Crypto-asset service providers (CASPs) operating in Cyprus must comply with DAC8 – Directive (EU) 2023/2226 – from 1 January 2026, reporting client transaction data annually to the Cyprus Tax Department. The first information return, covering 2026 data, is due by 31 May 2027. Cyprus's precise national transposition instrument is subject to ongoing legislative developments, and providers should monitor requirements carefully to avoid penalties that have been materially increased across the EU framework.
What DAC8 Is and Why It Matters for CASPs in Cyprus
DAC8 is the eighth amendment to the EU Directive on Administrative Cooperation in taxation. It aligns the EU reporting framework with the OECD's Crypto-Asset Reporting Framework (CARF) and extends automatic exchange of information to cover crypto-assets. For providers registered or operating in Cyprus, this creates concrete new compliance obligations that sit alongside existing CySEC authorisation requirements under MiCA.
DAC9 – Directive (EU) 2025/872 – runs in parallel and governs the exchange of Pillar Two/GloBE information between tax authorities. Large multinational groups with Cyprus entities should treat DAC9 as a related but distinct reporting stream, coordinated through the same Cyprus Tax Department channel.
The European Commission opened infringement procedures on 30 January 2026 against member states that had not yet transposed DAC8 and DAC9 into national law by the required deadline. This signals the seriousness with which Brussels is treating delayed compliance at the national level, and it reinforces the urgency for CASPs already operating in Cyprus not to wait for final domestic implementing legislation before beginning their internal preparation.
Cyprus-Specific Regulatory Landscape
The competent authority for receiving DAC8 and DAC9 reports in Cyprus is the Cyprus Tax Department. CySEC oversees the licensing and conduct of crypto-asset service providers under MiCA, but it is the Tax Department that administers the information exchange obligations. Understanding this division is critical: a provider that is fully MiCA-compliant can still face sanctions under DAC8 if its tax reporting is deficient.
Cyprus had not published a final DAC8 transposition law as of the date of this guide. Providers should therefore structure their compliance programmes around the directive's directly applicable requirements and the reporting parameters set at EU level, while continuing to monitor the Gazette of the Republic of Cyprus for implementing legislation. Engaging a law firm Cyprus–based practice with both tax and regulatory expertise is advisable given the evolving legislative environment.
For businesses requiring a broader view of the applicable tax framework, our Cyprus tax law services page sets out how Ferraz & Whitmore assists clients across direct and indirect tax matters in the jurisdiction.
Who Is a Reporting Crypto-Asset Service Provider?
DAC8 covers Reporting CASPs – entities that provide crypto-asset services to clients who are tax-resident in an EU member state. In the Cyprus context, this means:
- CASPs licensed by CySEC under MiCA and operating across the EU on a passporting basis;
- foreign CASPs that have elected Cyprus as their single point of registration under the DAC8 registration rules;
- entities that provide exchange services, transfer services, custody or administration of crypto-assets.
The reporting obligations attach to the CASP, not to the underlying client. Even if the client is a professional counterparty or an institutional fund, the CASP must collect and report the required data unless a specific exclusion applies. Providers should carry out a scoping exercise at the outset to determine whether each product line triggers reporting obligations.
Data Points Required Under DAC8
The reporting template under DAC8 – derived from the OECD CARF schema – requires CASPs to collect and submit the following categories of information for each reportable user:
- Full legal name (or entity name) and address;
- tax identification number (TIN) and, where applicable, date and place of birth;
- tax residency jurisdiction;
- aggregate gross proceeds from sales and exchanges of crypto-assets;
- aggregate fair market value of crypto-assets transferred to and from the user;
- type of crypto-asset involved in each reportable transaction.
Determining the correct tax residency of each client is one of the more demanding practical steps. CASPs must apply due diligence procedures analogous to those used under CRS/FATCA. Self-certifications must be obtained and validated; existing KYC data is a starting point but is rarely sufficient on its own to satisfy DAC8 requirements.
Step-by-Step Compliance Procedure in Cyprus
The following sequence reflects the preparation steps that CASPs should complete before the first reporting deadline of 31 May 2027. Because Cyprus implementing legislation is pending, certain procedural details – including the precise electronic submission portal – may be confirmed by the Cyprus Tax Department in due course.
- Step 1 – Scoping and classification. Identify which business lines and client segments trigger DAC8 reporting. Document the analysis in a legal memorandum.
- Step 2 – Registration or confirmation of registration point. Confirm whether Cyprus is the correct EU member state through which the CASP registers for DAC8 purposes. Non-EU CASPs with a Cyprus nexus should take legal advice on this point.
- Step 3 – Data architecture review. Map internal data systems against the DAC8 reporting schema. Identify gaps in TIN collection, tax residency verification and transaction-level data retention.
- Step 4 – Due diligence procedures. Implement self-certification collection for new clients from 1 January 2026 and initiate remediation for existing clients where tax residency data is incomplete.
- Step 5 – Systems build and testing. Configure or procure reporting software capable of producing DAC8-compliant XML output. Test against the EU's published schema.
- Step 6 – Internal governance. Appoint a responsible officer for DAC8 compliance. Document policies, controls and escalation procedures. Coordinate with the Data Protection Officer given the GDPR implications of collecting and transmitting personal tax data.
- Step 7 – First report submission. Submit the annual crypto-asset information return for 2026 data to the Cyprus Tax Department by 31 May 2027, using the submission mechanism published by the authority.
If your organisation requires support with corporate governance aspects of this programme – including board-level documentation and register updates through the Registrar of Companies – our Cyprus corporate law services team can assist alongside the tax workstream.
If you would like to discuss your specific DAC8 compliance position, please contact us at info@ferrazwhitmore.com or visit our contacts page.
Key Timelines
The critical dates under the EU DAC8 framework as they apply to CASPs in Cyprus are as follows:
| Event | Date |
|---|---|
| DAC8 obligations apply EU-wide (first reportable period begins) | 1 January 2026 |
| Commission infringement procedures opened against non-transposing states | 30 January 2026 |
| First annual crypto-asset information return due (covering 2026 data) | 31 May 2027 |
Note that 31 May 2027 is the EU-level deadline derived from the directive. The Cyprus Tax Department may publish supplementary guidance on filing windows and submission formats; providers should monitor official communications closely.
Cost Drivers and Resource Planning
Compliance costs under DAC8 vary considerably depending on a CASP's existing infrastructure. The principal cost drivers in the Cyprus context include:
- Data remediation. Retroactively collecting TINs and tax residency self-certifications from existing clients can be resource-intensive, particularly for high-volume retail platforms.
- Technology. Adapting or procuring reporting software to generate CARF-compatible XML is a one-off but significant investment. Costs depend on the complexity of the product set and the number of jurisdictions served.
- Legal and regulatory advisory. Scoping exercises, policy drafting and review of contracts with third-party data processors all require specialist input.
- Ongoing operational costs. Annual reporting, client communications regarding self-certifications, and updates to procedures as the Cyprus Tax Department issues guidance create recurring expenditure.
Providers that delay preparation tend to face higher costs, as remediation under time pressure is more expensive than orderly advance planning.
Common Errors by Foreign Clients Operating in Cyprus
Based on experience advising international businesses entering the Cyprus market, the following errors arise most frequently in DAC8 preparation:
- Assuming MiCA compliance equals DAC8 compliance. The two frameworks overlap in client identification but serve different purposes. MiCA KYC does not automatically satisfy DAC8 due diligence requirements.
- Incorrect registration point. Non-EU parent groups sometimes incorrectly identify the registration member state, creating a risk that reports are filed in the wrong jurisdiction or not filed at all.
- Treating DAC8 as a 2027 problem. The reporting obligation is annual and based on 2026 calendar-year data. Systems and due diligence must be in place from 1 January 2026, not from the filing deadline.
- Overlooking DAC9/Pillar Two for group entities. Larger groups operating through Cyprus holding or IP structures may simultaneously face DAC9 GloBE information exchange obligations. These should be assessed at group level, not entity by entity in isolation.
- Inadequate GDPR coordination. Transferring client tax data to a foreign tax authority engages GDPR Article 26 and 28 obligations. Privacy notices, data processing agreements and records of processing activities must be updated.
For further comparative analysis of how DAC8 is being implemented in other EU jurisdictions, our team has published a detailed discussion of the German experience: Crypto Tax After DAC8 in Germany. The German approach to withholding tax and reporting infrastructure offers useful reference points for Cyprus providers serving clients across multiple markets.
Interaction With Pillar Two and DAC9
For larger CASP groups – typically those with consolidated annual revenue above the Pillar Two threshold – DAC9 introduces a separate but related obligation: the exchange of GloBE information returns between EU tax administrations. In Cyprus, the Cyprus Tax Department is the competent authority for both DAC8 crypto-asset reports and DAC9 Pillar Two filings. Groups with Cyprus entities in scope should coordinate both workstreams under a single compliance governance structure to avoid duplication and inconsistency.
DAC9 does not alter the substantive Pillar Two tax rates or qualified domestic minimum top-up tax rules already applicable in Cyprus. Its effect is administrative: it establishes how GloBE information returns are exchanged between member states, with the aim of enabling tax authorities to verify top-up tax positions across groups.
Enforcement and Penalties
The DAC8 directive requires member states to introduce effective, proportionate and dissuasive penalties for failures to report, late reporting and materially incorrect reporting. The penalty regime in Cyprus will be set out in the national implementing legislation. What is clear at EU level is that penalties have been materially increased compared to the pre-DAC8 framework, and the Commission's decision to open infringement procedures against non-transposing states on 30 January 2026 demonstrates that enforcement is being treated as a priority.
Providers that identify historic compliance gaps should consider voluntary disclosure or early engagement with the Cyprus Tax Department, rather than waiting for an authority-initiated enquiry. The risk profile of a disclosed, remediated gap is typically more manageable than that of a gap discovered through audit. Any decision to approach the Tax Department should be taken with legal advice in place, and privilege should be preserved throughout the process.
If you are assessing your organisation's exposure and wish to discuss next steps in confidence, please reach out at info@ferrazwhitmore.com or through our contacts page.
Decision Checklist for CASPs in Cyprus
Before the first reporting period closes on 31 December 2026, a Cyprus-based or Cyprus-registered CASP should be able to answer the following questions affirmatively:
- Have you confirmed that Cyprus is the correct DAC8 registration member state for your entity or group?
- Have you completed a scoping analysis identifying which services and client segments are reportable?
- Have you updated client onboarding procedures to collect DAC8-compliant self-certifications from 1 January 2026?
- Have you identified and begun remediation of existing client records with incomplete tax residency data?
- Is your technology infrastructure capable of generating CARF-compatible reports in the format required by the Cyprus Tax Department?
- Have you assessed DAC9/Pillar Two obligations at group level if your consolidated revenue is above the applicable threshold?
- Have you updated your GDPR documentation to reflect the new data flows to the Cyprus Tax Department and onward to other EU authorities?
- Has a responsible officer been formally appointed for DAC8 compliance, with clear escalation paths to senior management?
Ferraz & Whitmore's team in Cyprus is available to assist with any stage of this process, from initial scoping through to submission review. To arrange an initial discussion, please contact us at info@ferrazwhitmore.com or visit our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.