DAC8 and CARF in Spain: What Crypto Asset Reporting Means for You From 2026

The End of Crypto Opacity: What Changed in 2026

For most of cryptocurrency's short history, there was a significant information asymmetry between taxpayers and tax authorities. Transactions on blockchain networks are technically public, but connecting wallet addresses to identifiable individuals required sophisticated chain-analysis tools that most tax authorities did not have. Centralised exchange platforms held the data, but international information exchange frameworks did not yet reach them.

2026 marks the end of that era. Two parallel frameworks — the EU's DAC8 Directive and the OECD's Crypto-Asset Reporting Framework (CARF) — have closed the information gap. From 2026 onward, major crypto exchanges are legally required to report Spanish residents' transaction data directly to the AEAT, automatically and annually. The days of "AEAT doesn't know about my crypto" are over.

What Is DAC8? — EU Directive 2023/2226

DAC8 — Council Directive (EU) 2023/2226, amending the Directive on Administrative Cooperation (DAC) — extends the EU's automatic exchange of information framework to Crypto-Asset Service Providers (CASPs). It entered into force in December 2023, with member states required to transpose it and begin collecting data by 1 January 2026, with the first data exchanges between tax authorities occurring in 2027 (covering 2026 data).

DAC8 requires CASPs operating in the EU — exchanges, brokers, custodians, and other crypto service providers — to collect and report data on their clients who are tax residents of EU member states. The data is reported to the CASP's home country tax authority (e.g., Coinbase EU to Irish Revenue), which then automatically shares it with the tax authority of each client's country of tax residence (e.g., the AEAT for Spanish residents).

Who Is a CASP Under DAC8?

DAC8 defines CASPs broadly, encompassing any entity that provides, as a business, one or more of the following services:

• Exchange of crypto-assets for fiat currency (buying and selling Bitcoin, Ethereum, etc. for euros)
• Exchange of crypto-assets for other crypto-assets (token swaps, crypto-to-crypto trading)
• Transfer of crypto-assets (processing withdrawals and deposits)
• Safekeeping and administration of crypto-assets on behalf of clients (custody)
• Participation in — and provision of financial services related to — the offer of crypto-assets

Major platforms subject to DAC8 reporting for Spanish residents include Coinbase EU (Ireland), Binance EU (Lithuania), Kraken's European entities, Bitstamp (Luxembourg), and any other CASP with an EU regulatory licence. Non-EU platforms without an EU licence are not directly subject to DAC8 — but they may be subject to CARF in their home jurisdictions.

What Is CARF? — The OECD Global Equivalent

The OECD's Crypto-Asset Reporting Framework (CARF) is the global equivalent of DAC8, designed to extend automatic crypto reporting beyond the EU to all OECD and partner countries. CARF operates on the same architecture as the Common Reporting Standard (CRS): crypto service providers in participating countries report clients' data to their domestic tax authority, which exchanges it automatically with treaty partner countries.

Over 50 countries have committed to implementing CARF, including the US (through a parallel IRS framework), the UK, Canada, Australia, Singapore, and the UAE. This means that Spanish residents using non-EU exchanges in these jurisdictions — including Coinbase US, Kraken US, Gemini, and others — will have their transaction data reported to those jurisdictions' tax authorities and ultimately shared with the AEAT.

Spain's Existing Framework: Modelo 721

Spain was already ahead of much of Europe in crypto reporting before DAC8. The Declaración informativa sobre monedas virtuales — Modelo 721 — entered into force for the tax year 2022 (first filing in January 2023). It requires Spanish tax residents to declare the value of crypto assets held on non-Spanish exchanges as of 31 December of each year, where the total value exceeds €50,000.

Modelo 721 is a taxpayer-facing declaration: it is the individual's responsibility to file it. DAC8 adds an exchange-facing layer: the CASP itself is now required to report data to the AEAT, regardless of whether the taxpayer files Modelo 721. The combination creates a cross-verification system — AEAT can compare what taxpayers declare against what exchanges report.

What Exactly Do CASPs Report Under DAC8?

DAC8 requires CASPs to report the following data for each reporting year, for each client who is a tax resident of an EU member state:

• Crypto-to-fiat exchanges: Each transaction where crypto is sold for fiat currency — the amount received in fiat, the type and amount of crypto disposed, and the date.
• Crypto-to-crypto swaps: Each transaction where one type of crypto is exchanged for another — the market value in fiat at the date of exchange, both sides of the transaction.
• Payments in crypto: Where a client pays for goods or services using crypto, the value of the payment at the date of transaction.
• Transfers: Withdrawals and deposits — both to/from other exchanges and to/from private wallets — including the value at the transfer date.
• Balances: The value of crypto assets held on the platform as of 31 December.
• Identifying information: Client name, date of birth, TIN (NIE/NIF for Spanish residents), address.

This is comprehensive data. The AEAT will receive, for every Spanish resident using a major EU exchange, a complete transaction log covering all activity on that platform — every buy, sell, swap, withdrawal, and deposit, with euro-equivalent values at transaction date.

Practical Consequences for Spanish Residents

The End of Selective Disclosure

Prior to DAC8, the practical enforcement risk for crypto tax non-disclosure in Spain was concentrated at the level of large, visible transactions — particularly large Bitcoin sales that appeared in bank account statements. Smaller or more complex crypto activity was substantially underreported across all jurisdictions.

From 2026, the AEAT receives the full transaction history from exchanges. Its automated systems will cross-reference reported exchange transactions against declared IRPF income and gains. Discrepancies will generate automatic risk flags. The scale of automatic data matching means that selective disclosure — reporting only the obvious transactions while omitting others — becomes effectively impossible.

How Capital Gains Are Taxed in Spain

All gains from crypto disposals — whether crypto-to-fiat, crypto-to-crypto, or payment-in-crypto — are capital gains for Spanish IRPF purposes, included in the base imponible del ahorro (savings income tax base) and taxed at the following rates for 2026:

Rates as per 2026 IRPF. National rates — autonomous community surtax applies additionally in some regions.

Losses from crypto disposals can be offset against other capital gains in the savings income base. They can also be carried forward for four years. The cost basis for acquired crypto is typically the purchase price including transaction fees.

DeFi and NFTs: Are They Covered?

The coverage of decentralised finance (DeFi) and non-fungible tokens (NFTs) under DAC8 and CARF is partial and evolving.

NFTs

Non-fungible tokens that are unique, non-interchangeable, and not used primarily as a means of payment are expressly excluded from the DAC8 definition of "crypto-assets" subject to mandatory CASP reporting. However, where NFTs are bought and sold through centralised platforms (OpenSea with custodial wallet, Binance NFT Marketplace, etc.), those platforms may report the transactions as they would any other crypto activity. From a Spanish tax perspective, gains from NFT sales remain taxable capital gains regardless of DAC8 coverage — the reporting gap does not eliminate the tax liability.

DeFi

Fully decentralised protocols — where there is no identifiable intermediary service provider — are not directly subject to DAC8, because there is no CASP to impose the reporting obligation on. However, several practical limitations apply: most DeFi activity requires on/off ramps through centralised exchanges (which are fully covered), most DeFi platforms require wallet connection through custodial or semi-custodial providers that may have reporting obligations, and the OECD's CARF is expected to extend to DeFi in subsequent iterations. The AEAT also has access to blockchain analytics tools for high-value investigation cases.

Penalties for Non-Disclosure

The penalty regime for crypto non-disclosure in Spain operates at two levels:

• Failure to file Modelo 721: €5,000 per piece of data not declared, minimum €10,000 per declaration. For incorrect or incomplete filing: €100 per item, minimum €1,500.
• Unreported capital gains (IRPF): Where AEAT discovers undeclared crypto capital gains through audit — including through DAC8 data — the assessment includes the tax due plus a penalty surcharge of 50–150% of the unpaid tax amount, plus interest. For amounts above €120,000 the conduct may constitute tax fraud (delito fiscal), carrying criminal liability.

Voluntary disclosure before AEAT opens an investigation significantly reduces the penalty exposure — surcharges are currently 15% for prompt voluntary disclosure, compared to 50–150% for audit-discovered amounts. This creates a powerful incentive to regularise prior periods before 2027, when the first DAC8 data will arrive at the AEAT.

Comparison: Modelo 720/721 and DAC8

Voluntary Disclosure Strategy Before DAC8 Reporting Begins

The window for pre-emptive voluntary disclosure is open now. DAC8 data for the 2026 calendar year will be exchanged between EU tax authorities in early 2027. The AEAT will begin receiving and processing this data during the second half of 2027. For Spanish residents with undisclosed prior-year crypto gains — whether from 2021, 2022, 2023, 2024 or 2025 — the time to regularise is before 2027.

The voluntary disclosure process involves:

1. Reconstruction of the transaction history: Obtaining complete export files from all exchanges used, including historical transactions. This is the most time-consuming part — exchanges must be contacted for all years where records exist.
2. Cost basis calculation: Establishing the acquisition cost of each crypto asset disposed of in each year. The FIFO (First In, First Out) method is the default in Spain — the oldest acquired units are treated as disposed of first.
3. Supplementary IRPF returns: Filing amended or supplementary IRPF returns (declaración complementaria) for each affected year, including the omitted capital gains and paying the resulting tax.
4. Supplementary Modelo 721 filing: Where the Modelo 721 was omitted or incomplete, supplementary filings are required.
5. Payment of tax and voluntary disclosure surcharge: Payment of the outstanding tax plus the voluntary disclosure surcharge (15% of the unpaid amount if disclosed promptly, before AEAT has initiated action).

The limitation period in Spain is four years for tax assessments — declarations more than four years old are generally statute-barred, though AEAT may argue for extended periods in fraud cases. Voluntary disclosure should cover all years within the limitation period as a minimum.