DAC8: Tax and Reporting Obligations for Investors, Crypto Companies, and Platforms in the European Union

IMPORTANT: This article was drafted in accordance with the European regulatory framework in effect at the time of its publication, specifically Directive (EU) 2023/2226—DAC8—and the European regime for the automatic exchange of tax information on cryptoassets. Since its practical application depends on the transposition, regulatory implementation, and administrative criteria of each Member State, including Spain, any specific case must be reviewed in accordance with current regulations and the Tax Agency’s current criteria.

The entry into force of the DAC8 Directive marks a turning point in the taxation of crypto-assets within the European Union. This is not a minor technical adjustment or just another rule within the European regulatory framework, but a profound structural change in how tax authorities monitor, track, and analyze cryptocurrency operations.

As we previously explained in our analysis of what DAC8 is and how it transforms cryptocurrency taxation in Europe, this directive creates a harmonized system for the automatic exchange of tax information, placing crypto-assets on par with other traditional financial instruments such as bank accounts, securities, or investment products.

However, understanding the general framework is not enough. What is truly relevant for investors, technology companies, and crypto platforms is to accurately answer three key questions:

• who is actually affected by DAC8
• what specific obligations it imposes
• What specific information will be sent to the tax authorities?

Who is actually affected by DAC8: beyond regulatory theory?

DAC8 does not establish a single obligation for a single type of subject. Its regulatory architecture clearly distinguishes between two categories of affected parties, each with distinct duties.

Specific obligations introduced by DAC8

The directive articulates a system of tiered obligations that begins with customer identification and culminates in the automatic exchange of information between Member States.

Strengthened User Authentication

Crypto-asset service providers must implement identification procedures that go beyond traditional KYC (Know Your Customer). It is not enough to know the customer’s name and address: it is necessary to determine their tax residence with certainty, identify whether they are acting on their own behalf or for a third party, detect ultimate beneficial ownership structures when companies or trusts are involved, and keep this information updated in the event of any relevant changes.

This obligation extends to the identification of pre-existing accounts. Platforms cannot limit themselves to applying these controls to new customers; they must also review and complete the information of users who were already operating with them before DAC8 came into force.

In many cases, this involves requesting additional documentation from long-standing customers, which creates operational friction and the risk of business loss for those platforms that are less prepared.

Comprehensive transaction log

Every relevant transaction must be documented with a level of detail that allows tax authorities to reconstruct the taxpayer’s tax position. This includes the precise identification of the crypto-asset involved, the exact date and time, the market value amounts expressed in the reference currency of the Member State, the participating counterparties when identifiable, and the nature of the transaction performed.

Recording is not limited to simple purchases and sales. It also covers reporting for exchange operations between crypto-assets (swaps), lending or staking operations where passive income is generated, transfers between wallets of the same owner when one is in the custody of a provider, mining operations when carried out through pools managed by third parties, and any other transaction that generates tax-relevant changes in assets.

Periodic reporting to tax authorities

Providers must submit structured reports to tax administrations on an annual basis, containing all the information recorded for each customer residing in their jurisdiction or in other European Union jurisdictions. This reporting follows standardized formats inspired by the OECD’s Common Reporting Standard (CRS), ensuring consistency in data processing and facilitating subsequent exchange between States.

The deadline for submitting these reports is aligned with standard tax calendars, but platforms must anticipate that the volume of information to be processed, validated, and structured can be massive, especially for operators with millions of active users and tens of millions of annual transactions.

Automatic exchange of information among Member States

Once the information is received from the providers, the tax administrations of each Member State must automatically share it with the tax authorities of the country of residence of each crypto-asset holder. This exchange operates without the need for a prior request, without taxpayer intervention, and on a systematic basis.

The practical result is that the Spanish Tax Agency will automatically receive complete information on crypto-asset operations carried out by tax residents in Spain on any European platform, regardless of where that platform is domiciled. Similarly, tax authorities in other Member States will receive information on operations by their residents on Spanish platforms.

This cross-exchange effectively eliminates any opacity that might exist simply by operating in jurisdictions other than the one of residence. The geographical mobility of digital assets, which for years was perceived as an advantage from a tax control perspective, now becomes a neutral element in the face of an interconnected information system.

What specific data will be reported to the Tax Agency?

The granularity of the information subject to reporting is extraordinarily high and far exceeds what many investors anticipate.

Personal identification data

The full identity of the account holder will be reported: full name or company name, date of birth for individuals, tax address, tax identification number in their jurisdiction of residence, and any other identifier that allows the taxpayer to be unequivocally linked to their operations.

When the holder acts through corporate structures, the ultimate beneficial owner will also be identified, thus preventing the use of shell companies or intermediary vehicles from hiding the true ownership of the assets.

Balances and valuations

At the end of each tax period, the total balance of crypto-assets held on each platform will be reported, expressed in market value and converted to euros or the reference currency of the corresponding Member State. This valuation must be carried out according to objective and verifiable criteria, which poses technical challenges in markets as volatile as crypto.

For illiquid crypto-assets or those with low market depth, providers must establish reasonable valuation methodologies that are auditable and consistent over time.

Transaction details

Each individual transaction will be accurately reflected: type of operation executed (purchase, sale, exchange, transfer), the crypto-asset involved, the amount transferred or exchanged, the market value at the time of execution, the counterparty when identifiable, and associated commissions or expenses.

This level of detail allows the Tax Agency to accurately calculate capital gains or losses, identify operations suspicious of money laundering or tax evasion, and detect inconsistencies between information reported by different platforms or between successive tax years.

Income generated

When the holder obtains passive income derived from staking, lending, yield farming, or any other form of income generation without asset transfer, this income will also be subject to individualized reporting. The distinction between capital gains and income from movable capital is fiscally critical in Spain, and the reported information will allow the Tax Agency to verify that each type of income has been declared in the correct category.

Cross-border movements

Special attention will be paid to transfers of crypto-assets to or from unhosted wallets, to platforms located outside the European Union, or to jurisdictions considered high tax risk. These movements, while legitimate, trigger automatic alerts in the risk analysis systems of tax administrations and may lead to requests for information or more exhaustive audits.

Differences according to the type of platform used

Not all platforms are subject to the same regime of obligations, and this distinction has direct consequences for users.

Regulated centralized exchanges

Large exchanges licensed in the European Union or operating under the supervision of European financial authorities are fully subject to DAC8 obligations. In many cases, these operators already have robust compliance infrastructures derived from previous regulations such as the Fifth Anti-Money Laundering Directive or the MiCA Regulation, which facilitates their adaptation.

For users, operating on these platforms means that practically 100% of their activity will be reported. There is no room for opacity, but in exchange, legal certainty is obtained regarding the regularity of operations and documentary traceability that can be useful in case of tax disputes.

Decentralized platforms and DeFi protocols

This is where the greatest uncertainties arise. Purely decentralized protocols, without an identifiable business structure or control by a specific entity, raise doubts about their subjection to reporting obligations. However, DAC8 adopts a broad interpretation and seeks to capture any operator that facilitates transactions, even when doing so through automated smart contracts.

In practice, many DeFi platforms operate through foundations, front-end management entities, or ancillary service provider companies that may indeed be subject to reporting obligations. Users operating in these environments must be aware that the platform’s failure to report does not exempt them from their reporting obligations, and that the Tax Agency can detect their operations through on-chain analysis or cross-referencing with other information sources.

Exchanges outside the European Union

Platforms located outside the European Union that do not have an effective presence in European territory are not legally bound by DAC8. However, many of these platforms are voluntarily adopting similar reporting systems, either due to pressure from their local regulators or through information exchange agreements with European authorities.

Tax residents in Spain operating on Asian, American, or other jurisdiction exchanges must assume that, although reporting may not be immediate, it is highly likely that they will eventually be subject to information exchange through other bilateral or multilateral mechanisms. Choosing to operate on non-EU platforms as an opacity strategy is legally unfeasible and fiscally suicidal.

Real risks derived from non-compliance

Beyond the technical analysis of obligations, it is essential to understand the practical consequences of failing to adapt correctly to the new regulatory framework.

Total tax exposure

The most obvious risk is that any inconsistency between the information reported by platforms and the returns filed by the taxpayer will be immediately exposed. The Tax Agency will have complete, traceable, and verifiable data on balances, operations, and income, eliminating any margin for error or interpretative ambiguity.

Taxpayers who have not correctly declared past operations, who have omitted income, or who have incorrectly valued their capital gains face regularizations that can cover the last four non-prescribed tax years, with corresponding late payment interest and surcharges. This analysis of inspections and penalties will be developed in depth in our next article on the use of DAC8 data by the Tax Agency and tax audit procedures.

Inconsistencies between tax years

A less obvious but equally serious risk is the detection of temporal inconsistencies. If a taxpayer declared certain crypto-asset balances in 2023 but the data reported by platforms shows undeclared operations in 2022, the Tax Agency will be able to reconstruct the entire chain of operations and demand explanations regarding the origin of funds, the taxation applied, and the asset consistency between years.

These inconsistencies are particularly frequent in taxpayers who operated actively during previous years, obtained significant gains, reinvested them in other crypto-assets, and never declared the capital gains generated in each intermediate operation.

Reputational risk for companies and professionals

For companies, family offices, and professionals operating with crypto-assets, the exposure is not only fiscal. An inspection procedure derived from DAC8 information can have serious reputational consequences, especially if it involves questioning the regularity of the structures used, the suitability of tax advisors, or the strength of internal compliance procedures.

In sectors where reputation is a critical asset (wealth management, financial advice, investment funds), a public tax dispute can destroy established business relationships and close off access to new institutional clients.

Loss of legitimate tax planning

Finally, there is a strategic risk that many overlook: the loss of lawful tax planning options. Taxpayers who could have benefited from special regimes, legal deferrals, loss offsets, or efficient asset restructuring lose these opportunities when the Tax Agency detects prior irregularities and opens audit procedures.

Tax planning is only effective when executed from a position of absolute regularity. Attempting to optimize the tax burden when there are unregularized historical non-compliances is legally unfeasible and practically useless.

Why is it important to be proactive?

Experience with similar regulations in other fields shows that anticipation is always the best strategy. Those actors who wait for authorities to detect non-compliance to regularize their situation face not only more severe economic consequences but also significantly higher reputational and operational costs.

In the case of DAC8, ignorance of the regulations will not be a valid defense. Starting in 2026, European tax administrations will have detailed information on crypto-asset operations. Any discrepancy between what is declared and what is reported will trigger audit mechanisms, with the consequences that entails.

The technical complexity of DAC8, its interaction with national regulations, and its cross-border nature make specialized legal advice essential. It is not just about complying with formal obligations, but about understanding how the new regulation affects business models, operational structures, and global tax strategies.

Conclusion: a structural change that requires strategic vision

The DAC8 Directive is not a minor technical modification of the European tax framework. It represents a structural change in the way Member States approach the taxation of crypto-assets, definitively placing them on par with traditional financial assets.

This move was inevitable. The exponential growth of the crypto sector, its increasing integration into the global financial system, and legitimate concerns about tax evasion and money laundering have forced regulators to act. DAC8 is the European response, aligned with similar international initiatives and consistent with the tax transparency strategy that the EU has been building for over a decade.

For those operating in the crypto ecosystem—as providers, investors, or companies—the key lies in understanding, anticipating, and adapting. The new regulatory framework does not penalize innovation or the legitimate use of crypto-assets, but it does demand compliance, transparency, and fiscally responsible management.

How can IN DIEM help you with the DAC8 Directive?

Anything else about IN DIEM Lawyers? Here’s a short presentation video…