DAC8 Crypto-Asset Tax Reporting and Due Diligence Obligations

DAC8 extends the European framework for administrative cooperation to include the automatic exchange of information on crypto-assets. It aims to close the tax information gap in a digital, cross-border market.

Its approach is practical: it requires certain operators to identify their clients (tax KYC), keep evidence and report transactions/holdings in line with the standards set in the transposition.

In short: more transparency, more data, more traceability and higher standards of reporting quality.

The main focus is on crypto-asset service providers that facilitate transactions for users who are tax resident in the EU (e.g., intermediation, execution, custody or transfers).

Depending on the case, it may also interact with entities already subject to other reporting regimes (for example, through CRS-related extensions/adjustments).

If you operate in several jurisdictions, the key question is: where you report and under which local regime.

Reporting is usually structured in two blocks: client data (identification and tax residence) and activity data (relevant crypto-asset transactions).

• Identification of the holder and, where applicable, entity/beneficial owner data, depending on the applicable flow.
• Tax residence and NIF/TIN, with evidence and a validation trail.
• Transactions/transfers/sales/swaps, depending on the final scope of your case.
• Dates, amounts/valuations and internal references that allow reconstruction and audit.

The critical point in DAC8 is tax due diligence: capturing tax residence and NIF/TIN consistently, and keeping auditable evidence.

Best practices:

• Self-certification built into onboarding and periodic reviews.
• Consistency rules: country ↔ TIN format ↔ documents provided.
• Exception handling: accounts with incomplete data, retries and blocks defined by internal policy.
• Change log (who/what/when) for a digital chain of custody.

The scope depends on the service and the type of activity: intermediation, custody, execution, fiat/crypto conversion, transfers, etc. That is why a map of your operations is essential.

In compliance, what matters is not “having scattered data” but a data model that links client → account → wallet → transaction → valuation, with clear, repeatable rules.

If your traceability is solid, your reporting is defensible.

DAC8 is aligned with international crypto-asset reporting standards (such as CARF) and coexists with existing reporting and compliance frameworks.

In practice, this pushes companies to bring together KYC/KYB, AML/CFT, data governance and tax reporting to avoid duplication and errors.

Planning should cover gap analysis, process design, reporting development, testing and go-live. The “last month” is too late: the bottleneck is usually data quality.

Operational recommendation: prioritize onboarding (tax data capture), source integration, validations and evidence. Everything else is built on top.

Typical DAC8 risks are incomplete tax data, residence errors, duplicates, inconsistent valuations and a lack of auditable evidence.

How to reduce your exposure:

• Clear policies (what is collected, how it is validated and when to block).
• Quality controls and periodic reconciliations.
• Documented criteria and reporting governance.
• Testing before reporting (UAT with real cases and edge cases).