DAC8: How Europe Implements CARF

DAC8 - the 8th amendment to the EU Directive on Administrative Cooperation - brings CARF requirements into European Union law with several important enhancements. For Crypto-Asset Service Providers operating in or serving the EU market, understanding DAC8 is essential for compliance.

What is DAC8?

DAC8 was adopted by the EU Council in October 2023, establishing mandatory reporting requirements for crypto-asset transactions across all 27 EU member states. The directive builds on the OECD's CARF while adding EU-specific provisions that extend the framework's reach.

Key characteristics:

• Binding on all EU member states: Must be transposed into national law
• Reporting begins January 1, 2026: First reports due by June 30, 2027
• Automatic exchange: Information shared between member states automatically
• Extended scope: Covers non-EU CASPs serving EU residents
• MiCA alignment: Coordinated with Markets in Crypto-Assets regulation

DAC8 vs CARF: Key Differences

While DAC8 implements the OECD's CARF framework, it includes several enhancements:

Extended Reporting Entity Definition

DAC8 extends reporting obligations to:

• Non-EU CASPs serving EU residents
• CASPs with no EU establishment but EU customers
• Entities providing exchange services regardless of MiCA authorization

Broader Asset Coverage

DAC8 includes additional asset types beyond base CARF:

• E-money tokens under MiCA
• Certain NFTs not covered by base CARF
• Crypto-assets issued by EU entities regardless of DLT characteristics

Enhanced Penalties

DAC8 mandates minimum penalty standards across all member states:

Violation Type	Maximum Penalty
Late reporting	Up to EUR 20,000 per report
Incorrect reporting	Up to EUR 50,000 per report
Failure to register	Up to EUR 200,000
Serious/repeated violations	Up to EUR 1,000,000
Willful evasion	Criminal liability possible

Coordination with MiCA

DAC8 aligns with the Markets in Crypto-Assets regulation:

• Consistent definitions where possible
• Combined registration for MiCA-authorized CASPs
• Shared regulatory infrastructure
• Potential for license revocation for DAC8 non-compliance

Reporting Requirements

User Information

DAC8 requires comprehensive user data collection:

• Full name and date of birth
• Address and tax residency
• TIN for each EU member state of residence
• Nationality (additional DAC8 requirement beyond base CARF)

Transaction Information

• Aggregate value by transaction type
• Number of units transacted
• Crypto-asset types involved
• Fair market value at transaction time

Covered Transactions

Same four categories as CARF:

• Crypto-to-fiat exchanges
• Crypto-to-crypto exchanges
• Transfers of crypto-assets (to non-custodial wallets)
• Retail payment transactions

Reporting Format and Deadlines

Reports must be submitted:

• In XML format per EU-adapted schema
• To the designated authority in the registration member state
• By June 30 following the reporting year (typically)

Due Diligence Requirements

New Users (from January 2026)

• Self-certification required at onboarding
• TIN validation mandatory before first reportable transaction
• Identity verification per AML requirements

Pre-Existing Users

• 12 months to complete due diligence remediation
• Must obtain self-certification
• Validate against existing information

TIN Validation

DAC8 requires TIN validation using:

• EU TIN verification module (for EU TINs)
• Member state-provided validation services
• Approved third-party services

Implementation Timeline

Practical Implications

For EU-Based CASPs

• Must comply with DAC8 in full
• May face varying national implementations
• Should coordinate with MiCA licensing
• Need to update onboarding processes by January 2026
• Must implement TIN validation systems

For Non-EU CASPs

• Must register in EU if serving EU residents
• Subject to EU penalties even without EU establishment
• Should consider EU market strategy
• May need local representative in EU
• Alternative: exit EU market entirely

Conclusion

DAC8 represents the most comprehensive crypto reporting regime globally. Its extended reach to non-EU CASPs and enhanced penalties make compliance essential for any organization serving European customers. With the January 2026 start date approaching, early preparation is critical.