Portugal enacted Law No. 26/2026 on 3 June 2026, transposing both DAC8 (Directive (EU) 2023/2226) and DAC9 (Directive (EU) 2025/872) into domestic law, making it one of the member states to complete transposition after the European Commission opened infringement procedures on 30 January 2026 against those that had not done so. Crypto-asset service providers (CASPs) operating in Portugal are now required to collect, verify and report user data to the Autoridade Tributária e Aduaneira (AT), with the first annual information return covering 2026 data due by 31 May 2027. Failure to comply triggers materially increased penalties under the new framework, which makes early operational readiness a matter of legal risk management rather than a discretionary project.
The Portugal-Specific Context: Why Law No. 26/2026 Matters to Your Business
Portugal's transposition through Law No. 26/2026 is the operative legal instrument for CASPs. The law does not alter existing tax rates on crypto-asset gains or income; its focus is information exchange and reporting infrastructure. What it does change is the compliance burden: providers that were previously outside a structured reporting regime must now embed systematic due-diligence and data-transmission workflows before 1 January 2026 obligations fully crystallise.
Portugal sits within a broader EU enforcement landscape. The Commission's decision to open infringement procedures on 30 January 2026 signalled that DAC8/DAC9 transposition is treated as a political and legal priority at the supranational level. For CASPs registered or licensed in Portugal – whether under the Banco de Portugal virtual-asset registration framework or authorised by the CMVM for MiCA-regulated activities – the message from both Brussels and Lisbon is consistent: the reporting regime is live, and supervisory scrutiny will follow.
If you are assessing your CASP's exposure under the new rules, the team at Ferraz & Whitmore is available to discuss your specific situation. Contact us at info@ferrazwhitmore.com or visit our contacts page.
Legal Basis: DAC8, DAC9 and the CARF Alignment
Directive (EU) 2023/2226 – commonly called DAC8 – extends the EU's automatic exchange of information framework to crypto-assets, aligning it substantially with the OECD's Crypto-Asset Reporting Framework (CARF) and amendments to the Common Reporting Standard (CRS). It applies EU-wide from 1 January 2026. The directive covers a broad definition of reportable crypto-assets, including crypto-assets used for payment or investment, and imposes due-diligence obligations on reporting CASPs to identify the tax residency of their users.
Directive (EU) 2025/872 – DAC9 – addresses the exchange of GloBE (Global Anti-Base Erosion) information under Pillar Two, relevant for multinational enterprise groups within scope of the 15% global minimum tax. Law No. 26/2026 transposes both directives simultaneously. For most CASPs, DAC8 is the primary operational concern; DAC9 is more relevant to large corporate groups that may be within Pillar Two scope and have crypto-related group entities in Portugal.
Who Is a Reporting CASP Under Portuguese Law?
A reporting CASP under Law No. 26/2026 is any entity that, as a business, provides one or more crypto-asset services in Portugal and is subject to Portuguese jurisdiction for these purposes. The jurisdictional nexus rules follow the DAC8 logic: a CASP is reportable in Portugal if it is incorporated there, has its place of management there, or – in the absence of an EU establishment – has registered users or transactions linked to Portugal under the nexus tie-breakers set out in the directive.
Key categories to consider include:
- Exchange services (crypto-to-fiat, crypto-to-crypto) operated from Portugal or with a Portuguese nexus.
- Transfer services facilitating the movement of crypto-assets on behalf of clients.
- Custody and administration of crypto-assets or instruments granting control over them.
- Participation in token offerings where the provider has a distribution or placement role.
DeFi protocols, purely self-hosted wallet providers and entities below the de minimis thresholds set out in the directive may fall outside the reporting obligation, but the analysis is fact-specific. If there is any doubt about whether your entity qualifies as a reporting CASP, legal advice tailored to your operational model is advisable before the reporting cycle begins.
Step-by-Step Compliance Procedure in Portugal
The following procedural outline reflects the framework established by Law No. 26/2026 and the underlying DAC8 directive. Where implementing regulations or AT guidance have not yet been published as of the date of this article, the relevant steps are described by reference to the statutory framework.
Step 1 – Register or Confirm Registration Status
Before any reporting obligation can be fulfilled, a CASP must have a valid registration or authorisation in Portugal. Virtual-asset service providers registered with Banco de Portugal under the anti-money-laundering framework, and CASPs authorised under MiCA by the CMVM, should confirm that their registration data is current and that the entity has been mapped as a reporting CASP in the AT's systems. Entities that newly fall within scope because of the DAC8 nexus rules may need to notify the AT separately.
Step 2 – Implement Due-Diligence Procedures for User Identification
The core of DAC8 compliance is a due-diligence regime analogous to CRS. Reporting CASPs must:
- Collect self-certifications from individual users identifying their jurisdiction(s) of tax residency and, where applicable, their tax identification number (TIN).
- Collect equivalent information from entity users, including their controlling persons where the entity is a passive non-financial entity.
- Verify self-certifications against existing KYC/AML data using a plausibility check; where inconsistencies arise, obtain revised certifications.
- Apply pre-existing user remediation procedures to accounts opened before 1 January 2026, within the timeframes prescribed by the directive and any implementing AT guidance.
Step 3 – Capture Reportable Transactions and Compute Reporting Fields
For each reportable user, the CASP must record and aggregate the data fields required by DAC8. These include the type and amount of crypto-asset exchanged, the aggregate gross proceeds from exchanges and transfers, and the fair market value of crypto-assets transferred. The directive specifies the data fields precisely; CASPs should map these fields against their existing transaction ledger infrastructure and identify gaps early, as data remediation after year-end is operationally costly.
Step 4 – Prepare and Submit the Annual Information Return to the AT
The annual information return must be filed with the Autoridade Tributária e Aduaneira by 31 May of the year following the reportable period. The first return, covering calendar year 2026 data, is therefore due by 31 May 2027. The AT is expected to publish technical specifications for the electronic submission format; CASPs should monitor AT communications and, where necessary, adapt their reporting systems in advance. Late submission or submission containing material errors can trigger the increased penalties introduced by Law No. 26/2026.
Step 5 – Maintain Documentation and Respond to AT Enquiries
CASPs must retain records sufficient to demonstrate compliance with the due-diligence and reporting obligations. The retention period and format requirements are subject to the AT's implementing guidance, but prudent practice is to align retention with the general Portuguese tax documentation rules. Where the AT issues enquiries or requests additional data in connection with a submitted return, responses should be coordinated with legal counsel to manage the evidential and privilege implications.
Documents and Data Infrastructure
A DAC8-compliant CASP will typically need to have in place or develop the following documentation and systems:
- DAC8 Compliance Policy – an internal policy document describing the entity's due-diligence procedures, reporting workflow and governance structure.
- Self-certification templates – for both individual and entity users, aligned with the AT's approved format once published.
- User notification materials – informing existing and new users of the data collection requirement and their obligation to provide accurate information.
- Transaction data schema – internal mapping of DAC8 reporting fields to the CASP's ledger or database.
- Responsible officer designation – identifying the individual within the CASP accountable for DAC8 compliance, as required by the directive's governance provisions.
- Legal basis assessment under GDPR – confirming the lawful basis for processing tax-residency data, given that DAC8 data collection interacts with Portuguese and EU data-protection law.
Realistic Timelines and Cost Drivers
For a CASP that is starting its DAC8 programme from a low baseline, the critical path from gap assessment to first-return readiness typically involves several months of parallel workstreams: legal review, IT development, user communications and staff training. Given that the first reportable period runs throughout 2026, the practical window for completing system build and user on-boarding remediation is already constrained.
The principal cost drivers are system integration (mapping DAC8 data fields to existing transaction infrastructure), legal advice on jurisdictional nexus and user classification, and the ongoing operational cost of managing self-certifications and plausibility checks at scale. CASPs with large pre-existing user bases face a particular challenge in the pre-existing-account remediation exercise, where the volume of outreach can be substantial.
Law No. 26/2026 introduces increased penalties for non-compliance, though the precise penalty schedule is subject to the implementing provisions of the law. The risk calculus therefore tilts strongly towards early investment in a robust compliance programme rather than reactive remediation after an AT inquiry.
Common Errors by Foreign CASPs Entering Portugal
Based on the structure of the DAC8 framework and the Portuguese regulatory environment, the following errors recur in cross-border CASP compliance projects:
- Assuming a non-EU headquarters removes Portuguese reporting obligations. The nexus rules mean that a CASP incorporated outside the EU may still have a Portuguese reporting obligation if it services Portuguese-tax-resident users and has no other EU establishment through which to report.
- Conflating MiCA licensing with DAC8 compliance. Obtaining a CMVM MiCA authorisation satisfies a separate regulatory requirement; it does not substitute for or automatically satisfy the AT reporting obligation under Law No. 26/2026.
- Delaying self-certification collection until year-end. DAC8 requires that self-certifications be obtained at on-boarding for new users and within prescribed timeframes for pre-existing users. Retrospective collection is both operationally harder and legally riskier.
- Underestimating the GDPR interface. Collecting and transmitting tax-residency and TIN data requires a clear legal basis under Regulation (EU) 2016/679, a data-processing agreement with the AT where applicable, and appropriate user notices. Portuguese data-protection obligations enforced by the CNPD apply in parallel.
- Treating DAC8 and DAC9 as identical obligations. For CASPs that are also part of large MNE groups within Pillar Two scope, DAC9 creates a separate GloBE information return obligation routed through the AT; conflating the two reporting streams leads to filing errors.
DAC9 and Pillar Two: The Intersection with Crypto-Asset Groups
Law No. 26/2026 simultaneously transposes DAC9, which implements the exchange of GloBE information returns under the Pillar Two framework. For crypto-asset businesses that are part of multinational enterprise groups with consolidated revenues above the Pillar Two threshold, the Portuguese AT becomes a recipient and transmitter of GloBE data. The practical implication is that the AT has enhanced visibility into the global tax position of such groups, and any inconsistency between the DAC8 crypto-asset report and the GloBE information return may attract scrutiny.
Groups within Pillar Two scope with Portuguese operations should ensure that their DAC8 and GloBE reporting workstreams are coordinated and reviewed for consistency. For further background on related corporate and tax structuring considerations, our Portuguese tax law practice page provides an overview of the services available.
Decision Checklist for Reporting CASPs
Use the following checklist as a starting point for assessing your organisation's DAC8 readiness under Portuguese law. This is not exhaustive and does not substitute for a formal compliance review.
- Has the entity confirmed whether it is a reporting CASP under Law No. 26/2026 and the DAC8 nexus rules?
- Is the entity's registration with Banco de Portugal or authorisation by the CMVM current and correctly recorded with the AT?
- Have due-diligence procedures for new user on-boarding been updated to include DAC8 self-certification collection?
- Has a plan been developed for pre-existing user remediation, with a target completion date within the permitted period?
- Have transaction data systems been mapped against DAC8 reporting fields, and have gaps been identified and scoped for remediation?
- Has a responsible officer been designated for DAC8 compliance governance?
- Has a GDPR legal-basis assessment been completed for DAC8 data processing?
- Has the entity assessed whether it is also within Pillar Two scope and, if so, coordinated DAC9 obligations with DAC8 reporting?
- Has a calendar reminder been set for the 31 May 2027 filing deadline for the first annual return?
For questions about corporate structuring in connection with DAC8 obligations, our Portuguese corporate law practice can assist with entity-level analysis and governance arrangements.
Supervisory and Enforcement Landscape
The Autoridade Tributária e Aduaneira is the designated competent authority for receiving and exchanging DAC8 and DAC9 information in Portugal. The AT operates within the EU's automatic exchange of information network administered by the Commission; data reported to the AT will be exchanged with tax authorities in other member states where reportable users are tax-resident.
The AT's enforcement posture in relation to CASPs is developing. Banco de Portugal and the CMVM retain their respective supervisory roles over the AML/CTF and MiCA dimensions of CASP regulation; DAC8 reporting is a distinct obligation owed directly to the AT. Coordination between these supervisory bodies is a structural feature of the Portuguese regulatory landscape, and a compliance failure on the DAC8 reporting side may also have consequences for a CASP's standing with its prudential or conduct supervisor.
Disputes with the AT over the scope of reporting obligations or the application of penalties are resolved through the Portuguese tax appeals framework, with the possibility of escalation to the administrative and fiscal courts. In cases involving questions of EU law interpretation, references to the Court of Justice of the European Union remain available. Judicial review of AT decisions at the highest level has historically involved the Supremo Tribunal de Justiça and the Supremo Tribunal Administrativo, depending on the nature of the dispute.
If your business is facing an AT inquiry or needs to understand the appeals process under Portuguese law, we are available to discuss the procedural options. Write to info@ferrazwhitmore.com or use our contacts page to arrange a consultation.
Looking Ahead: What CASPs Should Monitor
The DAC8 framework is unlikely to remain static. The Commission and the OECD are both engaged in ongoing work on the interaction between CARF, CRS and digital-asset markets, and further amendments to the EU framework should be anticipated over the medium term. At the national level, the AT is expected to publish implementing guidance, technical reporting specifications and, potentially, sector-specific FAQs as the 2026 reporting cycle progresses.
CASPs should also monitor developments in other EU jurisdictions where they operate. While this guide focuses on Portugal, the DAC8 directive applies uniformly across the EU from 1 January 2026, and the Commission's enforcement posture – illustrated by the infringement procedures opened on 30 January 2026 – signals that supervisory convergence will intensify. For context on how related cross-border tax developments are evolving in other jurisdictions, our recent alert on Kazakhstan's 2026 tax code amendments illustrates the broader global direction of travel on information exchange and digital-asset taxation.
Ferraz & Whitmore advises CASPs, crypto-asset funds and financial technology businesses on DAC8 compliance, regulatory licensing and cross-border tax structuring in Portugal and across jurisdictions. If you would like to discuss your organisation's position under Law No. 26/2026, please contact us at info@ferrazwhitmore.com or visit our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.