DAC 8 Article · Legal position 08/2026

DAC 8 and the closing window

Directive (EU) 2023/2226 obliges crypto asset service providers to report their users to the tax authorities, who then exchange the data automatically across the Union. For anyone with undeclared years, the practical question is not whether the data arrives, but when.

The essentials
  • Platforms, brokers, custodians and intermediaries report — including providers outside the EU serving EU users.
  • Reported data covers identity, tax identification number, residence and the trading activity itself.
  • Existing accounts are covered, not just newly opened ones.
  • What closes voluntary disclosure is arrival at your local tax office, not the report itself.
  • Note: a valid disclosure must be complete, and completeness takes weeks of preparation.

Who reports, and who does not

The scope is wider than "European exchanges", and narrower than "everything".

01

Caught: service providers

Trading platforms, brokers, custodians and intermediaries providing crypto asset services to users resident in the EU. Establishment outside the Union does not remove the obligation where the provider serves EU users.

02

Caught: existing relationships

Due diligence extends to accounts that already exist. There is no grandfathering for long-standing customers — which is precisely why undeclared earlier years are exposed.

03

Not caught: self-custody

Where there is no service provider, there is nothing to report. Holdings on your own hardware wallet are not the subject of a report.

04

Not caught: you

The obligation falls on providers, not on users. Your duty is the ordinary one — to declare your income completely and accurately.

Why self-custody protects less than it seems

Value has to enter and leave. The moment it does so through a platform, the connection between your identity and an address becomes visible — and a public blockchain can be analysed backwards from that point. Self-custody removes a report; it does not remove the trail.

What is transmitted

Two blocks of data: who you are, and what you did.

Categories of reported data
BlockContentsWhy it matters
Identification Name, address, date of birth, country or countries of residence, tax identification number Makes the account attributable to a specific person and a specific tax office
Fiat exchanges Acquisitions and disposals against legal tender, with amounts The classic entry and exit points, and the easiest to reconcile against bank data
Crypto-to-crypto Exchanges between crypto assets Each of these is a disposal under German law — the area most often left out of returns
Transfers Movements in and out, including to addresses not held with the provider Shows that holdings exist beyond the platform

The third row is the one that surprises people. Many investors declared their euro withdrawals and assumed that settled the matter. Under German law every swap is a taxable disposal, and the reported data shows those swaps directly. Why a swap resets the holding period

The route the data takes

Three stations. Only the last one matters legally.

Provider → national authority → your tax office

The provider reports to the authority of the member state in which it is registered. That authority passes the data to the state of the user's residence — in Germany, to the Federal Central Tax Office. From there it is routed to the tax office actually responsible for the individual.

Each step takes time, and the intervals are not published in a way that lets anyone plan to the day. Treating the schedule as a countdown you can run to the wire is the wrong reading of it.

The moment that counts

In our view the decisive point is arrival at the tax office responsible for you — not the report to the Federal Central Tax Office, and not the moment an official happens to open the file.

From that point a reasonable person must reckon with discovery, and section 371(2) sentence 1 no 2 of the Fiscal Code bars a voluntary disclosure. Whether anyone has actually read the data is irrelevant to the test.

  • Legal basisDirective (EU) 2023/2226
  • Reporting partythe crypto asset service provider
  • Routevia the Federal Central Tax Office
  • Decisivearrival at your local tax office
  • Barsec. 371(2) s. 1 no 2 Fiscal Code
  • Consequenceno voluntary disclosure thereafter

Once the bar applies, what remains is cooperation in the proceedings, not a disclosure with the benefit of impunity. The difference is measured in years of assessment and, above the threshold, in the surcharge under section 398a.

What this means for voluntary disclosure

The constraint is not the deadline. It is how long a complete disclosure takes to prepare.

A voluntary disclosure under section 371 of the Fiscal Code only exempts you from punishment if it is complete. Complete means all unexpired years, all types of tax, all facts. A partial disclosure is not a partial success — it fails entirely, and it puts the tax office on notice.

Why completeness takes weeks with crypto

Before anything can be declared, the transaction history has to be reconstructed: exports from every exchange, transfers between your own addresses identified, missing prices supplied for each inflow, the disposal sequence determined. Where a platform has since closed, the data has to be rebuilt from the blockchain and from bank statements.

That is the real timeline. Deciding to make a disclosure the week you expect the data to arrive is deciding too late.

  • Every year in which you were resident in Germany and traded is identified
  • All exchanges and wallets ever used are listed, including closed accounts
  • Raw exports have been secured while access still exists
  • Bank statements covering payments to and from exchanges are available
  • The scope of the disclosure has been settled before anything is filed

How a voluntary disclosure runs in practice (in German)

If you have left Germany

A point that catches people out repeatedly.

Leaving Germany ends your unlimited tax liability going forward. It does not close the years in which you were resident. If you traded during a year of German residence and did not declare it, that year stays open until the assessment period expires — ten years where evasion is established, and the limitation period does not start running until the return was due.

Two further points for departures

Where you move to a low-tax jurisdiction and retain substantial economic interests in Germany, extended limited tax liability under section 2 of the Foreign Tax Act can follow you for up to ten years. And the German tax office will in any case receive reports for the year of departure itself.

If you are planning a move rather than looking back at one, the sequence of steps matters more than the destination. Leaving Germany with crypto assets (in German)

Questions and answers

Who has to report under DAC 8?
Crypto asset service providers: trading platforms, brokers, custodians and intermediaries. Providers established outside the European Union are caught as well, to the extent they serve users resident in the EU. You are not the one reporting — you are the one being reported on.
What data is transmitted?
Identification data including your tax identification number and your country of residence, together with the transaction data for the reporting period: exchanges against fiat currency, exchanges between crypto assets, transfers and the amounts moved. It is not limited to withdrawals — it covers trading activity.
Are existing accounts covered, or only new ones?
Existing ones too. The due diligence obligations extend to established user relationships, not merely to newly opened accounts. Someone who has traded on the same platform for years is caught exactly as a new customer is. That is where the exposure for undeclared earlier years comes from.
I live outside Germany. Does this affect me?
It depends on where you are resident for tax purposes and on where you were resident in the years concerned. If you were resident in Germany during a year in which you traded, that year remains open regardless of where you live now. Leaving Germany does not close earlier years.
When does voluntary disclosure become impossible?
Once the offence has been discovered and you had to reckon with that, under section 371(2) sentence 1 no 2 of the Fiscal Code. In our view what matters is the arrival of the data at the tax office responsible for you, not the report to the Federal Central Tax Office. Whether an official has actually looked at it is irrelevant.
What about self-custodied wallets?
Holdings in self-custody are not reported — there is no reporting service provider. That protects you only to a limited extent: the moment you enter or exit through a platform, the connection becomes visible, and the blockchain itself can be analysed. Counting on staying undetected misreads the data situation.
What should I do now?
Check whether every year for which a report could supply data has been declared. If a year is open, timing is everything: a voluntary disclosure must be complete, and completeness for crypto means reconstructing the transaction history first. That takes weeks, not days.
Responsible for content: Matthias Steger, German certified tax advisor (Steuerberater), nine years as a tax auditor.
Legal position: 25 August 2026. Sources: Directive (EU) 2023/2226 and its German implementing legislation; sections 371, 398a of the Fiscal Code; section 2 of the Foreign Tax Act.
The view that arrival at the locally responsible tax office is the decisive moment reflects our own legal assessment. This article is not advice on an individual case. Where this English text and the German version differ, the German version governs.

Related