# DAC8 and CARF: what the new crypto reporting rules really mean for crypto investors in Malta > Dr. Werner & Partner - International Law Firm in Malta > URL: https://www.drwerner.com/en/dac8-carf-crypto-malta/ ## Metadata - **Author:** Susan Meier - **Published:** 2026-07-17 - **Topic:** Digital Independents & Finanzen - **Jurisdictions:** Malta - **Reading time:** 2 min --- Since 1 January 2026, crypto service providers across the EU have been collecting transaction data from their users. If you have moved your tax residency to Malta, that raises a fair question: does this change anything about what you owe? The short answer is no. The longer answer matters more, because the days when crypto holdings were effectively invisible to tax authorities are coming to an end. **The essentials at a glance** - Since 1 January 2026, crypto service providers in the EU have been recording every user's transaction data. The first automatic transfer to tax authorities follows in 2027. - DAC8 brings the OECD's CARF standard into EU law. It covers trading, stablecoins, e-money tokens and certain NFTs, including assets held through decentralised providers. - Malta remains attractive for tax purposes, thanks to non-dom status and remittance-basis taxation. What matters here: transparency is not taxation. A report does not automatically trigger a tax bill. - If your tax residency is properly established and your income correctly declared, this new transparency is not something to fear. If anything, it documents a solid structure rather than undermining it. ## What is DAC8, and what does CARF have to do with it? The two acronyms describe one connected set of rules. CARF (the Crypto-Asset Reporting Framework) is an OECD standard that organises the automatic exchange of information on crypto assets between countries. It works on the same principle as the Common Reporting Standard (CRS), which has governed the exchange of standard account data since 2016. What has long applied to bank accounts is now being extended to crypto assets. [DAC8](https://taxation-customs.ec.europa.eu/taxation/tax-transparency-cooperation/administrative-co-operation-and-mutual-assistance/directive-administrative-cooperation-dac/dac8_en) is how that standard gets written into EU law. The directive extends the EU's administrative cooperation framework to cover crypto assets and requires every member state to apply the reporting system consistently. Malta has transposed the directive into national law, just like every other EU country. ### Where things stand right now An honest assessment is worth having here, because plenty of overblown claims are doing the rounds. The reporting obligation took effect on 1 January 2026. Since then, we have been in the first collection phase: crypto providers are gathering data for the current year. That data will not actually be transferred and exchanged between tax authorities until 2027, within nine months of the end of the first reporting year. In practice, that means this is not some sudden new development that has just kicked off. We are already in the middle of the period whose transactions will be reported. If you want to review your structure, now - before that first data transfer - is the sensible time to do it. Not afterwards. ## Who and what gets reported? ### The service providers required to report The providers on the hook here are so-called reporting crypto-asset service providers: trading platforms, brokers and other providers who handle crypto transactions for their customers. The definition ties into MiCA, the EU regulation that sets the framework for crypto service providers across Europe. Providers based outside the EU can be caught too, the moment they serve users resident in the EU. ### The assets covered The scope here is deliberately broad. What gets reported is not just trading in standard cryptocurrencies, but also: - stablecoins and e-money tokens - certain NFTs, where they are used for payment or investment purposes - assets from decentralised offerings Swap one cryptocurrency for another, sell for euros, or use crypto to pay for something - in every one of these cases, a reportable event is triggered. ### The data that gets transferred What gets reported goes well beyond a simple account balance. It includes the user's identity (name, address, tax identification number, date of birth), their country of residence, and the aggregated value of transactions over the year. Your home tax authority ends up with a solid picture of your crypto activity. ## What does this actually mean for crypto investors in Malta? ### The tax advantage stays intact First, the reassurance: none of this changes Malta's tax appeal. If you are tax resident in Malta without being domiciled there, you benefit from non-dom status and get taxed on a remittance basis. Foreign capital gains stay tax-free in Malta, even when you bring that money into the country. Foreign income, by contrast, is only taxed to the extent it is remitted to Malta. Whether crypto gains count as capital gains or as income from trading depends on how the activity is actually structured, and it is worth having that checked in advance. We have covered the details in our [overview of crypto tax in Malta](https://www.drwerner.com/en/crypto-taxes-malta). Here is the distinction that often gets blurred: a report is a transfer of information, not a tax assessment. The fact that a trading platform sends data to a tax authority says nothing about whether, or where, those gains are taxable. With a properly set-up structure, the report simply confirms what already applied. ### Why residency is now under closer scrutiny The real impact of DAC8 lies elsewhere. Until now, it has been hard work for a home-country tax authority such as HMRC or Ireland's Revenue to spot crypto activity in the first place. That barrier is disappearing. Your home tax authority (say, HMRC) will now receive data automatically, the moment you are registered as resident there, or a provider links you to a previous address. That puts one question centre stage, one that often used to exist only on paper: where is someone actually tax resident? A Malta address on file, while your real life still centres on your home country, will not survive that kind of data trail. Anyone relocating should also check whether their home country levies any form of exit or departure tax, as these rules vary widely from one country to the next. Where such a charge exists, it can apply on leaving regardless of any later sale, depending on the shareholdings and assets involved, so it is worth checking before the move itself. ### A worked example Say an entrepreneur moves her tax residency to Malta while holding a crypto portfolio worth around EUR 2 million. Over the course of the year, she rebalances it through an EU-regulated trading platform. From 2026, that platform records these transactions and links them to her declared tax residency. If her home really is in Malta, and she can prove it, Maltese remittance-basis taxation applies. The report simply documents activity that was already correctly accounted for. If, on the other hand, she had stayed resident in her home country without ever properly completing the move, that same report would weaken her position, because the data lands with the tax authority back home. It is the same transaction, but the starting point is completely different. What matters is the structure behind it. ### Why a solid structure matters now more than ever This new transparency rewards exactly what sound planning has always relied on. Legal tax planning within the EU framework, backed by genuine residency and demonstrable substance, actually gains from being reported, because it is cleanly documented. Whether a structure holds up depends on its substance and on residency that has genuinely been completed - both of which can be proven, and that is exactly what counts once data starts flowing automatically. ### What happens if the data shows a mismatch? If your home tax authority receives data that does not match your declared tax position, a query is the usual next step. That can lead to an enquiry in which you need to prove your residency and where your holdings came from. If you are prepared, with a coherent set of documentation ready to go, the process typically closes without further consequence. Scrambling to put something together under pressure is a different story. That is exactly why now, before the first data transfer, is the right time to take stock - not once a letter turns up asking questions. ## What you should do now ### Establish and document your tax residency Check whether your life is genuinely centred in Malta, and whether you can prove it: days spent there, accommodation, economic and personal ties. The more clearly your residency is documented, the less an automatic report can actually threaten. If you have doubts, it is worth getting [international tax advice](https://www.drwerner.com/en/services/tax-advisory/) that looks at your situation against both countries' rules. ### Get your history in order Get a clear overview of your transactions and where your holdings came from. That is useful not just for tax purposes, but for the evidence banks and other service providers increasingly expect from you. Just how tight these requirements have become is clear from the rules around [AML compliance for crypto transactions](https://www.drwerner.com/en/understanding-aml-compliance-cryptocurrency). ### Have your structure checked for substance Whether you are operating as a private individual under non-dom status or through a Maltese company, both routes need real economic substance and need to hold up under scrutiny. An independent assessment of your specific situation will show where things need tightening up, before the first data transfer lands in 2027. ## Frequently asked questions ### Do I owe tax in Malta just because my exchange reports me? No. A report is a transfer of information, not a tax assessment. Whether and where gains are taxable depends on your tax residency and the relevant rules, not on the report itself. ### Does DAC8 apply to foreign exchanges outside the EU too? Providers based outside the EU can be caught, the moment they serve users resident in the EU. On top of that, a large number of non-EU countries have signed up to the OECD's CARF standard, so data flows from there too. The pool of platforms with no reporting obligation is shrinking. ### Are older crypto holdings reported retroactively? Data collection starts with the 2026 tax year. Earlier transactions are not automatically reported retroactively. Providers do, however, need to identify existing users, so current holdings will feed into future reports. ### What happens if I live in Malta but stay registered in my home country? Then there is a real risk that data reaches your home tax authority and your residency gets called into question. A properly completed and documented change of residence is what makes Maltese taxation apply in the first place. ### Are DeFi wallets and self-custody covered? The reporting obligation targets service providers, not pure self-custody. The moment you use a trading platform or exchange service, though - say to deposit or withdraw funds - that creates a reportable touchpoint. ## Your next step This new transparency is not something to worry about, provided your structure holds up. It is a reason to check exactly that, before the first data transfer takes place. In a free initial consultation, we will assess your situation and show you where action is needed. [Arrange a free initial consultation](https://www.drwerner.com/en/contact/) --- *Sources: DAC8 - Directive (EU) 2023/2226 (*[*eur-lex.europa.eu*](http://eur-lex.europa.eu)*); OECD Crypto-Asset Reporting Framework (CARF); MiCA - Regulation (EU) 2023/1114; Malta Tax and Customs Administration (*[*mtca.gov.mt*](http://mtca.gov.mt)*). Current as at July 2026. This article is for general information only and does not constitute individual tax advice.* --- ## Related Services ## Contact - **Telefon:** +356 213 777 00 - **Book appointment:** https://www.drwerner.com/en/contact/ - **Website:** https://www.drwerner.com/en/dac8-carf-crypto-malta/ --- *This page serves as a machine-readable summary for Large Language Models and AI assistants. For the full version, please visit the [Website](https://www.drwerner.com/en/dac8-carf-crypto-malta/).*