DAC8 Explained: EU Crypto Tax Reporting from 2026

DAC8 is the EU directive that makes crypto exchanges and other crypto service providers report their customers' identities and transaction totals to tax authorities. It is Council Directive (EU) 2023/2226, and it has applied since 1 January 2026. Providers collect your name, address, tax residence and tax identification number (TIN), report what you bought, sold and transferred during the year, and tax authorities exchange the 2026 data with each other by 30 September 2027.

This guide explains who has to report, exactly what is reported, how DAC8 relates to the OECD's global Crypto-Asset Reporting Framework (CARF) and to MiCA, what it means for you as a user, and what it does and does not reach in self-custody and DeFi. Legal references are to the directive as published in the Official Journal on 24 October 2023, checked on 5 October 2026.

This is general information, not tax advice. Crypto tax rules are national and differ widely. Speak to a qualified tax adviser about your own situation.

What is DAC8?

"DAC" stands for the Directive on Administrative Cooperation in the field of taxation, Directive 2011/16/EU, which sets out how EU tax authorities share information with one another. It has been amended repeatedly, and each amendment gets a number. DAC8, the eighth, was adopted by the Council on 17 October 2023 and published on 24 October 2023 (European Commission).

The reason is stated in the recitals: member states tax crypto income under different national rules, but "the decentralised nature of crypto-assets makes it difficult" for tax administrations to check compliance. Before DAC8, a tax office generally had no automatic way to learn that a resident held an account at a crypto exchange in another country. Banks have reported foreign account holders under the Common Reporting Standard for years; DAC8 brings crypto into the same system.

Under Article 2, member states had to adopt and publish their national laws by 31 December 2025 and apply them from 1 January 2026. DAC8 also makes other changes to the DAC, including on e-money accounts, tax rulings for wealthy individuals and wider TIN reporting, but this guide focuses on crypto.

Who has to report

The obligation falls on Reporting Crypto-Asset Service Providers (RCASPs). The directive defines two kinds:

• Crypto-asset service providers (CASPs) authorised under MiCA, the EU's crypto licensing regulation.
• Crypto-asset operators, meaning providers of crypto-asset services that are not MiCA-authorised CASPs. This catches firms based outside the EU that serve EU residents.

Either kind is an RCASP if it "conducts one or more Crypto-Asset Services effectuating Exchange Transactions for or on behalf of a Reportable User" (Annex VI, Section IV). Crypto-asset services take their meaning from MiCA, and DAC8 states expressly that they include staking and lending. A crypto-asset operator with EU-resident users must register in one member state, and the Commission had to set up a central register of such operators by 31 December 2025. An operator that does not register or report faces enforcement, which can extend, as a last resort, to preventing it from operating in the EU.

A "Reportable User" is a customer who is resident in an EU member state for tax purposes. If you live in France and use an exchange licensed in Ireland, the Irish authorities receive the report and pass it to France.

What is reported

For each Reportable User, the provider reports once a year, in the year after the activity (Annex VI, Section II). The report contains two blocks.

Who you are:

• name and address;
• member state(s) of tax residence;
• TIN(s);
• for individuals, date of birth (place of birth only where domestic law already requires the provider to collect it);
• for companies, the same details for the company and for any controlling persons who are reportable.

What you did, broken down by each type of crypto-asset you transacted in during the year:

• purchases for fiat money and sales for fiat money: the aggregate gross amount, the number of units and the number of transactions;
• exchanges of one crypto-asset for another, in both directions: the aggregate fair market value, units and number of transactions;
• "reportable retail payment transactions", which are crypto payments for goods or services worth more than USD 50,000;
• other transfers to you and by you, subdivided by transfer type where known;
• the aggregate fair market value and units of transfers the provider made on your behalf to blockchain addresses not known to be associated with a virtual asset service provider or financial institution, in practice, withdrawals to self-hosted wallets.

These are annual totals per asset, not a list of every trade. DAC8 does not report your gains or losses. The tax authority receives the inputs and still relies on your own tax return to work out what you owe.

Which tokens count? The recitals describe the concept of crypto-assets as very broad, including decentrally issued tokens, stablecoins and certain NFTs. The annex then carves out central bank digital currencies, tokens that meet the directive's own definition of electronic money (these are picked up under the financial-account rules of the DAC instead), and crypto-assets that the provider has "adequately determined" cannot be used for payment or investment purposes.

Key DAC8 dates

Exact national filing deadlines for providers depend on each member state's implementing law.

DAC8 and the OECD's CARF

DAC8 is the EU's way of implementing a global standard. The OECD published the Crypto-Asset Reporting Framework (CARF) so that tax authorities around the world could exchange crypto information on the same model, and DAC8's recitals refer to it directly. The data fields in DAC8 closely follow CARF.

As of the OECD Global Forum's list last updated on 14 September 2026, 77 jurisdictions had committed to implement CARF (OECD Global Forum):

• 46 plan first exchanges by 2027, including most EU member states, the United Kingdom, Japan, Korea, Brazil, Norway, Liechtenstein and the Crown Dependencies;
• 27 plan first exchanges by 2028, including Switzerland, Singapore, Hong Kong (China), the United Arab Emirates, Canada and Australia;
• 4 plan first exchanges by 2029: Argentina, Azerbaijan, Mexico and the United States.

The same list names four jurisdictions it considers relevant to CARF that had not yet committed: El Salvador, Georgia, India and Viet Nam. In other words, using an exchange outside the EU will increasingly not keep your activity away from your home tax authority. The UK, for example, tells UK crypto service providers that their first CARF report is due between 1 January and 31 May 2027 (GOV.UK).

What DAC8 means for you as a user

If you are an EU tax resident with an account at a centralised crypto platform, expect the following:

• A tax residence self-certification. When you open an account, or by 1 January 2027 if you were already a customer at the end of 2025, the provider must obtain a signed or otherwise confirmed declaration of your name, residence address, tax residence(s), TIN for each member state of residence, and date of birth. It must also check that the declaration is reasonable against the information it already holds, such as your KYC documents.
• A request for your TIN. Many users meet this for the first time as a pop-up asking for a tax number. It is a legal requirement, not an upsell. Collecting tax residence and TIN is now part of onboarding alongside identity checks, and verification vendors such as iDenfy handle it as part of the KYC flow. Our explainer on what KYC means in crypto shows where it fits.
• Consequences for not answering. If you do not provide the information after two reminders following the initial request, and not before 60 days have passed, the provider must prevent you from performing reportable transactions (Annex VI, Section V). In practice that means trading and transfers are blocked until you comply. Member states also set their own penalties, which the directive requires to be "effective, proportionate and dissuasive" (Article 25a); amounts vary by country.
• Keep it up to date. If you move country, the provider can no longer rely on your old self-certification and must obtain a new one.
• Your tax return still matters. DAC8 data lets tax authorities cross-check what you declare. It does not replace your own obligation to calculate and report gains under your country's rules.

Because providers report totals rather than gains, it is worth keeping your own transaction history and cost basis records. Exchange data exported in a year's time may not match what you need, especially if a platform closes. See why crypto exchanges are closing and what happens to your data when an exchange shuts down.

Self-custody and DeFi: what is and is not reported

This is the most misunderstood part of DAC8, so it is worth being precise.

DAC8 reports what providers do for you. The obligation sits with RCASPs, meaning businesses that effect exchange transactions for or on behalf of customers. A self-custody wallet is software; if you hold your own keys and transact directly on-chain, there is no provider in that transaction to report it.

Movements between exchanges and your wallet are visible. When an exchange sends crypto to an address not known to belong to a service provider, it reports the aggregate fair market value and number of units of those transfers. The directive's list of reportable items does not include the wallet addresses themselves; the OECD dropped address reporting from the final CARF after industry consultation (Wikipedia, citing the OECD). Separately, the EU Transfer of Funds Regulation already requires exchanges to collect information about transfers to and from self-hosted addresses for anti-money-laundering purposes. See the crypto Travel Rule explained.

DeFi is not automatically out of scope. Whether someone behind a DeFi service counts as a crypto-asset operator depends on the facts. The OECD's approach is that the rules apply where an entity or individual exercises enough control or influence over a platform that it could carry out the due diligence and reporting (Wikipedia, citing the OECD commentary). National tax authorities will interpret this case by case.

Not reported is not the same as not taxable. Swaps, liquidity provision, staking rewards and lending income may all be taxable events under your national rules, whether or not any provider reports them. DAC8 changes what the tax authority can see, not what you owe.

For context on JewelSwap: it is non-custodial DeFi software on MultiversX, Sui and Radix. It is not a CASP, is not regulated, does not take custody of user funds, and its money markets are currently paused.

How DAC8 relates to MiCA

The two are separate laws with different jobs, but they are built to fit together:

• MiCA, Regulation (EU) 2023/1114, is financial regulation. It decides who may provide crypto services in the EU and on what conditions, through the CASP licence.
• DAC8 is tax law. It reuses MiCA's definitions of crypto-assets, CASPs and crypto-asset services, and adds a reporting duty on top of the licence.
• An authorised CASP is automatically in scope of DAC8 if it effects exchange transactions for EU-resident customers. A firm without a MiCA licence that serves EU residents does not escape DAC8: it is a crypto-asset operator and must register and report.
• DAC8's recitals refer to ESMA's register of authorised CASPs and to its list of operators providing crypto services without the required authorisation.

Platforms also carry anti-money-laundering duties under the Transfer of Funds Regulation now, and under the EU Anti-Money Laundering Regulation from 10 July 2027. For the operational side of running all of this at once, see crypto AML compliance for exchanges and how to verify a MiCA-compliant platform.

Frequently asked questions

What is DAC8?

DAC8 is Council Directive (EU) 2023/2226, the eighth amendment to the EU directive on administrative cooperation in taxation. It requires crypto-asset service providers and crypto-asset operators to collect tax information from EU-resident users and report their crypto transactions to tax authorities, which then exchange the data.

When does DAC8 start?

DAC8 has applied since 1 January 2026. Providers report 2026 activity during 2027, and tax authorities must exchange the 2026 data with other member states by 30 September 2027.

What information does DAC8 report?

Your name, address, tax residence, tax identification number and date of birth, plus annual totals for each crypto-asset: purchases and sales for fiat, crypto-to-crypto exchanges, large retail payments over USD 50,000, other transfers, and transfers to wallets not known to belong to a service provider.

Why is my crypto exchange asking for my tax ID number?

Because DAC8 requires providers to obtain a tax self-certification including your TIN from new customers at onboarding, and from existing customers by 1 January 2027. If you do not provide it after two reminders and at least 60 days, the provider must block reportable transactions.

Does DAC8 cover self-custody wallets and DeFi?

DAC8 puts the reporting duty on service providers, so activity done purely from your own wallet has no provider to report it. Transfers from an exchange to self-hosted wallets are reported as aggregate values, and DeFi operators that exercise enough control over a platform may themselves be in scope. Your tax obligations apply either way.

Is DAC8 the same as CARF?

DAC8 is the EU's legal implementation of the OECD's Crypto-Asset Reporting Framework. As of 14 September 2026, 77 jurisdictions had committed to CARF, with 46 planning first exchanges by 2027, 27 by 2028 and 4 by 2029.

Keep reading

• What is MiCA? The EU crypto regulation explained
• What is KYC in crypto?
• CASP licence under MiCA explained
• The crypto Travel Rule explained
• Self-custody crypto guide

This article is educational and is not tax, legal or financial advice. Legal references are to Council Directive (EU) 2023/2226 as published on 24 October 2023, checked on 5 October 2026. CARF commitment figures are from the OECD Global Forum list last updated 14 September 2026. National implementation and penalties differ by member state. Other sources are linked inline, including EUR-Lex, the European Commission and GOV.UK.