Partner states outside the EU: whom a German crypto provider has to report under the KStTG

The first question in every DAC8 preparation is not "which format" but "whom, exactly". For customers resident in the EU the answer is simple. For the customer in Zurich, London or Singapore it is not, and anyone looking for the answer in a list published by the Federal Ministry of Finance is looking for something that, in October 2026, does not exist.

What the law says

The Kryptowerte-Steuertransparenzgesetz (KStTG), Germany's crypto-asset tax transparency act, defines in section 1(21) who a reportable person is. In our translation:

"A reportable person within the meaning of this Act is anyone resident for tax purposes in a member state of the European Union or in a third state with which a qualifying agreement exists, and who is not an excluded person."

The first half is clear: residence in an EU member state is enough, the provider's own state included. The second half hangs on a term that section 1(13) defines. A qualifying agreement is an agreement between the competent authorities of an EU member state and a third state on automatic exchange of information, and only once the European Commission has determined that the information to be exchanged is equivalent to what section 11 requires to be reported.

So two things have to exist for a third state before a customer resident there is reportable: an exchange agreement with Germany that is in effect, and the Commission's equivalence determination. Neither follows from a signature under the OECD agreement alone.

The same mechanism works in the other direction. Under section 9(1), a crypto-asset operator's reporting duty for a user lapses if it reports that user's data in a third state which has a qualifying agreement with the user's state of residence. And section 1(14) defines a qualified third state: one that has such an agreement with all EU member states and lists the member states as reportable in a published list. The word "list" appears there too, but as a duty of the third state, not as a list Germany provides.

What does not exist yet

The BZSt's procedure page for DAC8 names no list of states. It says that the data must be transmitted to the BZSt by 31 July of the following year, and that the BZSt forwards it by 30 September to the EU central directory and the CARF partner states. Which states those are is not on the page. We found no BMF letter with a list of qualified third states, and no Commission implementing decision on equivalence. Date of this check: 21 October 2026.

This is not a gap someone overlooked. The agreements are only now coming into being.

What does exist: the path to the list

The OECD keeps two documents which, together, show which states are on their way.

The signatories of the CARF MCAA. This is the multilateral competent authority agreement on which the exchange rests. The OECD list dated 3 March 2026 names 56 jurisdictions with their signing dates. Germany signed on 26 November 2024, in the same round as France, the Netherlands, the United Kingdom, Switzerland, Singapore, Japan and South Korea. Later additions include the United Arab Emirates (21 July 2025), Chile (21 October 2025), Panama (2 December 2025) and Mauritius (12 December 2025). Not on the list: the United States, Australia, Hong Kong.

The commitments to first exchanges. The OECD's Global Forum separately records which jurisdictions have politically committed to implement CARF in time for a given exchange year. As of 14 September 2026 that is 46 jurisdictions for 2027 (among them every EU member state except Cyprus, plus the United Kingdom, Norway, Iceland, Liechtenstein, Japan, South Korea, Brazil, South Africa, Indonesia, Kazakhstan and Uganda; Switzerland is not in this group), 27 jurisdictions for 2028 (among them Switzerland, Singapore, Hong Kong, the United Arab Emirates, Australia, Canada, Israel, Türkiye and Cyprus) and 4 jurisdictions for 2029 (Argentina, Azerbaijan, Mexico, the United States). Four more the Global Forum identifies as relevant without a commitment so far: El Salvador, Georgia, India, Vietnam.

Two observations. First, a signature and a commitment are not the same thing: Australia and Hong Kong have committed but not signed; Barbados and the Bahamas have signed and committed to 2028. Second, the exchange year says something about the reporting period: a jurisdiction committed to 2027 wants to exchange data about the year 2026, exactly the period German providers report on by 31 July 2027.

And Germany itself?

Germany's signature is not enough for domestic effect. The multilateral agreement needs a treaty law under Article 59(2) sentence 1 of the Basic Law. The federal government introduced the bill to the Bundesrat on 29 May 2026 (Drucksache 336/26); the Bundestag carries it as Drucksache 21/7195. The Finance Committee recommended on 7 October 2026 that the bill be adopted unchanged (Drucksache 21/8425). That the plenary adopted it on 8 October 2026 is reported by several specialist sites; we did not find the plenary record or a promulgation in the Federal Law Gazette by 21 October. We write it that way because an article that turns a press report into a statute would be exactly the mistake this subject cannot afford.

What a provider does in the meantime

The due-diligence duties do not depend on the list. The self-certification has to be collected from every crypto-asset user, with every tax residence and the tax identification numbers that go with them, and for existing customers it has to be on file by 1 January 2027. A provider that records only EU residences today, because only those are "safely" reportable, has a problem on the day the list appears that cannot be fixed retroactively.

What can be settled is how third states are handled in the meantime, and settled in writing:

1. Every residence is recorded, including those outside the EU.
2. For every third state that occurs among the provider's own customers, what is on record is noted: signature under the CARF MCAA with its date, the committed exchange year, or neither.
3. Whether a third state is included in the report is the provider's decision, recorded with its source: a BZSt notice, a BMF letter, advice from the tax firm. That decision is not made by the software, and not by guesswork.
4. When an official list appears, it replaces the provider's own decisions, and the difference becomes visible.

That is how it is built in Stablewerk. The page "Partner states outside the EU" shows every residence your users have declared, with the state of the evidence, and beside it every jurisdiction outside the EU that has signed or committed (54 as of 21.10.2026). The owner of the account makes the decision per state and records the source; the decision is logged with name and time and can be revoked. The report preparation follows it: a customer in Switzerland appears in the report only once Switzerland is confirmed, and until then the list of unreported users states the reason.

Frequently asked

Do I have to report customers in Switzerland for 2026? Under the wording of the KStTG, only if a qualifying agreement with Switzerland exists by the time of filing. Switzerland signed on 26 November 2024 and committed to first exchanges in 2028, meaning data for the year 2027. Whether and when the Commission determines equivalence is open. You need the customer's self-certification either way.

And customers in the United Kingdom? The United Kingdom has signed and committed to first exchanges in 2027. The same condition applies: the commitment is the path to the agreement, not the agreement itself.

Is it enough to take the OECD list as the reporting list? No. The signatory list contains states that intend to exchange only from 2028 or 2029, and the law attaches to the qualifying agreement, not to the signature. Anyone who reports the whole OECD list as a precaution reports data about people for whom the law provides no report; that is a data-protection question, not a safety margin.

Where do I learn when the list arrives? On the BZSt's procedure page and in the BMF letters on the KStTG. We check both continuously and update this article with the date.