DAC8 and TIN Collection: Practical Guide for CASPs

Tax Identification Number collection is one of the most operationally challenging aspects of DAC8 compliance. This guide provides practical strategies for CASPs to collect, validate, and manage TINs across multiple jurisdictions.

Why TIN Collection Matters

TINs are the key that allows tax authorities to match reported transaction data to individual taxpayers. Without accurate TINs, the information exchanged under DAC8 loses much of its enforcement value. Tax authorities across the EU have made clear that TIN completeness and accuracy will be a primary focus of their DAC8 compliance reviews.

TIN Formats by Jurisdiction

Each jurisdiction has its own TIN format, and CASPs must be able to validate the format of TINs from all EU Member States and other CARF jurisdictions. Examples include Germany's 11-digit IdNr, France's 13-digit Numéro Fiscal, the Netherlands' 9-digit BSN, Spain's 8-digit + letter NIF/NIE, Italy's 16-character Codice Fiscale, and Ireland's 7-digit + letter PPSN.

The OECD maintains a reference guide to TIN formats by jurisdiction, which CASPs should use as the basis for their validation logic.

Collection Strategies

New users (from January 1, 2026). TIN collection should be integrated into the onboarding process. Best practices include making TIN a mandatory field during registration, providing jurisdiction-specific input guidance (format hints, examples), implementing real-time format validation, and rejecting registrations with invalid TIN formats.

Existing users (pre-January 1, 2026). CASPs must conduct a look-back process to collect TINs from users who registered before DAC8 took effect. Strategies include email campaigns explaining the regulatory requirement, in-app notifications and prompts, progressive access restrictions for non-compliant users (where permitted by national law), and phased collection targeting the most active users first.

Validation Approaches

TIN validation operates at several levels. Format validation checks that the TIN matches the expected pattern for the claimed jurisdiction. Algorithmic validation applies check-digit algorithms where available (many TIN formats include check digits). Reasonableness checks cross-reference the TIN against other user information such as date of birth and nationality. External validation against tax authority databases may be available in some jurisdictions.

Handling Missing TINs

Despite best efforts, some users will not provide their TIN. DAC8 requires CASPs to report these users with an indication that the TIN was requested but not provided. CASPs should document all efforts to collect the TIN, including dates and methods of contact, to demonstrate compliance with the due diligence requirements.

Conclusion

TIN collection is a critical operational challenge that requires systematic processes, jurisdiction-specific knowledge, and persistent follow-up. CASPs that invest in robust TIN collection infrastructure will be better positioned to meet DAC8 requirements and avoid penalties for incomplete reporting.