The rapid expansion of digital assets has fundamentally changed how businesses operate, invest and interact with customers. But in parallel, tax authorities worldwide, especially in the European Union, have moved decisively to close crypto reporting gaps and bring cryptoassets into the formal transparency architecture previously reserved for bank accounts and financial instruments.
For companies with users or operations involving Portugal, 2025 marks the beginning of a new regulatory era governed by DAC7, DAC8 and the OECD’s Crypto-Asset Reporting Framework (CARF). These instruments collectively signal the end of anonymity in crypto transactions and the beginning of structured, mandatory information exchange.This article focuses on what businesses must know.
1. DAC7: Expanding the EU’s Digital Platform Reporting Regime
Although DAC7 is not exclusively a crypto directive, it sets the stage for DAC8 by obliging digital platform operators to report seller activity to EU tax authorities. Under DAC7, platforms, regardless of whether they are hosted inside or outside the EU, must report income earned through:
- Services;Rentals;
- Sales of goods;
- Real estate or short-term accommodation.
- The relevance for crypto businesses is twofold:
- Platform compliance expectations have been standardised: DAC7 establishes the procedural and technological blueprint for reporting obligations; KYC, due diligence, data verification, and the cross-border exchange of information.
- It directly anticipates digital-asset-related reporting under DAC8: DAC7 is effectively the infrastructure layer that the EU uses to expand monitoring into the crypto ecosystem.
2. DAC8: The EU’s New Mandatory Reporting System for Cryptoassets
DAC8 is the most consequential EU measure ever enacted for crypto taxation and transparency. For companies operating in Portugal or serving Portuguese users, the implications are substantial.
2.1 Who Must Report?
DAC8 applies to Crypto-Asset Service Providers (CASPs), including:
- Exchanges;
- Wallet providers;
- Trading platforms;
- Businesses facilitating crypto transfers, swaps or payments;
- Certain DeFi-adjacent intermediaries, depending on control structures.
Crucially, DAC8 applies even if the CASP is not established in the EU, provided it has EU-resident users, including residents of Portugal.
2.2 What Must Be Reported?
CASPs must identify and report:
- Customer identity (KYC requirements aligned with AML standards);
- All cryptoasset transfers (in and out);
- Trading activity;
- Fiat-crypto and crypto-crypto conversions;
- Fair-market-value calculations;
- Gains, losses and holding periods.
This data is automatically transmitted to all relevant EU tax authorities and used to match taxpayer disclosures.
2.3 Why DAC8 Matters for Crypto Taxation in Portugal
Portugal’s tax authorities will have automatic visibility into:
- Crypto capital gains realised by Portuguese residents;
- Staking or yield-related income;
- Wallet activity, even when held offshore;
- Cross-platform transfers previously invisible to regulators.
DAC8 eliminates any practical ambiguity about whether crypto transactions fall within the scope of international exchange of information, they clearly do.
3. The OECD’s CARF: A Global Crypto Reporting Standard for Cryptoassets
CARF (Crypto-Asset Reporting Framework) extends far beyond the EU. Developed by the OECD to mirror the success of CRS (Common Reporting Standard), CARF creates a globally harmonised system for reporting crypto transactions.
3.1 Global Reach
Over 45 jurisdictions, including EU Member States and major economies, have committed to implementing CARF. Its design ensures that:Information about crypto holdings and transfers is exchanged between jurisdictions;Non-EU platforms cannot shield EU residents from scrutiny;Tax authorities can track flows of digital value across borders with unprecedented clarity.
3.2 What CARF Requires
CARF mandates reporting of:
- Crypto-to-crypto and crypto-to-fiat transactions;
- Wallet addresses associated with identified users;
- Transfers to and from unhosted wallets (where feasible);
- Valuation data for taxable events.
3.3 How CARF Interacts with DAC8
CARF and DAC8 are mutually reinforcing:
- DAC8 governs reporting inside the EU;
- CARF governs reporting across global jurisdictions;
- Together, they replicate the CRS model for digital assets.
For companies dealing with Portugal, this means crypto transactions are, effectively, fully transparent internationally.
4. What This Regulatory Shift Means for Businesses
Organisations with users, employees or investors in Portugal face new obligations and new risks:
- Enhanced KYC and due diligence: Onboarding standards for crypto transactions now parallel those of banking and financial services.
- Mandatory cross-border reporting: CASPs must prepare for automated information exchange across all EU Member States and OECD jurisdictions implementing CARF.
- Increased tax risk for remote-work structures: Employees compensated in crypto or performing crypto-related functions from Portugal may trigger taxable events or, in rare cases, contribute to permanent establishment considerations.
- Zero tolerance for non-disclosure: With DAC8 and CARF, the opportunity for unreported portfolio gains or offshore crypto wallets has effectively disappeared.
- Need for integrated tax-technology solutions: Complex reporting requirements require automated systems capable of tracking, valuing and classifying transactions across multiple jurisdictions.
5. Action Points for Companies With Portuguese Users or Operations
Businesses should:
- Assess whether they qualify as CASPs under DAC8;
- Map reporting obligations for Portugal-based clients or employees;
- Review contractual terms, user policies and internal compliance frameworks;Implement enhanced KYC, record-keeping and transaction-monitoring systems;
- Conduct jurisdiction-by-jurisdiction impact assessments under CARF;
- Develop a governance model for cryptoasset operations that anticipates audits and regulatory requests.
DAC8 and CARF represent a structural transformation of the digital-asset regulatory environment, non-compliance is no longer a realistic option.
Conclusion
The combination of DAC7, DAC8 and the OECD’s CARF creates a comprehensive transparency regime that effectively integrates cryptoassets into the global tax-information exchange system. For companies interacting with the Portuguese market, this means elevated compliance duties, new reporting liabilities and the need for robust, proactive tax-technology governance.
Crypto is no longer an unregulated frontier, it is now part of the core international tax architecture.
The founding of Madeira Corporate Services dates back to 1996. MCS started as a corporate service provider in the Madeira International Business Center and rapidly became a leading management company… Read more
