DAC8 Users Who Traded in 2026 Without a Self-Certification: What You Report, and What You Must Fix Before 1 January 2027

Sources last verified: 25 October 2026

Official sources cited at the end of this page.

A crypto exchange within the scope of DAC8 onboarded new users throughout 2026. Each passed identity checks and holds a passport and an address in an EU Member State. None was asked to complete a tax self-certification. Its compliance team asked us this month whether those users must be reported, and as residents of which country. On the Directive’s text the answer is no, not on KYC data alone: a user becomes reportable only once due diligence identifies them as resident in a Member State, and that identification rests on a self-certification. The KYC file serves to test a self-certification and cannot stand in for one.

Leaving the user out of the report does not end the provider’s exposure. Where no self-certification was requested when the relationship began, the duty to obtain one was not met, and a later filing does not cure that. Collecting the self-certification now, or preventing reportable transactions after two reminders and at least 60 days, ends the non-compliance without erasing it, and the provider needs a record that proves which happened. Member States set their own penalties and must be able to address an order for reporting to the provider.

There are two ways to close the gap before the first reports fall due. One is a reminder campaign run from spreadsheets, user by user, against national clocks that differ. The other runs the same campaign inside the product, validating each answer as it arrives. On either route, requests to pre-existing users must go out well before 1 January 2027.

DAC8, Council Directive (EU) 2023/2226, has applied since 1 January 2026. Users who held an account on 31 December 2025 must have self-certified by 1 January 2027; users who joined later should have done so when the relationship began.

01 · The Short Answer, Rule by Rule

Our regulatory compliance engine clears this backlog before the first DAC8 report. It sends the request and both reminders, tracks the 60-day clock, collects and checks each self-certification against the KYC file you already hold, resolves indicia automatically instead of by your compliance team and prepares the validated report, with zero-touch remediation, as section 06 shows.

02 · Two Populations, Two Deadlines

The Directive treats two groups of users differently, so sorting the book by the date each relationship began comes first: the deadline, the blocking window and the exposure all follow from it.

Pre-existing users: due by 1 January 2027

A Pre-existing Individual Crypto-Asset User is one that established a relationship with the provider “as of 31 December 2025”. For them, Section III, A(1) of Annex VI sets a deadline: the provider obtains the self-certification “by 1 January 2027”. Germany’s Crypto-Asset Tax Transparency Act (Kryptowerte-Steuertransparenzgesetz, KStTG) repeats the date in § 7(2) and, in § 8(3), fixes a window for the block: after a reminder and a formal demand, the provider prevents reportable transactions “spätestens nach Ablauf von 90 Tagen, nicht jedoch vor Ablauf von 60 Tagen” (at the latest after 90 days, but not before 60 days) from the original request.

Users onboarded in 2026

For a user who joined in 2026, the same paragraph requires the self-certification “when establishing the relationship”. Germany ties the deadline to the first reportable transaction rather than to onboarding: under § 7(1) KStTG the measures must be completed “vor der Durchführung von zu meldenden Transaktionen” (before reportable transactions are carried out). The OECD’s Commentary on the Crypto-Asset Reporting Framework, which recital (9) of DAC8 tells Member States to use as a source of illustration or interpretation, notes that a relationship “may include a one-off transaction”. Where such a user was never asked for a self-certification and has traded since, the onboarding deadline has passed, and the remediation record should say so.

03 · What You Report for a User With No Self-Certification

The due diligence section of Annex VI opens with the rule that decides the question: a Crypto-Asset User “is treated as a Reportable User beginning as of the date when it is identified as such pursuant to the due diligence procedures described in this Section”. Section II, which lists what is reported, applies to users “that are Reportable Users or that have Controlling Persons that are Reportable Persons”. Identification runs through the self-certification, which must allow the provider “to determine the Individual Crypto-Asset User’s residence(s) for tax purposes”, its reasonableness confirmed against the documents collected under anti-money-laundering customer due diligence.

Customer due diligence data can confirm or undermine a declaration, but cannot supply it. A German address on a utility bill makes a self-certification naming Germany plausible, or one naming Malta in need of explanation. Without the declaration there is nothing to test, and no rule converts the address into a residence.

The contrast with financial accounts sits in the same Directive. For the CRS side, DAC8 inserts a “Temporary lack of self-certification” rule into Annex I of the Directive on administrative cooperation: in exceptional circumstances where a self-certification cannot be obtained for a new account in time to meet the due diligence and reporting obligations for the period in which it was opened, the financial institution applies the due diligence procedures for pre-existing accounts until it is obtained and validated. There is no equivalent for crypto-asset users, and none of the German or Irish provisions cited here adds one. Annex VI leaves the provider two outcomes: collect the self-certification or prevent reportable transactions.

The exchange format points the same way. The computerised format Member States use to exchange this information, set out in Annex XVIII to Implementing Regulation (EU) 2015/2378 as inserted by Commission Implementing Regulation (EU) 2025/2263, requires at least one residence country code for every individual and entity reported, and contains no element for an undocumented user. A report on an undocumented user would fail the schema.

On 25 October 2026 a Google search of the question returned an AI-generated summary stating that the exchange “must restrict the user’s account and report the missing or incomplete profile to tax authorities”. No such report exists in DAC8. And in South Africa, outside the EU, the South African Revenue Service (SARS) says in FAQ 18 of its CARF FAQs (5 March 2026) that a pre-existing user whose self-certification is still outstanding during its 12-month due diligence window may not be treated as non-reportable, and should be reported with an undocumented or unvalidated residence. The same document states that it is not a legal reference and that the OECD materials prevail where the two conflict.

One point the Directive leaves open: whether a self-certification obtained late reaches back to transactions made before it. The text ties reportable status to the date of identification and says nothing more. Until a national authority addresses it, a provider should record, for each late self-certification, the date it was received and the transactions on either side of it.

04 · The Exposure That Remains

Article 25a requires penalties that are “effective, proportionate and dissuasive” and leaves the amounts to each Member State. Germany fines a provider that intentionally or recklessly fails to obtain a self-certification, or fails to block when § 8(3) requires it, up to EUR 50,000 (§ 18 KStTG). Ireland sets a penalty of EUR 4,000 where a provider does not comply with Sections II and III of Annex VI (section 891M(19) of the Taxes Consolidation Act 1997, inserted by S.I. No. 584 of 2025).

An audit will begin with the record. Section V, B(1) requires the provider to keep “records of the steps undertaken and any information relied upon” for five to ten years after the end of the period within which the provider must report, where the information is reportable. For a user who never becomes reportable the Directive sets no separate period, so keeping the request, the reminders, their dates and the block at least as long is the prudent reading. A provider that cannot produce them cannot show that it was entitled to leave the user out of its report.

Section V, B(2) goes further: Member States must be able to address “an order for reporting” to a provider so that all necessary information reaches the authority. For a crypto-asset operator, a provider not authorised under MiCA that registers in a single Member State, Section V, F provides for revocation of the registration where it fails to report after two reminders from that State.

05 · The Remediation Calendar to 1 January 2027

Section V, A(2) bars a block before 60 days have expired but does not say from what point they run. Where they run from the initial request, as in Germany for pre-existing users, only a request sent by 1 November 2026 allows a block by 1 January 2027. A request sent later can still obtain the self-certification in time, but a block cannot then enforce the deadline. A block enforces the deadline; it does not meet it, because the duty is to obtain the self-certification.

National law decides when the 60 days start. Ireland counts them from the date of the second reminder (section 891M(12)), so an Irish cycle is longer by however long the reminders take. For pre-existing users Germany counts from the original request and closes the window at 90 days. A provider subject to more than one regime needs one calendar per regime: the earliest date it may block and, in Germany, the latest. Our Germany DAC8 guide sets out the German sequence in full.

The first reports follow within months. Providers file with their own tax authority on national dates for calendar year 2026: by 31 January 2027 in the Netherlands, 31 May 2027 in Ireland, before 15 June 2027 in France and by 31 July 2027 in Germany. Member States then exchange the information within nine months of the year end, by 30 September 2027.

06 · Two Ways to Close the Gap

By hand, from a spreadsheet

The manual route starts with an export of every EU-linked user without a self-certification, split by relationship date and Member State, then a request, two reminders, a blocking date and a log per user, and a review of each returned self-certification against the KYC file. That holds for a few hundred users. At several thousand, each answer that fails the reasonableness test restarts the conversation, each national clock runs from a different event, and the evidence lives in mailboxes.

Inside the product, with zero-touch remediation

TaxDo runs DAC8 due diligence inside the exchange’s own flow; the same five steps clear the existing book.

Step 1 · Collect the self-certification. Guided and jurisdiction-aware, for individuals, entities and controlling persons, digitally signed.

Step 2 · Validate the identity. Every TIN checked in real time against official sources in 130+ countries through TIN lookup; entities against business registries in 120+.

Step 3 · Run forensic due diligence with Verify+. Our Verify+ forensic engine tests each self-certification against the KYC file, with 20+ checks on an individual and 30+ tax-native checks across eight areas on an entity, including official TIN lookup in 130+ countries.

Step 4 · Cure the gaps, without the compliance team:

4a · New users. Discrepancies resolved in the same session, before the first reportable transaction.

4b · Users onboarded without a valid self-certification. One click starts remediation for the whole cohort: each user answers guided questions through a link in your own brand, every answer is checked by Verify+, and each case closes with a self-certification signed by eIDAS-compliant e-signature and an audit-ready certificate. Both reminders and the 60-day clock run and are logged automatically.

Step 5 · Prepare the report. Schema-validated CARF XML, prepared and validated for the provider to submit; our team can also submit it on your behalf on request, as an additional service.

From Day-1 self-certification to DAC8 reporting, with zero remediation.

Our DAC8 compliance software · Solutions for crypto exchanges and CASPs

Where this sits, and what it does not touch

It runs beside the KYC provider, not in place of it: KYC establishes who the user is; tax due diligence, where the user is resident for tax. The same engine covers CARF outside the EU. The reporting obligation, and the responsibility for what is reported, stays with the provider, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.

07 · What Comes Next

Every jurisdiction that implements the OECD’s Crypto-Asset Reporting Framework will pose the same choice, with its own clock. A provider that collects at onboarding will not repeat this exercise in each new jurisdiction.

08 · Related Reading

Framework articles: EU DAC8 compliance under CRS 2.0 and CARF · CARF and CRS 2.0 for crypto · Self-certification under CRS 2.0, DAC8 and CARF · Germany CRS 2.0 and DAC8

Product: Regulatory compliance engine · DAC8 compliance software · Day 1 onboarding validation