Smarter Data. Compliant Growth

DAC8 creates new operational obligations for any Reporting Crypto-Asset Service Provider serving EU users, regardless of where the business is based. Platforms need to collect and verify user tax residency and transaction data from 1 January 2026, build reporting processes aligned to CARF-based XML schemas, and handle self-certification from every user.

The enforcement mechanism carries real operational weight too. If a user doesn't complete self-certification after two reminders, the platform is required to block that user from reportable transactions within 60 days, directly affecting user experience and retention. Non-compliance risks fines ranging from EUR 20,000 to EUR 500,000, along with reputational damage and increased audit scrutiny. For most crypto businesses, this makes DAC8 a heavier operational lift than adjacent frameworks like MiCA, since it touches onboarding, data infrastructure, and ongoing monitoring rather than just licensing.

Data collection obligations under DAC8 apply from 1 January 2026, covering the full 2026 calendar year. National filing deadlines to each member state's tax authority vary, generally falling between 1 January and 30 September 2027, with the EU-wide exchange between member states completing by 30 September 2027. Since exact deadlines depend on domestic transposition in each member state, RCASPs should confirm the specific date that applies in their jurisdiction rather than relying on a single EU-wide date.

DAC7 and DAC8 are both EU directives under the same Directive on Administrative Cooperation framework, but they cover different asset types. DAC7 applies to digital platforms facilitating the sale of goods, personal services, and the rental of property or transport, requiring them to report seller income. DAC8 extends that same reporting logic to crypto-assets, requiring Reporting Crypto-Asset Service Providers to report user transaction data. If a business operates both a marketplace and a crypto platform, it may have obligations under both directives simultaneously, each with its own scope, data requirements, and deadlines.

Marketplace operators must collect a defined set of data from sellers before they can be reported under DAC7. For individual sellers this includes full name, primary address, date of birth, and tax identification number (or place of birth if no TIN is available). For entity sellers it includes legal name, registered address, tax identification number, and business registration number.

Operators also need to collect financial account details, so payments can be linked to the correct seller, and property location data where the seller lists real estate.

This data has to be verified against reliable sources, not just self-reported. Marketplaces can use official registries, government databases, or documentary evidence to confirm accuracy. If a seller doesn't provide the required information within 60 days of two reminders, the operator is required to close their account and withhold future payouts until the details are supplied.

Collection isn't a one-off exercise either. Operators need to keep this data current and re-verify it periodically, particularly where sellers' circumstances change.

A DAC7 notification is the message a platform sends to a seller confirming that their income and transaction data has been reported to the tax authorities. Platforms are required to notify each reportable seller before the report is filed, giving them visibility into what information has been shared.

The notification typically includes the seller's reported income, the number of transactions, and the tax identification details used. Sellers can use this notification to cross-check their own tax filings and flag any discrepancies before the reporting deadline.

For platforms, sending timely and accurate notifications is part of meeting DAC7 due diligence obligations, not just a courtesy step.

‍