DAC8 and Crypto Platform Reporting Obligations in Spain

January 2026: the deadline approaching

The DAC8 directive (Directive on Administrative Cooperation, eighth revision) requires all crypto asset platforms operating in the EU to report user transactions to national tax authorities. Transposition into Spanish law must be completed by December 31, 2025. The first report is due in January 2026.

This is not a draft. Not a proposal. The EU Council approved the final text in October 2023, and member states are obligated to transpose it. Spain, which already has Form 721 (informative declaration on foreign virtual currencies) and the Bank of Spain’s crypto asset service provider registry, will integrate DAC8 into its existing fiscal framework.

For crypto platforms, this is not just a legal problem. It is an engineering problem.

What DAC8 requires

The directive builds on the OECD’s CARF (Crypto-Asset Reporting Framework), adapted for the European context. The key requirements:

Who reports. Any crypto-asset service provider (CASP) operating in the EU. Exchanges, custodians, DeFi platforms with an identifiable intermediary, and crypto ATM operators. If you facilitate the purchase, sale, transfer, or custody of crypto assets for third parties, you report.

What gets reported. For each user, and for each crypto asset type:

• User identification data (name, address, tax ID number, date of birth)
• Number of units transacted (purchases, sales, exchanges)
• Aggregate fiat value (EUR) of each transaction type
• Total number of transactions
• Transfers between wallets (including transfers to non-custodial wallets)

That last point is particularly significant. Transfers to non-custodial (self-custody) wallets must be reported, even though the platform has no visibility into the recipient’s identity. The report includes the destination wallet address.

Report format. XML based on the CRS/CARF schema. Spain’s tax authority (AEAT) will publish the specific XML schema for Spain, aligned with the common European standard. If you have already implemented CRS for traditional financial assets, the schema is similar but with additional fields for crypto assets.

Frequency. Annual. The report covers the previous calendar year and must be submitted in the first quarter of the following year.

The technical challenge

For a mid-sized crypto platform, implementing DAC8 requires solving four technical problems.

User identification and verification. DAC8 requires enhanced due diligence. Basic KYC is not sufficient. The platform must verify the user’s tax identification number against national databases. For Spanish users, this means validation against AEAT’s census. For users from other member states, cross-validation via existing DAC mechanisms.

The practical problem: many crypto platforms, especially those operating for years, have users registered with incomplete or unverified data. DAC8 requires remediating those records before the first report. For platforms with hundreds of thousands of users, that data cleanup is a project in itself.

Transaction aggregation. The report requires data aggregated by user, by crypto asset type, and by operation type (purchase, sale, exchange, transfer). For high-volume platforms, aggregating millions of transactions per user and calculating fiat value at the time of each transaction requires robust data infrastructure.

The fiat value calculation is especially complex for low-liquidity tokens. The reference price can vary significantly between exchanges. DAC8 does not mandate a specific price source, which leaves room for interpretation but also risk of discrepancies with tax authorities.

XML generation. The CARF XML schema has strict validation rules. Mandatory fields that depend on transaction type, ISO 3166 country codes, specific date formats, and integrity checksums. A malformed XML will be rejected, and the platform will have a limited window to correct and resubmit.

Transfers to non-custodial wallets. Detecting and reporting these transfers requires monitoring the destination addresses of every withdrawal. For transparent blockchains (Bitcoin, Ethereum mainnet), this is possible by querying the blockchain. For privacy-enhanced blockchains (Monero, Zcash in shielded mode), the platform can only report the source address and the amount.

Implications for the European fintech sector

Spain has approximately 120 entities registered as crypto asset service providers with the Bank of Spain. Most are small companies with technical teams of 5 to 20 people. Implementing DAC8 with its data, validation, and reporting requirements will consume a significant proportion of their development capacity during 2025.

The pattern is similar across the EU. Germany, France, and the Netherlands have their own registries and transposition timelines. The technical requirements are identical (same CARF schema), but the implementation details (API endpoints, submission procedures, validation rules) will vary by country. Platforms operating across multiple EU jurisdictions face multiplicative compliance complexity.

Larger platforms (Coinbase, Kraken, and regional leaders like Bit2Me in Spain) likely have sufficient compliance and data teams to absorb the impact. Smaller platforms will need external help: tax consulting to interpret the requirements, and technical consulting to implement the data pipelines and report generation.

There is a clear opportunity for software providers building DAC8 reporting solutions “as a service.” A small crypto platform should not have to build its own CARF XML generator. It should be able to use a service that, given a transaction dataset in a standard format, generates validated XML ready to submit to the tax authority.

What to do now

If you operate a crypto asset platform in the EU, the 2025 action list is concrete:

1. User data audit. Identify records with incomplete or unverified data. Initiate KYC update campaigns.

2. Transaction inventory. Verify that your database can aggregate transactions by user, by asset type, and by operation type with precision. If your data schema does not support this, you have a migration project ahead.

3. Price source. Define and document the reference price source for fiat conversion. Consult with tax advisors on whether the chosen source is defensible before the tax authority.

4. Report prototype. Generate a test XML report with synthetic data against the CARF schema. Identify problematic fields before the deadline arrives.

5. Transposition tracking. National tax authorities will publish specific rules for DAC8 transposition throughout 2025. Follow updates and, if possible, participate in public consultations.

The available time is limited but sufficient if you start now. The cost of non-compliance is not just a fine: it is the potential revocation of registry status, which means ceasing operations.

For fintech companies needing technical guidance on DAC8 implementation, the combination of regulatory consulting and data engineering is the most efficient path.