This illustrative scenario describes how a Portuguese crypto-asset service provider prepared for DAC8 compliance following the enactment of Portugal Law No. 26/2026 of 3 June 2026, which transposes both DAC8 (Directive (EU) 2023/2226) and DAC9 (Directive (EU) 2025/872) into national law. The project involved restructuring internal reporting workflows, assessing user tax-residency data, and coordinating with the Autoridade Tributária e Aduaneira ahead of the first annual return deadline of 31 May 2027. The lessons drawn from this scenario are transferable to any EU-registered crypto platform facing comparable obligations.
Disclaimer on Scenario Status
This page presents an illustrative scenario constructed from the types of challenges that commonly arise in DAC8 readiness mandates for crypto-asset service providers operating in Portugal. It does not describe a specific client matter. No client names, transaction amounts, financial outcomes or confidential details are presented or implied.
Client Profile and Challenge
The entity in this scenario is a mid-sized crypto-asset trading and custody platform incorporated in Portugal, registered with the Banco de Portugal as a virtual-asset service provider and subject to oversight by the CMVM for any activities touching on financial instruments. The platform serves users across several EU member states, which meant its reporting exposure under DAC8 was cross-border from the outset.
When Portugal Law No. 26/2026 entered into force on 3 June 2026, the platform faced an immediate structural problem: its customer onboarding systems had not been designed to capture or validate the tax-residency information that DAC8 requires. Many users had supplied a billing address but no tax identification number, no country-of-tax-residence declaration, and no self-certification in a form compatible with the OECD Common Reporting and Due Diligence Standard for Crypto-Assets (CARF). The gap between the data the platform held and the data it would need to report to the Autoridade Tributária e Aduaneira (AT) was significant.
A secondary concern was timing. DAC8 applies EU-wide from 1 January 2026, meaning reportable transactions were already accumulating before the Portuguese transposing law had even been enacted. The European Commission had opened infringement procedures on 30 January 2026 against member states that had not yet transposed DAC8 and DAC9, which underscored the political urgency of the directive even while Portugal's national rules were still in draft. The platform needed to act on both the data-collection backlog and the prospective compliance architecture simultaneously.
Strategy and Rationale
The instructing team adopted a three-track strategy. The first track addressed legal interpretation: mapping the obligations under Law No. 26/2026 against the platform's existing processes, identifying which user categories fell within the reporting perimeter, and clarifying the interaction between DAC8's crypto-asset reporting obligations and any DAC9 Pillar Two/GloBE information-exchange requirements that might affect the platform's parent group.
The second track addressed data remediation. Because the platform could not report tax-residency information it had not collected, a structured outreach programme was designed to solicit self-certifications from existing users. This required careful handling: requests had to be framed in a manner consistent with GDPR obligations, and the platform needed a documented procedure for dealing with users who failed to respond, in line with the due-diligence rules embedded in the CARF framework now carried into Portuguese law.
The third track addressed systems and governance. The platform's technology team needed clear specifications to build the annual reporting module – a structured data extract capable of generating the information return due by 31 May 2027 for 2026 transaction data. Governance documentation (policies, internal controls, staff training) was layered on top so that the platform could demonstrate to the AT, if audited, that its compliance programme was genuine and not merely formal.
The rationale for front-loading effort in mid-2026, rather than waiting until early 2027, was straightforward: the penalty regime under Law No. 26/2026 was strengthened relative to prior Portuguese tax-reporting rules, and any failure to collect adequate user data during the 2026 calendar year would be irreversible by the time the reporting deadline arrived. Remediation after year-end is structurally harder than prevention during the reportable period.
If your platform is at an early stage of DAC8 assessment, the Ferraz & Whitmore tax practice can help map your specific obligations under Portuguese law. Contact us at info@ferrazwhitmore.com or visit our contacts page to discuss your situation.
Key Milestones
- June 2026: Engagement commenced; initial gap analysis completed against Law No. 26/2026 and the CARF due-diligence framework. Reporting perimeter defined by user type and transaction category.
- July 2026: User self-certification outreach programme launched for existing account holders lacking compliant tax-residency data. Template self-certification forms drafted in alignment with AT guidance, to the extent published at that stage.
- August 2026: Internal data-governance policy and DAC8 compliance manual finalised. Roles and responsibilities assigned across compliance, legal, and technology functions.
- September 2026: Systems specification delivered to the platform's technology team; build and testing of the reporting module commenced.
- October 2026: Second outreach wave to non-responding users; escalation procedures for unresponsive accounts reviewed against the national rules on account restriction or closure as a last resort.
- Q1 2027 (projected): End-to-end test of the reporting module against a sample dataset; dry-run submission to AT portal ahead of the 31 May 2027 deadline.
Complications Encountered
Three complications arose that were not fully anticipated at the outset.
First, a portion of the platform's user base held accounts registered through third-party aggregators operating in other EU jurisdictions. Determining which entity bore the primary reporting obligation – the Portuguese platform or the aggregator – required analysis of DAC8's ROCA (Reporting Crypto-Asset Service Provider) definition and, where the aggregator was itself subject to DAC8 in another member state, coordination to avoid duplicate reporting. The transposition status of DAC8 in those other member states was treated cautiously throughout, as not all had enacted implementing legislation by the time this analysis was conducted.
Second, the interaction between DAC8's tax-residency capture requirements and the platform's AIMA-related obligations (relevant where users were non-EU nationals whose residence status was uncertain) created a due-diligence overlap that had to be managed carefully across two separate regulatory regimes.
Third, some of the AT's operational guidance on the format and technical specifications for the annual return had not yet been published in final form as of mid-2026. The compliance manual was therefore written in modular form so that the reporting-format section could be updated once AT specifications were confirmed, without requiring a full redraft of the governance framework.
Outcome Category
By the close of the engagement period covered in this scenario, the platform had moved from a position of material non-readiness to a documented, operational compliance programme. The annual return for 2026 data remained outstanding (its deadline is 31 May 2027), so no final submission outcome can be described here. The value delivered was process architecture and risk reduction, not a guaranteed result: the platform had a defensible compliance framework, a remediated user dataset, and a functioning reporting module in test phase.
For further detail on Portugal's DAC8 and DAC9 implementation, including the specific provisions of Law No. 26/2026, see our dedicated legislative alert.
Three Transferable Lessons
1. Data collection cannot wait for the reporting deadline
Under DAC8, the reportable period runs from 1 January 2026. Any tax-residency data that a platform fails to collect during that calendar year cannot be reconstructed retrospectively. Platforms that delayed their self-certification outreach until late 2026 or early 2027 faced a structurally worse position than those that acted in mid-2026. The lesson is that DAC8 compliance is a live, year-round obligation, not a year-end filing exercise.
2. Multi-jurisdiction platforms require a ROCA analysis before building compliance systems
The question of which entity in a multi-party distribution chain qualifies as the Reporting Crypto-Asset Service Provider is not always self-evident. Building a reporting module before resolving that question risks either over-reporting (duplicating returns already filed by a counterpart in another jurisdiction) or under-reporting (assuming another party will file when it will not). Legal analysis of the ROCA perimeter should precede systems development, not follow it.
3. Penalties under Law No. 26/2026 are higher than under predecessor rules
Portugal Law No. 26/2026 increased the penalty framework for non-compliance with crypto-asset reporting obligations. For platforms accustomed to the previous regime, this represents a step change in the risk calculus. Boards and compliance officers should ensure that the enhanced penalty exposure is factored into any risk assessment, and that senior management has approved the compliance programme – not merely noted it. Documented board-level sign-off reduces exposure in the event of an AT inquiry.
Crypto-asset reporting under DAC8 intersects with broader questions of corporate structure, withholding-tax exposure, and regulatory authorisation. Our tax law practice in Portugal and corporate law practice in Portugal work together on cross-cutting mandates of this kind.
How Ferraz & Whitmore Can Assist
Whether your platform is at the gap-analysis stage or already building its reporting infrastructure, we can assist with legal interpretation of Law No. 26/2026, ROCA perimeter analysis, self-certification programme design, liaison with the Autoridade Tributária e Aduaneira, and governance documentation. We work with crypto-asset service providers of varying sizes and structures, including those with cross-border user bases across the EU.
To discuss how this scenario's lessons might apply to your situation, please write to info@ferrazwhitmore.com or use our contacts page. We will respond to set up an initial conversation without obligation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.