Crypto-asset businesses operating in Cyprus have entered a new era of tax transparency. From 1 January 2026, DAC8 extends the European Union’s automatic exchange of tax information framework to reportable crypto-asset transactions.
The rules affect more than tax return preparation. Reporting businesses may need to identify users, determine their tax residence, classify crypto-assets, collect transaction data and create reliable reporting controls.
These obligations can affect onboarding, compliance, accounting systems, data security and relationships with external technology providers.
Businesses that wait until the first reporting deadline to assess their position may discover that historical customer or transaction data is incomplete.
Preparing early provides time to identify reporting responsibilities and correct weaknesses before information must be submitted.
What DAC8 changes for the crypto-asset sector
DAC8 is the eighth amendment to the EU Directive on Administrative Cooperation in taxation. It introduces the automatic exchange of information about reportable crypto-asset users and transactions between EU tax authorities.
Under the framework, a Reporting Crypto-Asset Service Provider collects prescribed information about reportable users and transactions. The provider submits that information to the relevant national tax authority, which can then exchange it with the tax authority in the user’s country of residence.
Cyprus brought the framework into effect through its 2026 amendments on administrative cooperation in taxation. Businesses can monitor local announcements and implementation material through the Cyprus Tax Department’s DAC8 information page.
DAC8 does not create a single EU tax rate for crypto-assets, nor does it automatically determine whether every transaction results in taxable income or a taxable gain. Its primary purpose is tax transparency: giving authorities standardised information that can be compared with taxpayers’ declarations.
Which crypto-asset businesses may be affected?
The rules focus on Reporting Crypto-Asset Service Providers, commonly referred to as RCASPs. The classification can include entities and individuals that provide services facilitating exchange transactions in relevant crypto-assets.
A business should assess the services it actually performs rather than relying only on its commercial description. Potentially relevant activities may include facilitating:
- Exchanges between crypto-assets and fiat currencies
- Exchanges between one reportable crypto-asset and another
- Transfers of reportable crypto-assets
- Certain services carried out on behalf of crypto-asset users
The analysis may be straightforward for an exchange or brokerage platform but less obvious for businesses combining technology, custody, payment, execution or administrative functions.
Each legal entity within a group should be assessed separately. One company may own the technology, another may contract with users and another may execute transactions. The reporting responsibility should be based on the actual operating model, contracts and functions of each entity.
Businesses entering or restructuring the Cyprus market can review Corpera’s company formation services when considering how legal entities, governance and operational responsibilities should be organised.
Which crypto-assets and transactions fall within scope?
DAC8 has a broad scope based partly on definitions used under the EU Markets in Crypto-Assets Regulation. According to the European Commission’s DAC8 guidance, the framework can cover decentralised crypto-assets, stablecoins, e-money tokens and certain non-fungible tokens.
Whether a specific asset or transaction is reportable depends on the applicable definitions and exclusions. Businesses should avoid making decisions solely from labels such as “utility token,” “stablecoin” or “NFT.”
The asset’s characteristics, use and ability to be transferred or exchanged may be more important than its marketing name.
The information reported is divided by reportable crypto-asset and can include aggregate values relating to acquisitions, disposals and exchanges. For transfers, reporting may involve aggregate fair market value.
Both domestic and cross-border transactions can be relevant. A Cyprus provider should not assume that activity involving a Cyprus-resident user is outside the reporting framework simply because no international transfer occurred.
The 2026 data collection and 2027 reporting timeline
Reporting providers must collect data on reportable transactions involving EU-resident users from 1 January 2026. The first reporting period therefore covers activity occurring during the 2026 calendar year.
The first reports are due in the following calendar year. Under the EU timetable, information relating to 2026 must be reported and exchanged within nine months after the end of that reporting year, placing the first reporting deadline no later than 30 September 2027.
Businesses should still check the final Cyprus reporting procedure, including registration requirements, submission format and any domestic administrative deadlines.
Providers operating in the EU without authorisation under MiCA may also need to consider the DAC8 single-registration requirement in an EU Member State. MiCA authorisation and DAC8 reporting are related regulatory considerations, but compliance with one framework should not be assumed to satisfy every obligation under the other.
User identification and tax-residence checks
DAC8 requires due diligence procedures designed to identify reportable users and determine their tax residence. Existing customer verification records may provide useful information, but anti-money-laundering checks and tax reporting serve different purposes.
A customer file may establish identity without containing sufficient evidence of tax residence. Businesses should review whether their onboarding process captures the required identification details, tax residence, tax identification number and any other information needed for reporting.
Procedures should also address:
- Customers claiming residence in multiple jurisdictions
- Missing or invalid tax identification numbers
- Changes in address or tax residence
- Incomplete or contradictory self-certifications
- Customers who fail to respond to information requests
- Duplicate accounts belonging to the same user
Where a user’s circumstances change, the provider should be able to update the record without losing the historical information relevant to an earlier reporting period.
Customer-facing terms, privacy notices and data-retention policies may also require review. Businesses should ensure that personal information is collected, processed, stored and disclosed through an appropriately documented and secure process.
Mapping transaction data across multiple systems
Crypto-asset information is often distributed across several systems. Customer details may be held in a compliance platform, transaction records in an exchange engine, wallet information in another environment and accounting entries in the general ledger.
A DAC8 data-mapping exercise should identify where each required field originates, how systems connect and who is responsible for resolving discrepancies.
Transaction records should be traceable to the relevant user, legal entity, crypto-asset, transaction type, date, value and currency. Businesses should also document the valuation source and timing used when transactions must be converted into a reportable monetary amount.
Special attention may be needed for:
- Wallet migrations
- Failed or reversed transactions
- Transfers between wallets belonging to the same user
- Duplicate customer profiles
- Assets changing name or technical structure
- Corrections made after the reporting period
- Transactions processed through external liquidity providers
The reporting file should be reconciled with operational records and, where applicable, the company’s financial accounts. Corpera’s accounting services can support businesses in maintaining consistent records and reconciling transaction information with the general ledger.
Governance, outsourcing and accountability
DAC8 preparation should have a clearly assigned owner. Tax, compliance, legal, finance and technology teams may all hold part of the required information, but responsibility for the final reporting process must be defined.
A documented governance structure should identify who:
- Determines whether the business is an RCASP
- Classifies users and crypto-assets
- Owns customer and transaction data
- Reviews reporting exceptions
- Approves the final submission
- Communicates with the Cyprus Tax Department
- Corrects information after submission
If data processing or report preparation is outsourced, the agreement should address accuracy, security, service deadlines, error correction and access to supporting records. Outsourcing a technical process does not necessarily transfer the provider’s legal accountability.
Senior management should receive timely information about unresolved data gaps, reporting risks and implementation progress.
A DAC8 readiness checklist for Cyprus businesses
Businesses preparing for DAC8 should take the following steps:
- Document all crypto-asset services performed by each legal entity.
- Determine whether any entity qualifies as a Reporting Crypto-Asset Service Provider.
- Identify the crypto-assets and transaction types supported by the business.
- Map customer identification, tax-residence and transaction data across all systems.
- Update onboarding and self-certification procedures where required.
- Establish rules for handling missing, inconsistent or outdated customer information.
- Document valuation methods for reportable transactions and transfers.
- Reconcile transaction data with operational and accounting records.
- Review contracts with technology providers and outsourced compliance partners.
- Assign responsibility for preparation, review, approval and submission.
- Test the reporting process using realistic customer and transaction scenarios.
- Monitor Cyprus guidance on registration, filing formats and domestic deadlines.
Preparing for DAC8 with Corpera
DAC8 requires businesses to connect tax reporting with customer due diligence, technology systems, accounting records and governance. A narrow focus on the final submission file may overlook weaknesses in the information supporting it.
Corpera’s Tax and VAT services can help businesses assess their reporting position, organise financial information and coordinate implementation across relevant functions.
Businesses may also benefit from Corpera’s business advisory services when reviewing operating models, responsibilities and cross-border structures affected by the new framework.
Early preparation gives management time to identify incomplete records, test reporting controls and address complex classifications before the first submission becomes urgent. Businesses requiring support can contact Corpera to discuss their circumstances.
This article is provided for general information and does not constitute personalised tax, legal, regulatory or crypto-asset advice.
#CyprusDAC8 #DAC8Compliance #CryptoAssetReporting #CryptoTax #TaxTransparency #CyprusBusiness #EUCompliance #CorperaInsights
