DAC8 adopted - an extension of existing tax transparency obligations

One year after the OECD published a new global tax transparency framework for reporting and exchanging information related to crypto-assets (please refer to our previous newsletter dated October 2022 for more details), DAC8 introduces most of the concepts initiated last year, ensuring their implementation by member states.

AEoI: Crypto Assets Now in the Spotlight

DAC8, building upon the framework introduced by the OECD in the Crypto-Asset Reporting Framework (CARF) published the previous year, extends client on-boarding and transaction reporting obligations on individuals and entities facilitating transactions with crypto-assets (including exchanges and transfers of relevant crypto-assets) for or on behalf of a customer.

However, compared to CARF, DAC8 has an extraterritorial scope as it applies to both “Crypto-Asset Service Providers” authorised under Regulation (EU) 2023/1114 (Markets in Crypto-Assets – MiCA) and “Crypto Asset Operators” located in jurisdictions outside of the EU providing crypto-asset services in the EU.

Nominative data exchanged on clients will be similar to what is required under CRS (e.g. name, address, jurisdiction of tax residence, tax identification number (TIN), information on Controlling Persons etc). Such data should also be collected in a similar manner as for CRS by obtaining, as part of the client on-boarding process, a self-certification.

As opposed to CARF, DAC8 obligates Reporting Crypto-Asset Service Providers to block transactions if a Crypto-Asset User does not provide information within 60 days and after two reminders.

Member states will need to exchange the relevant information within nine months following the end of the calendar year to which the reporting requirements relate and will need to determine the local reporting deadlines applicable for Reporting Crypto-Asset Service Providers.

E-Money Institutions included in the scope of Financial Institution

DAC8 incorporates the concept of e-Money into the CRS framework by revising the definitions of "Depository Institution" and "Depository Account." By doing so, it brings entities holding e-money, products, or Central Bank Digital Currencies ("CBDC") for customer benefit within the scope of Reporting Financial Institutions under CRS. Consequently, newly classified Financial Institutions will be required to collect and review self-certification forms from their customers starting from the date the changes come into effect.

However, smaller accounts that represent specific Electronic Money Products held for the benefit of a customer will be excluded from this review and reporting requirements (in case the rolling average 90 days end-of-day aggregate account balance or value during any period of 90 consecutive days did not exceed USD 10,000 at any day during the reporting period).

Additional data to be reported under CRS  

DAC8 provides additional information to be reported under CRS (whether the account is a Pre-existing Account or a New Account, whether a valid self-certification has been obtained, whether the account is a joint account as well as the number of the joint account holders, the type of financial account and the role of Controlling Person in relation to the Entity Account Holder). Therefore, compliance officers should ensure that the review of the self-certification forms received by their clients / investors goes beyond the mere review of completeness, but includes a reconciliation with existing AML documentation, publicly available information and relevant CRS rules.

By incorporating these additional fields into the CRS reporting framework, tax authorities will be better equipped to scrutinise Financial Institutions regarding clients or investors with insufficient documentation. This will also enable them to refine their information requests during audits by prioritising these cases. For instance, they can focus on the lack of documentation obtained for newly opened accounts. This targeted approach enhances the effectiveness of regulatory compliance oversight by allowing tax authorities to address specific areas of concern more efficiently.

Further tax transparency amendments

DAC8 also introduces an exchange of information related to advance cross-border tax rulings for high-net-worth individuals (i.e, those with transactions covered by the ruling exceeding EUR 1.5 million) that have been issued, modified, or renewed after 1 January 2026.

DAC8 also includes provisions to adapt DAC6 to ensure that Member States give intermediaries the right to a waiver from filing information on a reportable cross-border arrangement where the reporting obligation would breach the legal professional privilege under the national law of that Member State. In such circumstances, each Member State shall take the necessary measures to require any intermediary that has been granted a waiver to notify, without delay, his or her client, if such client is an intermediary or, if there is no such intermediary, the relevant taxpayer, of their reporting obligations.

Furthermore, DAC8 also enforces an increased availability of TINs for reporting and communication to help tax authorities identify relevant taxpayers and correctly assess the related taxes.

On this final note, akin to the methodology employed by the IRS for FATCA, this implies an increase in verifications conducted by foreign administrations, emphasising the receipt of more precise and relevant data, especially concerning the structure of TINs from financial institutions.

However, contrary to what was initially anticipated in the discussions regarding DAC8, there will be no harmonisation of the penalty regime within the EU. The initial draft directive included a minimum penalty of at least EUR 50,000 (depending on the turnover) for DAC2, DAC6, DAC7 and DAC8 in case of missing, incomplete, or incorrect reporting. The final directive leaves the enforcement of effective, proportionate and dissuasive penalties at the discretion of the member states during the implementation of the directive. In Luxembourg, we have currently a penalty of up to EUR 250,000 in case of non-compliance with due diligence and reporting obligations under each regime (i.e. DAC2, DAC6 and DAC7).