Beginning Jan. 1, 2026, DAC8 and OECD’s Crypto-Asset Reporting Framework (CARF) will introduce sweeping new reporting obligations for RCASPs across the globe. RCASPs are broadly defined to include any entity or individual facilitating crypto-asset transactions on behalf of customers—such as digital asset brokers, crypto trading platforms, wallet providers, financial institutions dealing with crypto-assets, and certain decentralized finance (De-Fi) platforms that facilitate transactions. While reporting under DAC8 and CARF is not set to begin until 2027, the compressed timeline for implementing operational requirements under both regimes which go live Jan. 1, 2026 has been a challenge for both US and non-US RCASPs. As such, it is critical that companies assess their operational readiness and remediate gaps now to ensure a smooth transition for sustainable compliance with these complex and evolving rules now.
DAC8 presents a substantial risk management challenge for any organization dealing with crypto assets, regardless of their tax residency. Unlike CARF, which only affects organizations in countries that participate in the reporting regime, DAC8’s expanded reporting requirements encompass all crypto asset facilitators worldwide that have clients in the EU. While it remains uncertain whether the United States will adopt CARF, US-based digital asset brokers will still need to comply with DAC8. As such operational challenges associated with both regimes, including how to navigate data privacy concerns, varying local implementation requirements and deadlines, managing and scaling data, collecting and validating documentation all present risk, but even more importantly may impact your customer or user experience. It is therefore imperative that companies assess their readiness now by designing and implementing effective internal controls for managing risk and by remediating any potential gaps in their systems and processes now. The compressed timeline for implementation coupled with uncertain guidance and varying levels of enforcement across jurisdictions will undoubtedly mean more risk for organizations globally.
What is the difference between CARF and DAC8
Both CARF and the European Union’s DAC8 are regulatory frameworks aimed at increasing tax transparency and reporting requirements for crypto-asset transactions. While they share similar goals, they differ in scope, implementation, and jurisdictional reach. CARF establishes a global standard for the automatic exchange of tax information on crypto assets. It builds upon existing frameworks such as the Common Reporting Standard (CRS) and aligns with Financial Action Task Force (FATF) recommendations. CARF is intended as a standalone framework that countries can incorporate into their domestic legislation to facilitate cross-border tax cooperation. Notably, however, jurisdictions may differ in requirements for implementation of CARF and, to date, many jurisdictions that have adopted CARF have not published any guidance. The lack of harmonization across jurisdictions with varying timelines, inconsistent interpretations of the rules, and lack of guidance in some instances with differing levels of enforcement may be a competitive disadvantage for companies’ resident in those jurisdictions. For more information on CARF, please refer to Crypto-Asset Reporting Framework: Answers to fundamental questions.
In contrast, DAC8 is a directive adopted by the European Union that expands the scope of the existing Directive on Administrative Cooperation (DAC) to include crypto-asset transactions. While it incorporates elements of the OECD’s CARF, DAC8 introduces additional provisions specific to the EU regulatory environment. The Council of the EU adopted DAC8 in October 2023, amending the requirements for reporting and exchanging information on certain crypto asset transactions. DAC8 represents the EU’s adoption of CARF and amendments to the OECD’s Common Reporting Standard (CRS). Under the framework, RCASPs, including exchanges, wallet providers, and potentially some DeFi platforms, are obligated to report transaction data. DAC8 extends the scope of automatic exchange of information provisions under the DAC to include information that must be reported by RCASPs on transactions involving crypto assets. This means that RCASPs will need to report to relevant tax authorities balances and transactions, including transfers or exchanges of crypto assets.
Besides imposing penalties for noncompliance of 20,000 and 500,000 Euros, most importantly DAC 8 provides restrictions on customer activity that are not required under CARF. Specifically, if a customer fails to provide the required self-certification form after two (2) reminders, the RCASP must block the customer from performing reportable transactions on the platform within 60 days of the second reminder. This is particularly challenging since neither the OECD or the EU has published a draft version of the self-certification form which would allow RCASPs to begin planning for additional data fields or automation of their collection and review processes associated with the forms. Additionally, unlike CARF, DAC8 requires RCASPs to provide notifications under the General Data Protection Regulation (GDPR) by informing customers that their personally identifiable information will be collected and reported to competent authorities before the information is reported. Finally, DAC8 has extraterritorial implications because it requires all RCASPs regardless of their size or geographic location, to report applicable transactions involving EU tax residents, and covers both centralized and decentralized platforms and crypto assets defined under the Markets in Crypto-Assets Regulation (MiCA). Under DAC8, both EU-based and non-EU RCASPs serving EU taxpayers must register with a Member State to comply with their reporting obligations. This means that even if jurisdictions like the United States choose not to adopt CARF, U.S. based digital asset brokers will still be subject to DAC8 information reporting requirements if the transaction involves an EU tax residents.
Assessing your operational readiness
The implementation of DAC8 brings significant implications for US RCASPs and digital asset brokers that deal with EU clients. These entities must adhere to DAC8 reporting requirements, ensuring all relevant information is accurately reported to the appropriate tax authorities to avoid penalties and compliance issues.
To ensure compliance, organizations need to understand the specific reporting requirements, identify their reporting obligations, and implement processes and controls to fulfill these obligations. Upgrading or implementing systems to capture and report the required information on crypto asset transactions is essential, as is ensuring that key staff is adequately trained and that you proactively educate investors or shareholders on the new reporting requirements. Leveraging historical processes for complying with Anti-money Laundering and Know-Your-Customer (AML/KYC) requirements that brokers may have had in place for years is a start, but failure to collect tax self-certifications or taxpayer identification numbers under these rules can trigger serious consequences—from account blocks to misreporting, so RCASPs must identify gaps in standard processes to avoid potential exposure.
RCASPs will also need a process for gathering and identifying transactions involving crypto-assets and for collecting and storing large volumes of data such as taxpayer identification numbers which are reportable under these rules. Further, in order to address data privacy issues, they must draft communications to timely notify investors of information that will be collected and disclosed and should design a process for confirming data privacy rules in their respective jurisdictions. The rules will also require cross-functional collaboration across business units and geographies and engagement with taxing authorities to monitor the issuance of guidance and to understand and clarify their goals for use of the data collected.
DAC8 represents a pivotal development in the global regulatory framework for crypto asset transactions, introducing worldwide reporting obligations for RCASPs. Organizations—including those based in the U.S.—must proactively prepare to meet these new requirements to avoid penalties and maintain operational integrity. RSM US can assist in training your stakeholders and key staff to better understand their reporting and documentation obligations. Our advisors can assess your operations to identify potential areas of exposure and help implement the necessary processes and system enhancements to capture and report relevant information. Please contact a Global Information Reporting specialist at your earliest convenience for assistance.
