DAC8 & OECD CARF: Crypto Tax Reporting in the EU and Beyond

If you thought crypto could stay in the shadows forever, I have news for you.

Recently, I was asked to help journalists explain on their media what OECD CARF and DAC 8 mean for the average person. Not in tax jargon, not in regulatory speak, but in plain language that actually matters. 

In this blog, I share my take on it, with two very important warnings to both individual and corporate crypto investors - warnings that could save you from serious financial pain.

Non-tax practitioners need to understand that at the moment, there are no other international laws covering crypto taxation. Most likely there won't be any. This means the legislation of the jurisdiction where you are a tax resident is not just important, it is everything. And as of January 2026, that game has fundamentally changed.

The Arrival of DAC8 and CARF

As of 1 January 2026, DAC8 formally entered into force across the European Union. This marks a colossal shift in how crypto-assets are treated for tax transparency purposes within the EU. But DAC8 should not be viewed in isolation.

In reality, DAC8 is the EU implementation layer of a much broader international framework: the OECD Crypto-Asset Reporting Framework (CARF). And CARF is no longer hypothetical—it now has a concrete global rollout timeline.

Taken together, DAC8 and CARF mean that crypto tax reporting is moving from regional regulation to global automatic exchange of information.

DAC8: The EU Layer

DAC8 amends the Directive on Administrative Cooperation to introduce automatic exchange of information on crypto-assets between EU Member States. It does not create new taxes. It creates structured visibility. Under DAC8, Reportable Crypto-Asset Service Providers (RCASPs) must collect, verify and report:

• Taxpayer identification and tax residence,
• Crypto-to-fiat transactions,
• Crypto-to-crypto exchanges,
• Crypto payments,
• Transfers between hosted platforms and self-custody wallets.

Reported data is exchanged automatically between EU tax authorities. Sidenote from me is that some tax authorities don't exchange information automatically (for example, when they were recently hacked). This moves crypto firmly into the same enforcement architecture that already exists for bank accounts, securities, and investment income.

Entry into Force vs. Implementation Reality

Formally:

• DAC8 had to be transposed by 31 December 2025
• It entered into force on 1 January 2026

Practically (as highlighted in recent IBFD analysis):

• Implementation across Member States is uneven,
• Several jurisdictions are still finalising legislation,
• And key operational elements (IT systems, portals, reporting guidance) are still being built.

This does not delay DAC8 but it does mean that 2026 is a transition year in practice, especially for cross-border operators.

CARF: The Global Backbone Behind DAC8

Here, it is interesting to note that the 47 countries will exchange data from 2026. The 27 from 2027. The United States will exchange 2028 data in 2029 (or may be never). Me and many other colleagues are sceptical of the USA committing, since they ditched Pillar II. So some crypto investors have more time to get their ducks in a row than others.

DAC8 is explicitly based on the OECD's Crypto-Asset Reporting Framework (CARF). CARF is designed to ensure that crypto-asset reporting works globally, not just within the EU. And as of November 2025, the OECD Global Forum published a clear commitment schedule.

For EU-based businesses, this means DAC8 data will start flowing internationally almost immediately. This closes many of the classic "non-EU" assumptions around reporting gaps. Only a small number of countries (e.g. Argentina, India, Vietnam) are still uncommitted as of the last update.

Why This Matters

A common mistake we still see is treating DAC8 as a purely European compliance issue. It is not.

DAC8 is the EU's CARF implementation, meaning:

• EU platforms will report under DAC8,
• that data will be exchanged under EU rules,
• and then increasingly matched globally under CARF.

In other words, what starts as EU reporting does not stay in the EU.

Tax Residence Is the Real Risk Vector

Both DAC8 and CARF rely on tax residence, not citizenship or incorporation. If tax residence data is wrong, outdated, or inconsistently applied, the same crypto activity can be reported to the wrong jurisdiction, or reported to multiple jurisdictions. For founders, executives, and investors with international mobility, residence analysis is now a first-order compliance issue.

The last 6 years, I have seen the same mistake over and over again. Either people blindly but confidently believe that their passport equals their tax residency. Or worse, they think they tricked the system by being on work-holiday in Thailand for 3 months (for example). Both will get you into trouble 100% with the tax authorities, especially because they can go back retrospectively and tax assess you (plus fine you).

Self-Custody and DeFi

Back in 2020 I heard EU representatives in Brussels honestly ask us, "Help us with self-custodial wallets. They are our biggest headaches." Six years later, self-custody remains legal but authorities no longer "fear it". Transfers between regulated platforms and private wallets are reportable, and platform-level visibility does not disappear once assets move on-chain.

For DeFi, the familiar question applies: Is there a reportable intermediary or service provider?

Where there is governance, facilitation or control, reporting obligations may arise, mirroring the same fault lines already visible under MiCA.

Enforcement Is Built Into the Design

Both DAC8 and CARF are embedded in:

• Audit cooperation,
• Recovery assistance,
• Enforcement mechanisms.

Crypto is no longer structurally outside the tax enforcement perimeter. The narrative of "technical unreachability" no longer aligns with regulatory reality.

What This Means in Practice (2026–2029)

From our perspective, this means:

• CASPs must prepare for EU and global reporting simultaneously
• Data consistency across platforms, wallets and filings becomes critical
• Historic activity will increasingly be contextualized retroactively
• Jurisdictional arbitrage based on reporting gaps is rapidly disappearing

I personally feel sorry for CASPs because they have been hit with avalanches of compliance in the last few years like no other industry I have serviced. The only reason why these companies are not dying out is because they are technology savvy and automate everything as much as possible.

I don't need to be a clairvoyant to predict that there will be many angry customers with blocked accounts. They have been warned that they need to provide KYC numerous times. They didn't comply. And now the hands of CASPs are tied. So before you send an angry email to some overworked and overcaffeinated compliance officer, breathe deep please and be kind. You did this to yourself by trying to be an outlaw.

In Summary

MiCA decides who may operate in crypto markets.

DAC8 decides what EU tax authorities know.

CARF decides who else will know worldwide.

Together, they mark crypto's final integration into the global tax transparency framework.

‍