Cyprus DAC8 Implementation 2026 — Mandatory Crypto-Asset Reporting from 2027 and What Cyprus CASPs Must Do
10 min read·
By Nexora Cyprus editorial team · General information — seek advice for your circumstances
Two-line summary
DAC8 obliges EU Crypto-Asset Service Providers (CASPs) — including Cyprus-authorised CASPs — to collect and report customer transaction data to their member-state tax authority from 1 January 2026, with first cross-border auto-exchange by 30 September 2027. Operationally equivalent to CRS for traditional banks, but for crypto.
1. Legal basis
DAC8 is Directive (EU) 2023/2226 of the Council of 17 October 2023, amending Directive 2011/16/EU on administrative cooperation in the field of taxation. It implements the OECD's Crypto-Asset Reporting Framework (CARF) in EU law. Cyprus transposed DAC8 by amendment to the Administrative Cooperation in Taxation Law (Law 205(I)/2012 as amended) in late 2025.
2. Who must comply
Cyprus-authorised CASPs under MiCA (Regulation EU 2023/1114) — exchange platforms, custodians, brokers, OTC desks, market makers, advisers.
330 September 2027 — First DAC8 report submitted to Cyprus Tax Department, covering 2026 calendar year.
431 December 2027 — Cyprus Tax Department auto-exchanges with EU member states.
5Annually thereafter — September reporting + December auto-exchange.
5. Due-diligence on customer onboarding
DAC8 requires CASPs to apply due diligence on customer tax residency at onboarding and on any material change of circumstances:
Self-certification by the user of all jurisdictions of tax residency + corresponding TINs.
CASP must verify the reasonableness of the self-certification (e.g., compare against address, IP, payment-instrument country).
Pre-existing customers (those onboarded before 1 January 2026): CASP must obtain self-certification before next reportable transaction.
Failed self-certification → CASP must either decline service or report as 'undetermined' jurisdiction (treated as non-compliant by tax authorities).
6. Penalties + practical compliance
Cyprus penalty framework — administrative fines up to €20,000 for late or incomplete returns (per Section 27 of Law 205(I)/2012 as amended); criminal liability for wilful evasion.
Vendor ecosystem — several Cyprus reg-tech vendors offer DAC8-ready reporting modules; in-house build typically takes 6-9 months including testing.
Recommended Q3 2026 milestone: end-to-end test report submitted to Cyprus Tax Department UAT environment.
Official verification starting points
CySEC MiCAR information and EU Markets in Crypto-Assets Regulation publish the controlling material for this topic. Check the current law, form, circular or portal instructions before acting; this article is general information and the live official material prevails.
Disclaimer: This article is for informational purposes only and does not constitute legal, tax, or financial advice. Tax laws change frequently. Consult a qualified Cyprus adviser for guidance specific to your situation. The information on this page is general guidance only and does not constitute legal, tax, accounting, immigration or financial advice. Specific advice should be obtained based on the facts of each case.
Read each reference alongside the claim it accompanies and check current amendments before relying on it. General information — seek advice for your circumstances.