Portugal transposed DAC8 and DAC9 into national law through Law No. 26/2026 of 3 June 2026, making the Autoridade Tributária e Aduaneira (AT) the designated authority for receiving crypto-asset information reports from service providers operating in or registered with Portugal. The law does not alter existing crypto tax rates but introduces mandatory annual reporting obligations and materially increases penalties for non-compliance, with the first information returns covering 2026 data due by 31 May 2027. For international investors, funds and crypto-asset service providers with any Portuguese nexus, the practical consequences demand immediate attention to compliance structures, historic positions and voluntary disclosure options.
Portugal's Legislative Path: Law No. 26/2026 in Context
The EU's Directive (EU) 2023/2226 (DAC8) required member states to align their domestic frameworks with the OECD's Crypto-Asset Reporting Framework (CARF) and to make automatic exchange of crypto-asset information operational from 1 January 2026. Portugal met the transposition deadline through Law No. 26/2026, enacted on 3 June 2026. Notably, the European Commission opened infringement procedures on 30 January 2026 against member states that had not yet transposed DAC8 and its companion directive, DAC9 (Directive (EU) 2025/872, which governs Pillar Two/GloBE information exchange) – a step that underscored the urgency Portugal itself had to navigate.
Law No. 26/2026 simultaneously transposes DAC9, meaning that Portuguese and EU-headquartered multinational groups subject to the Pillar Two global minimum tax framework will also see their GloBE information exchange obligations administered through the AT. The two directives are technically distinct – one targets crypto-asset service providers (CASPs), the other large corporate groups – but their joint transposition through a single national instrument signals the AT's ambition to treat information asymmetry in the digital economy as a unified enforcement priority.
Importantly, the law leaves the substantive tax treatment of crypto-assets unchanged. Portugal's existing classification of gains from crypto disposals and the applicable personal and corporate income tax rules remain in force. What has changed is the visibility the AT will now have over transactions it could previously only partially reconstruct.
The Reporting Obligation: Who Reports, What, and When
Under the DAC8 framework as implemented by Law No. 26/2026, reporting entities are crypto-asset service providers that are resident in, registered in, managed from, or have a permanent establishment or other qualifying nexus with Portugal. This covers exchanges, custodians, brokerage platforms and certain other intermediaries operating in the Portuguese market – including those that may be authorised by or registered with Banco de Portugal or CMVM under the MiCA and earlier AML registration regimes.
The information to be reported to the AT relates to their clients and counterparties who are tax residents in EU member states. Reportable data includes:
- The identity and tax residency of account holders and beneficial owners;
- The type and volume of crypto-assets held and transacted;
- Gross proceeds from disposals and exchange transactions;
- Transfers to and from wallet addresses outside the CASP's own infrastructure, where they can be attributed;
- Market values at specified reference points.
Annual returns covering a given calendar year must be filed with the AT by 31 May of the following year. The first cycle therefore covers activity from 1 January 2026 to 31 December 2026, with submission due by 31 May 2027. CASPs that have not already audited their data collection systems, client due-diligence procedures and reporting infrastructure against these requirements are working against a deadline that is now within a single reporting cycle.
If your organisation provides crypto-asset services and has a Portuguese connection – whether through registration, management, customers or a branch – understanding your precise reporting obligations under Law No. 26/2026 is urgent. The team at Ferraz & Whitmore is available to assess your position and advise on compliance architecture. Contact us at info@ferrazwhitmore.com or visit our contacts page.
Penalties and Enforcement: A Materially Higher Risk Landscape
Law No. 26/2026 increases penalties for non-compliance with the new reporting obligations. While the specific penalty bands are set at the level of national implementing regulation, the directive of travel is clear: the AT is expected to treat failures to report, incomplete reporting and the provision of inaccurate data as distinct infringement categories, each carrying its own sanction scale. This is consistent with the broader EU policy that DAC8 enforcement should be credible enough to deter the use of non-reporting CASPs as a structural tax planning tool.
From an audit risk perspective, the significance of the new framework is less about any single penalty figure and more about what the AT can now do with the data it receives. Prior to DAC8 transposition, the AT's ability to cross-reference crypto transactions against declared income was limited to information voluntarily provided by taxpayers or obtained through domestic bank reporting and mutual assistance requests. From 2026 onwards, the AT will receive structured, standardised information from all reporting CASPs across the EU, enabling systematic matching against income tax returns and wealth declarations.
Taxpayers who have historically under-reported or not reported crypto gains – whether from disposal, exchange, or income-producing activities such as staking and lending – now face the realistic prospect of that gap being identified automatically. The Supremo Tribunal de Justiça has, in its general administrative and tax jurisprudence, affirmed that voluntary disclosure made in good faith before an audit commences is treated as a substantive mitigating factor in determining both penalty quantum and the AT's exercise of discretion in settlement procedures. That principle, developed in non-crypto contexts, is directly relevant to the current environment.
Tax Residency Complications: The Portuguese and Cross-Border Dimension
DAC8 reporting is triggered by a client's tax residency in an EU member state, not by the jurisdiction of the CASP. This creates a particular set of issues for individuals who have recently established or changed Portuguese tax residence – including under the arrangements that followed the end of the Non-Habitual Resident (NHR) regime and the introduction of its successor framework. If a person became tax resident in Portugal part-way through 2026, CASPs will need to apportion their reporting accordingly, and the AT may have visibility over the client's position from the date of residency onwards.
The converse situation also applies: individuals who ceased Portuguese tax residence before 2026 but held accounts with Portuguese-nexus CASPs during that period may find that prior-year positions come under scrutiny as the AT reconciles historical tax returns against newly available data. The interaction between residency transition dates, the AT's powers to open assessments for prior years, and the availability of voluntary disclosure mechanisms requires careful analysis on a case-by-case basis.
For corporate and fund structures with Portuguese investors or managers, the Pillar Two dimension of Law No. 26/2026 adds a further layer. Groups subject to the GloBE rules that route holding or treasury functions through Portuguese entities – whether managed or advised through Ferraz & Whitmore's corporate law practice in Portugal – should verify that their information reporting obligations under DAC9 are mapped and that the AT's new exchange channels are incorporated into their global tax compliance calendar.
Voluntary Disclosure: Strategic Considerations Under the New Framework
In the period between Law No. 26/2026's enactment and the first reporting deadline of 31 May 2027, there is a window in which taxpayers with historic crypto positions that were not fully declared can approach the AT proactively. Voluntary disclosure before AT contact, or before audit selection that can be evidenced as having occurred, typically preserves access to reduced penalty regimes and interest treatment that are unavailable once an enquiry has formally opened.
The strategic calculus is nuanced. Key considerations include:
- Statute of limitations: The AT's power to assess additional tax for prior years is subject to limitation periods under Portuguese law; the precise years that remain open depend on whether the AT characterises any under-declaration as simple non-reporting or as involving concealment;
- Classification of the gain: Whether historic crypto receipts are treated as capital gains, business income, or another category affects both the tax computation and the procedural rules that apply to the voluntary disclosure;
- Source of funds: Where crypto holdings were acquired with assets whose origin cannot be documented, voluntary disclosure engages AML and regulatory dimensions beyond the AT, potentially including AIMA if the individual holds a residence permit linked to investment activities;
- Cross-border treaty positions: Where gains have a foreign-source element, the applicable double taxation treaty or, in its absence, Portuguese unilateral relief provisions, need to be assessed before filing an amended return;
- Interaction with ongoing audits: A taxpayer under audit for an unrelated matter is generally not in a position to make a voluntary disclosure in respect of the same tax year.
The window for voluntary disclosure is not indefinite. As CASPs complete their onboarding of reporting infrastructure and the AT begins to receive 2026 data, the practical ability to characterise a disclosure as genuinely proactive will narrow. Individuals and entities considering this route should not delay.
Voluntary disclosure under the new framework involves overlapping tax, regulatory and – in some cases – immigration law considerations. Ferraz & Whitmore's tax law team in Portugal can assist in evaluating whether disclosure is appropriate, structuring the approach to the AT, and managing the documentation process. Reach us at info@ferrazwhitmore.com.
Open Questions in the Portuguese Implementation
Law No. 26/2026 is a transposition instrument, and several areas of detail are expected to be addressed through secondary regulation or AT guidance yet to be issued. Practitioners and compliance officers should monitor developments in the following areas:
- The technical specification and filing format for annual information returns to the AT, including any Portuguese-specific fields that go beyond the baseline DAC8 data standard;
- The AT's approach to CASPs registered in Portugal under the Banco de Portugal AML framework that may not squarely fit the DAC8 definition of a reporting CASP, particularly for decentralised or non-custodial models;
- The interface between DAC8 reporting and the CMVM's supervisory data on crypto-asset issuers and secondary market operators, and whether the AT intends to cross-reference these data sources;
- Guidance on how resident taxpayers should reflect reportable information on their personal income tax returns – specifically, whether the AT will issue a pre-populated draft return using CASP data, as it does for other financial income categories;
- The penalty structure in implementing regulations, including the distinction between first-instance failures and repeated or deliberate non-reporting.
For CASPs operating across multiple EU member states, the variation in how member states have transposed DAC8 is a practical compliance challenge. Our analysis of the implementation approach in another jurisdiction is available in our DAC8 compliance guide for Malta, which addresses a number of the shared technical questions that arise across the CASP registration landscape.
Looking Ahead: Audit Risk Trajectories and the Pillar Two Intersection
The AT is expected to begin exercising its new matching capabilities progressively as 2026 data becomes available from mid-2027. Based on the experience of analogous data-matching programmes in other OECD jurisdictions following automatic exchange of financial account information under the Common Reporting Standard, audit case selection tends to accelerate in the second and third year after first data receipt, once the AT has had the opportunity to benchmark declared income against reported crypto activity across the taxpayer population.
For large multinational groups, the DAC9/Pillar Two dimension will run in parallel. The AT's receipt of GloBE information returns will inform both its understanding of group structures and its capacity to identify situations where crypto-related income or assets are held in entities that may previously have attracted limited scrutiny at the Portuguese level.
The combined effect of DAC8 and DAC9 data flows, administered through a single authority under a single national instrument, represents a qualitative change in the AT's information environment. Compliance postures that were adequate before 2026 require reassessment, and cross-border structures that depend on information asymmetry between the AT and the taxpayer are likely to be significantly less viable from 2027 onwards.
Whether you are an individual investor reviewing historic positions, a CASP assessing your Portuguese reporting obligations, or a multinational group evaluating your DAC9 exposure, Ferraz & Whitmore can provide a structured legal assessment. Please contact us at info@ferrazwhitmore.com or through our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.