The era of tax anonymity in cryptocurrencies is coming to an end. From January 1, 2026, the DAC8 directive imposes an unprecedented transparency framework by requiring crypto service providers to automatically transmit transaction information to the tax authorities.
For millions of European investors in crypto-assets, this regulatory shift is a game-changer. A complete analysis of this major reform.
What exactly is DAC8?
The DAC8 directiveAdopted on October 17, 2023 by the Council of the European Union, this is the eighth version of the directive on administrative cooperation in tax matters. Its main objective is to extend to crypto-assets the mechanisms for the automatic exchange of tax information already applied to traditional financial institutions.
This directive is based on the OECD's Crypto-Asset Reporting Framework (CARF), which establishes international standards for the reporting of crypto-assets. It is part of the European regulatory framework MiCA (Markets in Crypto-Assets), thus creating a coherent regulatory framework for the crypto sector.
The calendar to remember
The key dates have now been set:
- 31th December 2025 Deadline for transposition of the directive into the national law of the Member States
- 1st January 2026 : Entry into force of data collection obligations by platforms
- September 30, 2027 : First transmission of reports to tax authorities, covering the year 2026
In France, Article 54 of the 2025 Finance Law transposed these provisions into the General Tax Code, marking the end of regulatory inaction.
Who is affected by DAC8?
The platforms in the crosshairs
The directive primarily targets Reporting Crypto-Asset Service Providers (RCASPs), a broad category that includes:
- Centralized exchanges (Binance, Coinbase, Kraken, etc.)
- Trading platforms
- Custody services (cryptoasset custody)
- Cryptocurrency brokers
- Service providers facilitating crypto-asset exchanges
Platforms located outside the European Union will also have to comply with DAC8 if they wish to serve European customers. Failure to do so risks blocking by internet service providers, a coercive measure provided for by the MiCA regulation.
Target users
This applies to all residents of a partner state, as well as passive non-financial entities controlled by a resident individual, provided that they have carried out at least one reportable transaction.
???? In practical terms, if you hold cryptocurrencies on a platform regulated in the EU or serving European clients, you fall within the scope of DAC8.
What data will be transmitted to the tax authorities?
The precision of the system is surgical. The platforms will transmit the full identity of users (surname, first name, address, date and place of birth), their tax identification number (NIF), the exact balances of portfolios in euros on December 31, and the total cumulative amount of acquisitions and disposals made during the year.
This information covers:
- Buying and selling cryptocurrencies
- Crypto-to-crypto exchanges between different crypto-assets
- Transfers between portfolios
- Staking and lending revenues
- Transactions in NFTs and stablecoins
All This data will then be exchanged automatically. between the tax administrations of the Member States, creating a pan-European tax surveillance network.
Penalties for non-compliance
The system provides for a graduated arsenal of repressive measures primarily targeting failing platforms.
For service providers, penalties include 15 euros per undeclared transaction (capped at 2 million euros annually), up to 50,000 euros for overall failure, and a ban on operating after two reminders.
For users, the risks remain significant. The existing obligation to declare foreign crypto accounts via form 3916-bis remains in effect, with a fine of €750 per undeclared account. With DAC8, data matching will allow for the automatic detection of omissions.
Misconceptions that need to be dispelled now
📎 "DeFi protects me"
Many believe that decentralized finance is a safe haven, but this is a major mistake: even if a protocol like Uniswap or Aave cannot technically send a tax report, any access ramp (fiat to crypto) or exit route goes through regulated platforms.
📎 "My old, forgotten accounts are not a problem"
Many investors opened accounts during the 2021 bull run, some of which sit idle with a few hundred euros of "crypto dust." These undeclared accounts now constitute a ticking time bomb, as platforms will systematically flag them.
📎 "I'm outside the EU, I'm safe" (partly true)
Major international platforms are already complying with DAC8 to maintain access to the European market. Furthermore, since January 2025, France has been exchanging its tax data with Singapore under a bilateral agreement, foreshadowing the extension of this system beyond Europe.
The real "blind spots" are now limited to completely uncooperative jurisdictions, but access to these platforms may be blocked for Europeans.
The net is therefore tightening overall, even if some loopholes theoretically remain. For the vast majority of European cryptocurrency holders, the message is clear: transparency is becoming the norm, regardless of your nationality or country of residence within the wider European area.
How to prepare in practical terms?
Regularize before January 2026
December 2025 represents a critical window to rectify one's situation through the right to make a mistake. It is better to spontaneously declare an overlooked account than to wait for a tax audit.
Maintain rigorous accounting
Keep carefully:
- Transaction histories downloadable in CSV format
- Proof of purchase and sale
- Screenshots of your wallets
- Calculations of capital gains realized
Specialized solutions exist to automate this monitoring. Waltio Pro, certified by DINUM, automatically generates French tax forms 2086 and 3916-bis.
Check your NIF with the platforms
The platforms are currently requesting confirmation of tax identification numbers. This step is mandatory and is required to maintain your access to the services.
Bitcoin without KYC and cold wallets: what is your actual situation?
The question comes up repeatedly in crypto communities: "I bought my bitcoins without KYC and I store them on my Ledger cold wallet, am I affected by DAC8?"
The nuanced answer deserves to be explained in detail, as it rests on a fundamental distinction between what DAC8 can technically track and what the tax authorities can legally demand.
What DAC8 doesn't see directly
Let's start with the good news: non-hosted wallets, such as cold wallets, are not directly affected by DAC8. A cold wallet (Ledger, Trezor, Coldcard) is a self-managed storage device where only you possess the private keys.
There is no central entity collecting information to be transmitted to the tax authorities. By definition, a cold wallet does not have KYC since there is no intermediary.
Similarly, purely on-chain transactions between two private wallets escape DAC8's radar. If you transfer bitcoins from your Ledger to your Trezor, or to a friend's wallet, this operation remains invisible to regulated platforms and therefore to the tax authorities under DAC8.
Non-custodial DeFi protocols (Uniswap, Aave, Curve) where you interact directly via your MetaMask or Rabby wallet also fall outside the scope of the directive. No centralized entity collects or transmits this data.
Where the system catches up with you: the entry and exit points
But be warned, this technical gray area in no way means you're tax-free. The trap closes at both ends of the process: the initial purchase and the final resale.
🟠 First scenario: purchase with KYC followed by transfer to a cold wallet
If you transfer your crypto to a Ledger, the exchange will note it in its report. The tax authorities will instantly know that funds have left the custody system. Let's say you bought €10,000 worth of Bitcoin on Coinbase in 2023 and then transferred it all to your Ledger. In September 2027, the tax authorities will receive a report stating: "Client X purchased €10,000 worth of BTC on our platform and then transferred it all to an external address on March 15, 2023. Current balance on the platform: €0."
The tax authorities are therefore aware that you own these bitcoins somewhere. When you file your annual tax return, if you declare your crypto assets, everything is fine. But if you don't mention anything, an automatic alert is triggered. The French tax authorities' algorithms are now trained to detect these gaps in traceability. You may then receive a request for explanation: "Where did these €10,000 worth of bitcoins go? Did you sell them? If so, when and at what price? If not, why didn't you declare them as part of your assets?"
🟠 Second scenario: purchase without KYC, but resale with KYC
You have bought your bitcoins peer-to-peer on Bisq, Peach, or at a face-to-face meeting paid for in cash. No digital trace, no KYC. These bitcoins have been sitting peacefully on your Ledger for years. DAC8 technically has no way of knowing you own them… until the day you decide to sell.
If you transfer your BTC to Kraken to sell them for euros, the platform will identify an incoming deposit from an external address. This deposit will be reported under DAC8. The administration will suddenly see X bitcoins appear in your Kraken account, followed by a sale for Y euros. They may legitimately ask you: "Where did these bitcoins come from? When did you acquire them? At what purchase price?"
If you cannot prove the date and price of acquisition, the tax authorities will automatically apply the principle of zero acquisition cost. In other words, they will consider the entire proceeds of the sale to be taxable capital gains. On a sale of €100,000, you will pay a flat tax of 30%, or €30,000, even if your bitcoins cost you €80,000 at the time.
🟠 Third scenario: purchase AND ownership without KYC
You purchased your bitcoins without KYC and are keeping them in your cold wallet with no immediate intention of reselling them on a regulated platform. Technically, DAC8 cannot detect you. However, this situation raises several major issues.
First, the question of assets. In France, there is currently no general obligation to declare cryptocurrency holdings if they remain unconverted to fiat currency. However, this situation could change. Several European countries are considering implementing mandatory declarations of crypto assets, regardless of transactions. Germany and the Netherlands have already moved in this direction.
Next, there's the issue of proving the origin of the funds. When you want to use this money for a major purchase (real estate, car, investment), you'll have to justify the source of these funds to your bank, your notary, or the authorities in case of an audit. Without proof of the initial purchase, this justification becomes extremely difficult. Banks are bound by anti-money laundering (AML/CFT) regulations to refuse funds whose origin is not clearly established.
Finally, legislation could become stricter. Several voices in the European Parliament are advocating for extending DAC8 to DeFi protocols and non-custodial wallets beyond a certain threshold (5000 euros, according to what has been suggested).
One proposal under discussion suggests requiring hardware wallet manufacturers to collect information on large holders, or establishing a European registry of blockchain addresses held by European residents.
P2P platforms (Bisq, HodlHodl, RoboSats): the last refuge of privacy?
Faced with the deployment of DAC8, one question consistently arises: what about decentralized peer-to-peer platforms like Bisq? HodlHodl or can RoboSats transmit your information to the tax authorities?
The short answer is no, but the reality is much more nuanced.
The technical peculiarity of decentralized P2P platforms
Unlike centralized exchanges like Binance or Coinbase, True decentralized P2P platforms do not have a central legal entity that collects and stores your data.Bisq, for example, works like open-source software that you download to your computer. Transactions take place directly between users via the Tor network, without going through a central server.
HodlHodl LocalCoinSwap and HodlHodl operate on a similar model, although HodlHodl is slightly less decentralized due to its web interface. These platforms utilize multi-signature or smart contract systems to secure transactions without requiring funds to be held in custody.
Direct consequence for DAC8: These platforms do not collect your personal data (no KYC), do not store your transaction history in a centralized database, and therefore technically have nothing to transmit to tax authorities. They do not fall under the definition of RCASPs (Reporting Crypto-Asset Service Providers) covered by the directive.
Why can't DAC8 reach them directly?
The DAC8 directive specifically targets entities that provide centralized services for exchanging, custodial, or trading crypto-assets. These entities must have an identifiable legal structure, a registered office, and accountable officers. This is precisely what truly decentralized platforms lack.
Bisq, for example, is managed by a DAO (Decentralized Autonomous Organization) where decisions are made collectively by BSQ token holders. There is no CEO to sue, no central servers to seize, and no customer database to requisition. The software operates via a peer-to-peer network distributed across thousands of computers worldwide.
This architecture makes it technically impossible to apply DAC8 to these platforms. They cannot transmit what they do not possess. It's the same principle as BitTorrent for file sharing: there is no central entity to shut down.
P2P platforms (Bisq, HodlHodl, RoboSats): the last refuge of privacy?
With the deployment of DAC8, one question keeps coming up: can decentralized peer-to-peer platforms like Bisq, HodlHodl or RoboSats transmit your information to the tax authorities? The short answer is no, but the reality is much more nuanced.
The key takeaway: the simple rule to know if your data will be transmitted
Don't confuse "non-custodial" and "anonymous"! Many people mistakenly believe that if a platform sends bitcoins directly to their Ledger (non-custodial), it is not affected by DAC8. This is incorrect.
Here's the ultra-simple golden rule to know if a platform will transmit your information to the tax authorities:
✅ Ask yourself these 3 questions:
1. Does the platform ask you for your personal information?
- Name, surname, address, date of birth, telephone number
- Identity card or passport
- Selfie with your ID (KYC)
2. Do you pay with a traceable payment method?
- Credit card
- Bank transfer
- PayPal, Apple Pay, Google Pay
- Everything that passes through your bank account
3. Is there an identifiable company behind the service?
- A website with legal notices
- A reachable customer service
- A physical address for the company
- General terms and conditions of sale
If you answer YES to these 3 questions → The platform will transmit your information to the tax authorities, regardless of whether they are custodial or non-custodial.
📋 Concrete examples to help you understand:
❌ Bull Bitcoin : They ask for KYC, you pay by bank transfer/card, it's a Canadian company → Transmit your data
❌ Relay (Switzerland) : They ask for your name/surname, you pay by bank transfer, Swiss company → Transmit your data
❌ Coinbase Full KYC, card payment, American company → Transmit your data
❌ PocketBitcoin : Simple KYC, bank transfer, Swiss company → Transmit your data
✅ Bisq No KYC, you pay DIRECTLY to another person (not to the platform), no central company → Do not transmit anything (but your bank transfer leaves a trace!)
✅ RoboSats No KYC, direct peer-to-peer exchange via Lightning, decentralized software → Do not transmit anything
🎯 The real difference: WHO are you giving your money to?
Scenario A – Centralized platform (Bull Bitcoin, Relay, Coinbase) :
- You send €1000 → to the company Bull Bitcoin SA
- Bull Bitcoin buys BTC for you
- Bull Bitcoin sends BTC to your Ledger
- → Bull Bitcoin knows EVERYTHING: who you are, how much you paid, when, how many BTC
Scenario B – True P2P platform (Bisq) :
- You send €1000 → directly to Jean Dupont (private seller)
- Jean Dupont sends BTC to your Ledger
- Bisq simply connects users, without seeing either the money or your data.
- → Bisq knows NOTHING, therefore cannot transmit anything
The trap of "non-custodial"
The term "non-custodial" simply means that The platform does not store your cryptocurrencies.It sends them directly to your wallet. But that does NOT mean it doesn't collect your personal information!
🔑 In summary: the absolute rule
If a platform asks you to identify yourself AND you pay it with your traceable money (card/transfer), consider that the tax authorities will be informed of your purchases, period.
The fact that your bitcoins go directly to your Ledger makes absolutely no difference. DAC8 targets intermediaries that facilitate fiat-to-crypto exchange, not crypto custody.
Why DAC8 can't reach some P2P platforms
The DAC8 directive specifically targets entities that provide centralized services for exchanging, custodial, or trading crypto-assets. These entities must have an identifiable legal structure, a registered office, and accountable officers. This is precisely what truly decentralized platforms lack.
Bisq, for example, is managed by a DAO (Decentralized Autonomous Organization) where decisions are made collectively by BSQ token holders. There is no CEO to sue, no central servers to seize, and no customer database to requisition. The software operates via a peer-to-peer network distributed across thousands of computers worldwide.
This architecture makes it technically impossible to apply DAC8 to these platforms. They cannot transmit what they do not possess. It's the same principle as BitTorrent for file sharing: there is no central entity to shut down.
The limits of this confidentiality on P2P
But be aware, this technical immunity does not mean you are completely off the tax radar. Several factors significantly limit the protection offered by P2P platforms:
The problem of entry and exit ramps
This is the Achilles' heel of the entire system. To buy bitcoins on Bisq, you must make a bank transfer to the other party. This transfer leaves a bank record with a description that is often quite explicit, such as "BTC Purchase" or "Bisq trade ID 123456." Banks are required to report suspicious transactions as part of anti-money laundering regulations. Regular transfers with crypto references can trigger questions from your bank or, worse, a report to Tracfin (the French anti-money laundering unit).
Similarly, if you sell your bitcoins via P2P and receive a transfer of several thousand euros marked "bitcoin sale," your bank will inevitably ask you to justify the origin of these funds. You will then have to explain that you sold cryptocurrencies, which ends any possibility of tax confidentiality.
Limited volume and less competitive prices
Liquidity on P2P platforms is incomparably lower than on centralized exchanges. On Bisq, you'll rarely find more than 50-100 active offers for euros at any one time. Spreads (the difference between the buy and sell price) often reach 3-5%, compared to 0,1% on Binance. For large amounts (over €10,000), it can take several days or weeks to find a counterparty at the right price.
This economic friction naturally limits the use of these platforms to privacy purists and those investing small amounts. For the majority of investors, the practical drawbacks outweigh the privacy advantages.
The €1,000 threshold and the Travel Rule
A crucial element often overlooked is the European Travel Rule, which comes into effect alongside DAC8. Withdrawals of €1,000 or more to a self-custody wallet now require verification of the recipient wallet. In practical terms, if you transfer more than €1,000 from Coinbase to your Ledger, the platform will ask you to prove that the address belongs to you (by signing a cryptographic message or providing additional information).
This measure creates a direct link between your verified identity on the platform and your cold wallet addresses. The tax authorities will theoretically be able to track fund movements on the blockchain from these known addresses, even if these transactions occur between private wallets.
Attempting to circumvent this threshold by making multiple small withdrawals of €999 is a mistake. Monitoring algorithms detect these artificially splitting (smurfing) patterns, which are considered a deliberate attempt to evade reporting requirements. This behavior constitutes an aggravating circumstance in the event of an audit.
What concrete steps should you take if you find yourself in one of these situations?
If your bitcoins were purchased with KYC
Even though they are now in your cold wallet, consider them traceable. Declare your crypto assets honestly on your tax returns. Carefully keep all supporting documents: screenshots of your purchases, blockchain transactions (TXID), and CSV exports from the platforms used. When you sell, you will need to prove your acquisition cost to correctly calculate your capital gain.
If your bitcoins were purchased without KYC but the amount is modest
Below a few thousand euros, the risk of in-depth scrutiny remains limited. However, we recommend documenting the origin of your funds as thoroughly as possible: screenshots of peer-to-peer conversations, bank transfer receipts to your counterparty, and any evidence that proves the purchase took place on a specific date and at a specific price. Store this information in an encrypted digital vault.
If your bitcoins represent a significant sum (>50,000 euros) and were acquired without KYC
You are in a high-risk zone. We strongly advise you to consult a tax lawyer specializing in crypto-assets to assess your options. In some cases, voluntary regularization through the right to make a mistake may be possible, especially if the purchase is old and documentable. The cost of this regularization will always be less than the penalties and fines of a late tax audit.
If you plan to sell soon
Anticipate the issue of proof of origin. If you have no supporting documentation, you will be taxed on the entire proceeds of the sale as a full capital gain. In this case, you have two options: accept this maximum tax rate (30% on the total), or find alternative liquidation methods (peer-to-peer lending, a phased sale spread over several years to dilute the tax impact, or relocating to a more favorable jurisdiction before the sale if you are considering expatriation).
⚠️ Cold wallet does not mean lawless zone
The idea that a cold wallet constitutes an inviolable tax haven is a myth. Technical sovereignty over your private keys does not exempt you from your tax obligations. DAC8 does not change tax law; it simply improves the tax authorities' control and detection capabilities.
In France, any gain realized from the sale of digital assets is taxable, regardless of the purchase or storage method. The fact that the tax authorities cannot technically see your bitcoins on your Ledger does not legally entitle you to fail to declare them.
The impact on the European crypto ecosystem
Forced professionalization
Compliance costs represent a significant barrier to entry for new players, which could paradoxically strengthen the position of large, established platforms. Players with the most advanced KYC and reporting infrastructures will gain a competitive advantage.
Towards a gradual tax harmonization
Two developments are being studied at the European level: the extension of DAC8 to DAOs and DeFi protocols by 2027, and the adoption of a directive establishing a minimum tax rate of 15% on crypto capital gains.
What future for privacy?
The directive legitimately raises concerns about the protection of personal data. The systematic transmission of detailed financial information raises questions about user security and the protection of their privacy.
However, DAC8 proponents point out that this transparency will help legitimize crypto-assets in the eyes of regulators and the general public, effectively combating money laundering and tax fraud.
Our opinion
DAC8 undeniably marks the end of an era for cryptocurrencies in Europe. Tax anonymity, long perceived as an intrinsic attribute of Bitcoin and its successors, is giving way to regulatory imperatives.
This development was predictable and, for many industry players, even desirable. The maturity of the crypto industry necessarily depends on its integration into existing regulatory frameworks. DAC8 represents a milestone towards this normalization.
For individual investors, the message is clear: the time for tax improvisation is over. Compliance is becoming imperative, and guidance from competent professionals (chartered accountants, specialized tax lawyers) is no longer a luxury but a necessity.
The crypto revolution continues, but it is now unfolding under the watchful eye of tax authorities. A new chapter is beginning, where transparency and innovation must coexist.
sources: European Commission (taxation-customs.ec.europa.eu), Official Journal of the European Union, French Finance Law 2025, CMS Francis Lefebvre Law Firm, Bird & Bird.
Warning : This article is provided for informational purposes only and does not constitute tax or legal advice. Consult a qualified professional for your personal situation.
