EU’s DAC8 crypto tax rules bring self-custody withdrawals into scope

From Jan. 1, 2026, DAC8 forces crypto platforms serving EU users to collect KYC and transaction data on trades and withdrawals, including to self-custody wallets.

Summary

• From Jan. 1, 2026, EU DAC8 rules require crypto-asset service providers to collect user identities, tax IDs and detailed transaction histories for EU tax residents.​
• Reporting covers crypto‑fiat trades, crypto‑crypto swaps and withdrawals to external addresses, bringing self‑custody destinations inside the tax reporting perimeter.​
• Platforms can freeze accounts after two reminders and a 60‑day grace period if users fail to supply a Tax Identification Number, with first full‑year reports due in 2027.

Cryptocurrency firms operating in the European Union began collecting tax data on January 1, 2026, under the bloc’s new DAC8 rules, prompting debate over privacy implications for digital asset users.

EU creates new rules for wallets

The regulations, implemented through Directive (EU) 2023/2226, require exchanges and service providers to report user information to national tax authorities, including names, tax identification numbers, and transaction histories, according to the European Commission framework.

Crypto commentator Blockchainchick posted a breakdown of the DAC8 launch on social media platform X, triggering discussion among industry observers. Some commentators have characterized the regulations as ending anonymous cryptocurrency transactions, though analysts note the rules introduce structured reporting rather than immediate enforcement measures.

Under the framework, digital asset service providers must collect customer data throughout 2026 and submit the first full-year reports by 2027. The regulations focus on building systems and gathering data in 2026, with larger enforcement effects expected later once reports can be compared across borders, according to regulatory observers.

The rules apply to all EU residents and cover crypto-to-fiat trades, crypto-to-crypto exchanges, and transfers. The definition of transfers includes withdrawals to addresses not managed by the same provider, meaning self-custody wallets and unhosted destinations fall within the reporting scope, according to European Parliament research.

Platforms may be required to freeze accounts or block transactions if users do not provide their Tax Identification Number, though account blocking follows two reminders and a 60-day window rather than an immediate freeze, according to the directive.

The European Commission estimates DAC8 could generate approximately €1.7 billion in additional annual revenue from crypto transactions, while the European Parliament cites a broader range of €1 billion to €2.4 billion per year. Providers may face about €259 million in one-time setup expenses and roughly €22.6 million to €24 million in recurring annual costs, according to Commission impact assessments.

The European Commission’s impact assessment describes a balanced approach, with aggregated data allowed in parts of the report while standardized identity and account fields enable cross-border matching. The framework increases tax visibility rather than banning self-custody, according to the directive text.

Reporting occurs annually, and the regulations target crypto-asset service providers and their EU-resident users. Activity starting at a regulated provider, including withdrawals to self-custody wallets, now falls within the regulatory reporting scope, according to the framework.