# EU DAC8 Compliance Under CRS 2.0 and CARF: What the Directive Requires From Day 1, and How to Meet It > DAC8 for crypto providers and banks: scope, the 60-day blocking rule, records, national deadlines and penalties, and how to meet CRS 2.0 and CARF. Source: https://taxdo.com/resources/blog/post/eu-dac8-compliance-crs-2-0-carf-crypto-reporting-2026 Last updated: 2026-10-18 _Sources last verified: 13 October 2026_ _Official sources cited at the end of this page._ **[Our regulatory compliance engine](https://taxdo.com/services/regulatory-compliance) keeps EU crypto users reportable before the blocking deadline.** It collects and checks each user’s self-certification at sign-up, runs the TIN check, the reasonableness test and the other due diligence the rules require, resolves indicia automatically instead of by your compliance team, tracks the two reminders and the 60-day clock, and prepares the validated DAC8 report, with zero remediation, as section 10 shows. DAC8 is Council Directive (EU) 2023/2226, the eighth amendment to the EU directive on administrative cooperation in taxation. From 1 January 2026 it brings the OECD’s [Crypto-Asset Reporting Framework](https://taxdo.com/resources/blog/post/carf-crs2-crypto-tax-transparency-guide) into EU law for crypto-asset service providers, and the amended Common Reporting Standard, [CRS 2.0](https://taxdo.com/resources/blog/post/crs-2-0-compliance-guide-banks), for financial institutions. The first reports, covering 2026, are filed in 2027. Its sharpest rule sits at the end of an annex. Where a crypto-asset user does not provide the required information “after two reminders following the initial request”, and “not prior to the expiration of 60 days”, the provider “shall prevent the Crypto-Asset User from performing Reportable Transactions”. For a new user, the initial request is onboarding. A provider that asks for tax residence late is not only late with a report; it has started a clock that ends with blocking its own customers. For operators outside the MiCA regime, the consequence goes further. A crypto-asset operator that fails to report after two reminders from its Member State of single registration faces revocation of that registration, and may register again only with assurance that it will meet its reporting obligations, including the outstanding ones. **There are two ways to meet DAC8.** The first treats it as a reporting project: collect what onboarding already collects, then chase tax residences and TINs, run the reminders and file in 2027\. The second makes the self-certification part of onboarding itself, so the declaration is complete, tested and cured before the first transaction and the reminder clock never starts. Both are set out below, with the rules each must meet. **One manages a countdown to blocking. The other makes sure it is never needed.** The Council adopted the [Directive](https://publications.europa.eu/resource/celex/32023L2226) on 17 October 2023 and published it in the Official Journal on 24 October 2023\. Member States had to transpose it by 31 December 2025 and apply it from 1 January 2026. ## 01 · DAC8 at a glance | **Point** | **Position as at 13 October 2026** | | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- | | Legal instrument | Council Directive (EU) 2023/2226 of 17 October 2023, amending Directive 2011/16/EU; Official Journal 24 October 2023 | | Applies from | 1 January 2026 (Article 2(1)); certain TIN provisions from 1 January 2028 and 1 January 2030 | | Crypto track | The OECD CARF, in Annex VI: Reporting Crypto-Asset Service Providers report on users resident in Member States | | Financial account track | The amended CRS, in Annex I: e-money and central bank digital currencies, new data points, stricter self-certification | | Who reports (crypto) | Crypto-asset service providers authorised under MiCA, and crypto-asset operators, which must register in a single Member State | | Self-certification | At onboarding; for pre-existing users by 1 January 2027; tested against customer due diligence information | | Blocking | After two reminders and not before 60 days, the provider must prevent the user from performing reportable transactions (Annex VI, Section V, A(2)) | | Records | Not less than five and not more than ten years after the end of the period in which the provider must report; national law sets the exact period | | Provider filing deadline | Set nationally: 31 May in Ireland, 31 July in Germany; Member States exchange within nine months of year-end | | Penalties | Effective, proportionate and dissuasive (Article 25a); amounts set nationally, with no EU minimum in the adopted text | | TIN | The TIN issued by the Member State of residence must be reported; Member States endeavour to let reporting entities confirm TINs electronically | | Operators | Registration revoked after two reminders for failing to report (Annex VI, Section V) | ## 02 · Why a ‘Wait and See’ Strategy Is Now a Liability Every date that once justified waiting has passed. The Directive applies, the national laws are in force in Germany, Ireland and the Netherlands, and the obligations run from the first user who signed up on or after 1 January 2026\. Providers that have not yet built tax self-certification into onboarding are not preparing for DAC8; they are accumulating a backlog under it. Three features make the backlog expensive. The pre-existing user deadline is fixed in the Directive: self-certifications for users who were already customers must be obtained by 1 January 2027\. The blocking rule turns an incomplete record into a customer who cannot trade. And for operators registered in a Member State rather than authorised under MiCA, a failure to report is a threat to the registration itself. Banks, e-money institutions and other financial institutions face the CRS 2.0 side of the same Directive: new e-money and central bank digital currency accounts in scope, new data points in every report, and a field stating whether a valid self-certification was obtained. Our [CRS 2.0 article](https://taxdo.com/resources/blog/post/crs-2-0-compliance-guide-banks) covers that track in detail. ## 03 · The Critical Timeline: The 2026 Deadline Hidden in DAC8 The deadline that matters is not the exchange between Member States, due by 30 September 2027\. It is the collection that began on 1 January 2026. | **Date** | **What happens** | | ----------------------- | ------------------------------------------------------------------------------------------------------------- | | 17 October 2023 | Council adopts Directive (EU) 2023/2226 | | 24 October 2023 | Published in the Official Journal | | 31 December 2025 | Transposition deadline for Member States | | 1 January 2026 | Rules apply: self-certification at onboarding for every new user; data collection for the 2026 reporting year | | 1 January 2027 | Deadline for self-certifications from pre-existing crypto-asset users | | 31 January 2027 | Netherlands provider deadline (Act of 1 April 2026, Stb. 2026, 79) | | 31 May 2027 | Ireland provider deadline (S.I. 584/2025) | | 31 July 2027 | Germany provider deadline (Bundeszentralamt für Steuern) | | 30 September 2027 | Member States exchange 2026 information, within nine months of year-end | | 1 January 2028 and 2030 | Later-phase TIN provisions apply (Article 27c) | Provider deadlines are national. DAC8 says only that information is reported in the calendar year after the year it relates to; the nine months in Article 8ad(6) is the deadline for exchange between Member States, not for providers. A group with providers in several Member States therefore faces several filing dates for the same year. ## 04 · Who Is in Scope? On the crypto track, a Reporting Crypto-Asset Service Provider is any crypto-asset service provider, and any crypto-asset operator, that conducts one or more crypto-asset services effectuating exchange transactions for or on behalf of a reportable user. A crypto-asset service provider is one regulated by and authorised under [MiCA, Regulation (EU) 2023/1114](https://publications.europa.eu/resource/celex/32023R1114). A crypto-asset operator is any other provider of crypto-asset services; operators must register in a single Member State for the purpose of meeting their reporting obligations. The rules follow the OECD framework closely, and the Directive asks Member States to use the OECD Commentaries to keep application consistent. Our [CARF article](https://taxdo.com/resources/blog/post/carf-crs2-crypto-tax-transparency-guide) sets out what is reported and how; the main EU additions are the blocking rule, the single-registration regime for operators and the fixed pre-existing user deadline. On the financial account track, Reporting Financial Institutions under the existing CRS rules are joined by entities that hold e-money or central bank digital currencies for customers. E-money accounts whose rolling 90-day average balance stays at or below USD 10,000 are excluded. For e-money institutions and neo-banks, our [fintech and neo-bank solutions page](https://taxdo.com/solutions/fintechs-neo-banks) explains how the two tracks meet in one onboarding flow. ### How DAC8 differs from CARF, and how to keep the two consistent In terms of reporting obligations, the two are largely the same; the enforcement is not. CARF is the OECD model, implemented differently by each jurisdiction. DAC8 makes it binding across the EU and adds rules CARF leaves open: mandatory blocking after two reminders and 60 days, single registration and revocation for crypto-asset operators, and a fixed 1 January 2027 deadline for pre-existing users. Where CARF and DAC8 both impact a firm operating across OECD and EU jurisdictions, it should design to the stricter EU rules. Crypto platforms ensure consistency between DAC8 and other reporting frameworks like CARF by holding one tax profile per user and generating each jurisdiction’s report from it, rather than running a separate process per regime. ### Crypto exchanges operating across multiple EU jurisdictions DAC8 compliance will impact a crypto exchange operating across multiple EU jurisdictions in two ways. A MiCA-authorised exchange reports where the Directive’s nexus rules place it, but it serves users across the Union. Its self-certification therefore has to capture tax residence in any Member State, while reminders, blocking and filing follow the national law where it reports. An exchange operating through several entities in several Member States faces several filing dates and penalty regimes for one reporting year. ## 05 · Are you in scope? A five-question check | **Question** | **What it means for you** | | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Are you authorised under MiCA and carry out crypto exchanges for customers? | You are a Reporting Crypto-Asset Service Provider under DAC8. | | Providing crypto-asset services without MiCA authorisation? | You are a crypto-asset operator: register in one Member State, report there, and expect revocation after two reminders if you do not. | | Do you hold e-money or central bank digital currencies for customers? | Those accounts enter the CRS track, subject to the USD 10,000 exclusion for small e-money accounts. | | Did you have users before 1 January 2026? | Their self-certifications are due by 1 January 2027. | | Operating in several Member States? | Expect several national filing deadlines and penalty regimes for one reporting year. | ## 06 · What DAC8 Requires: Self-Certification, Blocking and Records ### The self-certification An individual user’s self-certification is valid only if it is signed or otherwise positively affirmed, dated no later than the date of receipt, and contains the user’s first and last name, residence address, Member State or States of residence for tax purposes, the TIN for each Member State, and date of birth. The provider must confirm it is reasonable against the information it obtained when establishing the relationship, including documentation collected under its customer due diligence procedures. Where a change of circumstances gives the provider reason to know the original is incorrect or unreliable, it cannot rely on it: it must obtain a valid self-certification, or a reasonable explanation and, where appropriate, documentation supporting the original. ### The blocking rule Annex VI, Section V, A(2) is worth reading in full: _“Where a Crypto-Asset User does not provide the information required under Section III after two reminders following the initial request by the Reporting Crypto-Asset Service Provider, but not prior to the expiration of 60 days, the Reporting Crypto-Asset Service Provider shall prevent the Crypto-Asset User from performing Reportable Transactions.”_ Two details are often misstated. The 60 days is a floor, not a window: blocking may not happen before 60 days have passed, which is not the same as giving the user 60 days. And national laws count differently. Ireland’s implementing law requires two written reminders and then 60 days from the second. Germany’s Kryptowerte-Steuertransparenz-Gesetz (KStTG) counts from the original request, with a reminder, then a formal demand, and blocking no earlier than 60 and no later than 90 days; it applies that rule to users whose relationship began by 31 December 2025\. The national text decides the calendar. ### Records Providers must keep records of the steps taken and the information relied on for reporting and due diligence for not less than five and not more than ten years after the end of the period in which the provider must report the information. Member States choose within that range: Germany’s KStTG sets ten years and Ireland’s law six. ### The TIN Article 27c(1) requires the TIN issued by the Member State of residence to be reported. On verification, the Commission must give Member States a tool for automated TIN checks, and Member States must endeavour to let reporting entities confirm TINs electronically. The Commission’s public [TIN on the Web](https://taxation-customs.ec.europa.eu/online-services/online-services-and-databases-taxation/taxpayer-identification-number-tin%5Fen) module checks only the structure and syntax of individuals’ TINs; it does not confirm that a TIN exists or belongs to the user. DAC8 does not require providers to validate TINs against official sources. A provider that does so is choosing the strongest available evidence that the self-certification is reasonable. [Our TIN lookup](https://taxdo.com/services/tax-identity/tin-lookup) checks numbers in real time against official sources in 130+ countries. ## 07 · Penalties and Enforcement The adopted Article 25a requires Member States to set penalties that are effective, proportionate and dissuasive, and leaves the amounts to them. It contains no minimum fines and no turnover-based tiers; figures of that kind that circulate online do not appear in the Directive as adopted. National amounts therefore differ. Ireland’s implementing regulations provide fixed penalties, including EUR 4,000 for a provider that fails to register or to meet its due diligence and reporting obligations. Germany’s KStTG provides for fines of up to EUR 50,000 for the main breaches and up to EUR 10,000 for the rest. The structural sanction sits elsewhere. For a crypto-asset operator, two reminders followed by a continued failure to report lead to revocation of its registration, and a revoked operator may register again only if it gives appropriate assurance that it will comply, including with outstanding obligations. For a business whose access to EU users depends on that registration, the penalty schedule is the smaller risk. ## 08 · A Complete Day 1 Roadmap for Compliance ### Phase 1: Pre-Day 1 preparation, for providers still catching up 1. **Confirm your status.** MiCA-authorised provider or crypto-asset operator, and in which Member State you register and report. 2. **Map the users.** Separate users onboarded since 1 January 2026, who should have self-certified at sign-up, from pre-existing users due by 1 January 2027. 3. **Read the national text.** Filing date, blocking calendar, record period and penalties for each Member State where you report. 4. **Close the onboarding gap first.** Every day without self-certification at sign-up adds to the remediation queue. ### Phase 2: Day 1 execution, from 1 January 2026 onward 1. **Self-certify at sign-up.** Collect, affirm and test the declaration before the first reportable transaction. 2. **Run the reminder clock.** Where a user has not provided the information, send the reminders, record them, and block when the national rule requires. 3. **Classify every transaction.** Crypto-to-fiat, crypto-to-crypto and transfers, valued and aggregated per user and per asset type. 4. **Report and retain.** File by the national deadline; keep the records for the period national law sets. ## 09 · National Implementation | **Member State** | **Implementing law** | **Provider filing deadline** | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------- | | Germany | [Kryptowerte-Steuertransparenz-Gesetz (KStTG), BGBl. 2025 I Nr. 352](https://www.recht.bund.de/bgbl/1/2025/352/VO.html), in force 24 December 2025; authority: Bundeszentralamt für Steuern (BZSt, Federal Central Tax Office) | 31 July of the following year | | Ireland | [S.I. No. 584/2025](https://www.irishstatutebook.ie/eli/2025/si/584/made/en/print), inserting section 891M into the Taxes Consolidation Act | 31 May of the following year | | Netherlands | [Wet implementatie EU-richtlijn gegevensuitwisseling cryptoactiva (Kamerstuk 36 782)](https://www.eerstekamer.nl/nonav/wetsvoorstel/36782%5Fwet%5Fimplementatie%5Feu), adopted 31 March 2026, effective from 1 January 2026 | 31 January of the following year; first by 31 January 2027 | | France | Law No. 2025-127 (Finance Act 2025), Article 54, and Decree No. 2025-1276 of 19 December 2025 applying Articles 1649 AC bis to 1649 AC sexies of the General Tax Code | Before 15 June of the following year (Decree No. 2025-1276, Article 19) | Our country articles go further: Germany’s [CRS 2.0 and DAC8 rules](https://taxdo.com/resources/blog/post/germany-crs2-dac8-compliance) and its [CARF regime](https://taxdo.com/resources/blog/post/germany-carf-crypto-tax-compliance); France’s [CARF timetable](https://taxdo.com/resources/blog/post/france-implements-carf-crypto-transparency-2027), its [CRS 2.0 rules for banks](https://taxdo.com/resources/blog/post/crs-2-0-france-banks-digital-asset-compliance-2026) and those for [digital-asset firms](https://taxdo.com/resources/blog/post/crs-2-0-france-digital-asset-compliance-2026); Austria’s [CRS 2.0 rules](https://taxdo.com/resources/blog/post/crs-2-0-in-austria-navigating-next-generation-financial-reporting) and [crypto-asset reporting](https://taxdo.com/resources/blog/post/austria-crypto-asset-reporting-compliance-regulatory-landscape); Greece’s [CRS 2.0 rules for banks](https://taxdo.com/resources/blog/post/greece-crs-2-0-compliance-guide-for-banks-and-rfis) and its [CARF rules for providers](https://taxdo.com/resources/blog/post/carf-greece-casp-rfi-compliance-guide-2026); and [Finland’s CARF regime](https://taxdo.com/resources/blog/post/finland-carf-crypto-tax-compliance-2026). ## 10 · Two Ways to Meet DAC8: By Hand, or With a Complete Enterprise Solution ### By hand, as a reporting project Many providers approach DAC8 by extending what they already have. KYC collects identity at sign-up; a later campaign asks for tax residence and TINs; the reminders are tracked in a case tool or a spreadsheet; transaction data is pulled from the ledger and classified at year-end; and a separate team handles the CRS side for any fiat or e-money product. It can work for a small book. Its weakness is that it starts the blocking clock on users who are already trading, and every user who does not answer becomes a decision between a blocked customer and a compliance breach. ### At onboarding, from Day 1 TaxDo runs DAC8 due diligence inside onboarding, from the first self-certification to regulatory reporting, on one platform. It works in five steps, in this order, because each one needs the one before it. **Step 1 · Collect the self-certification.** Guided and jurisdiction-aware, one question at a time, for individuals and entities, with a digital signature. Where the entity is passive, its controlling persons are collected in the same flow. **Step 2 · Validate the identity.** Every TIN is checked in real time against official sources in 130+ countries, and the business against [registries in 120+](https://taxdo.com/services/tax-identity/business-registry). **Step 3 · Run the due diligence.** Indicia are detected across everything held on the user, and the self-certification is tested for reasonableness against it. For DAC8 that runs both tracks, [CARF](https://taxdo.com/services/regulatory-compliance/carf) for crypto-asset users and [CRS 2.0](https://taxdo.com/services/regulatory-compliance/crs) for financial accounts, from one data layer. **Step 4 · Cure the gaps, without the compliance team:** > **4a · New users.** Discrepancies are resolved in the same session, while the user is still onboarding, instead of landing in a queue for your team. > > **4b · Existing users.** The book is scanned and prioritised, missing self-certifications and TINs are remediated, and the two reminders and the 60-day clock are tracked to the blocking point. **Step 5 · Report, and keep the evidence.** Schema-validated CARF and CRS reports for each Member State from one data layer, prepared and validated for your institution to submit. On request, our team can also submit them on your behalf as an additional service. Every user keeps an immutable clearance record. **From Day-1 self-certification to regulatory reporting, with zero remediation.** Every user is cleared when the account opens, so nothing is left for year-end. [**Our DAC8 compliance software**](https://taxdo.com/services/regulatory-compliance/dac8) · [**Solutions for crypto exchanges and CASPs**](https://taxdo.com/solutions/crypto-exchanges-casps) ### Where this sits, and what it does not touch Your KYC provider keeps verifying identity under MiCA and AML rules, and your platform keeps running the ledger. KYC answers who the user is. Tax due diligence answers where they are resident for tax and whether the declaration holds up. This runs at onboarding beside KYC, not in place of it. The reporting obligation, and the responsibility for what is reported, stays with the provider, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report. **The difference is when the gap is found. At sign-up, it is one more question. After the user has started trading, it is two reminders, a 60-day clock and a decision to block.** ### Manual or automated DAC8 reporting: the trade-offs Manual processes cost little to start and much to run. They work while the user base is small, but they ask for tax data after users have started trading, depend on reminders being sent and logged by hand, and assemble the report at year-end. Automated processes cost more to set up and move the work to sign-up, where it is cheapest. The tradeoffs between manual and automated DAC8 EU crypto reporting processes turn on volume and on how many Member States you report in. ### DAC8 XML reporting and integration with internal systems Approach integration through an API-first layer that keeps the data separate from the file. The benefits of using an API-first compliance platform for DAC8 reporting are that onboarding, ledger and reporting systems exchange structured data rather than spreadsheets, each Member State’s XML is generated from the same record, and validation runs before submission. Integration then means connecting onboarding and transaction events once, not building a report per country. ## 11 · Recent Changes and What Comes Next ### 17 and 24 October 2023 Adoption and publication of Directive (EU) 2023/2226. ### 4 to 24 December 2025 Ireland’s S.I. 584/2025 made on 4 December; Germany’s KStTG enacted on 22 December and in force on 24 December. ### 1 January 2026 DAC8 applies across the EU; self-certification at onboarding and data collection begin. ### 31 March 2026 The Dutch implementing law adopted, effective from 1 January 2026. ### 1 January 2027 Deadline for self-certifications from pre-existing crypto-asset users. ### 2027 First provider filings under national deadlines; Member States exchange 2026 information by 30 September 2027. ## 12 · Related Reading **Framework articles:** [CRS 2.0 compliance for financial institutions](https://taxdo.com/resources/blog/post/crs-2-0-compliance-guide-banks) · [CARF, the Crypto-Asset Reporting Framework](https://taxdo.com/resources/blog/post/carf-crs2-crypto-tax-transparency-guide) · [Self-certification under CRS 2.0, DAC8 and CARF](https://taxdo.com/resources/blog/post/crs-2-0-dac8-mandatory-self-certification-guide) **Product:** [Regulatory compliance engine](https://taxdo.com/services/regulatory-compliance) · [Day 1 onboarding validation](https://taxdo.com/resources/blog/post/crs-2-0-carf-compliance-day-1-onboarding-validation) · [Solutions for financial institutions](https://taxdo.com/solutions/financial-institutions) ## Frequently asked questions ### How can firms ensure audit-ready tax compliance under DAC8 regulations? Keep the evidence as the work happens, for the period national law sets. DAC8 requires providers to keep records of the steps taken and the information relied on for at least five and at most ten years after the end of the period in which they must report. An audit-ready file for each user shows the self-certification and how it was affirmed, the reasonableness test against customer due diligence data, each reminder and its date, any block applied, the TIN and how it was checked, and the classification of each transaction. Records created in the workflow meet that standard; records reconstructed at filing time rarely do. ### How does CRS 2.0 align with frameworks like CARF and DAC8? DAC8 is the EU vehicle for both. It carries CARF into Annex VI for crypto-asset service providers and the CRS 2.0 amendments into Annex I for financial institutions. The self-certification fields largely match, so a firm offering both crypto and fiat or e-money products can collect one self-certification and feed both reports, while filing them separately. Where the two differ, as on e-money and on the new CRS data points, DAC8 follows each framework’s own rule. ### What features should teams prioritise in DAC8 compliance software solutions? Start from what the Directive requires, then add what makes it workable. Teams should prioritise self-certification at onboarding with a reasonableness test against due diligence data, TIN checks (DAC8 requires the TIN to be reported; validating it against official sources is a choice, not a requirement), entity classification and controlling persons, a tracked reminder workflow with blocking at the national calendar, transaction classification and valuation, pre-existing user remediation before 1 January 2027, dual-track CARF and CRS reporting per Member State, and an evidence record per user. A DAC8 solution is easier to run when it supports straight-through processing (STP) of clean cases, so the team sees only exceptions. No tool makes a provider fully compliant on its own: the obligation stays with the provider. Whether you evaluate a financial technology company or an established vendor, or compare which providers offer CRS 2.0 self-certification tools, test each against that list rather than a demonstration; [our DAC8 compliance software](https://taxdo.com/services/regulatory-compliance/dac8) is built to it. ### How can firms prepare onboarding workflows to support CRS 2.0 compliance for digital asset users? Put the self-certification inside sign-up, not after it. For digital asset users, the same flow should collect every tax residence and a TIN for each, test the declaration against customer due diligence data, classify entities and collect controlling persons, and decide which track applies to each product: CARF for crypto-assets, CRS 2.0 for e-money, central bank digital currencies and crypto exposure held through derivatives or funds. Preparing onboarding workflows this way means the reminder clock rarely has to start. ### How can firms put DAC8 compliance automation to work to reduce reporting complexity? By removing the hand-offs. Most of DAC8’s complexity comes from data that moves between onboarding, compliance, operations and finance before it reaches a report. Automation that collects and tests the self-certification at sign-up, classifies each transaction as it happens and generates each Member State’s file from one record reduces reporting complexity to the exceptions that need a person. ### How can automation enable audit-ready tax compliance under CARF? By creating the evidence at the moment each step happens. Under CARF, and under DAC8 in the EU, a provider must be able to show that it requested the self-certification, tested it against its customer due diligence data and, under DAC8, sent the reminders and applied any block when the rules required it. Automation records each of those steps with its date as part of the workflow, so the audit file exists before anyone asks for it. A file rebuilt from emails and spreadsheets months later is weaker evidence, and DAC8 expects the records to survive for five to ten years. ### What role does compliance infrastructure play in scaling DAC8 reporting workflows? It decides whether growth adds work. With one tax profile per user and one reporting layer that knows each Member State’s rules, a new market adds configuration. Without it, every new Member State adds a filing process, a reminder workflow and a reconciliation, which is how DAC8 reporting workflows stop scaling. Firms still running legacy systems should modernise them to meet evolving CRS 2.0 and DAC8 requirements once, rather than patching each new obligation. ### What is required for effective CARF self-certification during customer onboarding? Five items and two tests, settled before the first transaction. DAC8 takes CARF’s list: first and last name, residence address, every Member State of tax residence, a TIN for each, and date of birth. The declaration must be signed or otherwise positively affirmed and dated no later than its receipt, and the provider must confirm it is reasonable against what it learned when the relationship began, including its customer due diligence documentation. Effective means doing both at sign-up: a declaration accepted without the reasonableness test is complete on paper and unreliable in fact. Our [self-certification guide](https://taxdo.com/resources/blog/post/crs-2-0-dac8-mandatory-self-certification-guide) sets out each element. ### What are best practices for maintaining audit-ready tax compliance under CRS 2.0? For a bank or e-money institution on DAC8’s CRS track, the practices are those above, with the new CRS 2.0 data points added. Record for every account whether a valid self-certification was obtained, because the report now states it. Keep the reasonableness test and the documents it relied on, record each controlling person’s role, which the amended rules also require, and keep the file for at least five years, the floor the EU text sets for financial institutions. Where an e-money account is left out under the USD 10,000 exclusion, the file should show the balance test that put it there. ### What risks arise from fragmented systems when managing DAC8 compliance across entities? Conflicting records and missed clocks. When group entities keep separate user data, the same user can hold different residences or TINs in different systems, reminders sent by one entity are invisible to another, and a block that one entity applies is not reflected elsewhere. The results are reports that disagree, remediation repeated across entities, and penalties under national law for errors a single record would have prevented. ## References - [Council Directive (EU) 2023/2226 (DAC8), Official Journal text (Publications Office)](https://publications.europa.eu/resource/celex/32023L2226): including Annex VI, Section V - [Council Directive (EU) 2023/2226 on EUR-Lex](https://eur-lex.europa.eu/eli/dir/2023/2226/oj): the same text, EUR-Lex - [Regulation (EU) 2023/1114 (MiCA)](https://publications.europa.eu/resource/celex/32023R1114): definition of crypto-asset service provider - [European Commission, Taxpayer Identification Number (TIN on the Web)](https://taxation-customs.ec.europa.eu/online-services/online-services-and-databases-taxation/taxpayer-identification-number-tin%5Fen): checks TIN structure and syntax only - [OECD, International Standards for Automatic Exchange of Information in Tax Matters](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc.html): CARF and the amended CRS, 8 June 2023 - [Bundeszentralamt für Steuern, DAC8: Verfahren](https://www.bzst.de/DE/Unternehmen/Intern%5FInformationsaustausch/DAC8/Verfahren/verfahren%5Fnode.html): German filing deadline of 31 July - [Bundeszentralamt für Steuern, DAC8: Vorschriften](https://www.bzst.de/DE/Unternehmen/Intern%5FInformationsaustausch/DAC8/Vorschriften/vorschriften%5Fnode.html): KStTG enactment and entry into force - [Bundesgesetzblatt 2025 I Nr. 352](https://www.recht.bund.de/bgbl/1/2025/352/VO.html): German implementing act, KStTG §§ 8, 14 and 18 - [S.I. No. 584/2025 (Ireland)](https://www.irishstatutebook.ie/eli/2025/si/584/made/en/print): section 891M: deadline, reminders, blocking, penalties - [Eerste Kamer, Wet implementatie EU-richtlijn gegevensuitwisseling cryptoactiva (36 782)](https://www.eerstekamer.nl/nonav/wetsvoorstel/36782%5Fwet%5Fimplementatie%5Feu): Dutch implementing law _This article is general information on Council Directive (EU) 2023/2226 and its national implementation, including Germany’s KStTG administered by the Bundeszentralamt für Steuern and Ireland’s S.I. 584/2025 administered by the Revenue Commissioners, verified against the official sources listed on 13 October 2026\. National rules differ and continue to change; confirm the position in each Member State where you report with the competent tax authority or a qualified tax adviser._ Prepared by the TaxDo Tax & Regulatory Advisory Team