DAC8 self-certification and missing TINs for Irish crypto reporting

Tax and Legal should identify the contracting company, the entity performing exchanges and any relevant branch. Record its tax residence, incorporation, management and operating locations. For an Irish-authorised provider carrying out reportable transactions, section 891M(3)(a)(i) supplies the domestic registration route. Other providers can be caught through residence, qualifying incorporation, management, a regular place of business or an Irish branch. Register by 31 December of the first year in which the entity becomes a reporting provider. (TCA 1997, s. 891M(3).)

Permission must cover the services that entity supplies. MiCA requires authorisation or an applicable Article 60 route. For services in other Member States, complete the Article 65 notification to the home authority. Cross-border activity may begin after the prescribed communication or, at the latest, on the fifteenth calendar day after submitting the required information. A group affiliate's licence or a tax registration cannot supply the serving company's permission. (Regulation (EU) 2023/1114, arts. 59(1), (6) and 65(1)–(4).)

An Irish resident exchange provider can also fall within CARF. Section 891HA(17) coordinates the two regimes where its required CARF information is included in its DAC8 return. That condition requires coverage of the relevant CARF population; an EU-only extract may be insufficient. Broader entity-allocation questions are addressed in CARF and DAC8 reporting across an international platform.

Onboarding must then identify the actual crypto-asset user. Where an ordinary agent or nominee acts for another person, the underlying person is generally the user. The definition contains specific treatment for financial institutions and reporting providers. Record whether the user is an individual or an entity and when its relationship with this provider began. (Directive 2011/16/EU, Annex VI, IV.D.2–6.)

For an entity, answer two separate questions:

1. Is the entity itself reportable? An EU-resident entity is reportable unless it qualifies as an Excluded Person. Keep evidence for the claimed exclusion. Financial-institution status needs checking because the exclusion does not cover every investment entity.
2. Must its controlling persons be examined? Establish whether the entity qualifies as Active or Excluded. Otherwise identify the controlling persons and determine their reportable status, even where the entity itself is resident outside the EU.

Active status removes the controlling-person look-through; it does not generally remove the entity's own reporting. Under the income-and-assets test, both passive income and passive assets must be below 50% for the relevant preceding period. Other statutory active-entity categories have their own conditions. Tax should approve the claimed category and evidence before Product suppresses controlling-person fields. (Directive 2011/16/EU, Annex VI, III.B, IV.D.10 and IV.E.1, E.5.)

For a new individual relationship, Onboarding must obtain a self-certification that identifies tax residence and passes the reasonableness check. Its required contents are first and last name, residence address, relevant tax residences and TINs, and date of birth. It must be signed or positively affirmed and dated no later than receipt. A prefilled form still needs the customer's affirmation. Under CARF commentary, prefilled information excludes tax-residence answers for individuals, controlling persons and entities. (Directive 2011/16/EU, Annex VI, III.A.1 and III.C.1; CARF Commentary on Section III, paras. 39 and 45.)

Configure the form to accept multiple tax residences and associate each TIN with its issuing jurisdiction. An international provider applying CARF also needs the relevant non-EU residences. Store the declaration's wording, version, receipt time and affirmation event. Compliance should record the evidence checked and why the answers are reasonable. These records support the provider's duty to retain the steps and information used in due diligence. (CARF, III.A and III.C; TCA 1997, ss. 891HA(11) and 891M(13).)

For an entity, collect its legal name, address, relevant tax residences and TINs. Obtain the authorised person's dated affirmation for the entity. Record the factual criteria for any Active Entity or Excluded Person claim. A declaration that the entity has no tax residence requires further classification: the rules allow consideration of effective management or the principal office. It must not automatically produce a non-reportable result. (Directive 2011/16/EU, Annex VI, III.B.1 and III.C.2.)

For an entity requiring look-through, complete the controlling-person path:

1. Use compliant AML/customer-due-diligence evidence to identify the natural persons in control. Trusts require attention to settlors, trustees, protectors, beneficiaries or classes of beneficiaries, and other persons with ultimate effective control.
2. Obtain the required tax-residence certification from the entity or the controlling person. It must supply the individual's required identification, residence, TIN and birth-date information.
3. Record the role through which each reportable person controls the entity. Link that person to the correct entity and the period during which the role applies.

An AML beneficial-owner record can support identification, but it does not replace the required tax-residence certification. The entity can provide controlling-person information within its certification where the rules permit; separate signatures from every controller are not universally required. (Directive 2011/16/EU, Annex VI, III.B.2, III.C.2(e) and IV.D.9.)

Place of birth is a separate reporting question. It is absent from DAC8's core certification field list. Irish law requires it where the relevant residence jurisdiction's domestic law requires it. Tax should maintain that country-specific rule; Product should not infer a universal requirement from a generic form. (Directive 2011/16/EU, Annex VI, III.C; TCA 1997, s. 891M(7)(b)(v), (c)(ii)(VI).)

An existing CRS or other tax form can be reused if it meets the applicable requirements and remains reliable. Delegating collection to a vendor leaves the reporting provider responsible. (Directive 2011/16/EU, Annex VI, III.D.)

Start with the reason for the missing number. Onboarding should record the customer's explanation, the jurisdiction concerned and any supporting document. Keep the original response; a case handler should not manufacture an identifier to make the field validate.

Where the number exists but was omitted, request it and retain the record as incomplete until the defect is resolved. Where the customer says an application is pending, obtain the application evidence and follow-up date. That evidence explains the delay; it does not itself establish that the applicable TIN requirement has been satisfied. A refusal to provide an available number belongs in the non-cooperation process. (Directive 2011/16/EU, Annex VI, III.C; TCA 1997, s. 891M(12).)

Where the jurisdiction genuinely does not issue the relevant TIN, Tax must check current official country information and any functional equivalent. CARF expressly addresses non-issuance and, for collection and reporting, jurisdictions whose domestic law does not require collection of their issued TINs. Ireland's CARF reporting provision requires the TIN where issued by the relevant Reportable Jurisdiction or where required under that jurisdiction's domestic law; CARF's non-collection exception therefore does not automatically permit omission of an issued TIN from an Irish CARF return. Keep the legal basis and evidence for the particular person and jurisdiction. (CARF, II.B and III.C.3; TCA 1997, s. 891HA(6)(b)(iv), (c).)

DAC8 requires a separate decision. Its certification and reporting provisions do not reproduce CARF's express exception, and section 891M lists the TIN without the same qualification. A genuine non-issuance case therefore needs a documented Tax and Legal decision on the applicable treatment, with Revenue clarification where necessary. Do not declare the customer non-reportable, invent a number or automatically approve the record under a CARF exception. (Directive 2011/16/EU, Annex VI, II.B.1 and III.C; TCA 1997, s. 891M(7), (8).)

A technical missing-number code does not settle that legal question. The OECD XML guide provides NOTIN and an unknown indicator for specified cases. Use them only under the applicable reporting instructions and a supported treatment of the underlying record. Passing schema validation cannot cure an unreliable certification. (OECD, CARF XML Schema User Guide, July 2025, OrganisationParty_Type and PersonParty_Type.)

TIN validation should check the correct jurisdiction and person type. The European Commission's public checker tests individual TIN structure and, where supported, syntax. It does not confirm identity, existence or allocation, and it does not validate entity TINs. A company registration number or LEI is not automatically a tax identifier; the relevant authority must use the number as the taxpayer's TIN or functional equivalent. (European Commission, TIN online check guidance; Directive 2011/16/EU, Annex VI, IV.F.7.)

For conflicting residences, Compliance should state the contradiction precisely. Compare the declaration with the residence address, incorporation or management information and relevant AML documents. A different mailing address does not alone determine tax residence. A supported explanation can reconcile a genuine difference; an unexplained contradiction prevents reliance on the declaration. Obtain a corrected certification or a reasonable explanation with supporting documents where appropriate. (Directive 2011/16/EU, Annex VI, III.A.1–2 and III.B.1–3; Revenue TDM 38-03-38, §5.1.1, Example 9.)

Record every supported residence. Do not allow a single-country dropdown or an unsupported treaty claim to remove a jurisdiction. Tax should review any claimed treaty treatment against the applicable rules before changing the reporting classification. (CARF Commentary on Section III, paras. 5 and 26.)

Close the case only when the required fields and affirmation are complete, the evidence supports the classification, and every material conflict has a recorded resolution. The reviewer should identify the accepted certification version and the date from which its treatment applies.

A change review starts when new information gives the provider knowledge, or reason to know, that the existing certification is incorrect or unreliable. A move, new tax-residence claim, changed entity activity or replacement controlling person can trigger it. Product should send those changes to Compliance and Tax, preserve the previous record and record both the event date and discovery date. A temporary trip or changed login location needs assessment before it changes tax status. (Directive 2011/16/EU, Annex VI, III.A.2 and III.B.3.)

Obtain a replacement certification or a reasonable explanation, with supporting documents where appropriate. DAC8 does not provide a general 90-day cure period in these provisions. CARF commentary describes limited treatment under the former status for up to 90 days and, if unresolved, treatment in the original and possible new residence jurisdictions. Tax must assess that interpretative treatment against the applicable Irish duties; it cannot override a transaction restriction that has become due. (CARF Commentary on Section III, para. 17.)

For an existing user who fails to supply required information, the Irish statutory path is specific:

1. Send the initial request identifying the information required.
2. Issue two written reminders after that request and retain their contents and issue dates.
3. If the information remains outstanding after 60 days from the second reminder, prevent the user from performing the transactions covered by the applicable provision.

The conditions are cumulative. The Irish tax provisions expressly prevent applying this particular restriction before the reminder conditions and period have been satisfied. A new applicant's certification must still be obtained when establishing the relationship; the reminder process creates no onboarding grace period. Legal should record the separate basis for any restriction under other applicable duties. (TCA 1997, ss. 891M(8), (12) and 891HA(7), (10).)

Revenue's manual describes closure and prevention of reopening after the same non-response period. The legislation specifies prevention of Reportable or Relevant Transactions. Legal should resolve account termination, access and asset-return treatment before Product implements the broader closure instruction. Preserve the statutory transaction restriction while that implementation question is resolved. (Revenue TDM 38-03-38, §8.12; TCA 1997, ss. 891M(12) and 891HA(10).)

After cure, Compliance and Tax should approve the accepted certification and reporting treatment. Product should lift the applicable tax-data restriction only on that recorded approval. Legal must confirm whether another restriction or termination decision still applies.

Pre-existing users have a separate transition. The relationship must have existed as of 31 December 2025. DAC8 requires their certification by 1 January 2027; Revenue describes completion by 31 December 2026. Compliance should complete the review within that timetable and begin requests early enough to run the required reminders. The transition does not excuse reliance on information already known to be unreliable. (Directive 2011/16/EU, Annex VI, III.A.1, III.B.1(a), IV.D.4, D.6; Revenue TDM 38-03-38, §§6–7.)

Keep the reportability identification date. The rules treat a user as reportable from identification through due diligence. Capture the transaction history from commencement of the regime and let Tax determine the correct reporting period and any correction required. A later certification must not silently rewrite earlier classification history. (Directive 2011/16/EU, Annex VI, Section III, opening provision; Revenue TDM 38-03-38, §7.)

Tax should own the reporting population and approve the annual return. Compliance should own evidence review and escalations. Product and Engineering should preserve certification versions, implement the approved timers and produce traceable data. An agreed responsibility schedule should name the person authorised to file and the reviewer who approves corrections.

For each reported user, retain the link to the legal provider, accepted declaration, residence decision and relevant controlling persons. Connect those records to the underlying transactions and their annual aggregates by asset and transaction category. Preserve units, counts where required, transaction-time values, currency and conversion method. A year-end market price or net trading gain cannot replace the required gross amounts and consistently calculated transaction-time values. (TCA 1997, s. 891M(7)(d)–(f).)

Revenue directs Irish providers to ROS for registration and publishes CARF/DAC8 technical resources. Before production filing, the reporting owner must confirm the current domestic submission, acknowledgement, nil-return and correction instructions. The published exchange schema and validator do not establish every domestic portal step. Reconcile the proposed file with the underlying records and retain the accepted payload and acknowledgement. (Revenue, CARF/DAC8 registration obligations and AEOI software-developer resources.)

File the 2026 return and provide each reportable user with the required copy by 31 May 2027. Revenue's subsequent exchange with other authorities has a separate timetable. For a later error, correct the source record, identify affected users, jurisdictions and periods, and use Revenue's applicable correction procedure. Preserve the original and corrected submissions with the references connecting them. The OECD correction mechanism distinguishes corrections and deletions from new records; confirm the domestic implementation before sending the replacement. (TCA 1997, s. 891M(2), (6); Directive 2011/16/EU, art. 8ad(6); OECD, CARF XML Schema User Guide, July 2025, Corrections.)

Keep ordinary DAC8 records for six years from the day after the end of the latest reporting period to which they relate, or until the relevant Revenue enquiry is completed if later. A certificate used across several years therefore needs a retention date linked to its latest relevant period. Winding up or dissolution triggers a separate rule for the liquidator or last directors. (TCA 1997, s. 891M(13)(a)–(e).)

The privacy notice should explain the reporting purpose, legal basis, recipients, retention and consequences of withholding required data. Provide any required GDPR information when collecting data directly, or within Article 14's applicable timetable for indirectly obtained data. Inform individual users and controlling persons before reporting, with sufficient time to exercise their rights. Apply the legal-obligation basis to necessary statutory processing. Limit access to tax identifiers, apply appropriate security, and document processor contracts and international-transfer arrangements where relevant. Correct current records while retaining the necessary submission history. The statutory retention duty qualifies erasure; it does not justify unlimited retention of unrelated material. (Directive 2011/16/EU, art. 25(3)–(4); GDPR, arts. 5, 6(1)(c), 13–14, 16–19, 28, 32 and 44.)

Provide the current self-certification form, missing-data rules and reporting field map. Licentium can review the legal requirements, remediation procedure and allocation of review responsibilities. Scope onboarding and reporting controls.