Crypto-Assets and CRS Compliance: DAC 8 redefines the rules

DAC 8 expands the scope of mandatory tax reporting to crypto-asset service providers, e-money institutions and existing financial institutions. The bill aligns with the OECD Crypto-Asset Reporting Framework (CARF) and revises the Common Reporting Standard (CRS transposed in DAC 2) to reinforce clients’ onboarding oversight. 

Almost two years after the adoption of the Directive (EU) 2023/2226 (DAC 8) by the Council of the European Union, the Luxembourg Parliament introduced a draft law n°8592 to transpose this Directive which aims to:

• Establish the automatic and mandatory exchange of information to crypto-assets; and
• Expand the due diligence and reporting obligations under CRS to new and existing types of financial institutions.

Please refer to our previous newsletter dated October 2023 for more details.

If voted in due time, the law will enter into force on 1 January 2026 with the first reporting expected to be filed by 30 June 2027 (for FY 2026 reports).

Crypto-Asset Reporting Framework

The bill of law requires reporting Crypto-Asset Service Providers (CASP) to collect information on their clients and the transactions they carry out, and to transmit this data to the Luxembourg Tax Administration (LTA) on an annual basis.

In order to do so, CASPs will be required to implement robust procedures, processes and systems to comply with their due diligence and reporting obligations under the CARF. Indeed, they will notably have to:

1. Register with local tax authorities;
2. Collect tax information on their clients through a so-called “self-certification”;
3. Ensure that the latter is complete and reasonable and assess on that basis the reportability of their clients;
4. Monitor the tax status of the client remains valid during the length of the commercial relationship; and
5. Report annually to the tax authorities.

Registration should be updated regularly and no later than one month after a given modification occurs. In this respect, CASPs will need to monitor changes of circumstances including the tax residency of their clients since this information will be included in the registration process to be updated if needed.

However, in order to not trigger additional administrative burden, CASPs which are already classified as Reporting Financial Institutions (RFI) under CRS, may rely on their existing client due diligence performed. Indeed, since most of the information to be communicated to the LTA is the same, both regimes are complementary: transactions will be reported under CARF and annual positions are already reported under CRS. To avoid any duplicate reporting, the bill allows CASPs being also RFIs under CRS to not report some information on CRS if it was already reported under CARF. 

Common Reporting Standard 2.0

Apart from expanding automatic exchange of information to crypto-assets, DAC 8 also imposes due diligence and reporting obligations on existing RFIs. These new obligations will be borne by new entities classifying as RFIs as per DAC 8 but also by traditional RFIs (e.g., banks, life insurance companies, asset managers).

Indeed, the bill aims also to address the gaps under CRS regarding crypto-assets and expand the information to be provided by RFIs annually. Hence, crypto-assets are now considered as Financial Assets and the definition of RFI is expanded in order to include certain entities investing in or holding in custody crypto-assets as well as e-money institutions and entities holding Central Bank Digital Currencies (CBDCs) on behalf of their clients.

In this respect, e-money institutions holding e-money, products or CBDCs for client benefit are now within the scope of RFIs under CRS. This is particularly relevant in the alternative fund industry where e-money institutions opened accounts and transferred money on behalf of their clients. While these institutions are not actually in scope of CRS, they will have now to implement procedures, IT systems and register of actions in order to fulfil their new due diligence (notably by collecting documentation on their clients) and reporting obligations as provided for by DAC 8.

In addition, RFIs will now have to include more in-depth information in their annual report, such as the type of account (deposit, interest, equity, …), the type of controlling person (which was not a mandatory information so far) and more importantly if a valid self-certification has been obtained. Such granularity aims to strengthen tax authorities’ ability to detect gaps in the due diligence processes of RFIs and to exchange accurate and reliable information with other tax authorities with respect to a given account holder.

As a consequence of the amendments of the CRS reporting, financial institutions need to reassess the effectiveness and strength of their control framework involved on the client’s onboarding to conclude on the validity of the investors’ tax documentation. In this respect, self-certifications must be complete and their content accurate and reasonable at onboarding and at the end of the fiscal year reported (i.e., 31^st December N-1) to be considered as valid. It also implies to detect any change of circumstance as of the renewal of the AML or U.S. tax documentation which could impact the validity of the CRS documentation.

For instance, RFIs will have to report that a valid self-certification has not been obtained for a given investor if there are unexplained inconsistencies between the FATCA and the CRS status of the investor or between CRS and AML/publicly available information.

IT systems may be impacted to capture additional information to feed the reporting process. RFIs have to adapt their internal processes and systems to adopt a comprehensive and consistent approach.

FATCA/CRS recent tax audits from the LTA focused particularly on the quality of reported data, year-over-year consistency, and the existence of documented controls as part of the FATCA/CRS governance supported by a register of actions. With the additional information to be received under CRS, tax authorities will be better equipped to raise targeted queries and issue penalties more systematically.

The combination of intensified FATCA/CRS audits and the implementation of DAC 8 mark a new phase in the enforcement of international tax transparency. For RFIs, having a strong, well-documented, and cohesive compliance framework will be key to maintain trust with investors, counterparts, tax authorities, and regulators.

Other considerations

DAC 6

The bill proposes to modify the DAC 6 law in order to take into consideration the CJEU judgement of 8 December 2022 (case C-694/20, Orde van Vlaamse Balies). Lawyers acting as intermediaries will no longer be required to notify other intermediaries who are not their clients of their reporting obligations. However, they will still have to notify their own clients of their DAC 6 reporting obligations.

Other intermediaries subject to professional secrecy (i.e., auditors and certified accountants) would have to notify other intermediaries (not subject to professional secrecy themselves) even if not their clients or the relevant taxpayer if there is no other intermediary involved.

New tax reporting for life insurance companies

DAC 8 also introduces a new tax reporting for insurance companies which provide insurance contracts, other than life insurance contracts already subject to reporting under CRS, where benefits are payable upon the death of the policy holder.

Automatic exchange of information on tax rulings for individuals

The bill introduces an exchange of information related to advance cross-border tax rulings for high-net-worth individuals (i.e., those with transactions covered by the ruling exceeding EUR 1.5 million) or related to the tax residency of an individual (except in some cases) that have been issued, modified, or renewed after 1 January 2026.

Country-by-Country reporting (CbCr)

The bill proposes to amend the CbCr law in order to include a provision already included in the LTA CbCr FAQ. Indeed, while the Tax Identification Number (TIN) of constituent entities is not an information to be communicated on the CbCr report as per the law, it is a mandatory field to report when preparing such report on MyGuichet. Hence, the bill confirms the approach taken by the LTA in order to include that a TIN must be communicated for all constituent entities included in CbCr reports.

With the DAC 8 bill of law, RFIs, traditional and new actors, will have to take actions to comply with these upcoming requirements:

• Implement/verify that their systems contain all the required data elements and that they are compliant with the new rules;
• Support appropriately the different lines of defence involved in the clients’ onboarding;
• Review/modify collection and verification procedures for new data elements;
• Adopt a remediation plan to review clients’ documentation received for CRS;
• Collect missing information/documentation as soon as possible; and
• Ensure that their reporting solutions are updated to cover the new reporting requirements.

New actors subject to CARF and/or CRS reporting, will also have to adopt a compliance program within a short period of time in order to fulfil their new obligations (such as implementing internal procedures and collecting documentation from their clients) and should take the following actions:

• Perform and impact assessment;
• Implement new systems and clients’ documentation;
• Draft or review procedures and control matrix;
• Report demographic and financial data; and
• Organise dedicated training sessions.

Our subject-matter experts are available to further discuss the above updates and help you implement sound governance if needed.