TakeawaysIf you have been around crypto long enough, you already know how this goes. Every so often, a new law comes in that gives governments more control, requires more reporting, and slowly stripping away one of the core principles crypto was built on, financial privacy. Governments understand that crypto offers people full control over their money, and because it operates outside the traditional banking system, they do not have the same access to their citizens’ financial activity. That means they cannot monitor, freeze, or tax those funds as they can with money held inside the banking system. Afraid of losing their grip on tax collection and in an effort to collect as much tax as possible, they keep looking for new ways to access that information.
That is why, if you hold crypto, staying informed is not optional. You need to know what your legal obligations are, how new rules affect you, and what kind of information may end up being reported. This matters even more if you are an EU citizen. By now, most people have already heard about MiCA, which came in to set clearer rules and boundaries for exchanges and the crypto market across Europe, but MiCA is only part of the picture.
Alongside it, the EU has introduced several other rules in recent years as part of a wider push to collect more information on crypto holders, track taxable activity more closely, and make it easier for tax authorities across member states to share that data. That is where DAC8, the eighth Directive on Administrative Cooperation, comes in.
That is why crypto holders want clear answers. When does the reporting actually begin, what information will need to be reported, and most importantly, will DAC8 report on past transactions? No, the EU's DAC8 is not retroactive and will not report on transactions before 2026. Reports and data collection started on January 1, 2026. The first reporting period covers the full 2026 calendar year, and reports are due after the year ends by September 30, 2027. So, at least under DAC8 itself, you do not need to hand over your pre-2026 transaction history just because the rules took effect, and CASPs are not required to report crypto transactions from before that date under the DAC8 reporting cycle.
So What is DAC8? And Does All your transactions are being reported?
If you’re new to crypto, you may not even know that the sector has been at the center of some major regulatory moves in recent years. A few years ago, crypto was still a regulatory gray zone with very little clarity or basic guidance, but that has changed as lawmakers and European tax authorities introduced new rules and reporting obligations. So for people that do not want to play games with tax authorities, it's important to understand What is DAC8? It is a law that requires exchanges to report users’ crypto transactions and identity details to tax authorities, so EU countries can automatically share that data for tax purposes. This is similar to how banks already report under FATCA systems, making it much harder to hide crypto activity because the reports include details on trades and transfers, including deposits and withdrawals. DAC8 was adopted on October 17, 2023, and EU countries and crypto exchanges must comply starting January 1, 2026. Overall, the new EU system makes it much harder to hide crypto activity because the reports include details on trades and transfers, including deposits and withdrawals.
The European Commission recognizes that crypto has become an important part of the financial markets, creating new business opportunities and opening the door to more innovation.However, the increase in adoption shouldn’t mean a decrease in transparency for tax purposes, it said. To boost transparency, the EU adopted DAC8 on October 17, 2023. As to will DAC8 report on past transactions, the EU countries and crypto exchanges must comply with the law starting January 1, 2026. What this means for you is that exchanges must verify your identity and send details of each of your transactions to the relevant tax authorities starting in 2027.
Also, the European Commission is tasked with developing a secure central directory. The data that the exchanges collect will be stored in this new EU Central Directory, which all Member States can access, but only when related to their own residents. This is how they’ll exchange data, instead of using secure email.
What personal information gets shared?
As 2026 is the first reporting year, you should start neatly organizing your data and checking that your exchange of choice is doing its due diligence.
- Keep reports and records from exchanges for your own tax filing.
- Make sure you report your crypto activity on a regular basis.
- Check that the tax information you gave to the exchanges is correct and up-to-date.
- It’s a good idea to check every now and then that your exchange is indeed complying with the rules.
The new rules affect all providers licensed in one of the EU nations. This doesn’t mean only the companies based in the EU, but any platform, anywhere, that operates in the EU. For example, Binance is headquartered in Abu Dhabi, but it’s seeking the MiCA license that would allow it to operate in all EU member states.
The Berlaymont building; the headquarters of the European Commission.
So, now we know who must report and when, as well as will DAC8 report on past transactions. But we also need to be familiar with what type of user information exchanges send to the tax authorities. It turns out, pretty much what you’d expect. First, the exchanges will share your personal details, which includes your name, the EU country you live in, and your address. Next is your tax identification number (TIN) and they may, in some cases, include your date and place of birth in the package.
Next, the platforms will need to provide user activity. With this, every time you buy crypto with or sell crypto for fiat, the tax authorities will know the details. They’ll have accounts of each cryptotocrypto swap and transfer between usersand this also includes deposits and withdrawals. The tax authorities also want to know when a user pays for a product or service with crypto stored on an exchange. As you can see, this is a very detailed report, designed to ensure that no activity gets hidden.
For corporate accounts, the rules are very similar. Crypto service providers must share company details, including the name, the EU country it’s based in, the address, and the TIN. However, corporations also need to disclose information about any owner or person who has control within the company and possibly benefits from the position. The exchanges will need to include in their report each of these people’s name, address, country, date and place of birth, as well as the role or reason each is considered a beneficial owner or a person with significant control.
TIN is a key part of tax due diligence
Talking with so many crypto owners so often, I am well aware that many of them share a distrust towards centralized systems, especially as these want them to share personal information, they don’t like it. This is also where a dislike for KYC comes through and on top of that, the authorities are asking for more data, including tax identification number (TIN). Still, most understand that crypto platforms can’t be compliant with the EU laws (hence, can’t operate) without this data. As a refresher, KYC stands for ‘Know Your Customer’ or ‘Know Your Client.’ It’s a standardized process that helps financial institutions verify clients’ identities. The goal is to prevent illicit activities, including fraud and money laundering.
On the other hand, what DAC8 requires is confirming tax residence, which allows the system to connect the individual user to the correct tax authority in their country. It ensures that all future reports go to the right place, providing clarity and eliminating mistakes. This means that even if you’ve opened your account before 2026 and have completed KYC, we at PlasBit must ask for your tax residency country and TIN information. The TIN is a key that allows Member States to match the received data with data in national databases. Importantly, this doesn't mean we will report your full transaction history from previous years. We will simply confirm each user’s country of tax residence.
However, users will run into issues if they don’t submit the required data. First, they will receive two reminders to do so. Life is happening, our daily schedules are packed, so it’s understandable if someone forgets or is unsure if/how they should submit the data. The first step aims to help with that. But if a user refuses to provide the info even after being reminded, PlasBit will restrict their ability to do reportable transactions within 60 days. These include transfers, buying or selling crypto with fiat, and swapping crypto. This is a massive restriction for any investor, so it’s crucial to keep in mind that it will remain in place until the asked-for info is submitted. PlasBit collects only what we absolutely must in order to provide the service, and we keep it securely.
How Authorities Find un(der)reported crypto
Once you share all you have to, and the platforms send what they’re required to, the tax authorities will jump into action.
- When tax authorities receive the data, they will start processing and analyzing it. They will then automatically share it with tax authorities in the EU country of your tax residence.
- The authorities will check if the reported crypto activity matches your tax returns or self-reported income. Checking with existing tax records will enable them to find people holding crypto but not reporting it.
- Discrepancies such as undeclared gains or missing filings may trigger a request for clarification, follow-up investigations, or audits.
- If there is a need, the authorities will look at the existing crypto accounts in more detail.
- Similarly, higher activity takes priority in the eyes of the tax authorities. These users have higher chances of being contacted by tax authorities or even being audited.
How DAC8 tracks crypto activity. Image source: Dudkowiak Putyra Law Firm, dudkowiak.com.
Let’s look at some examples of how tax authorities may use the data:
- You’ve reported a specific sum as your income, while exchanges provided different disposals. DAC8 will compare them and flag discrepancies.
- You live in Spain but use an exchange registered in France. DAC8 will detect this undeclared exchange accountand the platform will report it to the French national authority, which will automatically share it with Spain tax authority.
- You swap BTC to ETH to USDT and then sell it for fiat, but you only report fiat withdrawals. DAC8 allows authorities to cross-check DeFi and crypto-to-crypto activity, enabling them see the full chain of taxable events.
- So if you falsely claim long-term holding status, DAC8 data will show any asset you bought in that calendar year.
After 2027, the reporting process turns into a yearly event. Data will be collected throughout the calendar year, reported the following year by a deadline, cross-checked, and shared with other relevant tax authorities. The central directory will store information for a minimum of five years to support audits and enforcement.
Audits are a headache, so let’s give our best to avoid them
Just recently, I read this report from March 2025 that said how, despite Denmark’s introduction of domestic third-party reporting, over 90% of crypto investors didn’t declare their crypto income. The EU Tax Observatory said in this report that investors are doing their best to avoid responding to the policy, instead turning away from the domestic platforms and towards foreign ones that sit outside regulatory reach. But this approach limits your choice of service providers, given that any foreign platform that wants to operate in the EU (and many certainly do) will have to comply with DAC8. Once the authorities receive the information from the exchanges, they will compare the data reported by the company with what the user reported. They’ll look for triggers such as large crypto disposals without declared capital gains or a significant amount of holdings that don’t match the declared income level.
Next, if the authorities find gaps or unreported activity, they may classify them into low, medium, and high risk tiers. Then, they could send letters asking the user to explain the problematic activity and adjust the filings. Some of the relevant records and documents include a statement of assets, proof of deposits, and transaction reports. However, in a case where the user doesn't respond and provide the documents that explain the activity, the tax authority could move to investigate them. It could impose interest and penalties, or commence a full audit for higher risk cases, even a criminal investigation for tax fraud. Hiding in another EU country is pointless, as joint audits can also happen, especially in large cases.
You now know will DAC8 report on past transactions, but if you’re not sure about anything else (how DAC8 works, what it entails, what will happen and when) or if your transactions involve large amounts of funds, it's best to consult an accountant or tax advisor. These professionals will help you avoid mistakes and handle every step properly. PlasBit also helps users by providing the necessary data for tax reporting, enabling them to educate themselves and take control of their financial assets. We fully control KYC and AML internally, which allows us to stay compliant but not compromise sovereignty.
Do crypto exchanges report transactions before 2026 under the EU's DAC8?
Exchanges are already working to gather the necessary info to comply with the new law but users want to know, do crypto exchanges report transactions before 2026 under the EU's DAC8? No, they don't report transactions you did prior to 01/01/2026. The first report will be submitted by September 30, 2027, and covers the full 2026 calendar year. Exchanges will collect the relevant data during 2026 so they can include it in the report.
Users have also taken steps to ensure the platforms won’t restrict their services and the authorities won’t come (metaphorically) knocking. Many have updated the information required by their chosen service providers and are collecting records for personal tax reporting.
The Travel Rule And DAC8 Make Crypto Harder To Hide
The EU crypto travel rule came into effect on December 30, 2024. The EU Council adopted DAC8 in 2013, giving Member States until December 31, 2025, to transpose the directive into national law. The reporting began with the first day of the year, also marking the moment when the two laws began working together. To put it simply, the travel rule is a system that connects a crypto wallet address with a real person. If you transfer crypto worth 1,000 euros or more, you need to give your details and those of the person or company you’re sending the funds to. CASPs must collect the info on both the sender and the recipient (including names, account numbers, and wallet addresses) and share it with relevant authorities upon every transaction. They store this data in their internal systems for a minimum of five years. The goal is to trace all transfers to fight money laundering and terrorist financing.
At the same time, DAC8 needs this data on crypto users in order to (properly) tax each of them. Until recently, this information often stayed on exchanges. But now that both the travel rule and DAC8 are in effect, it leaves the exchanges’ internal systems and is automatically shared with tax authorities and exchanged between the Member States as necessary. The goal is to fight tax fraud and evasion. Therefore, the travel rule and the DAC8 directive are complementary regulations, both keeping an eye on transactions. The Travel Rule is concerned with real-time Anti-Money Laundering (AML) monitoring, while DAC8 centers on annual tax reporting. Their joint goal is to bring full transparency to the crypto market by tracking, identifying, and reporting every transaction.
Gerassimos Thomas, Director-General in the Directorate-General for Taxation and Customs Union at the European Commission.
Is DAC8 retroactive? No, but authorities can ask for extra info
The type of information that regulators can ask for is limited, but they can still ask for quite a lot of it. What is certain is that they’ll have a look at the transactions on exchanges made this year. First, let’s make it clear, is DAC8 retroactive? No, it will not report on past transactions you did before January 1, 2026. The first report has to be filed by September 30, 2027 and covers the entire year of 2026. During that year, exchanges will collect the required data so they can include it in their report. This is also the first report that will include your information.
However, we all need to keep in mind that tax authorities maintain the right to ask for any additional data, including info from previous years. For example, for the purposes of some audit or investigation, tax authorities can send a collective information request to exchanges. The companies will then have to share the records of earlier transactions. If a user or a service provider ignores the requests or responds with a ‘no,’ they may face suspension of services, fines, or criminal charges.
As regulators move to gather your info, we don’t play with privacy
EU Member States’ governments are working closely with tax authorities to tighten oversight over crypto investors and their activities, and they’re working hard to close any potential loopholes. With another major change in the EU law requiring more personal information from crypto users, it’s no surprise that many feel their privacy rights are being fundamentally disrupted. Yet, anyone who wants to keep using crypto services in this increasingly regulated environment, whether as a platform or as a user, has to comply with the rules. That’s why platforms have begun collecting data at the start of this year. Wondering will DAC8 report on past transactions, we can safely conclude that there will be no required reporting from before the rules took effect on January 1, 2026.
In the future, tax authorities will be able to identify many more cases of unreported crypto activity, allowing them to collect more taxes. This is is why it makes sense to start tracking your activity now, keep your own records, and make sure your information stays up to date so you are prepared if any tax authority ever asks questions. We at PlasBit don’t play with privacy and while we must ask for KYC and TIN to be able to provide you with our services, you can rest assured that all your data is kept securely and for the shortest time possible.
