DAC8 Is Here: What the EU's Crypto Surveillance Directive Means for Your Wealth in 2026

On 1 January 2026, every crypto exchange, broker, and custodian operating in the European Union started collecting a file on you. Your name, your home address, your date of birth, your tax identification number, every transaction you make, and even your transfers to your own self-custody wallets. By September 2027, that file will be sitting in the databases of 27 different national tax administrations, shared automatically, whether you owe any tax or not.

This is DAC8, the EU's eighth Directive on Administrative Cooperation, and it is the most sweeping financial reporting regime ever applied to crypto-assets. Supporters call it tax transparency. Critics, including the exchanges now fighting it in court, call it mass surveillance that puts millions of Europeans at physical risk.

This guide covers what DAC8 actually requires and why a legal challenge is now underway to stop it. Then it gets practical: for Europeans who want their financial life private and their options open, a second citizenship has quietly become one of the most useful tools available. Here's why.

What Is DAC8?

DAC8 is an amendment to the EU's Directive on Administrative Cooperation, adopted by the Council of the EU on 17 October 2023 and published in the Official Journal that same month. Member states had until 31 December 2025 to transpose it into national law, and its provisions apply from 1 January 2026.

The directive extends the EU's automatic exchange of tax information, which already covers bank accounts under DAC2, to crypto-assets. It is the EU's implementation of the OECD's Crypto-Asset Reporting Framework (CARF), a global standard that more than 60 jurisdictions have committed to adopt.

Here is how it works in practice. Every crypto-asset service provider (CASP) authorized in the EU under MiCA, which means every regulated exchange, broker, and custodian, must now:

• Collect and verify the identity of every user: full legal name, residential address, date of birth, tax identification number (TIN), and country (or countries) of tax residence
• Record every reportable transaction: the type of crypto-asset, the transaction category, values, units, dates, transaction counts, and annual aggregates
• Report transfer information, including aggregate transfers to wallet addresses not hosted by a regulated provider, meaning your own hardware wallet or self-custody setup
• File this data annually with their national tax authority

The national tax authority then shares that data automatically with the tax authorities of all other EU member states. The first reporting period covers the 2026 calendar year. CASPs must file between 1 January and 30 September 2027, and the first automatic exchange between the 27 tax administrations is due in September 2027.

There is no threshold. This is not a regime that targets whales or suspected evaders. If you bought €50 of Bitcoin on a regulated European exchange in 2026, you are in the database.

What Exactly Gets Reported

It is worth being precise here, because the scope of DAC8 goes well beyond what most people assume when they hear "tax reporting."

Under DAC2, the existing regime for bank accounts, financial institutions report year-end balances and certain income. Under DAC8, CASPs report activity: what you traded, when, how much, and where it went. Because most crypto transactions settle on public blockchains, this creates a fundamentally different kind of exposure.

A bank account number is useless to anyone who doesn't control the bank. A blockchain address is different. It is a permanent, public record. Once your legal identity and home address are linked to on-chain activity, anyone who obtains that link can trace your entire transaction history, past and future, on a public ledger that never forgets. The reported data ages; the exposure it creates does not.

DAC8 also captures activity with no tax relevance at all. Transfers between your own wallets. Gifts to family members. Payments to merchants. Peer-to-peer transactions. None of these are taxable events in most member states, but all of them generate reportable data points that end up in 27 government databases.

And the reporting follows your tax residence, not your citizenship or the location of the exchange. A German tax resident using a French exchange gets reported to France, which forwards the data to Germany. A non-EU exchange with EU customers is pulled into the net too: CARF's global reach means providers in the UK, Switzerland, UAE, Singapore, and dozens of other committed jurisdictions will be reporting under parallel rules, with the OECD's first CARF exchanges also beginning in 2027.

The Case Against DAC8

The most organized opposition to DAC8 comes from within the crypto industry itself. Bull Bitcoin, a Canadian-founded exchange with significant European operations, has launched a public campaign and a legal challenge through the advocacy site dac8.com, and its arguments deserve serious attention because they are not really about tax at all. They are about safety.

A honeypot by design

The core argument is structural. DAC8 takes data that is currently spread across a hundred or more independent, regulated companies and concentrates it into databases shared among 27 national administrations. Each regulated CASP has strong incentives to protect customer data: a breach costs it its license, its customers, and up to 4% of worldwide turnover in GDPR penalties. A tax administration that leaks the same data faces, at worst, a symbolic fine paid by its own taxpayers.

The security of the shared system is only as strong as its weakest member. Under DAC8, the crypto data of French, German, and Dutch citizens will transit through the systems of every other member state. Precedents exist and they are not reassuring: Bulgaria's National Revenue Agency was breached in 2019, exposing data on up to 7 million taxpayers, and the campaign points to more than 100 million records of French citizens compromised from state-run or state-contracted databases in just 18 months.

The data has already gotten people hurt

This is where the DAC8 debate stops being abstract. Physical attacks on crypto holders, so-called wrench attacks, have surged in Europe. According to CertiK's Q1 2026 report, cited by the dac8.com campaign, 82% of global crypto-related physical attacks between January and April 2026 occurred in Europe, and 70% in France alone, with roughly $101 million extorted in four months. The French Interior Ministry records an attack roughly every 2.5 days. France's organized crime prosecution office (PNACO) has confirmed that criminal networks systematically target the families of known cryptocurrency holders.

The mechanism is data. Attackers no longer pick victims at random; they buy leaked personal data, cross-reference it, and select targets. The 2025 breach of Waltio, a French crypto tax platform, directly preceded at least three kidnapping cases according to the campaign's analysis. Waltio held tax data on about 50,000 customers. DAC8 creates the same category of database at a scale a thousand times larger.

The campaign's most sobering statistic: more than half of the attack victims recorded in 2026 held no crypto at all. They were spouses, children, and elderly parents of holders, used as direct victims or as pressure. Multiply Europe's estimated 54 million crypto holders by their immediate family circles and you get somewhere between 40 and 135 million Europeans whose physical safety now depends, in part, on the data security practices of the least well-equipped tax administration in the union.

Disproportionate and probably ineffective

The legal argument follows from the practical one. Article 52 of the EU Charter of Fundamental Rights requires that any limitation on fundamental rights be necessary and proportionate. The campaign argues DAC8 fails that test twice over.

First, a less intrusive alternative already exists. French law, like most member states' law, already gives tax authorities the power to make targeted, motivated information requests about specific taxpayers under investigation. That is how authorities obtain data on art, bullion, foreign real estate, and securities accounts. Crypto could work the same way. When a targeted tool achieves the same objective, mass collection is by definition disproportionate.

Second, the benefits are unproven. The European Commission's own staff working documents concede that the measurable revenue benefit of automatic exchange regimes is "extremely limited." The European Court of Auditors found in 2021 that only one of five audited member states even checks the quality of exchanged data, and that between 2015 and 2017 only 2% of covered taxpayers were successfully matched to a tax number. Europe's comparable AML regime costs an estimated $136.5 billion a year and intercepts around 0.1% of criminal funds.

There is also a policy contradiction the campaign highlights. The EU spent five years building MiCA to pull Europeans onto regulated, supervised platforms. Six months into DAC8, using those same regulated platforms is what gets you enrolled in the surveillance database, while non-custodial wallets, DEXs, P2P trades, and mining remain outside its scope, all perfectly legal. The predictable result is that sophisticated users drift out of the regulated perimeter, leaving ordinary users to bear the exposure alone.

The legal challenge

On 24 February 2026, Bull Bitcoin filed a summary petition before France's Conseil d'État, the country's highest administrative court, challenging Decree No. 2025-1276 of 19 December 2025, the main measure transposing DAC8 into French law. The company argues the decree expands reporting obligations even beyond what the directive requires. A fuller brief on the merits is being prepared, and a ruling could take 12 to 24 months. The petitioners have said this is one front among several they intend to open against DAC8 and CARF.

Whatever the outcome, the litigation will take years, and DAC8 is in force now. Your 2026 transactions are already being logged. Which brings us to the practical question: what can a law-abiding European actually do?

What DAC8 Means for You If You Hold Crypto in Europe

Let's be clear about something first: if you are an EU tax resident, you owe tax where the law says you owe tax, and DAC8 doesn't change your obligations. It changes your exposure. Three things are now true that were not true before:

First, your financial privacy on regulated platforms is gone. Every trade, every withdrawal to your own wallet, every annual aggregate gets reported and shared across 27 administrations, whether you owe anything or not.

Second, your personal data now sits in a target. Your name and home address, linked to signals about how much crypto you hold, will be replicated across dozens of government systems of wildly varying security quality.

Third, and this is the point everything else in this article turns on: the reporting follows your tax residence. DAC8 and CARF don't attach to your passport or where you were born. They attach to where you are tax resident. Change that, and you change what gets reported, where it goes, and which state's rules govern your financial life.

That third point is why interest in second citizenships and alternative residencies among European crypto holders has accelerated sharply since the directive was adopted.

Where a Second Passport Fits In

A second citizenship is not a tax trick, and anyone selling it as a way to hide from your current tax authority is selling you a problem. What a second passport actually provides is more durable than any trick: the standing legal right to restructure your life across borders, on your own timetable, without asking anyone's permission.

Here is what it does, concretely, for a European concerned about DAC8.

It makes changing your tax residence real, not theoretical

Reporting under DAC8 and CARF keys off tax residence. An EU citizen who genuinely relocates and becomes tax resident in, say, El Salvador or the UAE is no longer reportable to their former home state under DAC8 (subject to properly exiting their old tax residence, which varies by country and deserves professional advice).

But relocating requires somewhere to relocate to, with the legal right to stay indefinitely. Visas expire. Residence permits get revoked or renegotiated when governments change. Citizenship doesn't. A second passport converts "I could leave if things get worse" from a hope into a standing legal fact. For a deeper look at jurisdictions with no personal income or capital gains tax, see our guides to tax-free countries in the Caribbean and tax-free countries in the Middle East.

It diversifies your single biggest counterparty risk: your government

Crypto holders understand counterparty risk instinctively. Not your keys, not your coins. Yet most people accept total counterparty exposure to a single government: one passport, one tax authority, one set of politicians who can change the rules at any time. DAC8 itself is proof of how fast the rules change. The directive went from proposal to binding law in under three years, and the industry's concerns about physical safety were raised throughout and did not slow it down.

A second citizenship is jurisdictional diversification, the same logic as holding assets in more than one currency or coins in more than one wallet. If your home state's next directive is worse, if a data leak makes your country genuinely unsafe for known crypto holders, or if exit taxes and capital controls appear on the horizon, the holder of one passport has to ask permission. The holder of two already has it.

It restores a meaningful degree of privacy

Privacy here does not mean secrecy from tax authorities; it means not having your identity, address, and wealth signals concentrated where criminals have repeatedly obtained them. A family that relocates its tax residence outside the EU steps out of the DAC8 database going forward. Its ongoing activity is no longer automatically broadcast to 27 administrations, and its exposure shrinks to the (often far more limited) reporting regime of its new home. Several citizenship-by-investment countries impose no personal income tax, no capital gains tax, and no wealth tax, which means there is very little for anyone to report anywhere.

It protects your family, not just you

The most striking DAC8 statistic is that most 2026 attack victims held no crypto themselves. Security is a family-level problem, and so is the solution. Citizenship by investment programs naturally include spouses, children, and often parents and grandparents in a single application. One process covers the people the data actually endangers.

Realistic Options for European Crypto Holders

Different situations call for different tools. These are the main routes our clients weigh.

Citizenship by investment in crypto-native jurisdictions

El Salvador runs the only citizenship program in the world designed for Bitcoiners. Its Freedom Passport program grants citizenship in exchange for a $1 million donation payable in Bitcoin or USDT. Bitcoin is legal tender, there is no capital gains tax on Bitcoin, and the government's entire policy direction is the opposite of the EU's. For holders who want their citizenship jurisdiction and their asset philosophy aligned, this is the flagship option. Details on our El Salvador citizenship page.

Caribbean citizenship by investment

The classic route. Antigua and Barbuda, Grenada, St. Kitts and Nevis, Dominica, and St. Lucia offer citizenship from roughly $200,000–$300,000 (donation route), with processing typically inside a year and no requirement to relocate. All impose no tax on foreign-source income, and none tax capital gains. Grenada adds a practical bonus: its citizens are eligible for the US E-2 investor visa. Antigua and Barbuda has no personal income tax at all. See our Antigua and Barbuda and Grenada program pages.

A Caribbean passport does not by itself remove you from DAC8; if you remain tax resident in the EU, you remain reportable. What it provides is the standing right to leave and a low-tax jurisdiction ready to receive you when and if you exercise it.

Vanuatu

The fastest route to a second passport, with processing in as little as one to two months and investment from around $130,000. Vanuatu levies no personal income tax, no capital gains tax, and no wealth tax. Details on our Vanuatu program page.

Residence-first strategies

For those not ready for citizenship, tax residence in the UAE (no personal income tax, no capital gains tax) or Paraguay, among others, achieves the near-term goal of exiting EU automatic reporting once EU tax residence is properly terminated. The trade-off is permanence: residence permits are creatures of policy and can be tightened, as Portugal's repeated NHR reforms showed. Many clients pair a quick residence move with a citizenship application running in parallel.

What about CARF everywhere?

An honest caveat: CARF is going global, and more than 60 jurisdictions have committed to it, with major financial centers exchanging data from 2027 onward. The realistic goal is not to vanish from every reporting regime on Earth. It is to (a) legally exit the EU's particularly aggressive implementation, (b) become tax resident somewhere your reportable activity generates no tax liability and minimal stored data, and (c) hold the citizenship that lets you adapt again as the map changes. Several citizenship-by-investment jurisdictions have not committed to CARF at all; more importantly, in a zero-tax jurisdiction, the data trail that matters most simply never comes into being.

Frequently Asked Questions

Does DAC8 apply to my hardware wallet? Not directly. Self-custody is out of scope. But when you move coins between a regulated exchange and your own wallet, the exchange reports aggregate transfer data, and on a public blockchain that link can expose your broader on-chain history.

If I get a second passport but stay in Europe, am I still reported? Yes. DAC8 reporting follows tax residence, not citizenship. The passport is the enabler; the relocation is what changes your reporting position.

Is leaving to reduce reporting exposure legal? Changing your tax residence is legal and millions of people do it every year. What matters is doing it properly: genuinely exiting your old tax residence (rules differ by country, and some, like Spain and France, have anti-abuse provisions), settling any exit tax, and establishing real substance in your new home. Get professional tax advice before you move; this article is general information, not tax or legal advice.

Can I pay for citizenship with crypto? El Salvador accepts Bitcoin and USDT directly. For other programs, contributions are made in fiat, but CitizenX supports clients who fund their applications from crypto wealth and can guide you through compliant liquidation and source-of-funds documentation.

Will the Bull Bitcoin lawsuit stop DAC8? Nobody knows, and a Conseil d'État ruling on the merits is 12 to 24 months away, with effects limited to France's implementing decree in the first instance. Even a win would likely narrow rather than eliminate the regime. Planning around DAC8 as it stands is the prudent course.

The Bottom Line

Here is where things stand. Holding crypto through any regulated European platform now means automatic enrollment in a 27-country data-sharing system that links your identity and home address to your financial life. No threshold, no suspicion required, no way to opt out. The people fighting it in court make a strong case that it is disproportionate and dangerous. They may eventually win. You will live under it in the meantime.

A second citizenship will not change EU law. What it changes is your relationship to it: from someone with no alternative to someone with a permanent, legal, family-wide exit that no future directive can revoke. That is what wealth protection actually looks like in 2026. Not hiding, but holding options.

CitizenX helps investors acquire second citizenships in El Salvador, the Caribbean, and the Pacific, with crypto-native expertise at every step. Book a consultation to map out which program fits your situation.