DAC8: What EU Crypto Platforms Must Report Starting 2026

If your platform has any EU-resident users and touches crypto in any way, DAC8 already applies to you whether or not you are based in the EU yourself. The directive quietly entered into force on 1 January 2026, and by the time most platforms notice, they will already be nine months into the data-collection period the first reporting deadline is based on.

Here is what it actually requires, who is in scope, and the deadline that matters most right now.

What DAC8 Is

DAC8 is the EU’s eighth amendment to the Directive on Administrative Cooperation — its tax-transparency framework — extending automatic exchange-of-information rules to crypto-asset transactions for the first time. Where earlier versions covered bank accounts and financial assets, this one covers exchanges, transfers, and holdings of crypto-assets, closing what regulators saw as an obvious reporting gap. Member states were required to transpose the core rules into national law by 31 December 2025, and the substantive obligations apply from 1 January 2026.

Who Falls Under DAC8

The obligation falls on Reporting Crypto-Asset Service Providers — a category that reaches further than most platforms expect. Exchanges and wallet providers are squarely covered, and some DeFi-adjacent platforms may be caught too depending on how they interface with users. Critically, scope is determined by whether you serve EU-resident users, not by where your platform is incorporated or licensed — a US, UK, or Asia-based exchange with EU customers is in scope under this framework exactly like an EU-licensed one.

The Data and Due-Diligence Obligation

From 1 January 2026, in-scope platforms are expected to already be collecting reportable transaction data on every EU-resident user — this is not a future obligation but a live one. Alongside transaction data, platforms must obtain a valid Tax Identification Number and a self-certification from every EU-resident user, mirroring the due-diligence approach already familiar from banking’s Common Reporting Standard. Building this collection pipeline after the fact, rather than from day one of 2026, means reconstructing months of data retroactively — considerably harder than capturing it as it happens.

The Deadline That Actually Matters

The first reporting window covers all of 2026 and falls due between 1 January and 30 September 2027 — nine months after the close of the first reportable year, matching the standard DAC reporting rhythm. That sounds distant, but the data being reported is what platforms are supposed to be collecting right now, in 2026; a platform that starts its compliance build in mid-2026 is not late for the deadline itself, but is already missing months of the underlying data. The practical urgency is this year, not next.

How This Interacts With MiCA

DAC8 is a tax-transparency reporting obligation, not a licensing regime — it sits alongside MiCA’s CASP authorisation rather than replacing any part of it. A properly licensed CASP under MiCA still has a separate reporting obligation to build, and the two compliance tracks — licensing and tax reporting — need to be planned together rather than treated as one covering the other. For a platform weighing where to hold a CASP licence, this EU-user-based scope is a reminder that the reporting obligation follows your customer base, not your licensing jurisdiction alone.

FAQ

When did DAC8 come into force?

Member states had until 31 December 2025 to transpose the core rules into national law, with the substantive obligations applying from 1 January 2026.

Does it apply to platforms outside the EU?

Yes. Scope is based on serving EU-resident users, not on where the platform is incorporated or licensed — a non-EU exchange with EU customers is in scope.

What data must be collected?

Reportable crypto-asset transaction data for every EU-resident user, plus a valid Tax Identification Number and self-certification for each of them.

When is the first DAC8 report due?

Between 1 January and 30 September 2027, covering transaction data from calendar year 2026 — the data collection obligation is already live now, in 2026.

Does a MiCA CASP licence cover DAC8 compliance?

No. It is a separate tax-transparency reporting obligation that applies alongside MiCA licensing, not as part of it — both need to be planned for independently.

Conclusion

DAC8 is already in force, and the deadline that matters is not the 2027 filing date — it is now, because the data being reported has to be collected from EU-resident users throughout 2026 itself. Any platform with EU customers touching crypto, regardless of where it is based or licensed, needs a Tax Identification Number and self-certification process running today, not a compliance project scheduled for next year. Treat the 2027 reporting window as the deadline for filing what you should already be gathering, not as time to start gathering it.

Running a crypto platform with EU-resident users and unsure whether your DAC8 data collection and MiCA licensing are properly aligned? Send us your user base and current licensing status on Telegram or WhatsApp, and we will map your exposure and help you build the reporting pipeline correctly, alongside your CASP compliance.