The eighth amendment to the Directive on Administrative Cooperation in the field of taxation (DAC8) marks a significant expansion of the European Union’s framework on the automatic exchange of information (AEOI). Its primary objective is to enhance tax transparency and strengthen the fight against tax fraud, tax evasion, and tax avoidance, particularly in the rapidly evolving crypto-asset sector.
DAC8 introduces a harmonised approach to the reporting of crypto-asset transactions across Member States. It extends the scope of AEOI to include crypto-assets, an area that had previously remained largely outside traditional tax reporting mechanisms. The Directive lays down the procedures for the exchange of information on crypto-asset users by implementing due diligence procedures and reporting rules for operators active in crypto-asset transactions and their users. The rules are based on the OECD’s international standard Crypto-Asset Reporting Framework (CARF).
Under DAC8, Reporting Crypto-Asset Service Providers (RCASPs) are required to collect detailed information on both resident and non-resident users. This includes data relating to crypto-asset transactions carried out during the relevant reporting period. The information must be submitted to the relevant national tax authorities in the calendar year following the reporting year. Subsequently, information concerning non-resident users is exchanged with the tax authorities of the EU country of residence of such users within nine months of the end of the reporting period. For the first reporting year (2026), the exchange of information between Member States will take place by 30 September 2027.
In addition, crypto-assets that have been issued in a decentralised manner, as well as stablecoins, including e-money tokens and certain non-fungible tokens (NFTs), are included within the scope of DAC8.
Turning to the national level, Cyprus has transposed DAC8 into domestic legislation through the Administrative Cooperation in the Field of Taxation (Amending) Law of 2026 (L.38(I)/2026) (hereinafter, the “Law”) (available only in Greek) which entered into force on 1 January 2026.
Article 7ΣT and Sections I and II of Annex VI of the Law define the reporting requirements, the due diligence procedures, and other rules that RCASPs must apply so that the competent authority in the Republic of Cyprus can communicate, through automatic exchange, the information referred to in Article 7ΣT. It should be noted that Crypto-Asset Service Providers that fall within the exemption criteria outlined in Paragraphs Β to Ζ are not required to report the relevant information to the Cyprus Tax Department, nor are they obliged to perform the associated due diligence procedures.
According to Cyprus’s Tax Department, based on the Law, the first reporting by RCASPs will take place in 2027 (i.e., by 30 June 2027) concerning the relevant information for the calendar year of 2026.
The Cyprus Tax Department also emphasised that according to the Law, the reporting obligation also applies to reportable crypto-asset users who are tax residents of Cyprus.
Following the above, Cypriot Crypto-Asset Service Providers authorised under Article 63 of the MiCA Regulation (Regulation (EU) 2023/1114), as well as Cypriot Financial Institutions permitted to provide crypto-asset services pursuant to Article 60 of the MiCA Regulation, should carefully assess their status under the Law. In practice, it is highly likely that such entities will fall within the scope of the Law and will therefore be subject to its reporting and due diligence requirements.
In addition, Article 17 of the Law amends Annex I of the principal law, which defines the rules governing the automatic exchange of financial account information, including reporting obligations and due diligence requirements for Financial Institutions (Custodian Institutions, Depository Institutions, Investment Entities and Specified Insurance Companies).
Additionally, the definitions of Financial Institutions are expanded to include entities that hold crypto–assets, electronic money, and central bank digital currencies on behalf of clients.
Pursuant to the Law, the first filing of Financial Institutions that fall under the scope of the Law, including the additional information required by the Law, will take place in 2027 (i.e., by 30 June 2027) for information relating to the calendar year 2026.
In conclusion, Crypto-Asset Service Providers falling within the scope of the Law, as well as Financial Institutions (including those newly classified as Reporting Financial Institutions under the amended definitions introduced by the amended Annex I of the principal law), should take timely and proactive steps to assess their obligations. This includes implementing the appropriate due diligence procedures and commence the relevant data collection that need to be reported. Given that the 2026 calendar year constitutes the first reportable period, with reporting due by 30 June 2027, immediate preparation is essential to meet the forthcoming regulatory requirements effectively.
How Complyport can help?
With deep expertise across EU and international regulatory frameworks, Complyport is well positioned to assist Crypto-Asset Service Providers (CASPs), financial institutions, and other affected entities in assessing and meeting their obligations under the Administrative Cooperation in the Field of Taxation (Amending) Law of 2026 (DAC8), as well as the broader Automatic Exchange of Information (AEOI) framework.
Whether you are preparing for your first reporting cycle or seeking to enhance your existing regulatory reporting framework, Complyport can provide practical, tailored support aligned with your entity’s needs.
Contact Complyport today to discuss your reporting and compliance requirements. Our experienced team is ready to help you navigate these new obligations with confidence and ensure a robust approach to ongoing compliance.
