DAC8: Does the end justify the means?

The European legal framework for tax transparency reached a decisive turning point with the entry into force of the DAC8 Directive on January 1, 2026.

In France, Decree No. 2025-1276 of December 19, 2025, finalizes the transposition of this instrument, marking a shift from near-total opacity to the administration’s quasi-omniscience regarding crypto-asset flows.

While the exercise of sovereignty requires the State to possess the means of its power, the pursuit of its public interest missions must not infringe upon fundamental rights unless such interference is appropriate and proportionate. In the field of crypto-assets, the scope of the measures deployed is dictated by several assumptions whose speculative nature could lead them to be deemed excessive, particularly in light of the risks they pose to the right to privacy and, more fundamentally, the right to life.

The Means

The new framework imposes exhaustive annual due diligence and reporting obligations on Crypto-Asset Service Providers (CASPs), including staking and lending services. The mechanism relies on a “Tax KYC” process, under which users must provide a self-certification of residence upon registration or before December 31, 2026, failing which their accounts will be frozen.

Annually, the CASP must report to its competent tax authority a comprehensive and detailed list of user transactions: amounts deposited in fiat or crypto-assets (including justifications for the deposit, such as cashback or staking), executed transactions (crypto-to-fiat, fiat-to-crypto, crypto-to-crypto), and fiat or crypto withdrawals. Every movement, regardless of how nominal, will be disclosed to the tax administration. Only specific categories of users remain exempt from this generalized surveillance (listed companies, public entities, international organizations, central banks, and certain financial institutions).

To ensure compliance, CASPs may face penalties of up to €2 million per year for reporting failures. The information collected will be automatically exchanged between participating States (initially EU Member States and subsequently signatories to the MCAA-CARF multilateral agreement).

The End and the Risks

This pursuit of absolute transparency is justified by the objective of combating tax fraud and tax evasion, given that the “decentralized nature of crypto-assets complicates the task of Member States’ tax administrations” (Directive 2023/2226, Recital 6). While this objective may be sufficiently commendable to justify an interference with fundamental rights, such interference is only legitimate if it is necessary and proportionate to the aim pursued. This principle of proportionality defines the limits of public action.

The DAC8 framework effectively infringes upon several fundamental rights:

• Privacy: The automatic consultation of financial data, such as crypto-asset flows, by the tax administration constitutes an interference with the right to respect for private life (ECHR, Dec. 1, 2015, No. 69436/10). Beyond being mere speculative assets, crypto-assets—much like legal tender—serve as a means of payment and may reveal intimate personal details.
• Security: Recent events in France (physical assaults on crypto-holders, the breach of the national bank account database [Ficoba], and the resale of personal data by a tax official) suggest that this mass data collection, by creating “honeypot” risks, also constitutes a threat to the right to life, from which the right to security is derived, as well as the right to the protection of personal data (EUCFR, Art. 8).

The Disproportionality

The legitimacy of such an interference is questionable on several grounds.

First, the measures may be deemed unsuitable for combating tax fraud insofar as much of the information transmitted (deposits, withdrawals, exchanges) is insufficient, on its own, to determine the amount of tax evaded. Furthermore, recent examples of similar frameworks demonstrate a low impact on reporting rates, often resulting in migration to foreign platforms or on-chain activity.

Second, the interference may be considered disproportionate as it establishes generalized mass surveillance of an asset class: it applies to all taxpayers from the first euro, regardless of their specific fraud risk profile. Moreover, it covers the entirety of transactions, whereas less intrusive information (e.g., year-end balances, as seen with bank accounts) would suffice to ensure an adequate level of oversight.

Finally, the measures lack sufficient safeguards. Such an intrusion must be subject to prior or ex-post judicial review (ECHR, Jan. 8, 2026, No. 40607/19). However, no legal remedy is provided to verify the lawfulness of the collection or the accuracy of the data transmitted by platforms (which currently disclaim all liability for errors in transaction histories). Taxpayers will only become aware of this data if it is used in a tax reassessment and if they specifically request it.

Thus, the legal legitimacy of the framework appears as debatable as these concerns currently seem ignored. Had the Directive proposed providing the tax administration with a read-only API for all taxpayers’ bank accounts, it would undoubtedly have met with a legitimate outcry. Only prevailing misconceptions explain such unanimity regarding these excessive infringements: that any means are justified to combat an asset perceived solely as a vehicle for unbridled speculation and organized crime.