Cyprus DAC8 Implementation 2026 — Mandatory Crypto-Asset Reporting from 2027 and What Cyprus CASPs Must Do

1. Legal basis

DAC8 is Directive (EU) 2023/2226 of the Council of 17 October 2023, amending Directive 2011/16/EU on administrative cooperation in the field of taxation. It implements the OECD's Crypto-Asset Reporting Framework (CARF) in EU law. Cyprus transposed DAC8 by amendment to the Administrative Cooperation in Taxation Law (Law 205(I)/2012 as amended) in late 2025.

2. Who must comply

• Cyprus-authorised CASPs under MiCA (Regulation EU 2023/1114) — exchange platforms, custodians, brokers, OTC desks, market makers, advisers.
• Crypto-Asset Operators (CAOs) — non-MiCA-authorised providers conducting crypto-asset operations from Cyprus.
• EU-passported CASPs marketing in Cyprus (reporting via their home-state authority, not Cyprus).
• Out of scope: pure software providers (wallet UX without custody), pure infrastructure (node operators, miners as such), non-custodial DEXs.

3. What gets reported

For each REPORTABLE USER (EU-tax-resident user) and reportable crypto-asset transaction:

• User identification — name, address, jurisdiction(s) of tax residence, TIN(s), date of birth, place of birth.
• Aggregate gross amount paid (acquisitions) per crypto-asset type per year.
• Aggregate gross amount received (disposals) per crypto-asset type per year.
• Aggregate number of units in each category.
• Aggregate fair-market value at year-end.
• Specific transaction categories: exchanges crypto-for-fiat, exchanges crypto-for-crypto, retail-payment transactions.

4. The reporting timeline

1. 11 January 2026 — DAC8 obligations commence. CASPs must begin collecting reportable data.
2. 2Through 2026 — CASPs build self-certification flows, transaction-aggregation pipelines, and reporting infrastructure.
3. 330 September 2027 — First DAC8 report submitted to Cyprus Tax Department, covering 2026 calendar year.
4. 431 December 2027 — Cyprus Tax Department auto-exchanges with EU member states.
5. 5Annually thereafter — September reporting + December auto-exchange.

5. Due-diligence on customer onboarding

DAC8 requires CASPs to apply due diligence on customer tax residency at onboarding and on any material change of circumstances:

• Self-certification by the user of all jurisdictions of tax residency + corresponding TINs.
• CASP must verify the reasonableness of the self-certification (e.g., compare against address, IP, payment-instrument country).
• Pre-existing customers (those onboarded before 1 January 2026): CASP must obtain self-certification before next reportable transaction.
• Failed self-certification → CASP must either decline service or report as 'undetermined' jurisdiction (treated as non-compliant by tax authorities).

6. Penalties + practical compliance

• Cyprus penalty framework — administrative fines up to €20,000 for late or incomplete returns (per Section 27 of Law 205(I)/2012 as amended); criminal liability for wilful evasion.
• Practical first-year focus areas: KYC pipeline integration, transaction categorisation logic (CARF-compliant), XML schema-conformant export, internal sign-off / audit trail.
• Vendor ecosystem — several Cyprus reg-tech vendors offer DAC8-ready reporting modules; in-house build typically takes 6-9 months including testing.
• Recommended Q3 2026 milestone: end-to-end test report submitted to Cyprus Tax Department UAT environment.

Frequently Asked Questions

Share this article

Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.