Cyprus DAC8 & OECD CARF Crypto-Asset Reporting (2026): Who Reports, What Data, and When

For years, crypto holdings sat in a blind spot that bank accounts left long ago. That era is over. DAC8 — the EU's eighth amendment to the Directive on Administrative Cooperation — drags crypto-assets into the same automatic tax-information-exchange machinery that already covers ordinary financial accounts, and Cyprus has now written it into domestic law.Council Directive (EU) 2023/2226 (DAC8)

This guide gives the direct answers Cyprus crypto businesses and investors actually need: which law applies, who counts as a reporting provider, exactly what data is captured, the 2026–2027 timeline, how DAC8 interlocks with CRS, DAC6, DAC7 and MiCA, and why none of this changes whether your gains are taxable. For that separate question, see our guide to the mandatory 8% Article 20E crypto regime.

What are DAC8 and CARF, and how do they fit together?

CARF is the OECD's global standard for automatic exchange of tax information on crypto-assets; DAC8 is the EU law that makes CARF binding across all member states. Cyprus, as an EU member, implements CARF through DAC8 rather than as a standalone instrument.

The OECD published the Crypto-Asset Reporting Framework in 2022 as the crypto-native successor to the Common Reporting Standard, giving tax authorities a common schema for who reports, on whom, and what. Dozens of jurisdictions have committed to first exchanges by 2027.OECD Crypto-Asset Reporting Framework (CARF) Within the EU, CARF does not apply on its own — it is codified through DAC8, which additionally reaches EU-resident users regardless of where the service provider is based. The practical effect is a single reporting language spoken by exchanges and tax offices across Europe and beyond.

How did Cyprus transpose DAC8 into national law?

Cyprus enacted Law 38(I)/2026 — the Administrative Cooperation in the Field of Taxation (Amending) Law of 2026 — which amends the base Law 205(I)/2012 and imports the DAC8 crypto and CRS-upgrade provisions. It applies retroactively from 1 January 2026, so 2026 is the first data year despite the law being finalised later that spring.

Cyprus was among a group of member states that did not meet the original 31 December 2025 transposition deadline, and the amending law entered into force in late March 2026 with retroactive effect to the start of the year.Law 38(I)/2026 amending Law 205(I)/2012 (DAC8 transposition) That retroactivity matters: a provider that onboarded users in the January–March window before the domestic rules crystallised may still owe self-certifications and transaction data for that period, creating a real remediation exercise rather than a clean start. Because the operative detail sits in the amending law and subsequent Tax Department decrees, every specific figure below should be confirmed against the official gazette text before you rely on it.

Who must report — the RCASP definition?

The obligation falls on Reporting Crypto-Asset Service Providers (RCASPs): entities authorised in Cyprus under the EU Markets in Crypto-Assets Regulation (MiCA), and unlicensed Crypto-Asset Operators that nonetheless have a Cyprus nexus — tax residency, incorporation, place of effective management, or usual place of business in Cyprus.

In plain terms, the net is deliberately wide. It captures registered exchanges and brokers, but also operators facilitating exchanges between crypto and fiat, crypto-to-crypto swaps, and certain transfers — whether or not they hold a MiCA licence — provided the Cyprus connecting factors are met.Regulation (EU) 2023/1114 (MiCA) A Cyprus-incorporated crypto business should assume it is in scope and prove otherwise, not the reverse. Individual investors are not RCASPs — they are the reported users — but they should expect their Cyprus and foreign platforms to request self-certification of tax residency and TIN, and to pass that information on.

What data is collected and reported?

RCASPs must apply CARF-style due diligence to identify each reportable user, then report identity data plus aggregate valuations and transaction figures by asset type. Entity users trigger look-through to their controlling persons.

The granularity is the point. Reporting is per-user, per-asset and per-transaction-type, aggregated over the calendar year, so tax authorities can reconcile what an investor declares against what the platform reports.Law 38(I)/2026 (reportable data schema) Transfers to self-custodied (unhosted) wallets are specifically within scope, which closes the obvious avoidance route of moving assets off-platform.

When does reporting actually start?

The first reporting period is calendar year 2026. RCASPs file their first report with the Cyprus Tax Department by 30 June 2027, and the first automatic exchange of that information between EU member states occurs by 30 September 2027. The cycle then repeats every year.

Because collection is already live and retroactive, the compliance clock started before many providers had their systems ready — the practical priority in 2026 is remediating any onboarding and transaction data gaps well ahead of the June 2027 filing.OECD CARF 2025 Monitoring and Implementation Update

How does DAC8 relate to CRS, DAC6, DAC7 and MiCA?

DAC8 is one layer in a stack of EU transparency rules. It extends CRS to crypto (and upgrades CRS itself), sits alongside DAC6 (cross-border arrangement disclosure) and DAC7 (digital-platform seller reporting), and dovetails with MiCA, which licenses the same crypto providers it obliges to report.

• CRS / CRS 2.0: DAC8 brings crypto-assets into automatic exchange and enhances the existing CRS for financial accounts, adding e-money and certain digital products plus new data fields.
• DAC6: mandatory disclosure of reportable cross-border tax arrangements by intermediaries — a different trigger, but part of the same enforcement fabric.
• DAC7: reporting by digital platforms on the income of sellers using them; DAC8 is the crypto-specific counterpart. Both are covered in our DAC6 and DAC7 guide.
• MiCA: Regulation (EU) 2023/1114 licenses crypto-asset service providers; DAC8 makes those same providers report. Authorisation and reporting status should be assessed together.

Is DAC8 the same thing as the 8% crypto tax?

No. DAC8 decides what information tax authorities receive; Cyprus tax law decides what is taxed. The two are complementary but entirely distinct — DAC8 does not create, raise or reduce any tax.

Cyprus taxes qualifying crypto disposals under a dedicated regime, and crypto-business profits feed into the reformed 15% corporate base from 1 January 2026.Cyprus corporate income tax 15% from 1 Jan 2026 What DAC8 changes is enforceability: once the Tax Department and its EU counterparts receive per-user balance and transaction data, under-declaration becomes far easier to detect. The right response is not to fear the reporting but to get the underlying tax position correct — see the Article 20E crypto tax guide and, for business structuring, the Cyprus corporate tax guide.

What are the penalties for non-compliance?

Reported administrative penalties run up to €5,000 for due-diligence failures and up to €10,000 for record-keeping, late filing, or incomplete or inaccurate reporting — per the amending law and Tax Department decrees, which should be checked for the current figures and procedure.

Beyond the headline fines, the reputational and licensing exposure is arguably larger for a MiCA-authorised provider: a reporting failure is also a supervisory red flag. And because Cyprus does not switch off the retroactive 2026 obligations, a provider that ignored data collection early in the year cannot cure that simply by filing on time in 2027 — the underlying records must exist.Law 38(I)/2026 (administrative penalties)

What should Cyprus CASPs and investors do now?

Providers should confirm RCASP status, remediate 2026 data gaps, and build a compliant reporting file for the 30 June 2027 deadline. Investors should ensure their declared Cyprus tax position matches what platforms will report.

1. Scope your status. Determine whether MiCA authorisation or the Cyprus nexus tests make you an RCASP; document the conclusion.
2. Fix onboarding. Collect valid self-certifications (tax residency, TIN, controlling persons) and backfill anything missed in the January–March 2026 window.
3. Capture transactions. Ensure systems log acquisitions, disposals and transfers — including to unhosted wallets — at the required granularity.
4. Prepare to file. Map your data to the reporting schema and dry-run the submission well before 30 June 2027.
5. Align the tax side. Investors and businesses should reconcile their declared income and gains with the data that will be reported and exchanged.

Zeno is not a law firm; it coordinates independent Cyprus Bar advocates and ICPAC-licensed accountants who handle DAC8 scoping, remediation and the interaction with your crypto tax position under one managed engagement.