DAC8: Stop mass surveillance of crypto holders

A blockchain address is not a bank account number: it is an access key to an entire financial life that is public and permanent. On Bitcoin, Ethereum and nearly all public chains, every transaction is public, verifiable and permanent. When reported crypto activity links a civil identity to public-ledger activity, the exposure therefore goes far beyond a single taxable event.

• Total exposure. Where DAC2 transmits balances, DAC8 links identity and home address to crypto transaction and transfer data; on public ledgers, that can become an entry point into a broader history.
• Everything, including the non-fiscal. Transfers between your own wallets, gifts to family, payments to merchants, P2P operations: DAC8 captures movements with no tax relevance at all.
• A leak that never closes. Unlike a frozen balance, the on-chain history updates itself, in perpetuity, in full view of any attacker.
• A breach of proportionality. Article 52 of the Charter of Fundamental Rights requires that any limitation of a right be necessary and proportionate; the CJEU recalled this in its case law on FATCA and the GDPR.

No public data shows that mass automatic exchange delivers a tax return that matches its cost. Seven years after its first evaluation, the European Commission admits that “the assessment of benefits is extremely limited.” It is extending this same framework to crypto-assets anyway.

• The Commission (SWD 2019, then SWD 2025) concedes it cannot quantify the additional revenue generated by automatic exchange.
• The European Court of Auditors (report 03/2021) found that only one of the five audited Member States checks data quality, and that between 2015 and 2017 only 2% of the taxpayers covered were linked to a tax number.
• The comparable AML/KYC regime intercepts just 0.1% of criminal funds for 136.5 billion USD in annual costs in Europe.
• The CRS precedent mainly shows displacement toward non-participating jurisdictions, not a net drop in evasion.

The informed holder is not asking whether to declare: the moment they use a CASP, their data goes to the tax authority regardless. Their real question becomes “Should I keep using a regulated CASP at all?” For a growing number of holders, the answer will be no.

• The workarounds are lawful. Non-custodial wallets, DEXs, P2P, mining, non-custodial staking: all out of DAC8 scope and perfectly legal. The directive does not push people toward fraud, but toward leaving regulated CASPs.
• The contradiction with MiCA is head-on. The EU spent nearly five years (2019-2024) building MiCA to bring Europeans back to regulated, safe, supervised platforms. Six months before the 1 July 2026 deadline, DAC8 turns those same platforms into the most exposed place to transact.
• Effectiveness reverses. Sophisticated holders leave; only ordinary users stay inside the perimeter, bearing the physical risk alone. Less identified taxable base, at the cost of jobs and digital sovereignty.

The right of communication (Articles L. 81 and following of the French Tax Procedure Code) already lets the administration access data held by third parties (banks, service providers, and now CASPs) in a targeted and motivated way, for an identified taxpayer under investigation. When a less intrusive measure achieves the same objective, mass collection is, by construction, disproportionate.

Key points:

• A less intrusive alternative exists. DAC8 fails the proportionality test of Article 52 of the Charter: not necessary, not adequate, not proportionate.
• The right of communication is targeted. It concerns taxpayers under investigation, with strictly necessary data, instead of ~54 M holders across 27 centralized databases.
• It is already the standard. Art, bullion, foreign real estate (form 3916), securities accounts: the administration obtains them on a motivated request, never through permanent access. Crypto-assets justify no exception.