Understanding DAC8
What data does DAC8 collect?
Identity (name and home address), tax residence, transactions and transfers: the data at the center of DAC8 risk.
Updated
Short answer
DAC8 can collect and report identity data (name, home address, date of birth), tax residence, tax identification numbers, transaction categories, crypto-asset types, values, transfers, deposits and withdrawals, including operations with no tax relevance. The risk is not one field in isolation. The risk is the combined dataset: a real person, whether a natural or legal person, can be connected to crypto activity that may point into public blockchain history.
DAC8 does not merely report that a taxpayer holds crypto-assets or used a crypto platform. It can link a civil identity to detailed crypto-asset activity.
Key facts
| Data category | Examples |
|---|---|
| Identity | Name, home address, date of birth; natural or legal person |
| Tax status | Tax residence, taxpayer identification number (TIN) |
| Provider records | Account or user information held by the reporting provider |
| Transaction data | Acquisitions, disposals, crypto-to-crypto exchanges, payments, transfers, deposits, withdrawals, dates, gross amounts, number of units and number of transactions |
| Crypto and blockchain data | Crypto-asset type, transaction categories, transfers, values, number of units and number of transactions |
Identity data
Reporting providers must identify the users concerned. Reported information can include name, address, tax residence, date of birth and tax identification number. These data let the administration connect crypto activity to an identified natural or legal person.
Transaction data
The core of the risk comes from combining identity with transactional activity. Reported information can include acquisitions, disposals, crypto-to-crypto exchanges, payments, transfers, withdrawals, deposits, dates, gross amounts, number of units and number of transactions, alongside crypto-asset categories.
This is not merely reporting of taxable capital gains. The scope can include movements that are not themselves a taxable event.
Why crypto data is especially sensitive
Once a civil identity is linked to crypto activity, public chains make it possible to retrace past transactions and monitor certain future movements. That is why DAC8 data is more sensitive than an ordinary automatic exchange on bank accounts.
Why the combined dataset worsens the risk
Each data point taken alone can look administrative. Their combination produces something else: an exploitable map of people, flows, counterparties and assets.
A traditional bank-account report is already sensitive. Crypto reporting can be more exposing because many crypto networks are transparent. If a transfer, address or transaction pattern is linked to a user’s civil identity, outside parties who later obtain the data may be able to infer value, counterparties, habits or security-relevant behavior. A mass database can become useful to criminals, corrupt insiders or attackers for reasons unrelated to tax.
The central question is therefore proportionality: which data are truly necessary for the tax objective, and which data mainly create an attack surface?
Common misconception
DAC8 is not only a “balance report.” It is an information-reporting regime covering users and reportable transactions. Depending on the transaction and the provider, the reported dataset may include enough context to connect identity, tax residence, value and crypto activity.
Bull Bitcoin position
Bull Bitcoin does not argue that tax authorities should never obtain crypto information. The objection is to automatic reporting by default, before any individualized suspicion exists. Targeted information requests are more proportionate because they limit data collection to concrete cases.