DAC8 Compliance Guide for Crypto-Asset Service Providers in Malta

Crypto-asset service providers (CASPs) operating in Malta must comply with DAC8 – Directive (EU) 2023/2226 – which imposes mandatory annual reporting of crypto-asset transactions to the Commissioner for Revenue starting with data collected from 1 January 2026, with the first return due by 31 May 2027. Malta's national transposition status should be monitored closely: the European Commission opened infringement procedures on 30 January 2026 against member states that had not yet transposed DAC8 and DAC9 into domestic law, signalling that regulators are treating delayed implementation as a serious compliance risk. CASPs registered or licensed in Malta should treat the 1 January 2026 start date as a live obligation and begin building reporting infrastructure now.

Why Malta CASPs Face Distinct Compliance Pressures

Malta established itself as an early mover in crypto-asset regulation through the Virtual Financial Assets (VFA) framework administered by the Malta Financial Services Authority (MFSA). That regulatory head-start means the island hosts a significant concentration of licensed CASPs – and therefore faces proportionally higher DAC8 exposure than many comparable EU jurisdictions. Where a CASP holds an MFSA licence, it is already subject to AML/KYC obligations that generate the underlying customer data DAC8 now requires to be reported to the Commissioner for Revenue. The challenge is not data collection from scratch, but mapping existing VFA compliance workflows onto a structured tax-reporting schema aligned with the OECD Crypto-Asset Reporting Framework (CARF).

Additionally, DAC8 arrives alongside DAC9 – Directive (EU) 2025/872 – which governs the exchange of Pillar Two/GloBE information between EU tax authorities. Large CASPs that are part of multinational groups meeting the Pillar Two revenue threshold will need to coordinate two parallel reporting streams: crypto-asset transaction data under DAC8 and top-up tax information under DAC9. The interaction between these obligations is an area where early legal and tax structuring advice is particularly valuable.

The EU Legal Basis and What It Actually Requires

DAC8 amends Directive 2011/16/EU on administrative cooperation in tax matters. Its core mechanism requires CASPs to collect, verify and annually report user data – covering tax residency, taxpayer identification numbers, transaction volumes and asset values – to the competent authority of the member state in which the CASP is registered or licensed. That authority then exchanges the information automatically with the tax authorities of the users' states of residence.

The directive aligns closely with the OECD CARF standard, so CASPs already working toward CARF compliance in non-EU jurisdictions will find significant conceptual overlap. Key reporting categories include exchanges between crypto-assets and fiat currencies, exchanges between different crypto-assets, and transfers of crypto-assets. The scope is broad: it covers not only centralised exchanges but also certain decentralised and custody-service models, depending on whether the entity qualifies as a CASP under the applicable definition cross-referenced from MiCA.

Malta-Specific Transposition: Current Status and Practical Implications

As of the date of this guide, Malta's domestic legislation transposing DAC8 should be treated as pending confirmation. The EU-wide application date of 1 January 2026 is fixed by the directive itself, and the Commission's infringement action of 30 January 2026 confirms that this date is not contingent on any individual member state completing its parliamentary process. CASPs operating in Malta should therefore:

• Monitor the Malta Business Registry and official government gazette for transposing legislation and any national guidance issued by the Commissioner for Revenue.
• Review MFSA circulars and supervisory notices, which may provide supplementary operational guidance before formal legislative transposition is complete.
• Not assume that an absence of published national rules implies a delay in the underlying obligation – the directive's direct effect and the Commission's enforcement posture suggest otherwise.

Once Malta's transposing act is published, CASPs will need to check whether it introduces any Malta-specific procedural rules – such as a dedicated reporting portal, specific XML schema requirements, or local penalty scales – that go beyond the directive's minimum standards.

If you need assistance interpreting the current transposition status or reviewing MFSA communications in the context of DAC8, the team at Ferraz & Whitmore is available to assist. Contact us at info@ferrazwhitmore.com or visit our contacts page.

Step-by-Step Compliance Procedure for Malta-Licensed CASPs

The following steps reflect the logical sequence for a CASP that is already MFSA-licensed and needs to achieve DAC8 readiness. Steps involving specific national portal details are described functionally, as Malta's implementing regulations are subject to confirmation.

• Step 1 – Scope determination. Confirm that your entity qualifies as a CASP within the DAC8/MiCA definition. Some entities providing ancillary crypto services may fall outside the mandatory reporting scope; legal analysis of the entity's actual activities is the starting point.
• Step 2 – Data audit. Map all existing KYC/AML data fields against the DAC8 reporting schema. Identify gaps: in particular, verify that tax residency self-certifications and taxpayer identification numbers (TINs) are collected for all reportable users, including entity customers.
• Step 3 – Policy and procedure update. Amend onboarding documentation, terms of service and privacy notices to reflect DAC8 data collection and reporting obligations. GDPR alignment is required: users must be informed that their transaction data will be shared with the Commissioner for Revenue and potentially with foreign tax authorities.
• Step 4 – System build or vendor selection. Decide whether to build internal reporting logic or engage a third-party compliance technology provider. Either route must produce output in the format prescribed by the Commissioner for Revenue once that format is published.
• Step 5 – Registration or notification with the Commissioner for Revenue. Depending on Malta's implementing rules, CASPs may need to formally register as reporting entities. Monitor official guidance for the specific registration mechanism and deadline.
• Step 6 – 2026 data collection. From 1 January 2026, collect and record all reportable transaction data in a manner consistent with the DAC8 schema. This is the live obligation period for the first reporting cycle.
• Step 7 – Annual return submission. File the crypto-asset information return with the Commissioner for Revenue by 31 May 2027 for data relating to the 2026 calendar year. This deadline is set at EU level and is expected to be replicated in Malta's transposing legislation.
• Step 8 – Ongoing cycle. Establish an annual compliance calendar. Returns for subsequent years will follow the same 31 May deadline pattern.

Key Documents Required

Across each reporting cycle, CASPs should maintain and be prepared to provide:

• Tax residency self-certifications from all reportable users (individuals and entities), collected at onboarding and refreshed upon any indication of a change in circumstances.
• Validated TINs for each jurisdiction of tax residency, cross-checked against available OECD TIN formats.
• Transaction-level records covering asset type, transaction date, fiat equivalent value and counterparty classification.
• Evidence of due diligence procedures applied to determine whether a user is reportable – particularly relevant for pre-existing customers onboarded before DAC8 came into force.
• Internal sign-off records documenting the CASP's scope determination and any good-faith decisions about borderline cases.

Realistic Timelines and Cost Drivers

For a mid-size Malta-licensed CASP with an established KYC programme, the period from kick-off to full DAC8 readiness typically spans several months, depending on the complexity of the product suite and the state of existing data infrastructure. Cost drivers include: the volume of pre-existing customer records requiring retrospective TIN validation; the number of crypto-asset types traded (each may have different valuation methodology requirements); third-party technology integration costs; and external legal and tax advisory fees for scope analysis and documentation review.

CASPs that delayed preparation in expectation of Malta's national transposing act now face compressed timelines. Since the 2026 data collection period is already under way, any gap in the data architecture as at 1 January 2026 creates a remediation problem that may be difficult to resolve cleanly before the 31 May 2027 filing deadline.

Common Errors Made by Foreign-Based Clients Operating in Malta

Ferraz & Whitmore regularly advises non-Maltese groups that have established a Malta CASP subsidiary or branch as part of a wider structure. The following errors appear with particular frequency:

• Assuming the group's home-jurisdiction DAC8 compliance covers Malta. DAC8 reporting obligations attach to the entity in the member state where it is licensed or registered. A group that files correctly in, say, a non-Maltese EU jurisdiction is not thereby compliant for its Malta entity.
• Conflating MiCA authorisation with DAC8 registration. An MFSA licence under the VFA/MiCA framework is a separate regulatory matter from any reporting registration required by the Commissioner for Revenue under DAC8 implementing rules.
• Underestimating the tax residency verification burden. Many Malta CASPs serve retail customers across multiple jurisdictions. Verifying and documenting tax residency – rather than simply country of address – requires a structured self-certification process that differs from standard KYC address verification.
• Missing the interaction with Pillar Two. Groups subject to DAC9/Pillar Two reporting that also operate a Malta CASP need to coordinate both filing streams. Missing the DAC9 dimension because it sits with a different internal team is a structural risk.
• Delayed GDPR alignment. Processing transaction data for tax reporting purposes requires a specific legal basis and corresponding privacy notice update. Treating this as an afterthought creates regulatory exposure with the Information and Data Protection Commissioner in addition to the tax authority.

Penalties and Enforcement Risk

DAC8 requires member states to introduce effective, proportionate and dissuasive penalties for non-compliance. While Malta's specific penalty scale will be set in the transposing legislation, the directive signals an upward direction: comparable jurisdictions that have already transposed DAC8 have increased penalty thresholds materially relative to earlier DAC regimes. Non-reporting, incomplete reporting and failure to maintain adequate due diligence records are all distinct penalty triggers. The Commissioner for Revenue also receives information exchanged by other EU member states' tax authorities, which means cross-border inconsistencies are increasingly detectable.

Disputes with the Commissioner for Revenue that cannot be resolved administratively may ultimately be referred to the Civil Court Malta or the relevant tax appeals tribunal, depending on the nature of the challenge. Early engagement with the authority – including voluntary disclosure where a gap is identified – generally offers better outcomes than waiting for an enforcement notice, though no specific result can be guaranteed.

For a tailored assessment of your Malta CASP's DAC8 exposure and a review of your existing compliance documentation, please reach out to our team at info@ferrazwhitmore.com or through our contacts page. Our Malta tax law practice works alongside our corporate law team to provide integrated advice on regulatory and fiscal obligations.

Decision Checklist for Malta CASPs

Use this checklist to identify whether your organisation has the foundations in place for DAC8 compliance:

• Confirmed entity scope: does the Malta entity qualify as a CASP under the DAC8/MiCA definition?
• Data audit complete: are tax residency and TIN data being collected for all reportable users?
• Self-certification process in place for both individual and entity customers?
• Privacy notices and terms of service updated to reflect DAC8 reporting?
• Reporting technology solution selected and tested against expected output format?
• Registration or notification with the Commissioner for Revenue completed (once the mechanism is published)?
• 2026 data collection live from 1 January 2026?
• Internal deadline set for submission by 31 May 2027?
• DAC9/Pillar Two interaction assessed for group-level entities?
• Legal and tax counsel engaged for ongoing monitoring of Malta transposing legislation?

The Broader DAC8 Picture: Learning from Other Jurisdictions

Malta is not the only jurisdiction where CASPs are navigating the transition to DAC8. Our guide covering the DAC8 compliance framework for CASPs in Cyprus addresses comparable questions under a different national implementation context and may be a useful reference for groups operating across multiple EU member states. Where a group has entities in both Malta and Cyprus – or in Malta and a jurisdiction outside the EU – the interaction between DAC8 and OECD CARF becomes a live structuring question.

It is worth noting that Portugal's Law No. 26/2026, enacted on 3 June 2026, transposed both DAC8 and DAC9 into Portuguese law, providing one example of how an EU member state has approached the legislative mechanics. Portugal's approach confirms the 31 May annual reporting deadline and increased penalties for non-compliance, without altering underlying tax rates. Malta's transposing legislation, once published, may follow a broadly similar structure, though the specifics will need to be verified against the official text.

Ferraz & Whitmore advises CASPs at each stage of the DAC8 compliance lifecycle – from initial scope analysis through to annual return preparation and engagement with the Commissioner for Revenue. To discuss your specific situation, contact us at info@ferrazwhitmore.com or visit our contacts page.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.