Get in touch
Sources last verified: 13 October 2026
Official sources cited at the end of this page.
Our regulatory compliance engine clears every new German account for CRS 2.0 and DAC8 on Day 1. It collects the self-certification at account opening, runs the TIN check and the plausibility test, resolves indicia automatically instead of by your team, and prepares validated reports for the BZSt, with zero remediation, as section 07 shows.
A new customer opens an account with a German bank and leaves the tax self-certification for later. In Germany that is not an option: the Financial Account Information Exchange Act (FKAustG) requires the bank to obtain the self-certification, and confirm it is plausible, at account opening, and since 2025 a breach can be fined up to €50,000. From 1 January 2026 the same act also carries CRS 2.0. Crypto-asset service providers meet the same Day-1 logic under DAC8, through the new Crypto-Asset Tax Transparency Act (KStTG).
The exception is narrow. The bank may defer only if it can show that obtaining the self-certification at opening was legally or factually impossible, or that confirming its plausibility was unreasonable in a justified exceptional case; the same rule applies to entity accounts. Until the self-certification is obtained and its plausibility confirmed, no money may be withdrawn, and incoming funds may be repaid only to the payer. If either is still outstanding 90 calendar days after opening, the bank must notify the Federal Central Tax Office (BZSt) without delay, with the reasons.
The fine applies where the breach is intentional or reckless, and where the BZSt fines the same institution a second time, it now informs BaFin.
There are two ways to meet the German rules. The first collects the form at onboarding and chases what is missing, which the FKAustG allows only in those exceptional cases and with withdrawals blocked until the form arrives and its plausibility is confirmed. The second completes and tests the self-certification before the customer leaves the onboarding session, so there is nothing to freeze, chase or notify. One manages an exception queue; the other never creates one.
Both regimes come from one federal law of 22 December 2025 (BGBl. 2025 I No. 352): Article 1 enacted the KStTG and Article 3 amended the FKAustG. The law entered into force on 24 December 2025, and the amended CRS rules apply from 1 January 2026.
01 · Germany CRS 2.0 and DAC8 at a glance
| Point | Position as at 13 October 2026 |
| Authority | Federal Central Tax Office (Bundeszentralamt für Steuern, BZSt) |
| CRS 2.0 law | FKAustG as amended by BGBl. 2025 I No. 352; CRS changes apply from 1 January 2026 |
| DAC8 crypto law | KStTG, in force 24 December 2025; under DAC8, first reports cover 2026 |
| Self-certification (CRS) | At account opening (before opening for entities), plausibility confirmed against the information then obtained (FKAustG §§ 13(2), 16(2)) |
| Deferral | Only where impossible or unreasonable; no withdrawals until cleared; BZSt notice after 90 days (§§ 13(2a), 16(2a)) |
| Self-certification (crypto) | Before any reportable transaction; users onboarded by 31 December 2025 by 1 January 2027 (KStTG § 7) |
| Filing deadline | 31 July for the previous calendar year, under both laws (FKAustG § 27(2); KStTG § 9) |
| Accounts open on 31 Dec 2025 | Role information for periods ending by 31 December 2027 reported only if electronically searchable |
| Client duty | Report a change of circumstances by the later of the period’s end or 90 days after it (FKAustG § 3a(3)) |
| Fines | Up to €50,000 or €10,000, by offence (FKAustG § 28; KStTG § 18) |
| Records | Ten years, from the end of the calendar year they were made (FKAustG § 3(3); KStTG § 14) |
| Crypto blocking | Users onboarded by 31 December 2025 who ignore a reminder and a demand are blocked from reportable transactions 60 to 90 days after the original request (KStTG § 8) |
02 · CRS 2.0 and DAC8: Policy Convergence
CRS 2.0 is the OECD’s 2023 update of the Common Reporting Standard, published on 8 June 2023 together with the Crypto-Asset Reporting Framework (CARF). The update covers e-money, central bank digital currencies and indirect crypto exposure inside the financial account regime; CARF covers crypto-assets held and exchanged directly. DAC8, Council Directive (EU) 2023/2226, carries both into EU law from 1 January 2026.
Germany keeps the two apart in its statute book but runs them the same way: one authority, the BZSt; one filing date, 31 July; one record period, ten years; and the same fine ceiling of €50,000 for the serious offences. For an institution that serves both bank and crypto customers, that is the case for one onboarding flow that collects a single self-certification serving both laws.
03 · Who Must Report: Scope of Reporting in Germany
| Question | What it means for you |
| A bank, custodian, investment entity or insurer with cash-value products? | A reporting financial institution under the FKAustG: self-certification at account opening and a report to the BZSt by 31 July. |
| Holding e-money or central bank digital currency for customers? | A depository institution for those accounts; e-money includes MiCA e-money tokens redeemable at par in one fiat currency, and accounts whose 90-day average never exceeds USD 10,000 are excluded. |
| An account that counts as a financial account only because of the 2026 changes? | Maintained on 31 December 2025, it is a pre-existing account; opened on or after 1 January 2026, it is a new account. |
| A crypto-asset service provider? | The KStTG applies: due diligence before any reportable transaction, a report to the BZSt by 31 July. |
| A passive entity with controlling persons? | Its controlling persons are identified, and for each who is a reportable person the report states the role by which they control the entity. |
04 · Digital Asset Inclusion: CRS 2.0 and the KStTG
The amended CRS does not turn crypto-assets into bank deposits. What changes in the FKAustG is narrower: an institution that holds e-money or central bank digital currency for its customers is a depository institution, and e-money includes e-money tokens under the EU’s Markets in Crypto-Assets Regulation that represent a single fiat currency and are redeemable at par. Crypto-assets held directly go to the KStTG.
Under the KStTG, a provider completes the due diligence on a new user before carrying out any reportable transaction. For users with a business relationship begun by 31 December 2025, the deadline is 1 January 2027. A user who still does not respond after a reminder and a formal demand must be prevented from carrying out reportable transactions, at the latest 90 and no earlier than 60 days after the original request, until the information arrives. The detail for exchanges and wallet providers is in our Germany CARF article.
05 · BZSt Online Reporting: The Digital Data Record
Financial institutions transmit their data to the BZSt electronically, in the officially prescribed data record, by 31 July for the previous calendar year (FKAustG § 27). The BZSt then exchanges it with the partner jurisdictions by 30 September. Crypto-asset service providers report by the same 31 July date (KStTG § 9).
The German CRS report carries, for each reportable individual, name, address, jurisdictions of residence, tax identification numbers, date of birth, place of birth only where FKAustG § 8(4) requires it, and whether a valid self-certification was obtained, with the same for each controlling person who is a reportable person and the role by which they control the entity. For accounts maintained on 31 December 2025, role information for reporting periods ending by 31 December 2027 is reported only where it is available in the institution’s electronically searchable data.
06 · TIN Validation, Ongoing Due Diligence, and Advanced Compliance Tools
TIN validation is optional under the amended OECD Commentary, which does not require a format check; a blank TIN, where the OECD’s information shows the jurisdiction issues TINs to all residents, gives reason to know the self-certification is unreliable. Many institutions validate anyway, because a well-formed number can pass every format rule and belong to nobody. Our TIN lookup validates numbers against official sources in 130+ countries, in real time, with format validation across 210+.
Ongoing Account-Holder Due Diligence
The FKAustG puts a duty on the customer as well. Anyone who has given a self-certification must report a change of circumstances, with a new, correct self-certification, by the last day of the relevant period or 90 days after the change, whichever is later (§ 3a). A customer who intentionally or recklessly fails to, or gives an incorrect or incomplete self-certification, commits an offence carrying a fine of up to €10,000. On the institution’s side, it must record its processes and, for each account, what it processed and reported, and keep those records for ten years from the end of the year they were made (§ 3).
07 · Implications for Financial Institutions: Two Ways to Meet the German Rules
By hand, with an exception queue
Many institutions collect the self-certification in the onboarding form and route anything missing or implausible to a back-office queue. Under the FKAustG that queue is lawful only for the exceptional cases, withdrawals stay blocked until each case is cleared, and after 90 days each open case becomes a notice to the BZSt. The cost grows with every account that leaves onboarding incomplete.
At onboarding, from Day 1
TaxDo runs CRS 2.0 and DAC8 due diligence inside onboarding, from the first self-certification to the report, in five steps.
Step 1 · Collect the self-certification. Guided and jurisdiction-aware, with a digital signature; for a passive entity, its controlling persons and their roles in the same flow.
Step 2 · Validate the identity. Every TIN checked in real time against official sources in 130+ countries, and the business against registries in 120+.
Step 3 · Run the due diligence. Indicia detected across everything held on the customer, and the self-certification tested for plausibility against it before the account opens.
Step 4 · Cure the gaps, without the compliance team:
4a · New accounts. Discrepancies resolved in the same session, so no account enters the 90-day window.
4b · Existing accounts. The book scanned and prioritised; missing TINs, outdated self-certifications and unresolved indicia remediated.
Step 5 · Report, and keep the evidence. Validated CRS and DAC8 reports from one data layer, prepared and validated for your institution to submit to the BZSt. On request, our team can also submit them on your behalf as an additional service. Every customer keeps an immutable clearance record.
From Day-1 self-certification to the BZSt report, with zero remediation. Every account is cleared at opening.
Our CRS 2.0 compliance software · Our DAC8 compliance software · Solutions for financial institutions
Where this sits, and what it does not touch
It runs beside your KYC provider and core systems, not in place of them. The reporting obligation, and the responsibility for what is reported, stays with your institution, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report.
08 · Deadlines That Define 2026, and the Fines Behind Them
| Law | Fine up to | For (intentional or reckless) |
| FKAustG § 28 | €50,000 | Not obtaining a self-certification or confirming its plausibility in time; allowing withdrawals before it is obtained and confirmed; missing or wrong reports; failed reviews |
| FKAustG § 28 | €10,000 | Records not made or kept; a customer’s incorrect self-certification or unreported change |
| KStTG § 18 | €50,000 or €10,000 | Breaches of the crypto due diligence, reporting and record duties, by offence |
24 December 2025
The federal law implementing DAC8 (BGBl. 2025 I No. 352) enters into force: the KStTG and the FKAustG amendments.
1 January 2026
The FKAustG’s CRS 2.0 changes take effect; the first crypto reporting period begins.
1 January 2027
Deadline for crypto due diligence on users onboarded by 31 December 2025.
31 July 2027
First reports to the BZSt under the amended FKAustG and the KStTG, for 2026.
30 September 2027
The BZSt exchanges the 2026 financial account data with partner jurisdictions.
09 · Related Reading
Framework articles: CRS 2.0 compliance for financial institutions · DAC8 compliance · CARF and crypto tax transparency · Self-certification under CRS 2.0, DAC8 and CARF
Neighbours: Switzerland CRS 2.0 · Austria CRS 2.0 · France CRS 2.0 · United Kingdom CRS 2.0
Product: Regulatory compliance engine · Day 1 onboarding validation · DAC8 compliance software · CRS 2.0 compliance software · Business registry check · Crypto exchanges and CASPs
