Use of DAC8 Data by Tax Authorities: Inspections, Tax Risks, and Crypto Information Matching

IMPORTANT: This article was drafted in accordance with the European regulatory and tax framework in effect at the time of its publication, specifically Directive (EU) 2023/2226—DAC8—and its implementation timeline. Given that reporting obligations, the automatic exchange of information, and tax oversight regarding cryptoassets may be subject to regulatory development, transposition, or administrative adaptation in Spain, any specific case must be reviewed in accordance with the regulations in force at any given time and the current criteria of the Tax Agency.

The DAC8 Directive not only obliges crypto platforms to report detailed information about their users, but also turns that data into an unprecedented tax control tool.

From 2026, European Tax Administrations will have a massive volume of information on crypto-asset operations, which will radically transform the way investments and transactions in cryptocurrencies are taxed.

This article analyzes how the Tax Agency and other Tax Administrations will use DAC8 data to detect tax fraud, initiate inspections, and perform automatic information matching.

If you operate with crypto-assets, it is essential to understand how this control system works and what real tax risks derive from it.

What does the Tax Agency do with DAC8 data once received?

When crypto-asset platforms fulfill their reporting obligations under DAC8, the data will not remain archived in a passive database. The information will be integrated into the tax risk management and analysis systems of each Tax Administration, feeding an automated and cross-border control network.

Automatic Reception and Centralization of Crypto Data

In accordance with Directive (EU) 2023/2226, Member States will automatically exchange information reported by crypto-asset service providers. This means that the Spanish Tax Agency will receive data not only from exchanges based in Spain, but also from platforms established in any other European Union country that have Spanish users.

This information will include, among other elements, the total value of operations carried out, the type of crypto-asset, the gains obtained, and the identifying data of the taxpayer. All of this will be incorporated into national tax databases, where it will be cross-referenced with information already available from tax returns, informative forms, and other sources.

Integration into Tax Risk Analysis Systems

Modern Tax Administrations do not manage information manually. DAC8 data will be processed using algorithms and artificial intelligence systems that identify tax behavior patterns, detect inconsistencies, and assign risk levels to each taxpayer.

Thanks to these systems, the Tax Agency can assign risk profiles to each taxpayer and prioritize its control actions. The cross-referencing of crypto data with banking, asset, and economic information makes the taxpayer a practically transparent tax profile.

Cross-border Exchange of Information

One of the most relevant aspects of DAC8 is its European dimension. As established by the European Commission, the automatic exchange of tax information between Member States occurs regularly and without the need for a prior request.

This means that a Spanish taxpayer operating with an exchange based in Germany, France, or any other Member State will be equally subject to control by the Spanish Tax Agency. The cross-border mobility of crypto-assets is no longer an obstacle to tax control.

What automatic cross-references does the Tax Agency perform with DAC8 data?

The information received through DAC8 is not analyzed in isolation. The Tax Agency has multiple sources of tax and asset data that allow it to perform automatic cross-references, detect discrepancies, and generate tax risk alerts.

Cross-referencing with Personal Income Tax and Corporate Tax Returns

The first level of control consists of comparing the data reported by crypto platforms with the returns filed by taxpayers. If an exchange reports that a user has obtained gains amounting to 50,000 euros in a tax year and the taxpayer has not declared any capital gains derived from crypto-assets, a discrepancy is automatically generated that may lead to a request for information or an inspection.

This cross-referencing affects both individuals in Personal Income Tax (IRPF) and companies in Corporate Tax. Companies that accept payments in cryptocurrencies, perform trading operations, or hold digital assets on their balance sheet are equally exposed to this control.

Cross-referencing with Informative Forms and Formal Obligations

The Tax Agency uses informative forms as contrast tools. Form 721, which obliges reporting on cryptocurrency holdings abroad, is a direct source of comparison with DAC8 data. If a taxpayer has not filed Form 721 or has declared values lower than those reported by the platforms, the inconsistency will be detected.

Other relevant forms include Form 720 for assets abroad, Form 100 for Personal Income Tax, and Form 200 for Corporate Tax.

Any mismatch between these returns and the crypto data can trigger a control action.

Cross-referencing with Banking Data, KYC, and Asset Movements

Crypto-asset platforms are obliged to identify their users through KYC (Know Your Customer) procedures. This information, along with transaction data, can be cross-referenced with the banking information available to the Tax Agency.

If a taxpayer has made bank transfers to an exchange worth 100,000 euros and subsequently obtained fund withdrawals amounting to 150,000 euros, but has not declared any capital gain, the discrepancy is evident. Similarly, if there are unjustified increases in assets or acquisitions of goods without a declared source of income, crypto data can serve to support a tax regularization.

Having DAC8 data does not automatically imply an inspection

It is essential to understand that the reception of DAC8 data by the Tax Agency does not automatically imply the opening of an inspection or the imposition of a sanction. The reported information is a control tool, not a conviction.

However, the existence of this data significantly increases tax risk. Tax Administrations now have unprecedented visibility over crypto-asset operations, allowing them to accurately identify taxpayers who have not correctly fulfilled their tax obligations.

Inspection action occurs when, after automated data analysis, signs of non-compliance are detected. At that point, the Tax Agency may initiate a request for information, a limited verification, or a formal tax inspection. The key is that the taxpayer can anticipate that moment by regularizing their situation before the Administration acts.

Profiles with Higher Risk of Inspection due to DAC8 Data

Not all taxpayers operating with crypto-assets have the same level of tax risk. Tax Administrations focus their resources on those profiles that present a higher probability of non-compliance or a greater collection impact.

Crypto Investors with High Transaction Volume

Taxpayers who carry out purchase and sale operations of crypto-assets for high amounts are in the spotlight. Although each individual operation may seem minor, the annual accumulated volume can generate significant capital gains that must be declared.

The Tax Agency will pay special attention to those users whose DAC8 data reflects a high level of activity, but whose tax returns do not reflect proportional income or gains.

Frequent Traders and Professional Operators

Traders who perform operations habitually may be engaging in an economic activity subject to Personal Income Tax as income from economic activities, rather than as capital gains. The tax classification of these operations has direct consequences on the applicable taxation and formal obligations.

DAC8 data will allow the Tax Agency to identify activity patterns that suggest professionalism in operations, which may lead to a tax reclassification and significant regularizations.

Self-employed and Freelancers who get paid in Cryptocurrencies

Professionals who receive payments in crypto-assets must declare that income as income from economic activities. However, many taxpayers do not know how to correctly value these payments or believe that, by not passing through a traditional bank account, they are not detectable.

With DAC8 data, this income will be perfectly visible to the Administration, which will be able to compare it with issued invoices, charged VAT, and income declared in Personal Income Tax.

Companies that Accept Payments in Cryptocurrencies

Companies that accept crypto-assets as a means of payment must correctly account for this income, apply VAT where appropriate, and declare it in Corporate Tax. Many technology companies, startups, or businesses linked to the crypto sector face this scenario without having adequate tax advice.

DAC8 data will allow the Tax Agency to identify companies that receive payments in cryptocurrencies but do not reflect that income in their tax or accounting returns.

Users with Discrepancies between Exchanges and Tax Returns

One of the highest-risk scenarios is when the data reported by crypto platforms does not match the information declared by the taxpayer. This may be due to involuntary errors, lack of knowledge of tax obligations, or, in more serious cases, deliberate concealment of income.

In any case, the discrepancy will be detected automatically, triggering a verification process that may lead to a regularization with late payment interest and, where appropriate, sanctions.

Most Frequent Types of Tax Actions Derived from Crypto Data

Once the Tax Agency detects a possible irregularity from DAC8 data, it can initiate different types of control actions, which vary in their scope, procedure, and consequences for the taxpayer.

Information requests

A request for information is the mildest action. The Tax Agency asks the taxpayer to provide documentation or clarifications on certain operations or returns. It does not necessarily imply a regularization, but non-compliance or an insufficient response can lead to more invasive actions.

In the context of crypto-assets, it is common for the Tax Agency to request information on the source of funds, details of operations performed, gains obtained, or justification for certain asset movements.

Limited verifications

Limited verifications are procedures of restricted scope that focus on specific aspects of the taxpayer’s tax situation. They have a maximum duration and limit the possibility of the Administration subsequently opening an inspection on the same facts.

Regarding crypto-assets, a limited verification could focus exclusively on the correct declaration of capital gains derived from cryptocurrency operations in a specific year.

Formal Tax Inspections

A tax inspection is the most complete and rigorous control procedure. It involves an exhaustive analysis of the taxpayer’s tax situation, with broad powers of investigation and information gathering. It can cover several tax years and different taxes.

If DAC8 data reveals signs of significant tax fraud, concealment of income, or complex evasion structures, the Administration may open a formal inspection examining the entirety of the taxpayer’s economic and asset activity.

Retroactive Regularizations and Assessments

When the Tax Agency detects non-compliance, it proceeds to regularize the taxpayer’s tax situation through a proposed assessment. This involves payment of the omitted tax quota, plus the corresponding late payment interest and, where appropriate, applicable sanctions.

Regularizations derived from crypto data can cover several non-prescribed tax years, which can generate significant tax debts. Furthermore, if deliberate concealment is found, sanctions can reach up to 150% of the defrauded quota, as regulated by the General Tax Law.

Common Errors Detected by the Tax Agency with Crypto Data

Experience in tax inspections related to crypto-assets allows for the identification of a series of recurring errors made by taxpayers, many of them due to ignorance of the real tax implications of their operations.

1. Undeclared Income

The most serious and frequent error is the failure to declare income or gains derived from crypto-asset operations. Many taxpayers erroneously believe that cryptocurrency transactions are not tax-relevant or that, by not being converted into euros, they do not generate an obligation to declare.

DAC8 data allows the Tax Agency to accurately identify which operations have been performed, what gains have been obtained, and whether those gains have been correctly declared.

2. Confusion between Gross Income and Capital Gains

Another common error consists of declaring the total amount of a crypto-asset sale as a capital gain, without subtracting the acquisition value. For example, if a taxpayer bought bitcoin for 10,000 euros and sold it for 15,000 euros, the capital gain is 5,000 euros, not 15,000 euros.

However, some taxpayers declare the gross amount of the operation, which generates a tax burden higher than legally required. Although this error benefits the Tax Agency, it also reflects a lack of tax knowledge that may be indicative of other non-compliances.

3. Lack of Consistency between Tax Years

Crypto-asset operations often span several years. It is essential to maintain consistency between the returns of different years, correctly reflecting the acquisition value, intermediate operations, and final gains or losses.

DAC8 data will allow the Tax Agency to reconstruct a taxpayer’s complete operation history, detecting temporal inconsistencies that suggest errors or concealment.

4. Incorrect Use of Wallets, Exchanges, or Corporate Structures

Some taxpayers attempt to minimize their tax burden through the use of multiple wallets, exchanges, or even corporate structures abroad. If these structures do not respond to a valid economic reason and have the sole objective of evading tax payments, the Tax Agency can apply anti-abuse regulations and regularize the situation.

DAC8 data, combined with international information exchange and KYC procedures, significantly complicates the concealment of assets through these strategies.

5. Ignorance of the Real Tax Impact

Many taxpayers operate with crypto-assets without understanding the tax implications of their decisions. They do not know when a taxable event occurs, how capital gain is calculated, what informative obligations exist, or how all of this should be reflected in the Personal Income Tax or Corporate Tax return.

This ignorance does not exempt one from tax responsibility and can lead to regularizations and sanctions that could be avoided with proper advice.

When does it make sense to go to a specialized tax lawyer?

The complexity of cryptocurrency taxation, coupled with the increased control capacity of Tax Administrations derived from DAC8, means that specialized tax advice is no longer an option but a strategic necessity.

Before receiving a request: prevention and compliance

The ideal time to consult with a tax lawyer is before the Tax Agency initiates any action. A preventive analysis of the tax situation allows for the identification of risks, correction of errors, and, where appropriate, proceeding with a voluntary regularization that minimizes economic consequences.

Voluntary regularization, especially when performed before the Tax Agency has initiated actions, allows for a significant reduction in applicable sanctions or even their complete avoidance.

After receiving a notification: technical response and defense

If a request for information or a notification of the start of actions has already been received, the response must be technical, well-founded, and in accordance with the law. An inadequate response can aggravate the tax situation or close off defense avenues that could have been successful.

A tax lawyer specialized in crypto-assets can analyze the required documentation, prepare the appropriate response, and defend the taxpayer’s interests in the procedure.

During an open inspection: active defense

If the Tax Agency has opened a formal tax inspection, the complexity of the procedure requires specialized legal assistance. The inspector has broad powers of investigation and can require all types of information and documentation.

Active defense during the inspection allows for control of the procedure, limiting its scope, providing evidence and legal arguments, and ultimately minimizing the economic impact of the regularization.

For voluntary regularization and risk reduction

When a taxpayer is aware that their tax situation is not correct, voluntary regularization is the best strategy. It allows for the correction of errors before the Tax Agency detects them, which drastically reduces applicable sanctions and late payment interest.

A tax lawyer can analyze the best regularization strategy, which years should be included, how to correctly calculate capital gains, and how to file supplementary returns in a way that minimizes the tax cost.

To bear in mind

The entry into force of DAC8 marks a before and after in the taxation of crypto-assets in Europe. Tax Administrations will have detailed, updated, and verifiable information on the cryptocurrency operations of millions of taxpayers, which exponentially increases their control capacity.

DAC8 data is not a threat in itself, but it is a control tool that makes rigorous compliance with tax obligations essential. For those who operate with crypto-assets, the question is no longer whether the Tax Agency will have information, but when it will use it and how the taxpayer can prepare to minimize tax risks.

Specialized tax advice is not an expense, but an investment in legal certainty. Understanding how DAC8 data is used, what actions the Administration can initiate, and how to defend oneself properly is fundamental to avoiding costly regularizations, avoidable sanctions, and unnecessary tax conflicts.

If you operate with crypto-assets, have received a notification from the Tax Agency, or wish to regularize your tax situation voluntarily, we recommend contacting a firm specialized in international taxation and cryptocurrencies. Prevention and compliance are always the best strategy.

How can IN DIEM help you with the DAC8 Directive?