DAC8 & reporting obligations: what crypto providers tell the tax office

Since 2026, crypto providers in the EU have been recording who buys, sells and transfers bitcoin with them, and reporting it to the tax authorities once a year. The tax office learns a lot this way – but not everything it needs to assess your tax.

DAC8 and the KStTG

DAC8GlossaryDAC8 (EU reporting rules for crypto-assets)EU directive that has required crypto providers to report customer data and transactions to the tax authorities since 1 January 2026. In Germany, the KStTG implements it; the first report, for 2026, is due by 31 July 2027.On the learning path: Stage 6 · Step 3 – Bitcoin & tax →In the glossary →× is EU Directive 2023/2226. It requires crypto providers to report customer data to the tax authorities and is based on the OECD standard CARF (Crypto-Asset Reporting Framework).^[1] Germany implements it through the Crypto-Asset Tax Transparency Act (Kryptowerte-Steuertransparenz-Gesetz, KStTG); the obligations apply for the first time to calendar year 2026.^[2]

• Who reports: crypto-asset service providers (CASPsGlossaryCASP (crypto-asset service provider)A company that professionally provides crypto-asset services to customers – such as trading, exchange, custody or transfers. In the EU, every CASP needs an authorisation under MiCA.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →×) whose home member state under MiCA is Germany, plus other providers with their registered office or business activity in Germany.^[4] If your provider is licensed in another EU member state, it reports there. The data then reaches Germany’s Federal Central Tax Office (Bundeszentralamt für Steuern, BZSt) through the exchangeTermExchange (crypto exchange)A trading platform where buyers and sellers trade bitcoin with each other via an order book.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →AdLicensed providers with a paid linkProviders from our comparisonKrakenExchange · MiCA (Central Bank of Ireland)Visit Kraken* (paid link, opens in a new window)BitvavoExchange · MiCA (AFM, Netherlands)Visit Bitvavo* (paid link, opens in a new window)CoinbaseExchange · MiCA (CSSF, Luxembourg)Visit Coinbase* (paid link, opens in a new window)All 7 compared – including non-partners →*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →18+ · Crypto assets are highly volatile; you could lose all your money. No deposit protection.× between EU member states.^[1],[9]
• What is covered: bitcoin is one of the reportable crypto assets.^[3]

What is reported

The provider reports once a year for the previous year – not individual bookings, but annual totals per crypto asset. Simplified:^[7]

Category	Content of the report
Your identity	Name, address, state(s) of tax residence, tax ID, date of birth, place of birth where applicable
Purchases for euros or other government-issued currencies	Gross amount paid, number of units and of transactions
Sales for euros or other government-issued currencies	Gross amount received, number of units and of transactions
Swaps for other crypto assets	Market value, units and number, in both directions
Other incoming and outgoing transfers	Market value, units and number, by type of transfer where known
Withdrawals to addresses with no known provider – such as your own wallet	Market value and units

What the report shows – and what it doesn’t

In 2026, Anna buys bitcoin twelve times through a savings planGlossarySavings plan (Bitcoin savings plan)Automatically buying bitcoin at fixed intervals with a fixed amount, for example $50 a month. A savings plan takes the question of the right moment off your hands, but doesn’t promise a higher return.On the learning path: Stage 4 · Step 4 – Setting up a savings plan →In the glossary →× for €100 each, 0.0150 BTC in total. In November she sells 0.0050 BTC for €400; in December she withdraws 0.0100 BTC to her hardware walletGlossaryHardware walletA small dedicated device that keeps your private keys offline and signs transactions internally. The key never leaves the device, so malware on your computer can’t get at it.On the learning path: Stage 6 · Step 1 – Hardware wallets compared →In the glossary →×. Simplified, her provider’s report would look like this – in euros, because the provider reports in the currency that was paid:^[7]

Item	Total 2026	Units	Number
Purchases for euros	€1,200	0.0150 BTC	12
Sales for euros	€400	0.0050 BTC	1
Withdrawal to an address with no known provider	market value €850	0.0100 BTC	–

The statutory list includes neither an account balance nor when the bitcoin sold were bought.^[7] So the report doesn’t show whether Anna’s sale is taxable. That depends on whether the holding periodGlossaryHolding period (speculation period)In Germany, the gain from selling privately held bitcoin is tax-free if more than one year passes between purchase and sale (§ 23 EStG, as of September 2026). Each purchase has its own holding period.On the learning path: Stage 6 · Step 3 – Bitcoin & tax →In the glossary →× had ended – if Anna already held bitcoin with the same provider before 2026, older coins may have been sold – and on her total gain for the year. The report is a pointer for the tax office, not a tax calculation; Anna proves the rest with her own records.

From when: the timeline

1. 17 October 2023

   DAC8 adopted

   The EU adopts Directive (EU) 2023/2226.^[1]

2. 24 December 2025

   KStTG in force

   The German implementing law of 22 December 2025 enters into force.^[2]

3. 1 January 2026

   Data collection begins

   First reporting year; new customers submit a self-certification before their first reportable transaction.^[2],[5]

4. 1 January 2027

   Deadline for existing customers

   By then, providers must also have obtained the information from customers who joined before 2026.^[5]

5. 31 July 2027

   First report to the BZSt

   Report for 2026, then every year by 31 July for the previous year.^[2]

6. 30 September 2027

   First exchange within the EU

   EU member states exchange the data for the first time, then every year by 30 September.^[1],[9]

The self-certification: why your provider asks for your tax ID

So that the report can be matched to you, the provider obtains a self-certification: name, address, each country where you are tax-resident with the tax ID for each, and date of birth.^[2] In Germany, your eleven-digit tax ID (Steuer-ID) appears, for example, on your income tax assessment or your wage tax certificate (Lohnsteuerbescheinigung).^[11]

• New customers submit it before they can carry out reportable transactions.^[5]
• Existing customers who opened their account by 31 December 2025 will be asked by 1 January 2027.^[5]
• No reply: a reminder and a formal notice follow. If an existing customer’s information is still missing, the provider must block reportable transactions – no earlier than 60 and no later than 90 days after the first request. Once you provide the information, you can carry on.^[6]
• Changes: if the provider learns, for example, that you have moved abroad, it requests a new self-certification. You must submit it within the deadline it sets.^[2]
• Fines: anyone who intentionally or recklessly fails to submit the self-certification, or submits it incorrectly, incompletely or late, commits an administrative offence. Fines of up to €50,000 are possible.^[10]

What happens to the data

• To your tax office: the BZSt forwards the data on people tax-resident in Germany to the competent tax authority of the federal state.^[9]
• To other countries: if you are tax-resident in another EU member state or in a non-EU country with a corresponding agreement, the data goes there.^[9]
• Information for you: before the first report, the provider must tell you that data is being collected and reported, and inform you of your rights.^[8]
• Retention: the provider and the BZSt keep the data for ten years.^[2],[9]

What DAC8 means for you

No new tax

DAC8 is a reporting obligation, not a tax. For bitcoin held as a private asset in Germany, the rules remain (as of September 2026): gains are tax-free after a holding period of more than one year. Within that period, they stay tax-free as long as your total gain from such sales in the year is below €1,000 (exemption limit).^[13] Details are in Bitcoin & tax in Germany; the debate about the holding period is covered in the reform tracker.

More queries possible

Because purchase data is missing, the report may trigger queries. The tax office can request evidence, for example by questionnaire, and in individual cases ask about the source of funds, holdings as of 31 December, the wallet addresses used and transaction hashes.^[12] With purchase records, annual exports and a list of your transfers, you can answer – Record-keeping & tax tools shows how to set this up.

Self-custody: legal, but not invisible

Withdrawing bitcoin to your own wallet is legal and not a sale. The withdrawal does, however, appear in your provider’s report with amount and market value.^[7] As we understand it, nobody automatically reports what happens afterwards in your self-custodyGlossarySelf-custodyYou hold the private keys to your bitcoin yourself – in your own wallet rather than with a provider. Nobody can freeze your bitcoin. But nobody can help you if you lose your seed phrase and keys.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →× wallet – only when bitcoin arrives at a provider again does it appear in that provider’s report.^[7] The blockchain is public, though: if the tax office knows one of your addresses, it can use it to check your information.^[12] More in Privacy with Bitcoin.

Dive deeperIf earlier tax returns had gaps

If you realise after filing, but before the time limit for assessment (Festsetzungsfrist) has expired, that a tax return was incorrect or incomplete and that too little tax may be or has already been assessed as a result, you must notify the tax office without delay and correct it.^[14] Get support from a tax adviser for this.

Checklist

What’s next?