Can DAC8 be stopped? The French lawsuit, and what it changes in Germany

Status: 23 October 2026. The case is pending. If anything changes, we change the article.

Since the summer you can read that a company has opened "the first legal front against DAC8". That is true, and it still does not touch Germany directly. Here is what was actually filed, what a court in France can strike down, what only a court in Luxembourg can strike down, and what that means for the German report to the Federal Central Tax Office (BZSt).

What happened

Bull Bitcoin, a non-custodial Bitcoin exchange, filed an urgent application with the Conseil d'État, France's highest administrative court, on 24 February 2026, followed by a full brief. The company made the case public on 8 July 2026.

The target is Décret n° 2025-1276 of 19 December 2025, the main decree through which France implements the DAC8 directive. The core argument: the reporting links names, home addresses and crypto activity in a central database, including where that is irrelevant for tax. Such a database will leak sooner or later, and at a time when kidnappings of crypto holders are rising, that endangers people physically. That, the claim says, is disproportionate.

Bull Bitcoin brought the urgent application to suspend the decree together with the French platform Paymium. The Conseil d'État refused it because no urgency had been shown. The annulment itself has not been decided.

What a French court can strike down, and what it cannot

DAC8 has two layers.

The directive, (EU) 2023/2226, is EU law. It obliges member states to introduce the reporting. Whether a directive is valid is decided only by the Court of Justice of the European Union in Luxembourg. A national court cannot set it aside. It can, however, refer the question of whether it is compatible with the Charter of Fundamental Rights.

The implementation is national law. In France the decree under attack, in Germany the Kryptowerte-Steuertransparenzgesetz (KStTG). The Conseil d'État can annul the French decree, for example because it goes beyond the directive or breaches French law. That has no effect on the German statute.

For DAC8 itself to fall or be narrowed, a court in France or another member state has to refer it to the Court of Justice, and the Court has to rule. We have not found such a referral to date.

The precedent: DAC6

The previous directive has already taken exactly this route. DAC6 obliges advisers to report cross-border tax arrangements. The Conseil d'État referred questions on its validity to Luxembourg on 25 June 2021, and a Belgian court did as well.

The outcome came in two judgments:

About two years passed between the first referral, from Belgium at the end of 2020, and the first judgment. The reporting duty applied throughout, and it still applies today, minus the one provision struck out.

What applies in Germany

Nothing in the lawsuit changes the German position:

• The reporting period is the calendar year, first for 2026 (§ 10 and § 21 KStTG).
• Providers report each year by 31 July to the Federal Central Tax Office (§ 9(1) KStTG), so the year 2026 by 31 July 2027.
• Member states exchange the data for 2026 with each other by 30 September 2027.
• A customer from before 2026 who provides no self-certification is blocked by their provider from reportable transactions after a reminder and a formal demand, no earlier than 60 and no later than 90 days after the first request (§ 8 KStTG).

We have found neither a constitutional complaint against the KStTG nor a referral by a German court to Luxembourg. Both are possible. Until a judgment, neither would change the deadlines.

What a judgment could realistically change

What follows is our assessment, not a prediction.

The DAC6 history suggests that the Court does not throw out a tax-transparency reporting duty as a whole but measures its parts. For DAC8, the most exposed points are the ones the lawsuit aims at: which data is reported although it plays no role for tax, how long it is kept (the KStTG requires at least ten years, § 14), and what safeguards apply to a collection this large. A judgment could narrow the scope or tighten protection duties. That the reporting to tax authorities itself falls we consider unlikely after the DAC6 precedent.

The legitimate core

The lawsuit is aimed at a duty, but it touches a real danger. Whoever collects names, addresses and crypto holdings in one place creates a target. That holds for the authorities, and it holds equally for every provider and every service that processes this data for the report. What the law prescribes in protection is a minimum. How well the data is actually secured is decided by whoever holds it: who has access, where it is stored, for how long, and whether the file needs to exist in more places than necessary.

In practice for users: your self-certification goes to your provider, never to an authority, never through a link or QR code in a letter. And your provider must tell you before the first report what is reported and what rights you have (§ 13 KStTG).

Frequent questions

Do I have to provide the self-certification while the lawsuit is pending? Yes. A pending case in France suspends nothing in Germany. In France, too, the decree still applies; the urgent application was refused.

If the Court strikes down parts of DAC8, will my data be deleted? That would depend on the judgment. With DAC6, the invalidity concerned a single duty going forward, not data already reported. There is no prediction for DAC8.

Does the lawsuit affect wallets I keep myself? No. DAC8 covers users of providers. A wallet whose keys you hold yourself has no provider that reports. More on this: Who reports me?

Is there a letter from the authority through which I can "object"? No, and letters offering that are forgeries. How to recognise them: The fake DAC8 letter.