As of January 1, 2026, the European DAC8 directive is in force. It isn’t a piece of news that made much noise in the mainstream media, but it is perhaps the most important development of recent years for anyone who keeps Bitcoin on an exchange. In short: crypto intermediaries operating in the European Union are now required to collect every user’s data and transmit it automatically to the tax authority of the user’s country of residence. From this moment on, your exchange also works for the taxman.

Understanding what changes — and what you can do about it — is where it all starts.

What DAC8 Is and How It Works

DAC8 stands for Directive on Administrative Cooperation, in its eighth version. It is the European Union’s response to the growth of digital assets: the same rules that for years have obliged banks to report their clients’ foreign accounts (the CRS system, Common Reporting Standard) are now being extended to cryptocurrency exchanges, digital-asset service providers, and staking platforms.

The mechanism is simple: every CASP (Crypto-Asset Service Provider) registered in the EU collects complete identifying data on each client — name, tax identification number, address, transaction volume — and transmits it automatically to the local tax authority. From there, this information is shared with the tax authorities of the other 46 countries participating in the system.

From 2026, if you hold Bitcoin on Coinbase, Binance, Kraken, or any other European or EU-based exchange, your name and your movements are visible to the tax authorities without you having to do anything, without an explicit request, without any proceeding open against you. It is an automatic, systematic, permanent exchange of data.

Your Exchange Now Works for the Taxman

For years, many people kept Bitcoin on exchanges out of convenience, convinced that this “practical” privacy was enough. That is no longer the case.

DAC8 has turned every European exchange into a de facto tax withholding agent. This is not a metaphor: it is the same legal architecture that for decades has forced employers to report their employees’ salaries, or banks to report foreign accounts. The only difference is that here we are talking about an asset that, by its very nature, would not need intermediaries at all.

The problem is not only fiscal. A centralized database containing the identities of millions of Bitcoin holders, along with their balances and movements, is an extraordinarily attractive target. France’s own DGFIP — the equivalent of Italy’s Agenzia delle Entrate — has warned that the systematic collection of this data “creates a concentration of highly sensitive information, making this archive a prime target for hackers.” The irony is that the warning came in response to an even more invasive draft law, but the principle applies to any centralized system of this kind.

France Goes Further: Declaring Your Own Wallets Too

While DAC8 deals with exchanges, France has pushed forward a draft law that would have imposed the mandatory declaration of all self-custodial wallets with a balance above 5,000 euros. Hardware wallets like Ledger, apps like Metamask or BlueWallet: everything would have to be declared to the authorities.

The proposal met opposition even within the French government, and at the moment it seems unlikely to pass in its current form. But the fact that it was seriously discussed is a precise indicator of the direction in which European lawmakers are moving: self-custody is not seen as a right, but as a problem to be regulated.

This is not just a French issue. Regulatory pressure on self-managed Bitcoin is growing across Europe, and Italy is no exception.

The Answer Is Called Self-Custody

At the Bitcoin 2026 conference, several speakers framed the issue directly: self-custody is a civil liberty. This is not an ideological statement — it is a technical observation. Bitcoin was designed to allow the transfer of value between two people without intermediaries. When your Bitcoin is on an exchange, you are not using Bitcoin: you are using an IOU — a promise of payment — issued by a company that now has reporting obligations toward the tax authorities.

Keeping your own Bitcoin in a wallet whose seed phrase you control is not tax evasion. It is simply the correct use of the tool. Your tax obligations remain identical — declaring capital gains, filling out the RW schedule — but you are not handing any platform the ability to report you automatically.

The wallets recommended for getting started are Sparrow Wallet (desktop, for those who want maximum control), Muun or Phoenix (mobile, for Lightning payments), and a hardware wallet like Coldcard or Foundation Passport for more significant balances. In every case, the 12 or 24 words of the seed phrase must never be photographed, saved to the cloud, or typed on internet-connected devices.

Conclusion

DAC8 is not the end of Bitcoin, but it is the end of privacy for those who hold it on centralized platforms. The answer is not panic, nor evasion: it is understanding that self-custody is not an advanced option for experts, but the correct way to use this tool. Every sat you keep on an exchange is a sat you have delegated to someone else — and now that someone else has precise obligations toward the tax authorities. Whoever holds the keys, holds the Bitcoin.

Sources: