DAC8 - an extension of existing tax transparency obligations that affects most of actors of the financial sector.

A new reporting framework for Crypto-assets but not only...

Crypto-assets are currently an investment product which is subject to no or light tax transparency obligations especially in a cross-border context. It could be considered as a loophole within the existing tax transparency framework set by the OECD with the introduction of CRS and implemented across the European Union with the second version of the DAC in 2016.  The decentralized nature of crypto-assets has also made it difficult for EU countries’ tax administrations to ensure tax compliance.

To close that gap, almost 6 years later, the OECD published a new global tax transparency framework for reporting and exchanging information related to crypto-assets (Crypto-Asset Reporting Framework or “CARF”).

With the introduction of DAC8 which incorporates CARF into EU laws, CASPs ⁽¹⁾ will be subject to reporting obligations on crypto-assets transactions (including exchanges and transfers of relevant crypto-assets) made by their clients. Although the Directive states that the administrative burden should be minimized for the industry so that it is able to develop its full potential within the European Union, CASPs will have a significant amount of additional work to do to comply with these new obligations.

While CARF is built extensively on CRS for client onboarding and on-going due diligence, it introduces a fundamental difference in terms of reporting as daily transactions instead of annual positions will have to be reported.  In that sense, reporting would be of a similar nature to regulations such as the European Market Infrastructure Regulation (EMIR).

Daily transaction volumes will be substantial not only for service providers but also for tax authorities which will handle and exchange between themselves the information received. Robust systems must be implemented at both ends of the reporting value chain in a tight schedule. While the readiness status of tax authorities will remain mostly unknown because not visible, new actors do not have any other choice to develop and manage internally or outsource those new processes to external service providers and then exercise an oversight on them.

E-Money Institutions are also entering in the scope of DAC8.

DAC8 also incorporates the concept of e-Money into the CRS framework by revising the definitions of "Depository Institution" and "Depository Account."  The E-Money Institutions (EMI) holding e-money, products, or Central Bank Digital Currencies for customer benefit are entering within the scope of Reporting Financial Institutions under CRS.

In the alternative fund industry, where it is becoming more difficult for certain actors to quickly open bank accounts, such E-Money institutions are sometimes used to find a way to open accounts and transfer money. As those entities, are not yet in scope of the DAC 2 due diligence and reporting requirements, no documentation on their clients' CRS status has been collected from fund managers by the EMIs (and often at the great surprise of fund managers corporate departments...), hence creating a loophole in the reporting requirements.

Due Diligence process for CASPs and EMI will be similar to CRS/DAC2

When onboarding clients, the data and document collection process will be like what is required under CRS (e.g., name, address, jurisdiction of tax residence, tax identification number (TIN), information on Controlling Persons of entities, etc.). A self-certification form from the EMI and CASP clients or users will be legally required before opening the account as it is already the case under current CRS rules.  Controls will need to be put in place to ensure completeness, accuracy and reasonability of the information collected.

New actors must prepare for the due diligence and reporting rules starting January 2026. This unfamiliar process will need new systems, people, and procedures to manage their current client volumes. They must also contact existing clients or users to gather, verify, and record missing information.

Based on our experience, almost 10 years after DAC2 entry into force, these due diligence obligations, lying on current Reporting Financial Institutions, is still a day-to-day challenge in terms of internal controls, their documentation and the required tax knowledge to be fully effective. Recent statistics tell us that for some (even large) financial institutions, 50% of self-certifications reviewed are either incorrect or incomplete which leads in 25% of the cases to under- or overreporting issues towards tax authorities. This would mean that between 25% and 50% of the documentation collected can be today considered as not valid. This “validity” status of the documentation collected is one of the additional pieces of information that will need now to be reported to tax authorities and that may have some immediate consequences for RFIs.

Additional data to be reported under CRS leading to more automatic controls from tax authorities

Until the implementation of DAC8, foreign tax authorities will still be struggling to use part of the data exchanged due to errors or incomplete data that they are receiving.

With the additional data that will be required to be reported under DAC8, foreign tax authorities will now have much more means at their disposal to trigger exchange of information requests to local tax authorities of RFIs.

This additional information to be reported under CRS for both existing RFIs and newly included entities consists of: whether (a) the account is a Pre-existing Account ⁽²⁾ or a New Account; (b) a valid self-certification has been obtained; (c) the account is a joint account as well as the number of the joint account holders; (d) the type of financial account; and (e) the role of the Controlling Person in relation to the Entity Account Holder.

This does not come as a surprise for those who were already working on that subject in 2016. At that time, it was foreseen by the EU to assess in a short timeframe DAC2 effectiveness and add those fields to the existing reporting. Eventually it came only 10 years later...

By incorporating these additional fields into the CRS reporting framework, tax authorities will be better equipped to verify whether RFIs collected insufficient documentation or data from accountholders. This will also enable them to refine their information requests during tax audits by prioritizing these cases.

As a possible scenario, tax authorities can focus on the lack of documentation obtained for newly opened accounts and determine themselves if the validity status reported by the RFI is wrong based on a simple automatic check performed on 3 new data points. When crossing the information on new accounts with some mandatory reporting fields like the Tax Identification Number (TIN) and/or the validity status of self-certification, tax authorities will detect what are the RFIs which have some deficiency patterns in their CRS processes. This targeted approach will enhance the effectiveness of regulatory compliance oversight by allowing tax authorities to address specific areas of concern more efficiently and possibly issue more penalties automatically.

Penalty regime

And penalties levels will certainly not decrease in the future... Contrary to what was initially discussed at EU level, there will be no harmonization of the penalty regime within the EU. The initial draft proposed a minimum penalty of EUR 50,000 for DAC2, DAC6, DAC7, and DAC8 reporting issues. The final directive allows member states to enforce penalties independently. In Luxembourg, penalties can reach up to EUR 250,000 for non-compliance in DAC2, DAC6, and DAC7, with a minimum of EUR 10,000, one of the highest in the EU.

Further tax transparency amendments

DAC8 also introduces an exchange of information related to advance cross-border tax rulings for high-net-worth individuals (i.e., those with transactions covered by the ruling exceeding EUR 1.5 million) that have been issued, modified, or renewed after 1 January 2026 with the stated intention, “to reduce the risks of tax evasion, tax avoidance and tax fraud,” as the current provisions of DAC do not cover this type of income.

DAC8 also includes provisions to adapt DAC6 to ensure that Member States give intermediaries the right to a waiver from filing information on a reportable cross-border arrangement where the reporting obligation would breach the legal professional privilege under the national law of that Member State.

Furthermore, DAC8 also enforces an increased availability of TINs for reporting and communication to help tax authorities identify relevant taxpayers and correctly assess the related taxes.

In conclusion, less than 8 months away from DAC8 implementation, RFIs (already in scope entities but also EMIs and CASPs) should start the analysis of their legacy data , carefully review their operating model to ensure that any potential compliance gaps are identified and corrected before the entry into force of the Directive in January 2026. For the new actors in scope like CASPs and EMIs, establishing a strong governance on those new due diligence and reporting processes is a particularly important step that needs to be thoughtfully addressed without delay. Underestimating this will lead to more systematic potential penalties from tax authorities.

^{(1)  Whether they are regulated or not (the latter will be required to register in one single Member State for the purpose of complying with their reporting obligations)
(2)  Accounts opened before DAC2 entry into force date on 1st January 2016}