The DAC8 Directive: The EU's Crypto Tax Transparency Dragnet Explained

As the EU's DAC8 directive takes effect across all 27 member states, crypto platforms are enforcing mandatory TIN collection to automatically share transaction-level data—bringing an end to non-reporting from Germany to Malta.

In the European Union, the adoption of Council Directive (EU) 2023/2226—known as DAC8—marks the end of information asymmetry between crypto platforms and tax authorities. Formally adopted on October 17, 2023, and entering into effect across all 27 member states on January 1, 2026, DAC8 establishes a standardized framework for the automatic exchange of tax-relevant transaction data. The directive transposes the OECD's Crypto-Asset Reporting Framework (CARF) and the revised Common Reporting Standard (CRS 2.0) into binding EU law, targeting an estimated €1.4 billion in annual lost tax revenue from unreported crypto transactions.

Under DAC8, Reporting Crypto-Asset Service Providers (RCASPs)—which include centralized exchanges, custodial wallet providers, brokers, and certain decentralized finance (DeFi) platforms that maintain functional control over user access—must identify their EU-resident users, verify their tax residencies, collect their Taxpayer Identification Numbers (TINs), and report their transactional data annually. The reporting scope is comprehensive, covering crypto-to-fiat exchanges, crypto-to-crypto swaps, transfers to unhosted wallets, and retail payment transactions. Crucially, DAC8 operates without any de minimis threshold, meaning that any transaction or account balance above zero is reported.

The enforcement mechanisms of DAC8 are particularly stringent. If a user fails to supply the required self-certification or a valid TIN, the platform is legally obligated to issue two formal reminders. If the user does not comply within 60 days of the second reminder, the platform must block their account from performing any reportable transactions, restricting usage strictly to withdrawals. Non-compliant platforms face administrative fines ranging from €20,000 to €500,000 and the potential revocation of their operating licenses. Data collection commenced on January 1, 2026, with the first reports due from platforms to national authorities by January 31, 2027, or June 30, 2027, depending on the member state's specific guidelines. The first automatic exchanges between EU tax administrations will take place on September 30, 2027, covering the entire 2026 calendar year.

This European transparency layer operates in tandem with a broader global rollout of the OECD's CARF, which utilizes the same XML reporting schema and database structures. Over 75 jurisdictions have committed to CARF, which is being implemented in distinct waves, ensuring that offshore tax havens are integrated into the global reporting network.

National Tax Policies and Non-Compliance Penalties Within the EU

While DAC8 standardizes the collection and exchange of data across the EU, it does not harmonize tax rates or domestic classifications of digital assets. Member states continue to apply highly heterogeneous tax regimes, and their respective tax administrations have established specific, severe penalties for taxpayers who fail to accurately declare their digital asset income.

• Germany: Germany does not treat cryptocurrencies as capital assets, classifying them instead as private money. Gains from the sale of digital assets are completely tax-free if the assets are held for longer than 12 months within private portfolios; if held for less than one year, gains are taxed at the taxpayer's progressive income tax rate. Under Germany's transposition of DAC8 via the Crypto-Asset Tax Transparency Act (KStTG), any failure to disclose taxable transactions will trigger retrospective income tax reassessments, an annual interest penalty of 1.8% on the unpaid tax liability, and potential criminal charges for deliberate tax evasion.
• Italy: Italy imposes a flat capital gains tax rate of 33% on crypto-asset profits exceeding a statutory threshold of €2,000 within a tax year. If an Italian resident fails to declare their crypto holdings or transactions, the authorities can impose administrative penalties ranging from 90% to 180% of the unpaid tax amount, in addition to interest charges.
• France: French tax residents are subject to a flat tax rate of 30% (a 12.8% income tax component and 17.2% in social levies) on private digital asset gains. French tax law requires the mandatory declaration of all foreign crypto exchange accounts via Form 3916-bis. Taxpayers who deliberately conceal accounts or transactions face a 40% surcharge plus interest, escalating to an 80% surcharge in cases of established fraud.
• Spain: Spain taxes digital asset capital gains under a progressive scale ranging from 19% to 28%. Spanish tax authorities use DAC8 data to automatically cross-reference transactions against individual personal income tax returns (IRPF), and the burden of proof is shifted to the taxpayer to reconcile discrepancies. Penalties reach 50% of the unpaid tax for negligent non-reporting, rising to 150% where Hacienda determines intentional concealment. Discrepancies exceeding €120,000 carry criminal prosecution for tax fraud.
• Cyprus: Under the 2026 tax reform package effective January 1, 2026, Cyprus introduced dedicated rules under Article 20E of the Income Tax Law. Eligible individual tax residents can elect to tax crypto disposal profits—including fiat sales, swaps, gifting, and retail payments—at a flat rate of 8%. Capital gains from crypto assets listed on recognized exchanges remain 100% exempt for casual private investors, while active staking and mining rewards fall under standard progressive bands (0–35%) or corporate income tax (raised from 12.5% to 15% in 2026). Under-declaration triggers audits, a 3.50% statutory late-payment interest rate, and administrative surcharges.
• Greece: Greece lacks a crypto-specific income-tax line, requiring taxpayers to declare digital assets as "securities" under general personal returns. Capital gains from crypto transfers are taxed at a flat 15%; systematic professional trading is taxed under progressive business income rates (9% up to 44%). Investors log activity in Form E1 under Code 743 (acquisitions), Code 781 (sales), and Code 865 (capital gains); losses (Code 871) offset gains and carry forward for 5 years. Late or inaccurate filings trigger fines of 10%–50% of the unreported tax, rising to a flat 50% for non-filing, plus 8.76% annual interest.
• The Netherlands: The Netherlands does not levy a standard capital gains tax on individual investors. Crypto is declared as a wealth asset in "Box 3" based on fair market value on January 1st. In 2026, Box 3 rules assume a fictitious 6.00% return on "investments and other assets," taxed at 36%—an effective rate of roughly 2.16% on total portfolio value above a €59,357 allowance. A Supreme Court-approved actual-return rebuttal scheme allows paying 36% only on actual gains where returns are lower. Professional trading, mining, or crypto wages shift the obligation to "Box 1" progressive bands (up to 49.5%). Intentional Box 3 errors carry an automatic 150% fine (75% for gross negligence).
• Malta: Under Malta's Blockchain Tax Guidelines, treatment relies on token classification. Casual private investors enjoy a 0% capital gains tax on standard "Coins" (like BTC and ETH) and utility tokens, as they are not deemed securities. Security tokens with profit-participating or dividend-like rights follow standard capital gains rules. Professional trading under the "badges of trade" analysis is taxed as trading income at up to 35%, though Malta's full imputation system can reduce the effective corporate rate on distributed dividends to between 5% and nil. Resident non-domiciled individuals are exempt from Maltese tax on foreign-sourced capital gains, even if remitted. Unpaid balances incur late interest of 0.6% per month (7.2% annually).

Operational Directives for Platforms and Taxpayers

• Verify and document tax residency status. Expatriates and international residents must establish their tax residency under local laws and bilateral Double Taxation Agreements (DTAs), documenting physical presence and economic ties using the OECD Article 4 tie-breaker cascade to support residency claims during audits.
• Conduct thorough account and data audits. Gather complete historical transaction data across all centralized exchanges, custodial wallets, and on-chain protocols. CARF-compliant software can help reconcile cost basis records and identify discrepancies before data is automatically exchanged in 2027.
• Address past discrepancies proactively. Taxpayers with undeclared income from prior years should consider domestic voluntary disclosure programs—disclosing before host authorities receive the automated 2026 dataset can reduce surcharges and minimize criminal audit risk.
• Complete KYC and TIN verification. Users of EU-regulated platforms (or non-EU platforms serving EU residents) must confirm their correct TINs are on file to prevent mandatory account blocks.
• Update corporate balance-sheet accounting. Ensure the treatment of stablecoins aligns with the definitions under the GENIUS Act and GAAP—stablecoins issued by non-permitted or unregulated entities cannot be classified as cash or cash equivalents.

How Ondology Labs Can Help

DAC8 makes on-chain activity permanently legible to tax administrations—and the same analytics regulators use to cross-reference returns can help firms and investors get ahead of it. Ondology Labs combines Cyprus-based, ICPAC-licensed blockchain auditing with blockchain forensics and transaction tracing to reconstruct complete, verifiable transaction histories and reconcile cost basis before automatic exchange begins. For CASPs navigating both DAC8 and the closing MiCA transition window, that is the difference between audit-ready and exposed.

Read Part 1: The GENIUS Act and the tax status of digital assets, or continue to Part 3: How DAC8 and CARF affect international expats in the EU.