Cyprus Implements DAC8
The new tax transparency regime under Law 38(I)/2026 brings crypto-asset transactions, e-money, and high-net-worth individual rulings into automatic exchange of information. What service providers, financial institutions, and clients need to do now.
Key Parameters at a Glance
- Regime: Mandatory due diligence and reporting for crypto-asset service providers, expanded CRS scope, and new HNWI ruling exchange
- Competent authority: Cyprus Tax Department (CTA)
- Crypto reporting threshold: No de minimis — all reportable transactions are caught
- HNWI ruling threshold: Transactions ≥ €1.5 million referenced in the ruling, or rulings determining tax residency
- First reporting deadline: 30 June 2027 (covering calendar year 2026)
- First exchange deadline: 30 September 2027
- Record retention: 5 to 10 years from end of reporting year
- Penalties: Up to €5,000 for due diligence failures; up to €10,000 for record-keeping or filing failures
- Effective date: Retroactive to 1 January 2026 (with limited exceptions)
- Legislative basis: Law 38(I)/2026, transposing EU Directive 2023/2226 (DAC8)
Section 1 — Overview
On 27 March 2026, Law 38(I)/2026 was published in the Official Gazette of the Republic of Cyprus and entered into force, amending the Law on Administrative Cooperation in the field of Taxation (Law 205(I)/2012). The Law transposes EU Directive 2023/2226 (DAC8) into Cypriot law and applies retroactively from 1 January 2026, with a small number of limited exceptions.
DAC8 is the eighth iteration of the EU’s Directive on Administrative Cooperation. It builds on the existing tax transparency framework — the Common Reporting Standard (CRS), country-by-country reporting, mandatory disclosure rules — and extends automatic exchange of information into three new areas: crypto-asset transactions, e-money and digital currency products, and advance cross-border rulings issued to high-net-worth individuals. The crypto-asset provisions are aligned with the OECD’s Crypto-Asset Reporting Framework (CARF) and the EU’s Markets in Crypto-Assets Regulation (MiCAR), creating a single global standard for reporting digital asset activity to tax authorities.
For Cyprus, this is a significant compliance uplift. The Republic was among twelve EU Member States that missed the original 31 December 2025 transposition deadline, and the law was enacted later than ideal — with the first reporting period (calendar year 2026) already running. In practical terms, this means RCASPs, financial institutions, and tax advisers need to backfill 2026 due diligence and data capture obligations in time for the first reporting deadline of 30 June 2027.
It is worth reading DAC8 alongside two parallel reforms: the new 8% flat tax on crypto-asset disposals introduced by Article 20E of the Income Tax Law (effective from the same date), and the increase of the corporate tax rate to 15% under Pillar Two. DAC8 ensures that the lower 8% rate operates within full transparency — Cyprus is decisively not positioning itself as an opaque jurisdiction.
Section 2 — The Three Strands of DAC8
The Law operates across three substantive areas. Each captures a different population, has its own due diligence and reporting mechanics, and has its own first-reporting cadence.
| Strand | Who Is Caught | First Reporting |
|---|---|---|
| (i) Crypto-Asset Reporting | Reporting Crypto-Asset Service Providers (RCASPs) — MiCAR-licensed entities and Crypto-Asset Operators with Cyprus nexus | 30 June 2027 (for FY 2026) |
| (ii) CRS 2.0 | Reporting Financial Institutions, expanded to include e-money institutions; new mandatory data points | Aligned with existing CRS reporting cycle |
| (iii) HNWI Cross-Border Rulings | Tax authorities issuing advance cross-border rulings to natural persons — automatic exchange with other EU Member States | For rulings issued, amended, or renewed from 1 January 2026 |
Section 3 — Who Is a “Reporting Crypto-Asset Service Provider”?
The definition of an RCASP determines who carries the reporting burden. The Law captures two categories.
Definition — Reporting Crypto-Asset Service Provider (RCASP)
(a) Any entity licensed in Cyprus by the relevant competent authority under the EU’s Markets in Crypto-Assets Regulation (MiCAR).
(b) Any Crypto-Asset Operator — i.e. an entity that provides Crypto-Asset Services under MiCAR but is not required to be MiCAR-registered — that has a Cyprus nexus: tax residency in Cyprus, incorporation in Cyprus, place of effective management in Cyprus, or usual place of business in Cyprus.
Practical effect: The regime captures both regulated CASPs and operators that fall outside MiCAR but have a meaningful Cyprus connection. Non-EU operators serving EU clients are also expected to register in a single Member State for reporting purposes under the broader DAC8 framework. Mere use of a Cypriot service provider does not, by itself, create a Cyprus nexus for a foreign operator.
The scope of services caught is broad and includes:
| Service | Examples |
|---|---|
| Custody and administration | Holding crypto-assets on behalf of clients, wallet services |
| Operation of trading platform | Centralised exchanges, order book platforms |
| Execution of orders | Brokerage and dealing on behalf of clients |
| Exchange transactions | Crypto-to-fiat and crypto-to-crypto swaps |
| Advice and portfolio management | Discretionary or advisory services on crypto-assets |
| Staking and lending | Yield-generating arrangements where the provider facilitates the activity |
What Counts as a Reportable Crypto-Asset
A Reportable Crypto-Asset includes any crypto-asset except: (i) Central Bank Digital Currencies, (ii) Electronic Money, and (iii) any crypto-asset for which the RCASP has adequately determined that it cannot be used for payment or investment purposes. The definition is aligned with MiCAR but slightly broader — the Law extends the concept to all types of crypto-assets that may be used for payment or investment purposes, even where they fall outside MiCAR’s regulatory perimeter.
Section 4 — Due Diligence Procedures
RCASPs are required to identify their crypto-asset users and determine whether each user is “reportable” — i.e. an EU tax resident, or an estate of a decedent who was an EU resident — other than Excluded Persons defined in the existing CRS legislation.
Self-Certification
The cornerstone of the due diligence regime is the self-certification. The RCASP must obtain a signed self-certification from each user containing specific identification information. The self-certification must be valid, complete, and reasonable when assessed against other information held by the RCASP (e.g. AML/KYC files).
Look-Through to Controlling Persons
For legal entities and arrangements that are crypto-asset users, the RCASP must also identify controlling persons who themselves may be reportable users. This mirrors the controlling-person logic already familiar from CRS.
Record Retention
All RCASPs must maintain records demonstrating compliance with their reporting and due diligence obligations for a minimum of 5 years and up to 10 years from the end of the year to which the reporting refers.
Data Protection Notifications
Cyprus data protection legislation interacts with the Law in two specific ways. The RCASP must:
- inform each individual concerned that their information will be collected and transferred under the Law; and
- transmit to each individual all information they are entitled to receive from the data controller, with sufficient time to exercise data protection rights — and in any event before the information is communicated to the Cyprus Tax Authorities.
Section 5 — Reporting Mechanics and Timeline
The reporting cycle aligns with the calendar year and runs as follows.
| Step | Deadline | Detail |
|---|---|---|
| Data capture | Throughout calendar year | RCASPs collect transactional and user information continuously |
| RCASP report to CTA | 30 June following year-end | First report due 30 June 2027 for calendar year 2026 |
| CTA exchanges with EU peers | Within 9 months of year-end | First exchange by 30 September 2027 |
The information reported includes details of the RCASP itself, the reportable crypto-asset users (and their controlling persons where applicable), and transactional information on reportable crypto-assets — covering both exchanges and transfers.
Backfill Risk for 2026 Data
Because the Law entered into force on 27 March 2026 with retroactive effect from 1 January 2026, RCASPs that did not have CARF/DAC8-compliant onboarding and data capture in place from the start of the year may face a data gap. Practical exposures include:
- Self-certifications not collected at onboarding for users onboarded between 1 January and 27 March 2026
- Transactional data not captured to the granular standard required by the reporting schema
- Controlling-person information missing for entity users
Remediation should be a priority project for any RCASP that does not already operate to CRS/CARF standards — the first reporting deadline is closer than it appears.
Exemptions to Avoid Double Reporting
Two exemptions exist to prevent the same data being reported twice:
- An RCASP that fulfils its DAC8 obligations in another EU Member State, or in a third country with which Cyprus has concluded an equivalent exchange of information agreement, may be exempt in Cyprus subject to certain conditions.
- An RCASP that is also a Financial Institution within the meaning of the CRS Law may rely on its existing CRS due diligence procedures (or other valid self-certifications) to meet its DAC8 due diligence obligations.
Section 6 — Penalties for Non-Compliance
The penalty framework under the Cyprus implementation is meaningful but not at the upper end of EU norms.
| Violation | Maximum Fine |
|---|---|
| Failure to collect and verify user information (due diligence) | Up to €5,000 |
| Failure to comply with record-keeping obligations | Up to €10,000 |
| Incomplete or inaccurate submission of information to the CTA | Up to €10,000 |
| Failure by a Crypto-Asset Operator to register in Cyprus | Up to €10,000 |
Penalty in Context
The fines are modest in headline terms, but the real exposure for an RCASP is reputational and operational. A failure to register or report could trigger downstream consequences with banking partners, MiCAR supervisors, and counterparties — and create issues at the audit level when reviewing internal control environments around regulatory compliance.
Section 7 — CRS 2.0: Expanded Scope for Financial Institutions
DAC8 also brings the Common Reporting Standard up to its “CRS 2.0” form, which has two main consequences for Reporting Financial Institutions in Cyprus.
New Categories of Caught Institutions and Accounts
The definition of “Reporting Financial Institution” is expanded to include electronic money (e-money) institutions, and the definition of “Financial Account” now includes e-money products. This brings a population of payment-style institutions into the CRS reporting net for the first time.
New Mandatory Data Points
The information that must now be reported under CRS has been expanded to include:
New CRS 2.0 Reporting Fields
- Self-certification status: Indication of whether a valid self-certification is held for the account holder and any controlling person of a Passive NFE
- Joint accounts: Whether the account is a joint account, and if so, the number of joint account holders
- Account vintage: Whether the account is pre-existing (opened before 1 January 2016) or new (opened on or after that date)
- Account type: Depository Account, Custodial Account, Cash Value Insurance Contract, Annuity Contract, or Debt/Equity Interest in an Investment Entity
- Capacity of reportable person: For account holders that are investment entities qualifying as legal arrangements (e.g. trusts), the capacity in which the reportable person acts — settlor, trustee, protector, beneficiary, or equivalent
- Role of controlling persons: For Passive NFE account holders, the role of controlling persons (now mandatory rather than optional)
- Account number type: Optional category, expanded to include “Specified Electronic Money Product”
System and Onboarding Implications for FIs
The new fields require both back-book remediation (capturing missing data on pre-existing accounts) and forward-book uplifts (updating onboarding and self-certification templates). Most Cypriot Reporting Financial Institutions will need to update their CRS systems, onboarding flows, and reporting schemas before the next CRS reporting cycle in which CRS 2.0 fields are required.
Section 8 — Exchange of Information on HNWI Cross-Border Rulings
This is the strand that most directly affects clients of professional advisory firms. Until DAC8, automatic exchange of advance cross-border rulings under DAC3 was limited to corporates. DAC8 extends the regime to cross-border rulings issued to natural persons — but only where one of two thresholds is met.
When Is a Ruling Automatically Exchanged?
A cross-border ruling issued, amended, or renewed by the Cyprus tax authorities to a natural person from 1 January 2026 onwards is subject to automatic exchange with other EU Member States if either:
(a) The amount of the transaction or series of transactions covered by the ruling exceeds €1,500,000 (or equivalent in another currency), and that amount is referenced in the ruling itself; or
(b) The ruling determines whether the natural person is, or is not, tax resident in Cyprus.
Practical effect: Tax residency rulings — common for individuals relocating to Cyprus and using non-dom status, the 60-day rule, or Article 8(21A)/8(21B)/8(23A) exemptions — are now automatically exchanged with the individual’s other EU Member State of relevance, regardless of any monetary threshold. Substantive transactional rulings (e.g. on the tax treatment of a complex disposal or arrangement) are exchanged where the €1.5m amount is named in the ruling.
Additional Detail Required from 2028
For tax periods beginning on or after 1 January 2028, the exchange will be enriched with the tax identification number (TIN) issued by the EU Member State of residence of all relevant parties — both for the new HNWI rulings and for advance pricing agreements and cross-border rulings already exchanged under DAC3.
Why This Matters for Cyprus Advisers
Cyprus has been actively marketed to internationally mobile individuals and families on the strength of its non-dom regime, the 60-day rule, and the tax exemption articles for relocated workers. Where these positions have been confirmed by a private ruling — and many are — the existence and content of that ruling will, from 2026 onwards, be visible to the tax authorities of the other relevant EU Member State. This does not change the substantive Cyprus tax outcome, but it does change the evidentiary and reputational landscape: clients should expect their home-state tax administration to be aware of the position taken in Cyprus.
Section 9 — Amendments to the DAC6 (MDR) Regime
The Law also amends the existing Cyprus DAC6 / Mandatory Disclosure Rules legislation (Law 41(I)/2021) to align with the Court of Justice of the European Union’s judgment in Case C-694/20 (8 December 2022).
Under the revised rules, lawyers bound by legal professional privilege (LPP) are no longer required to notify other intermediaries of their reporting obligations — that requirement was struck down by the CJEU as incompatible with Article 7 of the EU Charter of Fundamental Rights. Lawyers must, however, continue to inform their own clients (or the relevant taxpayers) of the clients’ reporting obligations.
This change brings Cyprus into line with the rest of the EU on the LPP carve-out and reduces the cross-intermediary notification burden for the Cypriot bar.
Section 10 — Practical Implications
For Crypto-Asset Service Providers and Operators
The first 30 June 2027 reporting deadline is the binding constraint. Anyone providing crypto-asset services with a Cyprus nexus needs to confirm whether they are an RCASP, build CARF/DAC8-compliant due diligence into onboarding, capture transactional data to the required granularity from 1 January 2026, and stand up a reporting workflow into the CTA.
For Reporting Financial Institutions
CRS 2.0 is a system and data project, not just a legal one. E-money institutions previously outside CRS need an end-to-end implementation. Existing Reporting FIs need to update self-certification forms, expand reporting schemas, and remediate back-book data for the new fields.
For Cyprus Tax Residents and Non-Doms
Holders of crypto-asset balances on Cypriot or EU-licensed exchanges should expect their balances and transactions to be reported to the CTA from FY 2026, and to be exchanged with the individual’s other EU Member States of residence (where applicable) in 2027. This dovetails with the new 8% flat tax on crypto-asset disposals under Article 20E — meaning crypto activity is now both taxed and transparent. The window for “wait and see” is closed.
For Clients Holding Cyprus Tax Residency or Substantive Rulings
Any HNW individual obtaining or renewing a Cyprus cross-border ruling from 2026 onwards — particularly tax residency rulings and rulings referencing transactions of €1.5m or more — should plan on the assumption that the ruling will be visible to the tax authority of any other relevant EU Member State. Disclosure positions in the home jurisdiction should be aligned accordingly.
Documentation and Onboarding Considerations
- Self-certification templates: Update KYC packs to capture DAC8/CARF data points (tax residency, TIN, controlling persons, capacity)
- Engagement letters: Reflect the firm’s reporting role and the client’s data-sharing acknowledgements
- Privacy notices: Update under Cyprus data protection law to reflect transmission to the CTA and onward to EU peers
- Record retention: Lock in 5–10 year retention for crypto and CRS data
- Vendor due diligence: If using third-party reporting platforms, validate CARF/DAC8 schema support
- Audit trail: Document the assessment of “Reportable Crypto-Asset” status for each token traded — particularly the carve-out for tokens that cannot be used for payment or investment
Section 11 — Information to Be Reported (Crypto-Asset Reporting)
The DAC8 reporting schema captures both static (user-level) and dynamic (transaction-level) data.
Data Points in Each Crypto-Asset Report
- RCASP information: name, address, TIN, identification number, registration details
- Reportable user information: name, address, Member State(s) of residence, TIN(s), date and place of birth (for individuals)
- Controlling persons: for entity users — same identification data as for individual users
- Aggregate fair market value: by reportable crypto-asset type, paid and received during the year
- Number of units: by reportable crypto-asset type, transferred or exchanged
- Number of transactions: by reportable crypto-asset type
- Transfer information: for transfers to wallets not associated with a virtual asset service provider
Outstanding — Operational Guidance
The Cyprus Tax Department is expected to issue circulars and technical guidance on the practical mechanics of submission — the XML schema to be used, the submission portal, valuation methodology at the time of transaction, and the interaction with the new Article 20E 8% crypto tax compliance regime. Affected stakeholders should monitor CTA announcements at tax.gov.cy and any related MiCAR guidance from CySEC over the coming months.
Disclaimer
This article is for general informational purposes only and does not constitute legal, tax, or other professional advice. It is based on Law 38(I)/2026 as published in the Official Gazette of the Republic of Cyprus on 27 March 2026, EU Directive 2023/2226 (DAC8), and guidance from the European Commission as of April 2026. The Law and its interpretation may evolve through implementing circulars, technical guidance, or administrative practice. Specific elements — including penalty figures and operational mechanics — should be verified against the published Law and CTA guidance. Readers should seek tailored advice before acting on the content of this article. Constantinos Markou & Co Ltd accepts no liability for any loss or damage arising from reliance on the information contained herein.
Stay In Touch