Last Updated: 15.07.2026
Implementation of the DAC8 Directive in Poland: Administrative Cooperation in the Crypto-Asset Sector
On March 18, 2026, the amendment to the Act on the Exchange of Tax Information with Other Countries entered into force. This Act constitutes a direct implementation of the EU DAC8 (Directive on Administrative Cooperation) Directive into the Polish legal order. This act introduces new tax transparency and reporting rules for the crypto-asset sector.
The purpose of the new regulations is to introduce the mandatory automatic exchange of information regarding crypto-asset transactions between the tax authorities of the European Union, including EU tax authorities, competent authorities and EU member states.
This act delineates the obligations of crypto-asset service providers, the rules for collecting documentation, and the framework for compliance audits executed by the Head of the National Revenue Administration (KAS).
The new framework is intended to strengthen tax transparency, limit tax evasion and tax fraud, and improve tax compliance in relation to digital assets, other crypto assets and tax relevant information concerning users’ tax affairs.
Why Automatic Exchange of Information Changes Crypto Asset Transactions Reporting
From the perspective of the crypto industry, the introduced changes fundamentally disrupt one of the historical pillars of the crypto-asset sector: relative transactional anonymity. Prior to this, the Polish legal framework completely lacked provisions imposing automated collection and reporting mandates on cryptocurrency exchanges and bureau de change operators for tax purposes.
For users, this means that every single operation, ranging from fiat-to-crypto purchases and sales, through crypto-to-crypto exchanges, to transfers to external wallets, will be strictly recorded as transaction data. Tax authorities will obtain a comprehensive audit trail of the user’s transaction history.
Conversely, for exchanges and bureau de change operators, these new obligations necessitate an operational overhaul of their transaction systems. They must implement tools into their systems to, for instance:
- automatically verify foreign TINs,
- integrate tax questionnaires with existing KYC/AML procedures,
- deploy algorithms that automatically suspend trading for non-compliant users.
Which Crypto Asset Service Providers Are Affected by DAC8 Reporting Requirements?
The Polish regulations implementing DAC8 distinguish between two categories of reporting entities, reflecting the market structure in Poland.
Entities registered as Virtual Asset Service Providers (VASPs) continue to dominate the market. Meanwhile, Crypto-Asset Service Providers (CASPs) authorized under the MiCA Regulation operate on the Polish market via service passporting.
Two distinct groups of entities are differentiated:
- “Crypto-asset operators”, meaning entities providing crypto-asset services (including, among others, staking and lending of crypto-assets), which are other than service providers within the meaning of Art. 3(1)(15) of the MiCA Regulation.
- “Reporting crypto-asset service providers”.
Crypto-Asset Operators and Reporting Crypto Asset Service Providers: Key Differences
In order to avoid qualification errors, it is crucial to precisely distinguish the roles and concepts introduced by the amendment:
| Feature / Definition | Crypto-asset operator | Reporting crypto-asset service provider |
|---|---|---|
| Scope of definition | An entity providing crypto-asset services, as well as crypto-asset staking and lending, that does not qualify as a CASP within the meaning of Art. 3(1)(15) of the MiCA Regulation. | An umbrella term encompassing both authorized CASPs and crypto-asset operators (VASPs). |
| Activity criterion | The mere provision of services in the scope of crypto-assets regulated by MiCA, as well as staking or crypto-asset lending services. | The execution of exchange transactions for or on behalf of a reportable user while providing crypto-asset services within the meaning of Art. 3(1)(16) of the MiCA Regulation, or staking or crypto-asset lending services. |
Through this legislative mechanism, Polish VASPs automatically qualify as crypto-asset operators and are required to collect information for subsequent submission to the tax administration authorities.
Which Crypto-Asset Operators Must Register?
Crypto-asset operators are subject to mandatory registration with the Head of KAS.
The electronic registration form must be filed by March 31 of the year in which user information is first reported (i.e., by March 31, 2027).
This obligation directly targets “crypto-asset operators” (unauthorized entities under MiCA, i.e., traditional VASPs). Reporting providers holding a CASP authorization fall outside this narrow statutory definition and are exempt from this additional KAS notification requirement.
Scope of data collected from clients
Fulfilling reporting obligations relies crucially on obtaining a self-certification of the client’s tax residence.
The comprehensive scope of information that you, as an obliged entity, must acquire regarding the client is as follows:
| Entity Category | Scope of Required Identification Data |
|---|---|
| Individuals (retail investors) |
|
| Legal entities (companies, foundations, ASIs) |
|
User declarations are made under penalty of perjury (criminal liability) and must include the statutory clause acknowledging liability for false statements.
All of this information must be verified against documentation gathered for AML/CFT compliance purposes.
What is exempt from reporting?
Under Polish regulations, a “reported crypto-asset” is defined by excluding specific categories.
The following are exempt from reporting obligations:
- central bank digital currencies (CBDCs) or those issued by other monetary authorities.
- electronic money
- any crypto-asset that the provider has determined cannot be used for payment or investment purposes.
Which Crypto Asset Transactions Are Subject to Tracking and Reporting?
The categories of actions subject to detailed reporting have been precisely defined and divided into categories.
Obliged entities must report the following data:
- Fiat-to-Crypto Acquisitions: The total gross amount, total number of units, and the transaction count for crypto-asset purchases made using traditional currency.
- Crypto-to-Fiat Exchanges: The total gross amount, total number of units, and the transaction count for crypto-asset sales executed in exchange for traditional currencies (e.g., PLN, EUR, USD).
- Crypto-to-Crypto Exchanges: The total aggregate fair market value, total number of units, and transaction count for exchanges of one crypto-asset for another. This necessitates a valuation of the transaction in fiat currency (the so-called market fair value) at the exact time of execution.
- Transfers: The movement of crypto-assets to or from an external address (e.g., a self-custody wallet) that does not constitute an exchange transaction. Reporting requires the fair market value, total number of units, and transaction count, categorized by transfer type if known to the provider.
- Reportable Retail Payment Transactions: The transfer of crypto-assets in exchange for goods or services where the value exceeds USD 50,000. The report must specify the total aggregate fair market value, number of units, and transaction count.
Reporting Timeline and Cross-Border Exchange of Information under DAC8
Reporting providers submit information on crypto-asset users to the Head of KAS by June 30 of the following year.
Consequently, data for the initial reporting period (the calendar year 2026) must be reported by June 30, 2027.
Subsequently, the Head of KAS has until September 30 to exchange this data with the authorities of other countries.
| Procedural Stage | Statutory Period / Deadline | Dates for the First Cycle | Main Obligations and Actions |
|---|---|---|---|
| 1. Data Collection Period | Full calendar year. | January 1, 2026 – December 31, 2026. |
|
| 2. Reporting to KAS | By June 30 of the subsequent year. | By June 30, 2027 (for the year 2026). |
|
| 3. Automated Exchange | By September 30 of the subsequent year. | By September 30, 2027. |
|
Failure to Submit Tax Declarations: When Can Transactions Be Blocked?
When the client refuses to cooperate or fails to update their information (e.g., a change of address):
- upon arising doubts, the provider must request an updated self-certification
- if the client fails to submit the declaration, the provider must issue follow-up requests twice
- if the updated self-certification is not provided within 60 days of the initial request, the reporting provider is statutorily mandated to restrict the user from executing reportable transactions.
This transactional block remains in place until the declaration is successfully submitted and verified.
Disclosure obligations and data protection in the face of cyber threats
The amended framework imposes direct disclosure obligations on crypto-asset service providers toward data subjects.
The provider is obliged to inform the client about the collection, processing, and intended transfer of their tax information before the report reaches the Head of KAS.
KAS Audits, Administrative Penalties and Compliance Risks
The Head of KAS is vested with full authority to conduct compliance audits regarding reporting obligations and due diligence procedures.
Audit operations culminate in an audit report, and the audit concludes upon delivery of the audit result, which outlines a binding timeframe for rectifying irregularities – ranging from 1 to 6 months.
The provider must notify the authority of the correction methods within 14 days following the deadline.
For non-compliance, such as:
- failure to report within the deadline,
- failure to follow up on a KAS request,
- failure to implement due diligence procedures,
- operating without registration,
- failure to rectify deficiencies post-audit,
the Head of KAS may impose an administrative fine of up to PLN 1,000,000 through an administrative decision.
It must be emphasized that the single-penalty rule for multiple infractions discovered during a single audit is inapplicable to this sector.
The statutory limitation restricting the authority to a single fine applies exclusively to traditional financial institutions, leaving crypto-asset market participants exposed to separate cumulative penalties.
When determining the amount of the fine, the Head of KAS considers factors such as the entity’s current approach to compliance and its total turnover for the preceding financial year.
Legal Support for CASPs, VASPs and Other Crypto Businesses
We offer our support in conducting:
- a compliance audit of the solutions used in the AML and tax areas,
- updating the AML/KYC procedures used at CASPs and VASPs,
- review and update of the regulations used,
- updating the GDPR documentation and practices used,
- preparation of tax returns and voluntary disclosure filings for individual clients,
- tax advisory services.
Contact us to discuss how the DAC8 Directive may affect your crypto business and to plan the next compliance steps for your CASP, VASP or other crypto-asset activity in Poland.
FAQ – DAC8 Directive in Poland
From when do the new rules apply and by when will service providers send the first reports?
The regulations apply to all reportable events occurring on or after January 1, 2026. The first submission of consolidated reports by CASPs and VASPs to KAS must be completed on or before June 30, 2027, covering the full 2026 calendar year.
Will the exchange of one cryptocurrency for another (crypto-crypto) also be visible to the tax office?
Yes. The directive mandates the reporting of the number of units, transaction count, and the aggregate fair market value for crypto-to-crypto trades. The framework requires these transactions to be valued using the prevailing market rate at the exact time of execution.
I pay with cryptocurrencies for daily purchases using a card linked to an exchange. Is this also subject to control?
Reporting under the DAC8 Directive covers retail payment transactions, but exclusively in the case of payments for goods or services of relatively high value, i.e., exceeding the equivalent of USD 50,000. Standard, day-to-day retail transactions fall outside this specific reporting threshold.
What will happen if a user refuses to provide the exchange with information about their tax residence?
If a client evades submitting the relevant tax declaration after the exchange’s requests, after 60 days the service provider has an absolute obligation to apply a block. This completely prevents the user from executing any transactions subject to reporting (purchases, sales, transfers) until the documentation is provided.
What are the consequences for exchanges for failure to comply with DAC8 requirements?
Failure to comply with reporting obligations or deficiencies in procedures expose companies to administrative fines of up to PLN 1,000,000 for each independent violation
I have historical tax arrears on sold cryptocurrencies. Do the new regulations mean financial penalties?
KAS does not automatically possess data from new reports from before 2026, however, data matching against future personal income tax (PIT) returns may trigger discretionary audits into prior unclosed tax years. We help conduct historical audits and assist in filing a voluntary disclosure. The new identification and reporting mandates apply prospectively to transactions occurring from January 1, 2026, onward.
Is there one registration and reporting form?
No, the reporting framework utilizes two distinct electronic documents. The first is a one-off registration form filed with the Head of KAS (due by March 31, 2027, solely applicable to traditional VASPs classified as “crypto-asset operators”). The second is the annual user information return, which must be submitted by both VASPs and authorized CASPs.
What about reporting after July 1, 2026 by entities with VASP status?
The date of July 1, 2026 is a key moment for the Polish crypto-asset market, marking the definitive end of the transitional period for entities entered in the previous VASP register. After this day, further legal provision of services requires obtaining a CASP authorization under the MiCA Regulation. From the perspective of obligations resulting from the DAC8 Directive, the situation of existing VASPs depends on:
- Failure to obtain a CASP authorization: If a VASP does not obtain an authorization after July 1, 2026 and closes operations, its existing reporting obligations for the period of actual activity (from January 1 to July 1, 2026) are not canceled. In such a case, you have a statutory obligation to submit an electronic notification of cessation of activities to the Head of KAS in order to formally revoke your individual identification number. Despite deregistration, the former VASP is strictly obliged to submit a tax report for the first half of 2026 to the office within the standard deadline – i.e., by June 30, 2027.
- Obtaining a CASP authorization: Entities that have obtained an authorization continue to record transactions on the general principles of the DAC8 Directive. The difference is that as CASPs they cease to fall under the narrow definition of a “crypto-asset operator”. Consequently, they are exempt from the obligation to have a separate national registration and an individual number before the Head of KAS, as the reporting status results directly from the text of the provisions.
