DAC8 Reporting Obligations: A Plain-Language Summary

For many CASPs, the legal text of DAC8 can be dense and difficult to navigate. This article provides a plain-language summary of what you must do, when you must do it, and what information you must report — without the legal jargon.

Who Has to Report?

If your company does any of the following in the EU or for EU clients, you have reporting obligations under DAC8: operating a crypto exchange (fiat-to-crypto or crypto-to-crypto), holding crypto-assets on behalf of clients (custody), providing crypto transfer services, or offering brokerage, advisory, or portfolio management for crypto-assets.

It does not matter where your company is incorporated. If you serve clients who are tax residents of EU Member States, DAC8 applies to you.

What Do You Have to Collect from Your Users?

For every user who conducts a reportable transaction, you must collect and verify their full legal name (for individuals) or legal entity name (for companies), residential address, date of birth (for individuals), country or countries of tax residency, Tax Identification Number (TIN) for each country of tax residency, and for companies, the identity of controlling persons (beneficial owners).

You must also obtain a self-certification — a formal declaration from the user confirming their tax residency. This is not optional. You cannot rely solely on the address in their profile or their IP location to determine tax residency.

What Transactions Must You Report?

You must report every transaction in these four categories: crypto purchased with fiat currency (and vice versa), one crypto-asset exchanged for another crypto-asset, crypto-assets transferred from one user to another, and crypto-assets used to pay for goods or services.

For each category, you must report the total amount in fiat currency equivalent, the total number of units of crypto-assets involved, and the total number of transactions during the year.

There is no minimum amount. A user who makes a single transaction of one euro must be reported just like a user who trades millions.

When Do You Have to Report?

The reporting cycle is annual. You must begin collecting data from January 1, 2026. Your first report, covering the full 2026 calendar year, must be submitted by a deadline set by the Member State where you are registered — in most cases, this is expected to be January 31, 2027, or shortly thereafter. Reports are then due annually for each subsequent calendar year.

Where Do You Send the Report?

You submit your report to the tax authority of the EU Member State where you are registered or authorized. If you are a non-EU CASP serving EU clients, you must register in one EU Member State and report there.

The tax authority will then automatically share the relevant information with the tax authorities of every other EU Member State where your reported users are tax residents. You do not need to file separate reports in each country — the EU's exchange system handles the distribution.

What Format Must the Report Be In?

Reports must be submitted in XML format following a specific schema aligned with the OECD's CARF XML standard. The exact technical specifications are determined by each Member State, but they all follow the same underlying structure.

You cannot submit reports in Excel, PDF, or any other format. Your reporting system must be capable of generating valid XML files that pass the validation checks applied by the receiving tax authority.

What About Existing Users?

DAC8 applies not only to new users who register after January 1, 2026, but also to existing users. For existing users, you must conduct a review process — sometimes called a look-back — to collect the required information (TINs, self-certifications, tax residency) from users who registered before the directive took effect.

The look-back process must be completed within a timeframe specified by national legislation, typically within the first reporting year. This means that in 2026, you will need to contact your existing users to collect any missing information.

What If a User Refuses to Provide Their TIN?

If a user does not provide their TIN after you have made reasonable efforts to collect it, you must still include them in your report but indicate that the TIN was not provided despite a request. Some Member States may require you to take additional steps, such as restricting the user's account until the TIN is provided.

You cannot simply exclude non-compliant users from your report. Every user with reportable transactions must appear in the report.

What About Users with Multiple Tax Residencies?

Users who are tax residents of more than one jurisdiction must be reported for each jurisdiction. This means that a user who is tax resident in both Germany and France will appear in the reports sent to both German and French tax authorities.

What Records Must You Keep?

You must retain all data related to DAC8 reporting for a period determined by national law — typically at least five years. This includes user identification documents and self-certifications, TIN verification records, transaction records used to compile the report, copies of the XML reports submitted, and any correspondence with users regarding due diligence.

What Are the Penalties for Non-Compliance?

Penalties are set by each Member State individually. They typically include fines for late filing, incomplete filing, or inaccurate reporting, additional penalties for failure to perform due diligence, and potential impact on your MiCA authorization status.

The exact penalty amounts vary significantly across Member States. However, the political pressure to enforce DAC8 rigorously means that CASPs should not expect lenient treatment from tax authorities.

What Should You Do Right Now?

If you have not already started preparing for DAC8, the most important immediate steps are conducting a gap analysis to identify what data you currently collect and what you are missing, updating your onboarding processes to include TIN collection and self-certification, building or procuring a system capable of generating DAC8-compliant XML reports, training your team on the new obligations, and establishing a timeline that ensures you are fully operational by January 1, 2026.

Conclusion

DAC8 requires CASPs to collect specific user information, track all reportable transactions, and submit annual XML reports to their home tax authority. There are no thresholds, no exemptions for small CASPs, and no exceptions for users who refuse to cooperate. The obligations are clear and the timeline is fixed. Preparation should begin now if it has not already.