DAC8 from the user's side

Who reports me?

Since 1 January 2026 crypto providers in the EU record what their users exchange and transfer with them and report it once a year to the tax authority of their home state. In Germany the Kryptowerte-Steuertransparenzgesetz (KStTG) governs this. Here is which providers it covers, sorted by the official register, and what the law actually says. No advice, only sections and names.

Three sentences that are true. The reporting period is the calendar year, first for 2026 (§ 10 and § 21 KStTG). Providers report each year by 31 July to the Federal Central Tax Office (§ 9(1)), so the year 2026 by 31 July 2027. Reported is whoever uses a provider's services (§ 1(12) and (24)); a wallet you keep yourself has no provider.

Group 1: authorised in Germany

Every crypto-asset service provider authorised by BaFin under MiCAR is a provider in the sense of the KStTG (§ 1(2) and (10)) and is subject to the reporting duty. What it reports about you depends on the services it performs for you: exchanges and transfers are the reportable transactions (§ 1(16) and (22)). The table shows the providers private customers most likely use, with their services from the register as of 06.10.2026. The full register with all 100 authorisations is on the register page.

Provider	Services per register	Authorised since
Trade Republic Bank GmbH	custody, execution of orders, reception and transmission of orders, transfer	28.04.2025
Scalable Capital Bank GmbH	advice	02.03.2026
N26 Bank SE	reception and transmission of orders	14.05.2025
Bitpanda Asset Management GmbH	custody, exchange for funds, exchange for crypto-assets, transfer	24.01.2025
EUWAX AG	exchange for funds, exchange for crypto-assets, execution of orders	01.04.2025
Boerse Stuttgart Digital Custody GmbH	custody, transfer	17.01.2025
flatexDEGIRO Bank AG	execution of orders	04.04.2025
Smartbroker AG	reception and transmission of orders	11.08.2025
Lang & Schwarz TradeCenter AG & Co. KG	exchange for funds, exchange for crypto-assets	22.10.2025
DZ BANK AG Deutsche Zentral-Genossenschaftsbank	custody, execution of orders, transfer	23.12.2025
Commerzbank Aktiengesellschaft	custody, transfer	07.04.2025
Deutsche Bank Aktiengesellschaft	custody, transfer	12.10.2026

Reading aid: N26 Bank SE appears in the register with 'reception and transmission of orders'. N26 Krypto is, per N26, offered and custodied by Bitpanda Asset Management GmbH, which is registered for custody, exchange and transfer. The exchange, and so the report, sits with the executing provider. The same question pays off with every bank app: who executes the exchange?

All 100 providers authorised in Germany, with search and filter

Group 2: authorised elsewhere in the EU, active in Germany

A MiCAR authorisation is valid across the EU. These providers serve German customers under their home state's passport and report there. The report reaches the German tax administration through the exchange between authorities; the BZSt receives reports from partner states and forwards them (§ 16 KStTG). Home state and date of first authorisation from the ESMA register, read on 22.10.2026.

Brand	Authorised entity	Home state	Authorised since
Coinbase	Coinbase Luxembourg S.A.	LU	20.06.2025
Kraken	Payward Europe Solutions Limited	IE	25.06.2025
Bitpanda	Bitpanda GmbH	AT	09.04.2025
Bitvavo	Bitvavo B.V.	NL	26.06.2025
Revolut	Revolut Digital Assets (Europe) Ltd	CY	20.10.2025
eToro	eToro (Europe) Ltd	CY	16.01.2025
Crypto.com	Foris DAX MT Limited	MT	27.01.2025
OKX	OKX Europe Limited	MT	27.01.2025
Bybit	Bybit EU GmbH	AT	28.05.2025
KuCoin	KuCoin EU Exchange GmbH	AT	27.11.2025

Not in the ESMA register as of 06.10.2026: Binance. A provider without an EU authorisation may not serve customers in the EU since 1 July 2026; whether and where it reports follows the state of its authorisation, not the KStTG.

Group 3: apps on another firm's licence

Many cards and apps hold no authorisation of their own. The account, the IBAN or the exchange comes from a partner that holds it. The report then comes from that partner, for the customers it onboarded on EU documents. Two checked examples: N26 Krypto runs through Bitpanda Asset Management GmbH (above). Gnosis Pay's IBAN is, per Gnosis Pay, issued by Monerium, an e-money institution; Gnosis Pay itself is not in the CASP register. The question for every app is the same: who holds the authorisation for the service I use?

Outside: your own wallet

A wallet whose keys you hold yourself has no provider and is reported by nobody. Two limits: if you exchange inside the wallet through a built-in service, the operator of that service is the question. And the tax liability on gains exists whether or not anyone reports; the KStTG governs the report, not the tax.

The two errors going round

'From 2026 every crypto holder is transparent.' 2026 is the first year recorded. The report for it reaches the BZSt by 31 July 2027 and the tax office after that. And it covers users of providers, not everyone who holds crypto-assets.
'As a holder you must register with the authority.' Crypto-asset operators without an EU authorisation must register (§ 17 KStTG), not users. You give the self-certification to your provider. A letter or mail that sends you to a portal by link or QR code is the fraud described on the fake DAC8 letter page.

The fake DAC8 letter: how to recognise it

Frequent questions

From when am I 'transparent'?

The reporting period is the calendar year, first for 2026 (§ 10, § 21 KStTG). Your provider reports the year 2026 to the BZSt by 31 July 2027 (§ 9(1)). The BZSt forwards to the state tax authorities. What is reported is what went through a provider, not what you keep in self-custody.

Does my provider report me, or only totals?

Both: your identity (name, address, residence, tax ID) and, per crypto-asset, the yearly totals of exchanges and transfers (§ 11). That is why your provider asks for a self-certification. The self-certification goes to the provider, never to the BZSt.

My provider is in Luxembourg or Ireland. Does the German tax office learn of it?

Yes. A provider authorised in another EU state reports there. The report is exchanged between authorities; the BZSt receives it and forwards it (§ 16). The detour does not change the content.

What happens if I do not provide the self-certification?

The provider must remind you, then send a formal demand (§ 8(1) and (2)). A customer from before 1 January 2026 who still provides nothing after the demand is blocked by the provider from reportable transactions, no earlier than 60 and no later than 90 days after the first request (§ 8(3)). The block ends when the information arrives.

Will the BZSt write to me?

The law does not provide for it. Before the first report your provider informs you (§ 13). A letter from the BZSt to you that demands a registration, a portal or a wallet connection is not genuine. See the page on the fake DAC8 letter.

Sources: Kryptowerte-Steuertransparenzgesetz (KStTG), gesetze-im-internet.de, read on 22.10.2026, §§ 1, 8, 9, 10, 11, 13, 16, 17, 18, 21. ESMA register of crypto-asset service providers (Art. 109 MiCAR), as of 06.10.2026, normalised in our CASP register. N26: n26.com/de-de/krypto, read on 22.10.2026. Gnosis Pay: help.gnosispay.com, read on 22.10.2026. This page is not advice; your Steuerberater is responsible for your tax return.