Licensed or not, your DAC8 obligations started on 1 January 2026

DAC8 and MiCA: the tax reporting obligations that cannot wait any longer

The first of July 2026 marks a significant moment for the crypto asset industry in Luxembourg and across the European Union. Under the Markets in Crypto Assets Regulation, the transitional period during which crypto asset service providers could continue operating under pre-existing national frameworks has now closed. The licensing picture is crystallising, and the operators who are active in the Luxembourg market are increasingly identifiable.

Much of the conversation around MiCA has focused, understandably, on the licensing and regulatory compliance dimension. What has received considerably less attention is the tax reporting framework that runs in parallel, and which has been in force since the first of January 2026 regardless of an operator's licensing status.

The clock started on 1 January 2026. Are you already behind?

The eighth iteration of the Directive on Administrative Cooperation, known as DAC8, introduced a mandatory reporting framework for crypto asset transactions across the European Union. It is modelled on the OECD's Crypto Asset Reporting Framework (CARF) and requires Reporting Crypto Asset Service Providers to collect information on their users and report it to the relevant tax authority on an annual basis.

The obligations under DAC8 applied from the first of January 2026. The first reporting deadline will follow in 2027, covering the full 2026 calendar year. For operators who have not yet implemented the necessary due diligence and data collection processes, the window to do so is narrowing with each passing month. The data that will need to be reported at the end of the first cycle is being generated now, and an operator that has not built the right processes will find itself unable to reconstruct it retrospectively.

The scope is broader than you think. MiCA licensing is not the threshold.

The starting point is that DAC8 scope is determined by the nature of an operator's activity, not exclusively by its MiCA licensing status. An entity that facilitates crypto asset transactions, provides exchange services, manages crypto assets on behalf of users, or facilitates staking services on behalf of clients may fall within the definition of a Reporting Crypto Asset Service Provider under DAC8, irrespective of whether it holds a CSSF licence.

Staking service providers deserve particular attention in this context as they might be treated as an RCASP for DAC8 purposes. The staking rewards distributed to clients would then constitute reportable transactions, and the operator would have an obligation to collect the relevant due diligence information and report it to the competent tax authority. This is an obligation that applies regardless of MiCA licensing status, and it is one that many staking operators in Luxembourg and across the EU have not yet addressed.

The licensing and the reporting obligation are two separate questions, and the answer to one does not automatically determine the answer to the other. This means that the population of operators with DAC8 obligations is broader than the population of MiCA-licensed CASPs. Operators who have been focused exclusively on the MiCA licensing question, and who have concluded that they do not need a CSSF licence or that the transitional period gave them time to prepare, may nonetheless be in scope for DAC8 reporting and may not yet know it.

Not knowing whether you are in scope is not a defence.

The starting point for any operator that has not yet addressed this question is an impact assessment. The assessment determines whether the entity meets the definition of a Reporting Crypto Asset Service Provider under the directive, whether it needs to register with the ACD for DAC8 reporting purposes, and what due diligence and data collection obligations apply to its specific activities.

This is not a question that can be answered by assumption. The definitions in DAC8 are broad and technically precise, and the consequences of getting the analysis wrong, whether by failing to register when required or by implementing unnecessary obligations, are real. An operator that has been collecting data since January 2026 without a proper framework in place is already behind, and one that has not yet begun the assessment is further behind still.

The first reporting cycle is already underway. The data is being generated now.

For licensed CASPs, the expectation is clear. MiCA compliance and DAC8 compliance are parallel obligations, and both need to be in place. An operator that has invested in obtaining its CSSF licence but has not yet implemented its DAC8 framework is only halfway there.

For the broader population of crypto asset operators, including exchanges, wallet providers, staking platforms, and any intermediary facilitating crypto asset transactions on behalf of clients, the more fundamental question is whether DAC8 applies at all. The first of July is a natural moment to ask that question if it has not yet been asked. The regulatory picture is now clearer, the transitional period has closed, and the first reporting cycle is already underway.