From 1 January 2026, DAC8 – the EU directive aligning European crypto-asset reporting with the OECD's Crypto-Asset Reporting Framework (CARF) – applies across all member states, including Spain, where the receiving authority is the Agencia Estatal de Administración Tributaria (AEAT). Crypto-asset service providers operating in or serving Spanish residents are now subject to mandatory information exchange obligations that will, for the first time, give the AEAT structured, cross-border visibility over holdings and transactions previously difficult to trace. Individuals and entities with exposure to crypto assets in Spain should assess their reporting position now, before the first wave of exchanged data arrives.
The DAC8 Framework and Spain's Position
Directive (EU) 2023/2226 – commonly known as DAC8 – extends the EU's automatic exchange of information regime to crypto assets, tracking the OECD's CARF closely. It requires crypto-asset service providers (CASPs) to collect, verify and report user data to their local tax authority, which then exchanges it with the tax authority of the user's country of residence. The AEAT is the designated recipient for Spanish tax residents.
DAC8 entered into application on 1 January 2026. On 30 January 2026, the European Commission opened infringement procedures against member states that had not yet transposed DAC8 and its companion measure, DAC9 – Directive (EU) 2025/872, which governs the exchange of Pillar Two/GloBE information returns. Spain's precise transposition instrument should be verified against official sources, as national implementing rules determine procedural details including penalty scales and the exact scope of reporting entities. Where those details are still subject to pending national rules, the position described here reflects the directive's minimum requirements.
The companion directive, DAC9, carries separate significance for corporate groups with a Spanish presence that fall within the Pillar Two/GloBE regime. The AEAT will receive and exchange GloBE information returns through the same enhanced infrastructure that DAC8 activates, making the two instruments strategically linked for multinational clients.
What the AEAT Will Receive – and When
Under the DAC8 reporting calendar, annual crypto-asset information returns cover each calendar year and are due by 31 May of the following year. The first reporting period is the 2026 tax year, with data due by 31 May 2027. That means the AEAT will begin receiving structured CASP-reported data on Spanish residents' crypto holdings and transactions from mid-2027 onwards, covering activity from 1 January 2026.
The categories of reportable information are broad. CASPs must report identifying information on users, the types and quantities of crypto assets held, gross proceeds from disposals, and transfers to or from non-custodial wallets. For Spanish tax purposes, this data maps directly onto the information the AEAT already requires in Model 721 (the overseas-asset declaration for crypto held abroad) and in personal income tax returns where capital gains from crypto disposals must be declared. The practical effect is that self-reported figures will now be cross-referenceable against third-party CASP data.
For clients with cross-border portfolios, the Netherlands represents a comparable DAC8 implementation scenario within the EU. Our analysis of the Dutch framework is available at Crypto Tax After DAC8 in the Netherlands for those seeking a comparative perspective.
Spain-Specific Compliance Landscape Before DAC8
Spain already operated one of the more demanding crypto disclosure frameworks in the EU. The AEAT introduced Model 721 for reporting crypto assets held at foreign CASPs (first returns filed in 2024 covering the 2023 tax year), alongside Model 172 (balances held at Spanish CASPs) and Model 173 (operations conducted through Spanish CASPs). The interaction of these existing obligations with the incoming DAC8 data flows creates a specific compliance tension: any discrepancy between what a taxpayer previously declared on Models 172, 173 and 721 and what a CASP now reports to the AEAT under DAC8 will be visible to auditors.
Tax residency is a foundational variable in this analysis. An individual who split time between Spain and another jurisdiction, or who held crypto through a non-Spanish entity, may face questions about where DAC8 reporting is triggered and which authority receives the data. The AEAT applies domestic rules and applicable tax treaties to determine residency; for individuals, the 183-day rule and the centre-of-vital-interests test both remain relevant. CASPs, for their part, apply due diligence procedures to classify account holders by residence, and errors in that classification do not relieve the taxpayer of Spanish filing obligations if they are, in fact, Spanish tax residents.
If your crypto holdings, CASP accounts or corporate structures create uncertainty about your reporting position in Spain, the Tax Law team at Ferraz & Whitmore can assess your situation. Contact us at info@ferrazwhitmore.com or visit our contacts page.
Audit Risk: How the AEAT Is Likely to Use DAC8 Data
The AEAT has historically been an active and technically sophisticated tax authority. Its risk-scoring systems already flag inconsistencies between declared income and asset growth. DAC8 data will provide a new and high-quality input into those systems: structured, standardised records of crypto activity submitted by regulated CASPs across the EU and, through CARF, potentially from a wider set of participating jurisdictions.
Audit exposure is elevated in several scenarios:
- Undisclosed prior gains: Taxpayers who disposed of crypto assets at a gain before 2026 but did not report the gain in their personal income tax or corporate tax return face retrospective risk. The AEAT can investigate tax years within the applicable limitation period, and DAC8 data may prompt targeted reviews of earlier years where patterns suggest undisclosed activity.
- Model 721 omissions: Individuals who held crypto at foreign CASPs but did not file Model 721, or who understated balances, are particularly exposed once CASP-reported data arrives at the AEAT.
- Non-resident withholding tax issues: Where a Spanish-resident entity paid or received crypto-denominated income with a cross-border element, withholding tax obligations may have been overlooked. The rate applicable depends on the relevant tax treaty or, in its absence, domestic Spanish rules; DAC8 data may surface transactions where withholding was not applied.
- Corporate structures involving crypto: Companies incorporated in Spain – whose data appears in the Registro Mercantil – that held or traded crypto assets may face AEAT scrutiny of whether gains were correctly booked and taxed, particularly where assets were transferred to related parties or held through intermediate entities.
- CNMV-supervised entities: Where a CASP is also regulated by the Comisión Nacional del Mercado de Valores (CNMV) under MiCA, regulatory and tax reporting obligations overlap. The AEAT and CNMV can share information, and a supervisory review by the CNMV may trigger a parallel tax inquiry.
It is also worth noting that Spain's administrative enforcement toolkit includes the proceso monitorio for recovering tax debts once assessed, a relatively efficient procedure that can result in enforceable orders without full trial. Taxpayers who receive an AEAT assessment following a DAC8-triggered audit should take prompt legal advice before any enforcement steps are initiated.
Voluntary Disclosure: Strategic Considerations
Spanish law provides a mechanism for voluntary regularisation of unpaid tax liabilities. The key strategic variable is timing: a voluntary disclosure made before the AEAT has commenced any audit, investigation or formal inquiry in respect of the relevant tax period and taxpayer will generally attract a more favourable outcome in terms of surcharges and the mitigation of penalties than a disclosure made after proceedings have begun. DAC8 reporting begins for the 2026 tax year, but it may prompt the AEAT to look retrospectively at earlier periods where patterns of non-compliance are identifiable.
There is no guarantee that voluntary disclosure will eliminate all consequences – the outcome depends on the specific facts, the quantum of underpaid tax, the tax period in question, and the applicable procedural rules at the time. What voluntary disclosure does offer is the opportunity to control the narrative, provide context, and engage with the AEAT proactively rather than reactively.
For clients with undisclosed crypto activity in Spain, the window for proactive regularisation is narrowing. Cross-border cases – for example, a client resident in another EU member state who also has Spanish-sourced crypto income, or a Spanish resident who held crypto through a foreign structure – require coordinated advice across jurisdictions. Ferraz & Whitmore's tax practice covers both Spanish and cross-border dimensions; for an initial assessment, write to info@ferrazwhitmore.com.
Corporate and Fund Clients: DAC9 and Pillar Two Intersections
For corporate groups with a Spanish presence and consolidated revenue above the Pillar Two threshold, DAC9 introduces a parallel obligation. Directive (EU) 2025/872 provides the framework for automatic exchange of GloBE information returns between EU tax authorities. The AEAT will receive GloBE data relating to Spanish constituent entities of in-scope groups, and will exchange Spanish-sourced data with other member states' authorities.
The intersection with crypto taxation arises where a group's crypto-asset holdings generate income or gains that affect the effective tax rate calculation under GloBE rules. If crypto gains are taxed at a rate below the Pillar Two minimum, or if losses are recognised in a jurisdiction in a manner that reduces the group's effective rate, the AEAT may raise questions under both the domestic corporate tax rules and the top-up tax mechanism.
Funds and investment vehicles with Spanish-resident investors that hold crypto assets face a distinct set of issues, including the classification of returns as capital gains versus income, the application of any applicable tax treaty, and the question of whether the vehicle itself has any Spanish tax nexus. These questions benefit from early-stage structuring advice. Our corporate law practice in Spain can assist with entity structure analysis; further information is available at Corporate Law – Spain.
Practical Steps for Spanish Taxpayers and Investors
The following steps are relevant for individuals and entities assessing their position in light of DAC8:
- Audit your CASP relationships: Identify all crypto-asset service providers with which you hold or have held accounts. For each, determine whether the CASP is EU-based (and therefore directly subject to DAC8 reporting) or in a CARF-participating third country (where exchange may occur through the OECD framework).
- Review prior Spanish filings: Cross-reference your historical personal income tax returns and Model 721/172/173 filings against your actual crypto activity. Gaps or inconsistencies should be addressed before the AEAT receives CASP data.
- Clarify your tax residency position: If you have moved between Spain and another jurisdiction, or if you hold assets through a non-Spanish entity, obtain advice on how the AEAT will classify you and where DAC8 data will be routed.
- Assess corporate structures: If crypto assets are held through a Spanish or foreign company, review whether the corporate tax treatment of gains, losses and distributions is consistent with the AEAT's interpretation of applicable rules.
- Consider voluntary disclosure where appropriate: If prior periods contain unreported or incorrectly reported crypto activity, take advice on the merits and timing of a voluntary regularisation before DAC8-triggered audits commence.
- Monitor national implementing rules: Spain's transposition of DAC8 may introduce procedural specifics – including penalty scales and the precise scope of reporting entities – that are not yet fully settled. Monitoring official AEAT guidance and legislative developments is advisable.
Outlook: The Regulatory Trajectory
DAC8 is not the end of the regulatory movement; it is a consolidation point. The Commission's infringement actions on 30 January 2026 against member states that had not transposed DAC8 and DAC9 on time signal the political importance attached to closing the information gaps that have allowed crypto activity to go unreported. The integration of CARF into the EU framework means that the exchange network extends beyond EU borders to other OECD-framework participants, progressively reducing the utility of holding assets through non-EU CASPs as a means of avoiding Spanish reporting obligations.
For Spain specifically, the combination of the AEAT's existing Model 721 infrastructure, the CNMV's MiCA supervisory role, and the incoming DAC8 data flows creates a compliance environment that is materially more demanding than that which existed even two years ago. Clients who built their structures or filing positions on the assumption that crypto activity was difficult to trace should reassess that assumption.
The Tax Law team at Ferraz & Whitmore advises on Spanish and cross-border crypto taxation, voluntary disclosure procedures, and audit response strategy. A full description of our tax practice in Spain is available at Tax Law – Spain. To discuss your specific situation, contact us at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.