they qualify as CASPs within the Portuguese transposition should seek legal analysis without delay, as the reporting obligation attaches from the start of the 2026 calendar year.
For a detailed operational guide on CASP compliance steps under the Portuguese framework, see our DAC8 compliance guide for CASPs in Portugal.
DAC9: Pillar Two Information Exchange
DAC9 addresses the exchange of the GloBE information return (GIR) between EU member states. Multinational enterprise (MNE) groups that are already within scope of Portugal's Pillar Two legislation and that file a GIR are now subject to the automatic exchange mechanism that DAC9 establishes. The AT will both send and receive GIR data with other EU authorities, and Law 26/2026 provides the legal basis for that exchange under domestic law.
Law 26/2026 does not itself alter the substantive Pillar Two rules or introduce a new top-up tax – those flow from prior legislation. Its contribution is to embed the information-exchange layer, ensuring that group entities in multiple EU jurisdictions can rely on a single filing mechanism and that Portuguese authorities have access to GIR data held by other member states. Groups with Portuguese constituent entities should confirm with their tax advisers that their GIR filing strategy accounts for the exchange rules now operative under Portuguese law.
Penalties and Enforcement Context
Law 26/2026 increases penalties for non-compliance with the new reporting obligations. The legislation does not set out a different penalty structure for DAC8 and DAC9 failures. While the specific penalty bands applicable to each breach type are governed by the Portuguese tax infringement regime as amended, the direction of reform is clear: regulators are expected to treat failures to report crypto-asset data with the same seriousness as failures under existing financial account reporting frameworks.
The European Commission opened infringement proceedings on 30 January 2026 against member states that had not transposed DAC8 and DAC9 by the required date, signalling that Brussels views timely national implementation as a political and legal priority. Portugal's enactment on 3 June 2026 follows that pressure. Companies and service providers that delayed their internal compliance programmes on the assumption that national rules would not arrive quickly should recalibrate their timelines immediately.
Who Is Affected in Portugal
- Crypto-asset service providers – including exchanges, custodians, and brokers – that operate in Portugal, hold a Portuguese licence, or service customers tax-resident in Portugal.
- Multinational enterprise groups with a Portuguese constituent entity that is within scope of the Pillar Two top-up tax framework.
- Foreign CASPs with a registration or permanent establishment in Portugal, or that otherwise fall within Portuguese jurisdictional reach under the DAC8 nexus rules.
- Financial intermediaries and fund managers that facilitate crypto-asset transactions on behalf of clients and may qualify as reporting entities depending on their activity and structure.
- Investment funds and holding structures that hold crypto-assets directly or through subsidiary vehicles registered in Portugal.
Entities supervised by the Banco de Portugal or the CMVM that also provide crypto-asset services should note that DAC8 reporting obligations sit alongside – and do not replace – their existing regulatory reporting duties. Similarly, entities that have interacted with the AIMA (Agência para a Integração, Migrações e Asilo) in connection with residency and tax-residency determinations of their users will need to ensure that tax residency data collected for immigration purposes aligns with the identification data required for DAC8 returns.
If you are uncertain whether your entity or your clients fall within the scope of Law 26/2026, our team is available to discuss the position in detail. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
Key Deadlines at a Glance
| Event | Date |
|---|---|
| DAC8 EU-wide application date | 1 January 2026 |
| Commission infringement proceedings opened | 30 January 2026 |
| Law No. 26/2026 enacted (Portugal) | 3 June 2026 |
| First DAC8 annual return due (covering 2026 data) | 31 May 2027 |
Immediate Action Items for International Companies
Companies that have not yet begun their compliance review should consider the following steps as a matter of priority.
- Determine scope: Establish whether any group entity qualifies as a CASP under the Portuguese transposition of DAC8 or holds crypto-assets in a way that triggers reporting obligations.
- Review Pillar Two filing strategy: Confirm that the group's GIR filing arrangements account for the DAC9 exchange mechanism now operative in Portugal, and verify that Portuguese constituent entity data is consistent with the GIR as filed.
- Audit data collection processes: DAC8 requires granular user identification and transaction data. If existing KYC or onboarding processes do not capture tax residency information in a form compatible with AT reporting requirements, remediation should begin before year-end 2026.
- Assess penalties exposure: Where reporting failures have already occurred – even inadvertently, given the 1 January 2026 application date – legal advice on voluntary disclosure and penalty mitigation should be sought promptly.
- Monitor AT guidance: The Autoridade Tributária e Aduaneira is expected to issue technical guidance and, potentially, forms or electronic filing specifications. Nominate an internal or external owner to track and implement that guidance as it is published.
Our Portuguese tax law practice and corporate law team work together on cross-border compliance mandates of this kind. We can assist with scope analysis, data gap assessments, and representation before the Autoridade Tributária e Aduaneira where required.
To discuss how Law 26/2026 affects your organisation or your clients, please reach out to us at info@ferrazwhitmore.com or through our contacts page. Early engagement allows for a more measured and cost-efficient response than addressing compliance gaps under time pressure.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.