DAC8 in numbers

Short answer

DAC8 turns an obligation of tax cooperation into an automatic reporting infrastructure applied to crypto-assets. The directive was adopted in 2023, Member States had to transpose it by the end of 2025, data collection covers 2026 activity and the first automatic exchanges occur in 2027.

These numbers capture the core of the problem: DAC8 concerns a large number of people (about 6.1 million holders in France, on the order of 54 million across the EU), creates a sensitive database that crosses identity, home address and economic value, and arrives in a context of physical violence and data leaks. The amount of data collected is not enough to measure the risk: the nature of the data matters as much as its volume.

Key facts

Directive (EU) 2023/2226 · Decree No. 2025-1276 · ADAN 2026 barometer.

Timeline

Date	Event
17 October 2023	Formal adoption of the DAC8 directive by the Council of the European Union
End of 2025	Deadline for Member States to transpose the directive
19 December 2025	French Decree No. 2025-1276 (transposition into French law)
1 January 2026	Collection obligations take effect
September 2027	First automatic exchange covering 2026 data

Data concerned

DAC8 can cover the client’s full identity (name, home address, date of birth), tax residence, taxpayer identification number, crypto-asset type, crypto-fiat exchanges, crypto-crypto exchanges, transfers, values, units and transaction counts.

The directive therefore targets both identification data and transactional data, not only an isolated tax event.

What makes this data different

A classic bank report often gives a status or a balance. A crypto report can also provide elements that open onto a public transaction graph. As soon as an address is linked to an identity, the exposure can go beyond the reported transaction.

This difference explains why the amount of data collected is not enough to measure the risk. The nature of the data matters as much as its volume.

Crypto adoption

Figure	Meaning
6.1 million	Estimated number of holders in France in the ADAN 2026 barometer
~54 million	Estimated order of magnitude for holders in the EU-27 if adoption around 15% is extrapolated
20%	Holding rate cited for the Netherlands in the ADAN benchmark

Affected population

The ADAN 2026 barometer estimates that crypto-asset adoption is significant in several European countries. In France and Europe, this adoption is no longer marginal: automatic reporting affects millions of ordinary people, not a narrow set of suspected offenders. The reference dossier uses an order of magnitude of about 54 million holders in the EU if adoption around 15% is extrapolated.

The real risk extends beyond these holders: identifiable relatives can become indirect targets in the event of a leak or insider corruption.

Physical exposure

Figure	Meaning
40 to 135 million	Europeans potentially exposed if relatives are included
>50%	Share of incidents involving a relative according to the reference dossier
27 administrations	Number of tax administrations in the EU sharing the DAC8 framework

Leaks and centralized databases

Figure	Meaning
1 weak link	A single point of failure is enough to compromise a shared database
100%	A leaked public address can expose the visible on-chain history
Permanent	An address linked to an identity can remain exploitable in the future

The risk figures are not only tax figures. They include the number of people whose family, address, wealth signals and transaction graph may become exposed if a reporting database leaks.

Tax effectiveness

Automatic exchange mechanisms are often justified by tax effectiveness, but assessing their benefits remains difficult. The European Court of Auditors has already noted problems of quality, use and measurement in tax information exchange schemes.

The cost-risk ratio of DAC8 must therefore be assessed rigorously: the measure exposes extremely sensitive data even before its marginal effectiveness is demonstrated.

What to measure

A serious DAC8 debate should measure several dimensions, not only tax yield:

• actual tax effectiveness;
• compliance cost;
• physical safety risk for individuals;
• data breach probability;
• the incentive for users to leave regulated services.

Why these numbers matter

A database of several tens of millions of crypto profiles is not just an administrative tool. It is a very high-value target for attackers, corrupt intermediaries and specialized criminal networks.

The decisive point is the accumulation: identity, address, history, economic value, family circle and circulation between administrations. Each layer makes the next one more dangerous.

Related pages

• What data does DAC8 collect?
• DAC8 reporting deadlines
• Data leaks and DAC8
• Families on the front line
• Unproven effectiveness