dac8.org
dac8.org

What DAC8 requires. And what it means for you.

You are affected if you buy, sell or keep crypto-assets through a provider such as an exchange, broker or app. Anyone who only uses self-custody and never uses a provider is not reported.

What goes to the tax office. What stays with the provider.

Under Austria’s Crypto-Asset Reporting Obligations Act, the provider reports to the tax office every year, starting with 2026. It keeps the details, most of them already under anti-money-laundering rules.

Illustration: specimen of a 2026 annual report on Max Mustermann with name, postal address, tax residence, masked tax identification number, date of birth and the reporting provider’s details. Beside it, one sheet each for Bitcoin, Ether and Litecoin with total value, units and, for most categories, the count per transaction category.
Specimen of an annual report. Full size

Goes to the tax office

Section 18 Krypto-MPfG

  • Name, postal address and date of birth
  • Tax residence and tax identification number
  • For each crypto-asset, the annual totals for purchases, sales, exchanges and transfers: euro value, units and, for most categories, the number of transactions
  • Transfers to wallets with no known provider, usually including your own: as a total, without wallet addresses
  • Activities that often have no tax consequences, such as crypto-to-crypto exchanges

The provider must prepare this reporting data for all customers, even those who are not ultimately reported. Section 20(1) Krypto-MPfG

Stays with the provider

Section 21 FM-GwG, Regulation (EU) 2023/1113

  • Your ID and the records of your identification
  • Wallet addresses, including those of your own wallet
  • Individual transactions with time and amount, and for transfers, the sender and recipient
  • Your balance

For DAC8, the provider adds your tax identification number and tax residence to these records.

Who keeps your data, and for how long

Every year adds another report, and the longest period only starts when you close your account.

Who What How long
Your provider Your ID, wallet addresses and individual transactions currently up to ten years after the customer relationship ends Section 21 FM-GwG
Your provider Each annual report ten years after the reporting year, then it is deleted Section 20(4) Krypto-MPfG
Tax authority of another EU country, such as Germany The annual report, if you are tax-resident there at least five years; the directive sets no maximum Article 22(3) DAC
Illustration: three stacks of annual files on Max Mustermann, labelled 2026 (year 1), 2030 (year 5) and 2035 (year 10), grow taller from left to right.
If you remain a customer, from 2036 ten annual reports will always be on file.

How the reporting works

DAC8 is an EU directive extending the automatic exchange of tax information between EU countries to crypto-assets. Austria implements it through the Crypto-Asset Reporting Obligations Act (Krypto-MPfG), which has applied since 1 January 2026.

Directive (EU) 2023/2226, Federal Law Gazette I No. 96/2025

  1. 2026 Your provider records the first reporting year and prepares the reporting data for all customers. Section 20(1) Krypto-MPfG
  2. By 31 July 2027 It reports 2026 to the Austrian tax office. Section 19(2) Krypto-MPfG
  3. By 30 September 2027 If you live in Germany or another EU country, Austria passes the report on to it. Section 21 Krypto-MPfG
  4. Every year The same happens again for each following year.
How we got to DAC8

Questions and answers

Will my wallet address be reported?

No, wallet addresses are not in the annual report. But the value and units transferred to wallet addresses not known to belong to another provider are reported, as a total. This usually includes your own wallet. The wallet address and its link to you nevertheless remain stored with the provider under anti-money-laundering rules.

Can the report reveal my wealth?

Not directly. It contains annual totals, not current balances or total wealth. Your provider does know your balance, though, and over the years the reports show how much you move. Anyone who combines them with the bank account register and blockchain analysis or, after a breach, with provider records can build a detailed picture of a person’s assets.

What about purchases and sales before 2026?

They will not be reported retroactively. The first reporting period starts on 1 January 2026. A retroactive obligation would require a new law; neither DAC9 nor the current proposal to recast the directive provides for this. The provider still holds older transactions: since 2020, anti-money-laundering rules have required it to keep them, currently for up to ten years after the customer relationship ends.

I live in Germany. Who receives my data?

With a provider that reports in Austria, your annual report goes to the Austrian tax office first, and Austria passes it on to Germany by 30 September, because you are tax-resident there. Providers in Germany or another EU country report there; the data also ends up with the German tax authorities. Whatever a country receives through the exchange it must keep for at least five years under the directive, which sets no fixed maximum. Your ID, wallet addresses and individual transactions stay with the provider.

What does the complaint change for me?

Nothing yet: data collection continues during the proceedings. We are convinced that collecting data on every customer violates fundamental rights. The Data Protection Authority is bound by the law and may not review whether it is compatible with constitutional or EU law. That question therefore lies with the courts, as does whether the case goes to the Court of Justice of the European Union. How long this will take, and how individuals can take part, we are still working out.

How do I recognise phishing that uses the reporting duty?

Fake FinanzOnline messages are already circulating in Austria, asking about your holdings on the pretext of new crypto tax rules. The tax office does not ask about them by email or text message. No legitimate sender asks you to connect a wallet or enter your recovery phrase, the words that restore a wallet. Your provider reports the DAC8 data itself. Be discreet about your holdings, including with acquaintances and on social media. Watchlist Internet warning (German)

Do DAC9 and DAC10 mean more crypto surveillance?

Not automatically. DAC9 concerns minimum taxation of large corporate groups, not individual crypto users. The recast proposed in June 2026, often called DAC10, is not yet law and retains the existing crypto reporting fields.

Terms

Words with a dotted underline explain themselves when you tap them. Here are all of them, A to Z.

  • Annual report What the provider sends the tax authority every year under DAC8: name, postal address, tax residence, tax identification number, date of birth and annual totals per crypto-asset. Wallet addresses and individual transactions are not in it.
  • DAC8 A 2023 amendment to the EU directive on administrative cooperation in taxation (2011/16/EU). It extends the automatic exchange of tax data to crypto-assets.
  • FM-GwG Austria’s Financial Markets Anti-Money Laundering Act. It requires the identity check and the retention of identification and transaction records, currently until ten years after the relationship ends.
  • Honeypot A data store that gathers so much of value in one place that it attracts attackers.
  • Krypto-MPfG The Crypto-Asset Reporting Obligations Act, Austria’s implementation of DAC8, in force since 1 January 2026. It also requires providers to prepare reporting data for all customers.
  • KYC Know Your Customer: the identity check when you open an account with a provider, for example with your ID and a selfie. Anti-money-laundering rules require it, and the provider currently keeps the records until ten years after the relationship ends.
  • Provider In law, a crypto-asset service provider: exchanges, brokers and apps where you buy, sell or keep crypto-assets, including banks that offer crypto. They report under DAC8.
  • Recovery phrase Usually 12 or 24 words that restore a wallet. Whoever knows them can move the bitcoin. Never share your recovery phrase.
  • Self-custody You hold the keys to your bitcoin yourself, for example on a hardware wallet, instead of leaving them with a provider. As with cash at home, nobody has to approve a transfer.
  • Travel rule The EU transfer of funds regulation: for every crypto transfer, the provider records details of the sender and recipient, including when you transfer to your own wallet.
  • Wallet An app or device that manages the keys to your crypto-assets. If you leave them with a provider, it holds the keys for you.
  • Wallet address A string such as bc1q… that bitcoin can be sent to, much like an account number. Payments to an address are public on the blockchain. Not to be confused with your home address.

Sources

The dossier rests on legislation, EU law, court rulings and reports. Research last updated: 30 September 2026. Sources on the development from 1977 to the recast are in the history of the DAC.

Show all 37 sources Hide sources

Data breaches, attacks and fraud

Donate