DAC8 (Directive (EU) 2023/2226) requires crypto-asset service providers operating in the European Union to collect, verify and report detailed information on their clients' transactions to tax authorities, with the first reporting cycle covering 2026 data and a filing deadline of 31 May 2027. The framework applies EU-wide from 1 January 2026 and is aligned with the OECD Crypto-Asset Reporting Framework (CARF), creating near-universal visibility of crypto holdings and transfers for EU tax administrations. Providers that have not yet built compliant reporting infrastructure face significant legal and reputational exposure as infringement procedures are already under way against late-transposing member states.
Legal Basis and Regulatory Architecture
DAC8 amends the EU Directive on Administrative Cooperation in taxation (DAC) to capture crypto-asset transactions within the automatic exchange of information regime that already covers bank accounts, financial instruments and rulings. The directive aligns EU rules with the OECD CARF standard, ensuring that a crypto-asset service provider (CASP) operating in one member state feeds data into a network that ultimately reaches the tax authority of each reportable user's country of tax residency.
Alongside DAC8, practitioners must also be aware of DAC9 (Directive (EU) 2025/872), which establishes the information exchange layer for the Pillar Two / GloBE minimum-tax rules. Although DAC9 targets large multinational groups rather than all CASPs, groups with crypto-related revenues above the GloBE threshold will need to manage both reporting streams simultaneously. Portugal's Law No. 26/2026 of 3 June 2026 transposes both directives into domestic law in a single instrument – the first EU member state to do so in consolidated form.
On 30 January 2026, the European Commission opened infringement procedures against member states that had not yet completed transposition of DAC8 and DAC9. CASPs operating in those jurisdictions should monitor national implementation closely, as the procedural obligations – penalties, deadlines, competent authority designations – depend on national transposing legislation and may still be subject to national rules pending final adoption.
Oversight of market integrity for crypto-asset service providers sits partly with ESMA and EBA under MiCA, and both authorities have issued guidance that intersects with the DAC8 data-collection obligations. Providers that are already MiCA-authorised will find some of the customer identification procedures transferable, though the DAC8 tax-residency determination requirements go beyond standard AML/KYC checks.
Who Is Caught: Defining a Reportable CASP
DAC8 captures any service provider that executes exchange transactions between crypto-assets and fiat currencies, between different crypto-assets, or that effects transfers of crypto-assets, where that provider is resident, incorporated, managed or has a permanent establishment in a member state. The obligation also extends to providers registered or licensed in an EU member state to serve EU clients, even if headquartered outside the Union.
Key categories of reportable users include individuals and entities that are tax resident in a member state and that carry out reportable transactions above the thresholds set in the directive. Providers must determine tax residency using self-certification, supplemented by know-your-customer data and, where inconsistencies arise, enhanced due diligence. The process mirrors the Common Reporting Standard (CRS) logic familiar from the financial sector.
- Exchange services – spot, margin and derivative conversions involving at least one crypto-asset.
- Transfer services – on-chain and off-chain movements of crypto-assets on behalf of a reportable user.
- Custody and administration – safekeeping or controlling crypto-assets or private keys.
- Participation in token offerings – services facilitating issuance or initial distribution where the provider holds client assets.
Decentralised protocols that involve no identifiable intermediary may fall outside the direct scope of the current rules, but providers building hybrid models should take legal advice before assuming a non-reporting position. Regulatory perimeters in this area are actively evolving.
Step-by-Step Compliance Procedure
Step 1 – Registration and Competent Authority Identification
A CASP with nexus to multiple member states must identify which single member state is its "single point of registration" for DAC8 purposes. Where a provider is incorporated in one state but operates branches in others, the rules on single registration apply; the designated competent authority then shares data with peer authorities. In Portugal, the competent authority for DAC8 is the Autoridade Tributária e Aduaneira (AT). Providers should confirm the equivalent authority in each relevant jurisdiction, noting that designations in states yet to complete transposition may still be pending.
Step 2 – Client Due Diligence and Tax Residency Determination
Collect self-certification of tax residency from all new reportable users before the first transaction. For existing users, providers have a defined remediation window to obtain certifications; the exact domestic deadline will vary depending on each member state's transposing rules. Where self-certification conflicts with other data held (for example, a billing address in a different country), the provider must resolve the inconsistency before reporting.
- Obtain tax identification numbers (TINs) for each reportable jurisdiction of residence.
- Validate TIN formats against official databases where available.
- Flag and escalate cases where residency cannot be confirmed to avoid misreporting.
- Document each determination step; regulators may request audit trails.
Step 3 – Transaction Data Capture
The reportable data set includes the type and amount of crypto-asset transferred or exchanged, the fiat value at transaction date, wallet addresses where relevant, and aggregate annual figures per user. Systems must be capable of capturing this data in real time and aggregating it accurately across the full calendar year. Integration between trading, custody and accounting systems is often the most technically demanding aspect of compliance for providers that grew from startup infrastructure.
Step 4 – Preparing and Filing the Annual Information Return
Under Portugal's Law No. 26/2026 and the DAC8 framework generally, the annual crypto-asset information return must be filed by 31 May of the year following the reporting year. For the first reporting period covering calendar year 2026 data, the deadline is 31 May 2027. The return must be submitted electronically in the XML schema specified by the competent authority, which in Portugal follows the format prescribed at EU level to enable cross-border exchange.
Providers operating across multiple jurisdictions should plan for potentially differing national XML schemas or submission portals, at least until technical harmonisation is achieved at EU level through the Commission's centralised repository.
Step 5 – Rectification and Nil Returns
Where errors are identified after filing, providers must submit corrected returns promptly. Most member states' rules – and Portugal's transposing legislation – treat voluntary correction more favourably than errors discovered during audit. A nil return is required where a provider has no reportable transactions for a given year; failure to file at all, even where there is nothing to report, may itself attract a penalty under national rules.
Penalties and Enforcement
Portugal's Law No. 26/2026 explicitly increases penalties for DAC8 non-compliance relative to the prior regime. The directive requires member states to lay down effective, proportionate and dissuasive sanctions; while the precise penalty bands are set at national level and will therefore vary across the EU, the direction of travel is clear – enforcement appetite is higher than it was for earlier DAC iterations.
Infringement procedures opened by the Commission on 30 January 2026 against non-transposing member states signal that the Commission is prepared to escalate to the Court of Justice of the EU (CJEU) if necessary. This matters to CASPs because protracted national transposition uncertainty does not suspend the underlying EU-law obligation to comply from 1 January 2026 – providers cannot use a member state's delay as a shield against eventual enforcement once rules are adopted.
Common triggers for penalty exposure identified in early compliance reviews include: late or absent registration; failure to obtain or verify self-certification; aggregation errors in transaction data; and failure to file a nil return. Providers should build internal controls that detect and remediate these issues before the filing deadline.
If your organisation is assessing its exposure under DAC8 or reviewing the adequacy of existing compliance systems, our tax law practice can assist with gap analysis, regulatory correspondence and structuring advice. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
Cost Drivers and Realistic Timelines
Compliance costs vary considerably depending on a provider's existing technology stack, client base size and geographic footprint. The principal cost drivers are:
- System integration and data engineering – adapting trading and custody platforms to capture DAC8-specific fields, often the largest single cost item.
- Legal and regulatory advisory fees – jurisdiction-by-jurisdiction analysis of transposing legislation, particularly for multi-state operators.
- Client outreach – obtaining self-certifications from existing users at scale, including translation and operational support costs.
- Ongoing compliance operations – annual filing preparation, quality control, and staff training.
For providers starting from scratch in mid-2026, a realistic timeline to be fully operational before 31 December 2026 (the end of the first reporting year) is tight. Technology implementation alone can require several months, and regulatory review or registration processes add further lead time. Providers that have not yet begun should treat this as urgent.
Common Errors by Foreign Clients and Pitfalls to Avoid
Foreign-headquartered CASPs entering the EU market frequently underestimate the nexus rules. Providing services to EU-resident users through a non-EU entity, without a branch or registration in any member state, does not automatically place a provider outside DAC8 scope – the rules include registration-based triggers that may apply under MiCA authorisation even where the parent is offshore.
A second common error is conflating MiCA customer data with DAC8 self-certification. MiCA-compliant KYC processes capture identity and AML data; DAC8 additionally requires explicit tax residency self-certification and TIN collection, which are separate legal instruments. Assuming one satisfies the other has caused compliance gaps in early review exercises.
Third, some providers incorrectly treat staking rewards, token lending income and airdropped assets as outside the reporting perimeter on the basis that no "exchange" has occurred. The directive's scope covers transfers as well as exchanges; the characterisation of specific product types should be confirmed against EUR-Lex source text and any technical guidance issued by competent authorities rather than assumed.
Finally, providers in jurisdictions where national transposing legislation was not in place by 1 January 2026 have in some cases deferred compliance planning. Given the Commission's infringement actions of 30 January 2026, this approach carries risk: once transposition is completed – potentially retroactively effective – providers with no prior preparation will face compressed timelines.
Interaction with MiCA, ESMA and EBA Frameworks
DAC8 does not operate in isolation. MiCA authorisation requirements administered through ESMA and EBA already impose organisational, capital and disclosure obligations on CASPs. The data governance infrastructure required for MiCA – client categorisation, transaction records, custody ledgers – provides a useful foundation for DAC8 compliance, but providers should map the two frameworks explicitly rather than assuming overlap.
ESMA has indicated in its supervisory convergence work that crypto-asset operators should treat tax reporting obligations as part of their broader compliance programme, not as a standalone exercise. This integration approach also makes practical sense: a single data model that feeds both MiCA reporting and DAC8 returns reduces duplication, lowers operational risk and simplifies regulatory examination.
For groups with revenues above the GloBE threshold, the DAC9 layer adds a further information exchange requirement coordinated through the same national competent authorities. Portugal's Law No. 26/2026 transposes DAC9 alongside DAC8, which means that for Portugal-based or Portugal-registered providers, both obligations now have a common domestic legal basis. For a detailed analysis of how these rules interact in the Portuguese context, see our analysis of crypto tax developments post-DAC8.
Decision Checklist for CASPs
The following checklist is designed to help compliance teams assess readiness. It is indicative rather than exhaustive; specific obligations depend on a provider's structure and the member states in which it operates.
- Confirmed nexus analysis: have you identified which member state(s) trigger a DAC8 reporting obligation for your entity?
- Single point of registration determined and registration completed with the competent authority?
- Self-certification process operational for new users from 1 January 2026?
- Remediation programme in place for existing users lacking valid self-certifications?
- TIN validation integrated into onboarding and KYC workflows?
- Transaction data capture updated to collect all DAC8-required fields (asset type, fiat value, wallet address where applicable)?
- XML reporting schema implemented and tested against the competent authority's technical specification?
- Annual filing calendar confirmed: first return due 31 May 2027 for 2026 data?
- Nil-return obligation addressed in internal procedures?
- Penalty and escalation matrix documented for internal audit purposes?
- MiCA and DAC8 data models reviewed for gaps and overlaps?
- DAC9 / Pillar Two applicability assessed for group-level entities above the GloBE threshold?
Our corporate law team regularly advises on structuring questions that arise at the intersection of MiCA authorisation, DAC8 compliance and group reorganisation. Where cross-border structures are involved, early-stage planning can meaningfully reduce complexity and cost.
Next Steps
DAC8 compliance is not a one-time project – it establishes an annual reporting cycle that will evolve as competent authorities refine technical standards, as further CJEU case law develops on the directive's scope, and as the Commission monitors member states' enforcement practices through the EUR-Lex publication of implementing measures. Providers that build robust, auditable compliance programmes now will be better placed to absorb future adjustments with minimal disruption.
To discuss your organisation's specific situation, review your current compliance posture or obtain advice on a particular aspect of the DAC8 framework, please reach out to the Ferraz & Whitmore team at info@ferrazwhitmore.com or through our contacts page. We advise on EU regulatory and tax matters across multiple jurisdictions and can coordinate multi-state compliance projects through our network of correspondent counsel.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.