DAC8 crypto tax reporting, built from the data up

DAC8 is the eighth amendment to the EU Directive on administrative cooperation in tax (Directive (EU) 2023/2226). It transposes the OECD Crypto-Asset Reporting Framework into EU law and applies from 1 January 2026. Crypto-asset service providers with EU-resident users must identify those users, collect tax self-certifications including tax residence and taxpayer identification numbers, aggregate their reportable transactions per user and per asset at fair market value, and report the lot to a tax authority annually. That authority then exchanges the data automatically with every member state where a user is tax resident. There is no minimum threshold: any reportable activity above zero is reported.

Reporting crypto-asset service providers, which covers two groups: providers authorised under MiCA, and crypto-asset operators serving EU users without a MiCA authorisation, including non-EU platforms with EU-resident customers. Exchanges, brokers, custodial wallet providers, and platforms that control access to user assets are all caught. Individuals and ordinary companies that merely hold or trade crypto do not file DAC8 reports themselves, but they are the subject of the reports their platforms file, which is why their own records need to agree with what is reported about them.

Three matter. Data collection has applied since 1 January 2026, so the first reporting year is already running and cannot be started retroactively without reconstruction work. Self-certifications from pre-existing users, meaning accounts opened before 2026, are due by 1 January 2027. The first reports, covering the 2026 calendar year, fall due in 2027; Cyprus has set 30 June 2027, and other member states set their own dates within the EU window. We confirm the exact filing deadline for your reporting jurisdiction at scoping rather than leaving you to assume it.

Yes. Cyprus missed the original 31 December 2025 transposition deadline, then passed the implementing law on 27 March 2026 with retroactive effect from 1 January 2026. Retroactive is the important word: the late law did not move the start of the first reporting year, so obligations run from January 2026 regardless of when the law arrived. The law applies to entities licensed in Cyprus under MiCA and to crypto-asset operators providing services without a MiCA registration requirement.

DAC8 puts the enforcement on you. After the initial request and two reminders, once 60 days have passed, the provider is required to block the user from performing reportable transactions until the self-certification arrives. That means your onboarding and operations need a working reminder-and-block procedure, with the dates evidenced, not just a policy document that mentions one. It is one of the specific things we test in the due diligence readiness review.

For each reportable user: identity, tax residence, and taxpayer identification number, all supported by a valid self-certification. For their activity: aggregate amounts per crypto-asset for exchanges between crypto and fiat, exchanges between crypto-assets, certain transfers including to unhosted wallets, and retail payment transactions, together with the number of transactions and fair market values. The aggregation sounds simple and is not: it requires classifying every movement correctly, and misclassified internal transfers are the most common way a report ends up wrong.

We are not tax advisors, and this service is deliberately drawn to stop where tax advice starts. What we do is the data: determining your reportable footprint, building the aggregated dataset from chain and exchange records, reconciling it, and preparing it for submission with every figure traceable to source. Interpretation of tax law, positions on contested points, and the filing itself belong to your tax advisor, and we work alongside whoever that is. If you do not have one, we can involve the tax team of CYAUSE, the ICPAC-licensed firm we deliver statutory audits with.

Because from 2026 the information flows whether you participate or not. Every EU-facing platform you use reports your activity, identified by your tax number, to your tax authority. If your filings are built on incomplete records, the mismatch is now visible automatically. The useful response is tax-ready records: cost basis reconstructed from actual transaction history, realised gains and losses computed consistently, internal transfers between your own wallets excluded from taxable events, and the whole thing reconcilable to the chain. That is this service for non-reporting businesses, and it is the same discipline we apply in transaction reconciliation.

Recoverable, and common: the first year of any new reporting regime finds most firms mid-stream. The chain does not forget, exchange records can be exported after the fact, and valuations can be established retrospectively from market data. Self-certifications are the harder gap because they depend on users responding, which is why the backlog work should start immediately rather than in the autumn of 2027. The honest framing is that reconstruction costs more than collection, and the cost grows with the delay.

DAC8 is the EU implementation of the OECD Crypto-Asset Reporting Framework, and dozens of non-EU jurisdictions have committed to CARF exchanges on a similar timetable. In practice that means the reporting architecture you build for DAC8 is the same one CARF will ask of you elsewhere, and data prepared properly once serves both. It also means moving operations outside the EU does not move you outside the regime: a non-EU platform with EU-resident users is still a reporting crypto-asset operator under DAC8.

They share one foundation: records that agree with the chain. Transaction reconciliation is the underlying discipline and is where to start if your books have never been tied to on-chain activity. DAC8 reporting builds the regulatory dataset on top of reconciled records. And when your financial statements are audited, whether through our own audit service with CYAUSE or with your existing auditor through crypto audit support, the same verified data serves the audit evidence. Firms that treat these as one data problem pay for the work once; firms that treat them separately pay three times.