DAC8 (EU) and CARF (UK): How 2026 Marks the Shift to Mandatory Crypto Tax Surveillance
From TIN onboarding to enforced transaction lockouts after 60 days of non-compliance
Beginning 1 January 2026, crypto platforms operating with users in the European Union entered a new regulatory phase. Under DAC8, service providers are now required to collect tax-identifying information and prepare for compulsory annual reporting. Where users refuse to cooperate, platforms may be legally required to disable access to reportable crypto transactions following a defined notice period.
At the same time, the United Kingdom is rolling out its own implementation of the OECD Cryptoasset Reporting Framework (CARF), with disclosures to HMRC starting in 2027 for transactions conducted in 2026.
This development does not create a new tax burden on crypto users. Instead, it establishes a coordinated enforcement infrastructure, transforming regulated crypto platforms into standardized tax-reporting intermediaries.
Regulatory Snapshot
| Jurisdiction | Framework | Data Collection Starts | First Reporting Deadline |
|---|---|---|---|
| European Union | DAC8 (Directive (EU) 2023/2226) | 1 January 2026 | 30 September 2027 |
| United Kingdom | OECD CARF (HMRC) | 1 January 2026 | 1 Jan – 31 May 2027 |
The Core Mechanism in Simple Terms
Public discourse has portrayed January 2026 as a sudden crackdown on crypto privacy. In reality, the shift is procedural, not instantaneous—but operationally demanding.
Under DAC8, 2026 becomes the mandatory data capture year. No immediate cross-border data sharing occurs at that point. Instead, platforms must spend 2026 collecting standardized user and transaction data so that tax authorities can begin automated exchanges in 2027.
In effect, 2026 functions as the calibration year for future enforcement.
Who Is Required to Comply?
DAC8 applies to Reporting Crypto-Asset Service Providers (RCASPs). These are entities—or, in limited cases, individuals—that facilitate exchange or transfer transactions involving crypto-assets on behalf of customers.
Covered actors typically include:
- Centralized crypto exchanges
- Brokerage-style trading platforms
- Custodial wallet providers
- Intermediated transfer services
The scope mirrors MiCA classifications and extends to a wide range of crypto-assets, including:
- Cryptocurrencies
- Stablecoins (including e-money tokens)
- Certain NFT structures when used for payment or investment purposes
Non-custodial wallet software without transaction intermediation generally falls outside the reporting perimeter. However, once funds pass through a reporting provider, the compliance trail reactivates immediately.
What Information Must Be Collected?
DAC8 imposes mandatory, automatic reporting obligations.
Platforms must obtain and annually disclose:
- User identity and tax residency details
- Tax Identification Numbers (TINs)
- Aggregated gross values of acquisitions and disposals
- Transaction totals involving fiat and other crypto-assets
- Fair market value calculations for relevant transfers and payments
Notably, DAC8 explicitly includes transfers to distributed ledger addresses not linked to another service provider or financial institution. This provision establishes the reporting basis for withdrawals to self-custody wallets.
Enforcement Trigger: The 60-Day Compliance Window
The widely referenced 60-day rule is often misunderstood.
DAC8 does not authorize confiscation or forced access to private wallets. Instead, it creates an obligation on platforms to restrict functionality.
If a user:
- Fails to submit required tax information
- Ignores two formal reminders
- Remains non-compliant for a minimum of 60 days
Then the provider must prevent that user from carrying out reportable transactions.
In practice, this can mean:
- Suspension of trading activity
- Blocking withdrawals that fall within reporting scope
- Partial or full account limitations until remediation is completed
Beyond the EU: The UK and Global Alignment
United Kingdom
The UK’s CARF implementation requires platforms to collect and report crypto transaction data to HMRC. The first reporting cycle covers calendar year 2026, with submissions due between 1 January and 31 May 2027.
Required data includes:
- Full name and address
- Date of birth
- Tax residence
- For UK residents: National Insurance number or UTR
- For non-UK residents: TIN and issuing jurisdiction
International Outlook
The EU and OECD have confirmed that multiple jurisdictions have committed to CARF-based exchanges between 2027 and 2029.
For platforms with international user bases, tax reporting convergence should now be treated as a baseline operational assumption, not a regional exception.
Self-Custody Wallets: What Changes in Practice?
DAC8 does not prohibit self-custody. However, it materially affects how transfers are reported:
- Withdrawals from exchanges to wallets such as Ledger can be classified as reportable events, including standardized valuation data.
- Activity occurring entirely within self-custody remains outside automatic reporting mechanisms.
- Once assets re-enter a reporting platform, visibility resumes.
The regulatory boundary is therefore defined by regulated on- and off-ramps, not by wallet technology itself.
Operational Impact for Crypto Platforms (2026 Readiness)
Key implementation priorities:
- Integrate TIN and tax-residency capture into onboarding and remediation flows
- Automate reminder logic and 60-day restriction triggers
- Classify transactions accurately under DAC8 and CARF taxonomies
- Apply consistent fair market value calculations
- Identify and flag withdrawals to unhosted addresses
- Prepare for cross-border reporting obligations
Governance considerations:
- GDPR-compliant data minimization
- Controlled access and retention policies
- Documented audit trails
- Incident and breach response procedures
What Users Should Prepare For
- Increased requests for tax and residency documentation
- Service interruptions if compliance requests are ignored
- Higher likelihood of discrepancy detection by tax authorities
- In the UK, HMRC will receive aggregated reports directly from platforms
Self-custody reduces exposure to platform risk—but does not eliminate tax reporting obligations.
Call for Information
Are crypto platforms using DAC8 or CARF as justification for excessive data harvesting, selective transaction freezes, or uneven enforcement practices?
Compliance professionals, affected users, and industry vendors with documented evidence of misuse or implementation failures are encouraged to submit information securely via the Scam-Or Project whistleblower section. Anonymous submissions are supported.
