DAC8 Crypto-Asset Tax Reporting Obligations Apply to CASPs in Malta Under EU Law

Council Directive (EU) 2023/2226 of 17 October 2023, known as DAC8, amends Directive 2011/16/EU on administrative cooperation in the field of taxation to introduce mandatory automatic exchange of information on crypto-asset transactions. The directive was published in the Official Journal of the European Union on 24 October 2023 (OJ L 2023/2226) and is in force. Member States, including Malta, were required to transpose DAC8 into national law by 31 December 2025, with the reporting obligations applying from 1 January 2026.

The operative provisions relevant to crypto-asset service providers are set out in Article 1(11) of DAC8, which inserts a new Section II(B) into Annex VI of Directive 2011/16/EU. Under that annex, a Reporting Crypto-Asset Service Provider (RCASP) — defined as any entity permitted to provide crypto-asset services under Regulation (EU) 2023/1114 (MiCAR) and resident, incorporated, managed, or with a significant establishment in a participating Member State — must collect, verify, and annually report specified data on crypto-asset transactions. Reportable data includes the full name, address, date of birth, taxpayer identification number, and annual aggregate gross proceeds for each Reportable User. The first reports cover 2026 data and are due by 31 January 2027.

For CASPs operating in Malta, the practical impact is immediate. Malta is an EU Member State and a significant hub for crypto-asset businesses licensed under the Virtual Financial Assets Act (VFA Act) and, from the MiCAR transition, under MiCAR itself. CASPs holding a MiCAR authorisation from the Malta Financial Services Authority (MFSA), or pending grandfathering under MiCAR transitional provisions, qualify as RCASPs and must implement DAC8-compliant due diligence and reporting systems for the 2026 reporting period. CASPs that service users resident in EU Member States must report data to the Maltese Commissioner for Revenue, which will automatically exchange it with the competent authorities of users' Member States of residence under the mutual exchange mechanism in Article 8(c) of Directive 2011/16/EU as amended.

DAC8 contains a carve-out for de minimis transactions: Section IV, paragraph B(3) of the amended Annex VI excludes transactions below a threshold set by each Member State (not to exceed EUR 1,000 in aggregate per user per year) from the reporting obligation. DAC8 aligns its scope definitions with MiCAR — entities that fall outside MiCAR's definition of a crypto-asset service are not RCASPs. Decentralised finance protocols with no identifiable operator and certain non-fungible token marketplaces may fall outside scope depending on their MiCAR classification. Entities must assess their RCASP status now, as the due diligence period for the first reporting year (2026) has already begun.

Our firm advises crypto-asset service providers on DAC8 compliance, MiCAR licensing, and EU tax transparency obligations, and maintains a dedicated partner network in Malta and across EU jurisdictions. We can assist with RCASP status assessments, due diligence programme design, and reporting system implementation. Contact us to discuss your situation. Relevant areas of work include: DAC8 reporting, MiCAR authorisation, VASP and CASP compliance, crypto tax transparency, MFSA licensing, VFA Act advisory, and EU administrative cooperation.

Source: Council Directive (EU) 2023/2226 of 17 October 2023 amending Directive 2011/16/EU on administrative cooperation in the field of taxation, OJ L 2023/2226, 24.10.2023, CELEX:32023L2226; available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023L2226 (confirmed in force, 24 March 2026).

The information provided is not legal, tax, investment, or accounting advice and should not be used as such. It is for discussion purposes only. Seek guidance from your own legal counsel and advisors on any matters. The views presented are those of the author and not any other individual or organization. Some parts of the text may be automatically generated. The author of this material makes no guarantees or warranties about the accuracy or completeness of the information.