EU DAC8 Compliance Under CRS 2.0 and CARF: What the Directive Requires From Day 1, and How to Meet It

Sources last verified: 13 October 2026

Official sources cited at the end of this page.

Our regulatory compliance engine keeps EU crypto users reportable before the blocking deadline. It collects and checks each user’s self-certification at sign-up, runs the TIN check, the reasonableness test and the other due diligence the rules require, resolves indicia automatically instead of by your compliance team, tracks the two reminders and the 60-day clock, and prepares the validated DAC8 report, with zero remediation, as section 10 shows.

DAC8 is Council Directive (EU) 2023/2226, the eighth amendment to the EU directive on administrative cooperation in taxation. From 1 January 2026 it brings the OECD’s Crypto-Asset Reporting Framework into EU law for crypto-asset service providers, and the amended Common Reporting Standard, CRS 2.0, for financial institutions. The first reports, covering 2026, are filed in 2027.

Its sharpest rule sits at the end of an annex. Where a crypto-asset user does not provide the required information “after two reminders following the initial request”, and “not prior to the expiration of 60 days”, the provider “shall prevent the Crypto-Asset User from performing Reportable Transactions”. For a new user, the initial request is onboarding. A provider that asks for tax residence late is not only late with a report; it has started a clock that ends with blocking its own customers.

For operators outside the MiCA regime, the consequence goes further. A crypto-asset operator that fails to report after two reminders from its Member State of single registration faces revocation of that registration, and may register again only with assurance that it will meet its reporting obligations, including the outstanding ones.

There are two ways to meet DAC8. The first treats it as a reporting project: collect what onboarding already collects, then chase tax residences and TINs, run the reminders and file in 2027. The second makes the self-certification part of onboarding itself, so the declaration is complete, tested and cured before the first transaction and the reminder clock never starts. Both are set out below, with the rules each must meet. One manages a countdown to blocking. The other makes sure it is never needed.

The Council adopted the Directive on 17 October 2023 and published it in the Official Journal on 24 October 2023. Member States had to transpose it by 31 December 2025 and apply it from 1 January 2026.

01 · DAC8 at a glance

02 · Why a ‘Wait and See’ Strategy Is Now a Liability

Every date that once justified waiting has passed. The Directive applies, the national laws are in force in Germany, Ireland and the Netherlands, and the obligations run from the first user who signed up on or after 1 January 2026. Providers that have not yet built tax self-certification into onboarding are not preparing for DAC8; they are accumulating a backlog under it.

Three features make the backlog expensive. The pre-existing user deadline is fixed in the Directive: self-certifications for users who were already customers must be obtained by 1 January 2027. The blocking rule turns an incomplete record into a customer who cannot trade. And for operators registered in a Member State rather than authorised under MiCA, a failure to report is a threat to the registration itself.

Banks, e-money institutions and other financial institutions face the CRS 2.0 side of the same Directive: new e-money and central bank digital currency accounts in scope, new data points in every report, and a field stating whether a valid self-certification was obtained. Our CRS 2.0 article covers that track in detail.

03 · The Critical Timeline: The 2026 Deadline Hidden in DAC8

The deadline that matters is not the exchange between Member States, due by 30 September 2027. It is the collection that began on 1 January 2026.

Provider deadlines are national. DAC8 says only that information is reported in the calendar year after the year it relates to; the nine months in Article 8ad(6) is the deadline for exchange between Member States, not for providers. A group with providers in several Member States therefore faces several filing dates for the same year.

04 · Who Is in Scope?

On the crypto track, a Reporting Crypto-Asset Service Provider is any crypto-asset service provider, and any crypto-asset operator, that conducts one or more crypto-asset services effectuating exchange transactions for or on behalf of a reportable user. A crypto-asset service provider is one regulated by and authorised under MiCA, Regulation (EU) 2023/1114. A crypto-asset operator is any other provider of crypto-asset services; operators must register in a single Member State for the purpose of meeting their reporting obligations.

The rules follow the OECD framework closely, and the Directive asks Member States to use the OECD Commentaries to keep application consistent. Our CARF article sets out what is reported and how; the main EU additions are the blocking rule, the single-registration regime for operators and the fixed pre-existing user deadline.

On the financial account track, Reporting Financial Institutions under the existing CRS rules are joined by entities that hold e-money or central bank digital currencies for customers. E-money accounts whose rolling 90-day average balance stays at or below USD 10,000 are excluded. For e-money institutions and neo-banks, our fintech and neo-bank solutions page explains how the two tracks meet in one onboarding flow.

How DAC8 differs from CARF, and how to keep the two consistent

In terms of reporting obligations, the two are largely the same; the enforcement is not. CARF is the OECD model, implemented differently by each jurisdiction. DAC8 makes it binding across the EU and adds rules CARF leaves open: mandatory blocking after two reminders and 60 days, single registration and revocation for crypto-asset operators, and a fixed 1 January 2027 deadline for pre-existing users. Where CARF and DAC8 both impact a firm operating across OECD and EU jurisdictions, it should design to the stricter EU rules. Crypto platforms ensure consistency between DAC8 and other reporting frameworks like CARF by holding one tax profile per user and generating each jurisdiction’s report from it, rather than running a separate process per regime.

Crypto exchanges operating across multiple EU jurisdictions

DAC8 compliance will impact a crypto exchange operating across multiple EU jurisdictions in two ways. A MiCA-authorised exchange reports where the Directive’s nexus rules place it, but it serves users across the Union. Its self-certification therefore has to capture tax residence in any Member State, while reminders, blocking and filing follow the national law where it reports. An exchange operating through several entities in several Member States faces several filing dates and penalty regimes for one reporting year.

05 · Are you in scope? A five-question check

06 · What DAC8 Requires: Self-Certification, Blocking and Records

The self-certification

An individual user’s self-certification is valid only if it is signed or otherwise positively affirmed, dated no later than the date of receipt, and contains the user’s first and last name, residence address, Member State or States of residence for tax purposes, the TIN for each Member State, and date of birth. The provider must confirm it is reasonable against the information it obtained when establishing the relationship, including documentation collected under its customer due diligence procedures. Where a change of circumstances gives the provider reason to know the original is incorrect or unreliable, it cannot rely on it: it must obtain a valid self-certification, or a reasonable explanation and, where appropriate, documentation supporting the original.

The blocking rule

Annex VI, Section V, A(2) is worth reading in full: “Where a Crypto-Asset User does not provide the information required under Section III after two reminders following the initial request by the Reporting Crypto-Asset Service Provider, but not prior to the expiration of 60 days, the Reporting Crypto-Asset Service Provider shall prevent the Crypto-Asset User from performing Reportable Transactions.”

Two details are often misstated. The 60 days is a floor, not a window: blocking may not happen before 60 days have passed, which is not the same as giving the user 60 days. And national laws count differently. Ireland’s implementing law requires two written reminders and then 60 days from the second. Germany’s Kryptowerte-Steuertransparenz-Gesetz (KStTG) counts from the original request, with a reminder, then a formal demand, and blocking no earlier than 60 and no later than 90 days; it applies that rule to users whose relationship began by 31 December 2025. The national text decides the calendar.

Records

Providers must keep records of the steps taken and the information relied on for reporting and due diligence for not less than five and not more than ten years after the end of the period in which the provider must report the information. Member States choose within that range: Germany’s KStTG sets ten years and Ireland’s law six.

The TIN

Article 27c(1) requires the TIN issued by the Member State of residence to be reported. On verification, the Commission must give Member States a tool for automated TIN checks, and Member States must endeavour to let reporting entities confirm TINs electronically. The Commission’s public TIN on the Web module checks only the structure and syntax of individuals’ TINs; it does not confirm that a TIN exists or belongs to the user. DAC8 does not require providers to validate TINs against official sources. A provider that does so is choosing the strongest available evidence that the self-certification is reasonable. Our TIN lookup checks numbers in real time against official sources in 130+ countries.

07 · Penalties and Enforcement

The adopted Article 25a requires Member States to set penalties that are effective, proportionate and dissuasive, and leaves the amounts to them. It contains no minimum fines and no turnover-based tiers; figures of that kind that circulate online do not appear in the Directive as adopted.

National amounts therefore differ. Ireland’s implementing regulations provide fixed penalties, including EUR 4,000 for a provider that fails to register or to meet its due diligence and reporting obligations. Germany’s KStTG provides for fines of up to EUR 50,000 for the main breaches and up to EUR 10,000 for the rest.

The structural sanction sits elsewhere. For a crypto-asset operator, two reminders followed by a continued failure to report lead to revocation of its registration, and a revoked operator may register again only if it gives appropriate assurance that it will comply, including with outstanding obligations. For a business whose access to EU users depends on that registration, the penalty schedule is the smaller risk.

08 · A Complete Day 1 Roadmap for Compliance

Phase 1: Pre-Day 1 preparation, for providers still catching up

1. Confirm your status. MiCA-authorised provider or crypto-asset operator, and in which Member State you register and report.
2. Map the users. Separate users onboarded since 1 January 2026, who should have self-certified at sign-up, from pre-existing users due by 1 January 2027.
3. Read the national text. Filing date, blocking calendar, record period and penalties for each Member State where you report.
4. Close the onboarding gap first. Every day without self-certification at sign-up adds to the remediation queue.

Phase 2: Day 1 execution, from 1 January 2026 onward

1. Self-certify at sign-up. Collect, affirm and test the declaration before the first reportable transaction.
2. Run the reminder clock. Where a user has not provided the information, send the reminders, record them, and block when the national rule requires.
3. Classify every transaction. Crypto-to-fiat, crypto-to-crypto and transfers, valued and aggregated per user and per asset type.
4. Report and retain. File by the national deadline; keep the records for the period national law sets.

09 · National Implementation

Our country articles go further: Germany’s CRS 2.0 and DAC8 rules and its CARF regime; France’s CARF timetable, its CRS 2.0 rules for banks and those for digital-asset firms; Austria’s CRS 2.0 rules and crypto-asset reporting; Greece’s CRS 2.0 rules for banks and its CARF rules for providers; and Finland’s CARF regime.

10 · Two Ways to Meet DAC8: By Hand, or With a Complete Enterprise Solution

By hand, as a reporting project

Many providers approach DAC8 by extending what they already have. KYC collects identity at sign-up; a later campaign asks for tax residence and TINs; the reminders are tracked in a case tool or a spreadsheet; transaction data is pulled from the ledger and classified at year-end; and a separate team handles the CRS side for any fiat or e-money product.

It can work for a small book. Its weakness is that it starts the blocking clock on users who are already trading, and every user who does not answer becomes a decision between a blocked customer and a compliance breach.

At onboarding, from Day 1

TaxDo runs DAC8 due diligence inside onboarding, from the first self-certification to regulatory reporting, on one platform. It works in five steps, in this order, because each one needs the one before it.

Step 1 · Collect the self-certification. Guided and jurisdiction-aware, one question at a time, for individuals and entities, with a digital signature. Where the entity is passive, its controlling persons are collected in the same flow.

Step 2 · Validate the identity. Every TIN is checked in real time against official sources in 130+ countries, and the business against registries in 120+.

Step 3 · Run the due diligence. Indicia are detected across everything held on the user, and the self-certification is tested for reasonableness against it. For DAC8 that runs both tracks, CARF for crypto-asset users and CRS 2.0 for financial accounts, from one data layer.

Step 4 · Cure the gaps, without the compliance team:

4a · New users. Discrepancies are resolved in the same session, while the user is still onboarding, instead of landing in a queue for your team.

4b · Existing users. The book is scanned and prioritised, missing self-certifications and TINs are remediated, and the two reminders and the 60-day clock are tracked to the blocking point.

Step 5 · Report, and keep the evidence. Schema-validated CARF and CRS reports for each Member State from one data layer, prepared and validated for your institution to submit. On request, our team can also submit them on your behalf as an additional service. Every user keeps an immutable clearance record.

From Day-1 self-certification to regulatory reporting, with zero remediation. Every user is cleared when the account opens, so nothing is left for year-end.

Our DAC8 compliance software · Solutions for crypto exchanges and CASPs

Where this sits, and what it does not touch

Your KYC provider keeps verifying identity under MiCA and AML rules, and your platform keeps running the ledger. KYC answers who the user is. Tax due diligence answers where they are resident for tax and whether the declaration holds up. This runs at onboarding beside KYC, not in place of it.

The reporting obligation, and the responsibility for what is reported, stays with the provider, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.

The difference is when the gap is found. At sign-up, it is one more question. After the user has started trading, it is two reminders, a 60-day clock and a decision to block.

Manual or automated DAC8 reporting: the trade-offs

Manual processes cost little to start and much to run. They work while the user base is small, but they ask for tax data after users have started trading, depend on reminders being sent and logged by hand, and assemble the report at year-end. Automated processes cost more to set up and move the work to sign-up, where it is cheapest. The tradeoffs between manual and automated DAC8 EU crypto reporting processes turn on volume and on how many Member States you report in.

DAC8 XML reporting and integration with internal systems

Approach integration through an API-first layer that keeps the data separate from the file. The benefits of using an API-first compliance platform for DAC8 reporting are that onboarding, ledger and reporting systems exchange structured data rather than spreadsheets, each Member State’s XML is generated from the same record, and validation runs before submission. Integration then means connecting onboarding and transaction events once, not building a report per country.

11 · Recent Changes and What Comes Next

17 and 24 October 2023

Adoption and publication of Directive (EU) 2023/2226.

4 to 24 December 2025

Ireland’s S.I. 584/2025 made on 4 December; Germany’s KStTG enacted on 22 December and in force on 24 December.

1 January 2026

DAC8 applies across the EU; self-certification at onboarding and data collection begin.

31 March 2026

The Dutch implementing law adopted, effective from 1 January 2026.

1 January 2027

Deadline for self-certifications from pre-existing crypto-asset users.

2027

First provider filings under national deadlines; Member States exchange 2026 information by 30 September 2027.

12 · Related Reading

Framework articles: CRS 2.0 compliance for financial institutions · CARF, the Crypto-Asset Reporting Framework · Self-certification under CRS 2.0, DAC8 and CARF

Product: Regulatory compliance engine · Day 1 onboarding validation · Solutions for financial institutions