DAC8 — EU Crypto Reporting Rules Taking Effect in 2026

What is DAC8 and why does it change the game?

DAC8 is the common name for Council Directive (EU) 2023/2226 of 17 October 2023, amending Directive 2011/16/EU on administrative cooperation in the field of taxation. In practice, every crypto-asset service provider (CASP) operating within the European Union must now collect and transmit data on its users' cryptocurrency transactions — regardless of whether the user is a tax resident of the same country.

Until now, cryptocurrencies sat in a regulatory blind spot. KAS (Krajowa Administracja Skarbowa — Poland's National Revenue Administration) had no systematic access to trading data from foreign exchanges. DAC8 closes that gap: information will be exchanged automatically between the tax authorities of all 27 EU member states, much like the Common Reporting Standard (CRS) has worked for bank accounts for years. For expats in Poland, this means your home country's tax office will also receive your crypto trading data from Polish platforms — and vice versa.

The broader context matters too: DAC8 is the EU's implementation of CARF (Crypto-Asset Reporting Framework), a standard developed by the OECD. For Polish-based entrepreneurs trading crypto within their business (a topic we covered in our guide to cryptocurrency in a Polish company), this adds a new compliance layer whose cost and complexity should not be underestimated.

Key dates and implementation timeline for DAC8 in Poland

1. 17 October 2023 — Council Directive 2023/2226 adopted by the EU Council.
2. 31 December 2025 — deadline for transposition into national law (implementation in Polish legislation).
3. 1 January 2026 — rules take effect; first reporting year begins.
4. 31 January 2027 — deadline for submitting the first DAC8 reports to KAS for the 2026 tax year.

Practical note: The Polish Council of Ministers approved the draft amendment to the Act on Exchange of Tax Information with Other Countries only on 17 December 2025. Following a pattern of delays seen with DAC7 (digital platforms), Poland likely missed the transposition deadline. However, this does not relieve CASPs of their data-collection duties from 1 January 2026 onward, since the obligation flows directly from the EU directive and MiCA regulations.

Who must report — entities covered by DAC8

The reporting obligation falls on Crypto-Asset Service Providers (CASPs), specifically:

• Cryptocurrency exchanges (e.g. Binance, Zonda, ZondaCrypto),
• Operators of crypto-asset trading platforms (DEXs with a custodial element),
• Token issuers (in relation to ICO/IEO/IDO offerings),
• Custodial wallet providers,
• Other intermediaries in the acquisition, disposal, or transfer of crypto-assets — including OTC brokers.

If you run a company in Poland that in any way intermediates crypto-asset trading, you need to verify whether you fall under the CASP definition in Article 8ac of Directive 2011/16/EU (as amended by DAC8). This is especially relevant for foreigners who have set up a JDG (Jednoosobowa Działalność Gospodarcza — sole proprietorship) or Sp. z o.o. (limited liability company) in Poland and operate in the crypto space.

What data goes to KAS — scope of reporting

CARF DAC8 Poland — the reporting requirements cover two categories of data:

Category	Data scope	Example
User data	Full name, address, NIP (Numer Identyfikacji Podatkowej — tax ID) or foreign TIN, date of birth, country of tax residence	Jan Kowalski, PL, NIP 1234567890
Transaction data	Type of crypto-asset, transaction date, gross amount (in fiat currency or market value), transaction type (sale, exchange, transfer)	Sale of 0.5 BTC for 98,200 PLN, 15.03.2026
Aggregated balances	Portfolio value at the end of the reporting period	Balance: 2.3 ETH = 27,400 PLN (31.12.2026)

An important detail: reportable transactions cover EU residents — but the CASP must verify the tax residency of every user, not just those who voluntarily provide a TIN. For expats, this means your Polish NIP or PESEL (national ID number) and your declared country of tax residence will be cross-referenced across borders.

DAC8 and other regulations — how it fits with MiCA, DAC7, and CARF

These rules stack on top of each other. For clarity, here's a comparison:

Regulation	Scope	Effective from	Purpose
DAC8	Automatic exchange of tax information on crypto-assets	1 Jan 2026	Tax transparency, automatic data exchange
MiCA	Regulation of crypto-asset markets (CASP licensing)	30 Dec 2024 (full)	Consumer protection, financial stability
DAC7	Digital platforms (e-commerce, services)	1 Jan 2023	Reporting on platform sellers
CARF (OECD)	Global crypto-asset reporting standard	2027 (data exchange)	CRS equivalent for crypto — DAC8 is the EU version of CARF

In the context of the global minimum tax of 15% and growing fiscal transparency, the trend is clear: the era of anonymous crypto trading in the EU is coming to an end.

Penalties for breaching DAC8 obligations

The directive requires member states to introduce "effective, proportionate, and dissuasive" sanctions. The Polish draft amendment provides penalties for the following:

• Failure to register as a CASP in the reporting entity register — administrative fine up to 1,000,000 PLN.
• Failure to file a report by the deadline (31 January of the following year) — disciplinary fine plus an administrative penalty.
• Filing an inaccurate report — obligation to correct within 14 days of being notified, with fines up to 500,000 PLN per violation.
• Failure to suspend a user who has not provided a TIN within 60 days — the CASP is liable for non-compliance with the due diligence procedure.
• Insufficient record-keeping — data must be retained for 5 years; missing documentation is penalized as if no report were filed.

For comparison: under DAC7 (digital platforms), the maximum administrative fine is 1,000,000 PLN (Art. 90d of the Act on Exchange of Tax Information). DAC8 penalties are expected to be at least comparable, if not higher.

CASP due diligence obligations — step by step

As a crypto-asset service provider, you must implement a user verification procedure (tax-focused KYC) covering:

1. User identification — collect the user's full name, address, date of birth, and TIN (in Poland: NIP for businesses or PESEL for individuals).
2. Tax residency verification — based on a self-certification (user's declaration) confirmed by IP address, identity document, or correspondence address.
3. 60-day TIN deadline — if a user does not provide a tax identification number within 60 days of registration, the CASP must suspend the account until the data is supplied.
4. Ongoing updates — once per calendar year, verify that the user's data (especially tax residency) remains current.
5. Record-keeping — retain all data and supporting documents for a minimum of 5 years from the date the report is filed.

From an accounting-software perspective, none of the popular Polish tools — Comarch Optima, Symfonia, or InFakt — currently offer a DAC8 reporting module. Polish exchanges (ZondaCrypto) are building proprietary reporting systems; smaller entities will need to consider dedicated compliance solutions (e.g. Sumsub, Crystal Blockchain, Notabene).

Practical example — what does a DAC8 report look like?

Suppose you run a P2P crypto trading platform as a Sp. z o.o. in Poland. In 2026, your users carry out 12,000 transactions. By 31 January 2027, you must prepare an XML file (in the format specified by the Commission's implementing regulation) containing:

• Identification data for every EU-resident user,
• Details of each transaction: date, amount in PLN (or its equivalent at the exchange rate on the transaction date), type of crypto-asset (BTC, ETH, USDT, etc.),
• Operation type: sale for fiat, crypto-to-crypto exchange, transfer to an external wallet,
• The aggregated portfolio value for each user as of 31 December 2026.

The report is submitted electronically to the Head of KAS. The data is then automatically forwarded to the tax authority of each user's country of residence — for example, a German tax resident's data would be sent to the BZSt (Bundeszentralamt für Steuern). This is exactly how CRS works for bank accounts, now extended to crypto.

What does this mean for individual crypto investors?

If you don't operate a platform but simply invest in cryptocurrencies, DAC8 does not impose a direct reporting obligation on you. However:

• KAS and crypto — the tax office will receive full data about your transactions from every EU-based exchange. Cross-referencing this data against your PIT-38 (the annual tax return for capital gains) will be automatic.
• If you have not declared crypto income in your annual tax return, the risk of an audit increases dramatically.
• The statute of limitations for tax liabilities is 5 years (Art. 70 § 1 of the Tax Ordinance — Ordynacja podatkowa) — KAS can go back to transactions from 2021–2025 based on data obtained from CASPs.

Reporting crypto gains in PIT-38 (income from financial capital, Art. 30b of the PDOF — Personal Income Tax Act) is now not only a formal obligation but a practically enforceable one. For expats, this is critical: even if you're used to filing taxes in your home country, your Polish-sourced crypto gains may need to be declared in Poland if you're a Polish tax resident. More on crypto taxation in a business context in our dedicated article.

CARF DAC8 Poland — specifics of the national implementation

Poland is implementing CARF DAC8 through an amendment to the Act of 9 March 2017 on Exchange of Tax Information with Other Countries (Journal of Laws 2017, item 648, as amended). Key elements of the Polish transposition include:

• A CASP register maintained by the Head of KAS (analogous to the DAC7 platform register).
• Obligation to file reports in XML format — XSD schema published by MF (Ministerstwo Finansów — Ministry of Finance).
• Administrative fines imposed by decision of the Head of KAS (without the need for fiscal-criminal proceedings).
• Integration with the VASP register maintained by GIIF (Generalny Inspektor Informacji Finansowej — General Inspector of Financial Information, Poland's FIU) — entities already listed in the VASP register must additionally register as reporting CASPs.

Given the transposition delay (draft adopted 17 December 2025, the act entering into force late), MF will likely announce a transitional period — but data collection from 1 January 2026 is absolutely mandatory.

How to prepare — checklist for CASPs and accountants

1. KYC audit — verify that your existing procedure collects all data required by DAC8 (TIN, tax residency, date of birth).
2. Reporting system — implement or commission an XML generation module in the DAC8/CARF format. Check whether your technology provider (e.g. Chainalysis, Elliptic, Sumsub) offers a ready-made solution.
3. 60-day procedure — implement automatic account suspension for users who have not provided a TIN after 60 days.
4. Archiving — ensure data is retained for at least 5 years in a manner compliant with GDPR (Art. 5(1)(e) GDPR — storage limitation).
5. Team training — your compliance officer, customer service team, and accounting department must understand the new obligations.
6. Registration — file an application for entry in the CASP register maintained by the Head of KAS (deadline: before submitting the first report).

Impact of DAC8 on VAT and CIT filings

DAC8 reporting itself does not change the rules for taxing cryptocurrencies — but it makes enforcement far more effective. Key points to remember:

• VAT — cryptocurrency trading (exchange for fiat) is exempt from VAT under Art. 43(1)(7) of the VAT Act (following CJEU case C-264/14, Hedqvist). However, intermediation services (exchange commissions) are subject to 23% VAT. Full details in our complete VAT guide for 2026.
• CIT — companies trading in crypto-assets must recognize revenue and costs under general rules (Art. 12 and Art. 15 of the PDOP — Corporate Income Tax Act). DAC8 data will allow KAS to cross-check against CIT-8 filings.
• Transfer pricing — if crypto transactions take place between related entities, transfer pricing rules apply (Art. 11a–11t of the PDOP).

Common mistakes to avoid

• Mistake 1: Assuming a transposition delay means no obligation. Even if the Polish act entered into force late, data must be collected from 1 January 2026. Failure to collect data will make it impossible to file a report — and that triggers penalties.
• Mistake 2: Limiting KYC to Polish residents only. CASPs must identify the tax residency of ALL users — including those from other EU states and from outside the EU (non-EU data is not exchanged, but verification is still mandatory).
• Mistake 3: Ignoring crypto-to-crypto transactions. Reporting covers not just sales for PLN or EUR, but also exchanges of one crypto-asset for another (e.g. BTC → ETH). The value must be calculated at the market rate on the transaction date.
• Mistake 4: Not implementing the 60-day suspension procedure. The directive requires suspending the account of any user who has not provided a TIN within 60 days. Failing to implement this procedure is a separate ground for sanctions.
• Mistake 5: Treating DAC8 as "just an IT problem." This is a compliance and legal issue — it requires the involvement of a tax adviser, an AML officer, and the management board. Liability rests with the reporting entity, not the software vendor.

FAQ

Does DAC8 apply to individuals who invest in crypto privately?

Not directly. The reporting obligation falls on CASPs (exchanges, platforms). However, data about your transactions will be sent to KAS automatically. You must declare crypto income in your PIT-38 — otherwise you risk a tax audit and late-payment interest (currently 14.5% per year, Art. 56 § 1 of the Tax Ordinance). If you're a foreign national with Polish tax residency, the same rules apply to you.

What if I only use exchanges based outside the EU (e.g. KuCoin, MEXC)?

Exchanges outside the EU are not covered by DAC8, but they will fall under CARF from 2027 onward (provided their jurisdiction has ratified the OECD standard). Moreover, transfers from a non-EU exchange to an EU-based exchange will still be captured. Remember that your Polish tax obligations under Art. 30b of the PDOF apply regardless of where the exchange is headquartered.

Are non-custodial wallets (MetaMask, Ledger) covered by DAC8?

No. DAC8 applies exclusively to custodial service providers — those who hold users' private keys. Self-custody wallets (MetaMask, Ledger, Trezor) are not CASPs under the directive. However, the moment you interact with an exchange (deposit or withdrawal), that transaction is reportable.

How does DAC8 affect companies operating in the crypto space?

A company — whether a JDG (sole proprietorship) or Sp. z o.o. (limited liability company) — running a crypto exchange desk or P2P platform must register as a CASP and meet the full reporting requirements. Annual compliance costs are estimated at 50,000–200,000 PLN for smaller entities (covering audits, IT systems, and legal advice). More details in our article on cryptocurrency taxation in a Polish company.

When will KAS realistically start using DAC8 data?

The first reports are due by 31 January 2027. Realistically, automated cross-checking against PIT-38 and CIT-8 filings will begin during the 2027/2028 tax season. However, keep in mind that KAS already conducts analyses based on data from Polish exchanges — ZondaCrypto, for instance, reports to GIIF (Poland's financial intelligence unit) under existing AML rules.

Key takeaways

DAC8 is a landmark shift in the tax transparency of crypto-asset trading across Europe. From 1 January 2026, every crypto-asset service provider in the EU must collect user and transaction data, and by 31 January 2027, file the first report. For taxpayers in Poland — locals and expats alike — this marks the end of an era in which KAS could only monitor crypto activity in a fragmented way.

Whether you operate an exchange, serve crypto businesses as an accountant, or simply invest in digital assets as an individual, the time to prepare is now. Review your KYC procedures, implement a reporting system, and make sure your PIT/CIT filings for 2026 are consistent with the data KAS will receive automatically under CARF DAC8 Poland.

Need help with crypto compliance or tax reporting for your business in Poland? Get in touch — we'll help you navigate the new requirements without the stress.