# Germany’s Tax Transparency Compliance: CRS 2.0, DAC8 and the Digital Audit Era Under the FKAustG and KStTG > Germany’s CRS 2.0 and DAC8 rules for 2026: self-certification at account opening under the FKAustG, KStTG for crypto, BZSt by 31 July, fines to €50,000. Source: https://taxdo.com/resources/blog/post/germany-crs2-dac8-compliance Last updated: 2026-10-22 _Sources last verified: 13 October 2026_ _Official sources cited at the end of this page._ **[Our regulatory compliance engine](https://taxdo.com/services/regulatory-compliance) clears every new German account for [CRS 2.0](https://taxdo.com/services/regulatory-compliance/crs) and [DAC8 on Day 1](https://taxdo.com/services/regulatory-compliance/dac8).** It collects the self-certification at account opening, runs the TIN check and the plausibility test, resolves indicia automatically instead of by your team, and prepares validated reports for the BZSt, with zero remediation, as section 07 shows. A new customer opens an account with a German bank and leaves the tax self-certification for later. In Germany that is not an option: the Financial Account Information Exchange Act (FKAustG) requires the bank to obtain the self-certification, and confirm it is plausible, at account opening, and since 2025 a breach can be fined up to €50,000\. From 1 January 2026 the same act also carries [CRS 2.0](https://taxdo.com/resources/blog/post/crs-2-0-compliance-guide-banks). Crypto-asset service providers meet the same Day-1 logic under [DAC8](https://taxdo.com/resources/blog/post/eu-dac8-compliance-crs-2-0-carf-crypto-reporting-2026), through the new Crypto-Asset Tax Transparency Act (KStTG). The exception is narrow. The bank may defer only if it can show that obtaining the self-certification at opening was legally or factually impossible, or that confirming its plausibility was unreasonable in a justified exceptional case; the same rule applies to entity accounts. Until the self-certification is obtained and its plausibility confirmed, no money may be withdrawn, and incoming funds may be repaid only to the payer. If either is still outstanding 90 calendar days after opening, the bank must notify the Federal Central Tax Office (BZSt) without delay, with the reasons. The fine applies where the breach is intentional or reckless, and where the BZSt fines the same institution a second time, it now informs BaFin. **There are two ways to meet the German rules.** The first collects the form at onboarding and chases what is missing, which the FKAustG allows only in those exceptional cases and with withdrawals blocked until the form arrives and its plausibility is confirmed. The second completes and tests the self-certification before the customer leaves the onboarding session, so there is nothing to freeze, chase or notify. **One manages an exception queue; the other never creates one.** Both regimes come from one federal law of [22 December 2025 (BGBl. 2025 I No. 352)](https://www.recht.bund.de/bgbl/1/2025/352/VO.html): Article 1 enacted the KStTG and Article 3 amended the FKAustG. The law entered into force on 24 December 2025, and the amended CRS rules apply from 1 January 2026. ## 01 · Germany [CRS 2.0](https://taxdo.com/services/regulatory-compliance/crs) and DAC8 at a glance | **Point** | **Position as at 13 October 2026** | | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Authority | Federal Central Tax Office (Bundeszentralamt für Steuern, BZSt) | | CRS 2.0 law | FKAustG as amended by BGBl. 2025 I No. 352; CRS changes apply from 1 January 2026 | | DAC8 crypto law | KStTG, in force 24 December 2025; under DAC8, first reports cover 2026 | | Self-certification (CRS) | At account opening (before opening for entities), plausibility confirmed against the information then obtained (FKAustG §§ 13(2), 16(2)) | | Deferral | Only where impossible or unreasonable; no withdrawals until cleared; BZSt notice after 90 days (§§ 13(2a), 16(2a)) | | Self-certification (crypto) | Before any reportable transaction; users onboarded by 31 December 2025 by 1 January 2027 (KStTG § 7) | | Filing deadline | 31 July for the previous calendar year, under both laws (FKAustG § 27(2); KStTG § 9) | | Accounts open on 31 Dec 2025 | Role information for periods ending by 31 December 2027 reported only if electronically searchable | | Client duty | Report a change of circumstances by the later of the period’s end or 90 days after it (FKAustG § 3a(3)) | | Fines | Up to €50,000 or €10,000, by offence (FKAustG § 28; KStTG § 18) | | Records | Ten years, from the end of the calendar year they were made (FKAustG § 3(3); KStTG § 14) | | Crypto blocking | Users onboarded by 31 December 2025 who ignore a reminder and a demand are blocked from reportable transactions 60 to 90 days after the original request (KStTG § 8) | ## 02 · [CRS 2.0](https://taxdo.com/services/regulatory-compliance/crs) and DAC8: Policy Convergence [CRS 2.0](https://taxdo.com/services/regulatory-compliance/crs) is the OECD’s 2023 update of the Common Reporting Standard, published on [8 June 2023](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report.html) together with the [Crypto-Asset Reporting Framework](https://taxdo.com/resources/blog/post/carf-crs2-crypto-tax-transparency-guide) (CARF). The update covers e-money, central bank digital currencies and indirect crypto exposure inside the financial account regime; CARF covers crypto-assets held and exchanged directly. DAC8, [Council Directive (EU) 2023/2226](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023L2226), carries both into EU law from 1 January 2026. Germany keeps the two apart in its statute book but runs them the same way: one authority, the BZSt; one filing date, 31 July; one record period, ten years; and the same fine ceiling of €50,000 for the serious offences. For an institution that serves both bank and crypto customers, that is the case for one onboarding flow that collects a single self-certification serving both laws. ## 03 · Who Must Report: Scope of Reporting in Germany | **Question** | **What it means for you** | | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | A bank, custodian, investment entity or insurer with cash-value products? | A reporting financial institution under the FKAustG: self-certification at account opening and a report to the BZSt by 31 July. | | Holding e-money or central bank digital currency for customers? | A depository institution for those accounts; e-money includes MiCA e-money tokens redeemable at par in one fiat currency, and accounts whose 90-day average never exceeds USD 10,000 are excluded. | | An account that counts as a financial account only because of the 2026 changes? | Maintained on 31 December 2025, it is a pre-existing account; opened on or after 1 January 2026, it is a new account. | | A crypto-asset service provider? | The KStTG applies: due diligence before any reportable transaction, a report to the BZSt by 31 July. | | A passive entity with controlling persons? | Its controlling persons are identified, and for each who is a reportable person the report states the role by which they control the entity. | ## 04 · Digital Asset Inclusion: [CRS 2.0](https://taxdo.com/services/regulatory-compliance/crs) and the KStTG The amended CRS does not turn crypto-assets into bank deposits. What changes in the FKAustG is narrower: an institution that holds e-money or central bank digital currency for its customers is a depository institution, and e-money includes e-money tokens under the EU’s Markets in Crypto-Assets Regulation that represent a single fiat currency and are redeemable at par. Crypto-assets held directly go to the KStTG. Under the KStTG, a provider completes the due diligence on a new user before carrying out any reportable transaction. For users with a business relationship begun by 31 December 2025, the deadline is 1 January 2027\. A user who still does not respond after a reminder and a formal demand must be prevented from carrying out reportable transactions, at the latest 90 and no earlier than 60 days after the original request, until the information arrives. The detail for exchanges and wallet providers is in our [Germany CARF article](https://taxdo.com/resources/blog/post/germany-carf-crypto-tax-compliance). ## 05 · BZSt Online Reporting: The Digital Data Record Financial institutions transmit their data to the BZSt electronically, in the officially prescribed data record, by 31 July for the previous calendar year ([FKAustG § 27](https://www.gesetze-im-internet.de/fkaustg/%5F%5F27.html)). The BZSt then exchanges it with the partner jurisdictions by 30 September. Crypto-asset service providers report by the same 31 July date ([KStTG § 9](https://www.gesetze-im-internet.de/ksttg/%5F%5F9.html)). The German CRS report carries, for each reportable individual, name, address, jurisdictions of residence, tax identification numbers, date of birth, place of birth only where FKAustG § 8(4) requires it, and whether a valid self-certification was obtained, with the same for each controlling person who is a reportable person and the role by which they control the entity. For accounts maintained on 31 December 2025, role information for reporting periods ending by 31 December 2027 is reported only where it is available in the institution’s electronically searchable data. ## 06 · TIN Validation, Ongoing Due Diligence, and Advanced Compliance Tools TIN validation is optional under the amended OECD [Commentary](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report/component-13.html), which does not require a format check; a blank TIN, where the OECD’s information shows the jurisdiction issues TINs to all residents, gives reason to know the self-certification is unreliable. Many institutions validate anyway, because a well-formed number can pass every format rule and belong to nobody. [Our TIN lookup](https://taxdo.com/services/tax-identity/tin-lookup) validates numbers against official sources in 130+ countries, in real time, with format validation across 210+. ### Ongoing Account-Holder Due Diligence The FKAustG puts a duty on the customer as well. Anyone who has given a self-certification must report a change of circumstances, with a new, correct self-certification, by the last day of the relevant period or 90 days after the change, whichever is later ([§ 3a](https://www.gesetze-im-internet.de/fkaustg/%5F%5F3a.html)). A customer who intentionally or recklessly fails to, or gives an incorrect or incomplete self-certification, commits an offence carrying a fine of up to €10,000\. On the institution’s side, it must record its processes and, for each account, what it processed and reported, and keep those records for ten years from the end of the year they were made ([§ 3](https://www.gesetze-im-internet.de/fkaustg/%5F%5F3.html)). ## 07 · Implications for Financial Institutions: Two Ways to Meet the German Rules ### By hand, with an exception queue Many institutions collect the self-certification in the onboarding form and route anything missing or implausible to a back-office queue. Under the FKAustG that queue is lawful only for the exceptional cases, withdrawals stay blocked until each case is cleared, and after 90 days each open case becomes a notice to the BZSt. The cost grows with every account that leaves onboarding incomplete. ### At onboarding, from Day 1 TaxDo runs [CRS 2.0](https://taxdo.com/services/regulatory-compliance/crs) and DAC8 due diligence inside onboarding, from the first self-certification to the report, in five steps. **Step 1 · Collect the self-certification.** Guided and jurisdiction-aware, with a digital signature; for a passive entity, its controlling persons and their roles in the same flow. **Step 2 · Validate the identity.** Every TIN checked in real time against official sources in 130+ countries, and the business against registries in 120+. **Step 3 · Run the due diligence.** Indicia detected across everything held on the customer, and the self-certification tested for plausibility against it before the account opens. **Step 4 · Cure the gaps, without the compliance team:** > **4a · New accounts.** Discrepancies resolved in the same session, so no account enters the 90-day window. > > **4b · Existing accounts.** The book scanned and prioritised; missing TINs, outdated self-certifications and unresolved indicia remediated. **Step 5 · Report, and keep the evidence.** Validated CRS and DAC8 reports from one data layer, prepared and validated for your institution to submit to the BZSt. On request, our team can also submit them on your behalf as an additional service. Every customer keeps an immutable clearance record. **From Day-1 self-certification to the BZSt report, with zero remediation.** Every account is cleared at opening. [**Our CRS 2.0 compliance software**](https://taxdo.com/services/regulatory-compliance/crs) · [**Our DAC8 compliance software**](https://taxdo.com/services/regulatory-compliance/dac8) · [**Solutions for financial institutions**](https://taxdo.com/solutions/financial-institutions) ### Where this sits, and what it does not touch It runs beside your KYC provider and core systems, not in place of them. The reporting obligation, and the responsibility for what is reported, stays with your institution, including where TaxDo submits the report on its behalf at its request. TaxDo runs the due diligence and prepares and validates the report. ## 08 · Deadlines That Define 2026, and the Fines Behind Them | **Law** | **Fine up to** | **For (intentional or reckless)** | | ------------ | ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | FKAustG § 28 | €50,000 | Not obtaining a self-certification or confirming its plausibility in time; allowing withdrawals before it is obtained and confirmed; missing or wrong reports; failed reviews | | FKAustG § 28 | €10,000 | Records not made or kept; a customer’s incorrect self-certification or unreported change | | KStTG § 18 | €50,000 or €10,000 | Breaches of the crypto due diligence, reporting and record duties, by offence | ### 24 December 2025 The federal law implementing DAC8 (BGBl. 2025 I No. 352) enters into force: the KStTG and the FKAustG amendments. ### 1 January 2026 The FKAustG’s [CRS 2.0](https://taxdo.com/services/regulatory-compliance/crs) changes take effect; the first crypto reporting period begins. ### 1 January 2027 Deadline for crypto due diligence on users onboarded by 31 December 2025. ### 31 July 2027 First reports to the BZSt under the amended FKAustG and the KStTG, for 2026. ### 30 September 2027 The BZSt exchanges the 2026 financial account data with partner jurisdictions. ## 09 · Related Reading **Framework articles:** [CRS 2.0 compliance for financial institutions](https://taxdo.com/resources/blog/post/crs-2-0-compliance-guide-banks) · [DAC8 compliance](https://taxdo.com/resources/blog/post/eu-dac8-compliance-crs-2-0-carf-crypto-reporting-2026) · [CARF and crypto tax transparency](https://taxdo.com/resources/blog/post/carf-crs2-crypto-tax-transparency-guide) · [Self-certification under CRS 2.0, DAC8 and CARF](https://taxdo.com/resources/blog/post/crs-2-0-dac8-mandatory-self-certification-guide) **Neighbours:** [Switzerland CRS 2.0](https://taxdo.com/resources/blog/post/switzerland-crs-2-0-compliance-guide) · [Austria CRS 2.0](https://taxdo.com/resources/blog/post/crs-2-0-in-austria-navigating-next-generation-financial-reporting) · [France CRS 2.0](https://taxdo.com/resources/blog/post/crs-2-0-france-banks-digital-asset-compliance-2026) · [United Kingdom CRS 2.0](https://taxdo.com/resources/blog/post/crs-2-0-uk-financial-institutions-global-tax-transparency) **Product:** [Regulatory compliance engine](https://taxdo.com/services/regulatory-compliance) · [Day 1 onboarding validation](https://taxdo.com/resources/blog/post/crs-2-0-carf-compliance-day-1-onboarding-validation) · [DAC8 compliance software](https://taxdo.com/services/regulatory-compliance/dac8) · [CRS 2.0 compliance software](https://taxdo.com/services/regulatory-compliance/crs) · [Business registry check](https://taxdo.com/services/tax-identity/business-registry) · [Crypto exchanges and CASPs](https://taxdo.com/solutions/crypto-exchanges-casps) ## Frequently asked questions ### What features should teams prioritize in DAC8 compliance software solutions? Those that match the German deadlines. Due diligence must finish before a new user’s first reportable transaction, and for users onboarded by 31 December 2025 by 1 January 2027, so self-certification inside onboarding comes first. Next: plausibility testing against the customer due diligence file, TIN checks, the reminder, demand and blocking sequence the KStTG requires for existing users, transaction classification, a validated report for the BZSt by 31 July, and a ten-year evidence record. Ask whether it covers the CRS 2.0 side too, from the same customer record. ### How does CRS 2.0 align with frameworks like CARF and DAC8? They divide the ground. CRS 2.0 covers financial accounts, now including e-money, central bank digital currencies and indirect crypto exposure; CARF covers crypto-assets held and exchanged directly; DAC8 puts both into EU law from 2026\. In Germany the FKAustG carries CRS 2.0 and the KStTG carries the crypto rules, with the same authority, the same 31 July filing date and the same ten-year records, so one self-certification flow can serve both. ### Should firms modernize legacy systems to meet evolving CRS 2.0 compliance requirements? Where they cannot meet the account-opening rule, yes. The FKAustG expects the self-certification and its plausibility check at opening, a withdrawal block when either cannot be done then, and a BZSt notice after 90 days; CRS 2.0 adds new fields on top. A legacy system that collects the form after opening, or cannot hold controlling-person roles in structured fields, turns each of these into manual work. The relief for role information on accounts maintained on 31 December 2025 ends with reporting periods closing on 31 December 2027. ### How can automation enable audit-ready tax compliance under CARF? By recording each step as it happens. The KStTG requires records to be kept for ten years from the end of the year they were made, and the BZSt audits compliance against records that must show what was processed, when, and with what result. An automated flow stores the self-certification, the plausibility test, any reminder, demand or block, the TIN check and the transaction classification against each user, so the file exists before anyone asks for it. ### How can firms use DAC8 compliance automation to reduce reporting complexity? By running one data layer for both German laws. A provider that serves bank and crypto customers can collect one self-certification, test it once, and produce the FKAustG and KStTG reports for the BZSt from the same record by 31 July. Automation also runs the KStTG sequence for users onboarded before 2026, the reminder, the demand and the block within 60 to 90 days, without a manual tracker. ### What data collection challenges arise with CRS 2.0 updates? Four stand out in Germany. Self-certification must arrive at account opening, before opening for entities, with a fine of up to €50,000 for a missing one. Controlling-person and equity-holder roles must be captured in a form that can be reported. Whether a valid self-certification was obtained is now reported for each reportable person. And customers must report changes within the later of the period’s end or 90 days. Each is easiest to collect at onboarding and hardest to reconstruct afterwards. ## References - [Finanzkonten-Informationsaustauschgesetz (FKAustG), gesetze-im-internet.de](https://www.gesetze-im-internet.de/fkaustg/): as last amended by Art. 3 of the law of 22 December 2025 (German) - [FKAustG § 13](https://www.gesetze-im-internet.de/fkaustg/%5F%5F13.html): self-certification at account opening; the 90-day rule (German) - [FKAustG § 27](https://www.gesetze-im-internet.de/fkaustg/%5F%5F27.html): 31 July filing; role relief to 2027 (German) - [FKAustG § 28](https://www.gesetze-im-internet.de/fkaustg/%5F%5F28.html): administrative fines (German) - [Kryptowerte-Steuertransparenz-Gesetz (KStTG), gesetze-im-internet.de](https://www.gesetze-im-internet.de/ksttg/): Art. 1 of the law of 22 December 2025 (German) - [KStTG § 7 and § 8](https://www.gesetze-im-internet.de/ksttg/%5F%5F8.html): due diligence deadlines and blocking (German) - [KStTG § 18](https://www.gesetze-im-internet.de/ksttg/%5F%5F18.html): administrative fines (German) - [Bundesgesetzblatt 2025 I Nr. 352](https://www.recht.bund.de/bgbl/1/2025/352/VO.html): law implementing Directive (EU) 2023/2226 - [BZSt, DAC8 legal provisions](https://www.bzst.de/DE/Unternehmen/Intern%5FInformationsaustausch/DAC8/Vorschriften/vorschriften%5Fnode.html): the KStTG and its entry into force (German) - [Council Directive (EU) 2023/2226 (DAC8), EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023L2226): CRS amendments and crypto reporting from 1 January 2026 - [OECD, International Standards for Automatic Exchange of Information in Tax Matters](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report.html): 8 June 2023 - [OECD, Commentary on the amended CRS](https://www.oecd.org/en/publications/2023/06/international-standards-for-automatic-exchange-of-information-in-tax-matters%5Fab3a23bc/full-report/component-13.html): TIN and self-certification _General information on the amended Common Reporting Standard and DAC8 in Germany, checked against the official sources listed on 13 October 2026\. Confirm how the rules apply to your institution with the Federal Central Tax Office or a qualified tax adviser._ Prepared by the TaxDo Tax & Regulatory Advisory Team