DAC8 Penalties: What Crypto Platforms Risk for Non-Compliance

With DAC8 now in effect across the EU, crypto service providers face real consequences for non-compliance. While specific penalty amounts vary by member state, the framework establishes clear expectations for enforcement.

Types of Violations

DAC8 violations generally fall into three categories:

1. Late Reporting

Submitting reports after the deadline (September 30, 2027 for the first reporting period). Penalties typically increase the longer the delay.

2. Incomplete or Inaccurate Reporting

Submitting reports with missing information, incorrect user data, or inaccurate transaction records. This includes failures in customer due diligence.

3. Failure to Register

Non-EU crypto service providers serving EU customers must register in an EU member state. Operating without registration is a serious violation.

Penalty Ranges

EU member states have discretion in setting specific penalty amounts, but they must be "effective, proportionate, and dissuasive." In practice, this means:

• Fines can reach tens of thousands of euros per violation
• Repeated or intentional violations face higher penalties
• In severe cases, operating licenses can be suspended or revoked

Some member states have published specific fine schedules, while others assess penalties on a case-by-case basis.

Non-EU Platforms at Risk

Platforms based outside the EU but serving EU customers face particular scrutiny. Without proper registration and compliance, they risk:

• Being blocked from operating in the EU market
• Having their services flagged to EU users
• Potential legal action in member states

The User Blocking Requirement

One enforcement mechanism built into DAC8: platforms may need to block or restrict accounts of users who refuse to provide required tax information. This happens after reminders and a grace period, but it's a real consequence that affects both platforms and users.

How to Avoid Penalties

• Implement compliant onboarding processes now
• Collect tax residency self-certifications from all users
• Validate tax identification numbers
• Maintain accurate transaction records
• Test your reporting systems before the deadline