DAC8 and CARF: what U.S. crypto companies need to know.

DAC8 is the EU directive that requires crypto-asset service providers to collect tax information on EU customers and report it every year, starting with 2026 transactions. It covers MiCA-licensed firms and non-EU operators serving EU residents, which can include U.S. crypto companies. Most first reports are due in 2027, and customer due diligence must be in place now.

DAC8 is the European Union’s crypto tax reporting directive, and it has applied since January 1, 2026. For U.S. crypto companies with EU customers, the hard question is whether DAC8 applies to them at all. This guide covers who DAC8 reaches, what is reported, the national filing deadlines, and how DAC8 connects to MiCA and to CARF, the OECD framework the United States has committed to adopt.

What is DAC8?

Council Directive (EU) 2023/2226, known as DAC8, amends the EU’s directive on administrative cooperation in tax. It requires reporting crypto-asset service providers to collect identity and transaction data from their customers and report it to a member state’s tax authority, which shares it with the customer’s home country. Member states had to adopt DAC8 into national law by December 31, 2025, and it applies from January 1, 2026. DAC8 closely follows the OECD’s Crypto-Asset Reporting Framework (CARF), so one compliance program can often serve both.

Does DAC8 apply to U.S. crypto companies?

It can. A reporting crypto-asset service provider is any crypto-asset service provider authorized under MiCA, and any other crypto-asset operator that carries out exchange transactions for customers who are EU tax residents. A provider falls under a member state’s rules if it is authorized or notified under MiCA there or, if it is outside MiCA, if it is tax resident, incorporated or managed in that state or has a regular place of business there.

DAC8 also requires operators outside MiCA that serve EU residents to register in a single member state (Article 8ad(7)). Advisers such as RSM read DAC8 as reaching operators based outside the EU. How member states will enforce it against a U.S. crypto company with no EU presence is not settled yet.

There is one alternative. A non-EU operator can report through its home country instead if that country exchanges the same information with the EU under a qualifying agreement (Recital 19). The United States doesn’t have that arrangement yet.

What does DAC8 require crypto providers to report?

The treatment of e-money tokens, such as euro stablecoins, isn’t fully settled. Ireland, for example, reports qualifying e-money under its existing Common Reporting Standard rules. Commission Implementing Regulation (EU) 2025/2263 sets the DAC8 reporting format.

When are DAC8 reports due? Deadlines by country

Customers who signed up before January 1, 2026, must be brought through due diligence by January 1, 2027; new customers are covered as they sign up. Member states must exchange 2026 data with each other by September 30, 2027. Each member state sets its own DAC8 filing deadline for providers:

On January 30, 2026, the European Commission sent formal notices to 12 member states that hadn’t adopted DAC8 on time: Belgium, Bulgaria, Czechia, Estonia, Greece, Spain, Cyprus, Luxembourg, Malta, the Netherlands, Poland and Portugal. Luxembourg (March 27, 2026) and Malta (May 22, 2026) have since adopted it. We update this table as national DAC8 laws change.

What are the DAC8 penalties?

DAC8 leaves penalties to each member state, which must make them “effective, proportionate and dissuasive.” There are no EU-wide minimums. Romania’s fines run from RON 20,000 to 150,000, and Luxembourg’s run from a fixed EUR 5,000 for registration and late-filing failures to EUR 250,000 for other breaches found in an audit. National laws share two further consequences. A customer who still hasn’t provided the required information 60 days after two reminders must be stopped from making reportable transactions (Ireland counts the 60 days from the second reminder, Lithuania from the first). And an operator’s registration can be revoked, with re-registration only on adequate assurances of compliance.

How does DAC8 fit with MiCA?

DAC8 is a tax reporting rule, not a license. A company providing crypto-asset services in the EU still needs MiCA authorization (Article 59), and MiCA’s reverse solicitation exception (Article 61) is narrow: it covers only services a customer requested on their own initiative. Registering for DAC8 doesn’t make an unlicensed EU business lawful, and a registration may draw a regulator’s attention to one.

CARF and where the United States stands

The OECD approved CARF in August 2022 and published the full package in June 2023. On the Global Forum’s June 2025 list, 52 jurisdictions had committed to first CARF exchanges in 2027, including the EU member states, the United Kingdom, the Cayman Islands, Japan, Korea, Canada and Brazil. Another 17 committed to 2028, including the United States, Singapore, Hong Kong and the UAE.

In the United States, Treasury’s proposed CARF rules (RIN 1545-BQ82) have been under review at the White House Office of Information and Regulatory Affairs since November 14, 2025, and haven’t been published. U.S. brokers already report on Form 1099-DA: gross proceeds from 2025 and cost basis from 2026. U.S. CARF rules are expected to add tax residence checks and reporting on non-U.S. customers, which the IRS would share with partner countries.

UK and other CARF rules already in force

• United Kingdom. The UK’s CARF regulations (SI 2025/744) took effect January 1, 2026, for UK-based providers. The first report is due May 31, 2027. The penalty is up to £300 per customer without a valid self-certification. HMRC guidance gives January 31, 2027, for registration, though the regulations read differently, so confirm the date with UK advisers.
• Cayman Islands. The first CARF return is due June 30, 2027.

What U.S. crypto companies should do now

1. Count your EU-resident and UK-resident customers, and where they live.
2. Decide whether you are a reporting provider under DAC8, and which member state you would register in.
3. Check whether your EU activity also needs MiCA authorization.
4. Add tax residence self-certification and tax ID collection to onboarding.
5. Plan due diligence on existing customers before January 1, 2027.
6. Map your transaction data to the DAC8 reporting format.
7. Set up customer reminders and the block process for customers who don’t respond.
8. Align the program with your Form 1099-DA reporting and the coming U.S. CARF rules.

What we’re watching

DAC8 and CARF questions

Does DAC8 apply to U.S. crypto exchanges?

It can. A U.S. exchange with EU-resident customers may have to register in one member state and report on those customers. How member states will enforce that against a company with no EU presence is still unsettled.

When is the first DAC8 report due?

It depends on the member state. Reports on 2026 transactions are due in 2027, from the end of January in Finland to July 31 in Germany.

What happens if a customer won’t provide a tax ID?

After two reminders and 60 days, the provider must stop that customer from making reportable transactions until the information is provided.

Is DAC8 the same as CARF?

They are closely aligned. CARF is the OECD’s global framework, and DAC8 puts it into EU law with EU rules on registration and penalties.

Does DAC8 replace MiCA?

No. DAC8 covers tax reporting. MiCA decides whether you can provide crypto-asset services in the EU at all.

When will the United States adopt CARF?

The United States has committed to first exchanges in 2028. Treasury’s proposed rules have been under White House review since November 2025 and haven’t been published.

Related: DAC8 and CARF compliance lawyers · Exchanges and custody · MiCA licensing guide · All Intelligence

Update log: October 10, 2026, first published.

Crystal V. Venning, Esq.

Founder and Managing Partner, Crypto Law Hub. Admitted in New York, Texas and Georgia. Educated at Yale University and Columbia Law School (J.D.). She advises founders, funds and institutions on digital-asset law, from stablecoins and token offerings to disputes and cross-border launches.