The EU switched on automatic crypto reporting: what goes to the tax office
Since 1 January 2026 crypto platforms serving customers in the European Union have been collecting data for the tax authorities. This is DAC8, the European version of an international standard called the Crypto-Asset Reporting Framework. It is not a new tax. It is a pipe: what you did on a platform during 2026 goes to your national tax office between January and September 2027, and from there to the other member states.
What exactly reaches the tax office
Two blocks. Who you are: full name, address, date of birth, tax identification number and country of residence. And what you did, aggregated for the year by asset: purchases and sales against ordinary money, exchanges of one crypto-asset for another, retail payments above fifty thousand dollars, and transfers, including transfers out to addresses that do not belong to any regulated provider.
That last category is the one people underestimate. When you withdraw from an exchange to your own wallet, the withdrawal is reported along with the destination address, and the report carries a flag for whether the address is believed to be yours. Nobody sees your keys. Everybody sees that a named person moved an amount to a specific address on a specific date.
Who has to report
The obligation falls on providers that hold or move assets for you: exchanges, custodial wallets, brokers, some payment processors. A company outside the EU that serves EU residents does not escape it either; it has to register in a member state and report anyway. What is not covered is software that never touches your funds, which is why a self-custody wallet app has nothing to hand over.
Non-custodial does not mean invisible
Marketing is currently selling the opposite. Moving coins to your own wallet removes one reporter from the chain, not the record: the exchange already reported the withdrawal and the address, the blockchain keeps that address forever, and the moment you convert anything back into ordinary money you are standing in front of a regulated provider again. Since December 2024 a separate European rule adds that transfers above a thousand euro to a self-hosted address must be checked to confirm the address really is yours, and saying so yourself is not enough.
What changes for an ordinary user
Nothing about how much tax you owe. Everything about verification. Until now a declaration was mostly taken on trust unless something drew attention; from 2027 the office receives an annual summary of your activity from the platform side and can compare it with what you filed, automatically, for every resident at once. Discrepancies stop being a matter of luck.
Two practical consequences. Keep your own records now rather than reconstructing them in a year, because the platform's numbers will exist whether or not yours do. And expect requests for a tax identification number and country of residence on services that never asked before: that is the same directive arriving, not a website being nosy.
What stays outside
Trades between two people, and activity that never touches a regulated provider, are outside the direct scope today. That is a description of the current perimeter, not a loophole: the perimeter is where crypto meets ordinary money, and almost everyone crosses it eventually. The trajectory is visible in the design of the standard itself, which is written to be adopted well beyond the EU.
