DAC8 and KStTG in practice: What the tax office has learned about crypto clients since 2026

A client is sitting in your office, convinced that no one is interested in their crypto profits from recent years. The wallets are held on a foreign exchange, the transaction history is incomplete, and they haven't been included in their tax returns. This peace of mind will end in 2026 with the Crypto Asset Tax Transparency Act (KStTG) and the EU Directive. DAC8 An automatic data stream begins, reporting identity, wallet addresses, and transactions directly to the financial authorities.

Finanz Forensik GmbH reconstructs money flows on the blockchain, admissible in court and compliant with GDPR. In this article, we explain to lawyers and law firms, as well as affected companies and investors with unclear transaction histories, which data flows and from when, where the real reconciliation risks lie, and how a gappy transaction history affects forensic blockchain analysis can be restored cleanly.

Important note: We do not replace tax or legal advice. We provide the factual basis on which you, as a lawyer, and your client's other advisors work. We deliberately refrain from specifying particular deadlines and amounts and refer you to the relevant regulations, as details may still change during the ongoing implementation process.

The most important information at a glance

• KStTG in force since the end of 2025: The Crypto Asset Tax Transparency Act implements DAC8 and the OECD framework CARF into German law. The first reporting period is the calendar year 2026.
• First automatic notification in 2027: Reporting providers will transmit the data collected for 2026 to the Federal Central Tax Office (BZSt) in 2027, which will then forward it to EU member states and CARF partner countries.
• Extensive reporting data: The following information is reported: identity (name, address, date of birth, tax ID, residence), wallet withdrawals, aggregated transactions, and purchases and disposals for each cryptocurrency.
• Comparison with the tax return: The tax authorities can compare reported data with declared profits. Gaps or discrepancies will generate inquiries and, in serious cases, a risk of tax evasion.
• Self-disclosure window closes: A self-disclosure that grants immunity from prosecution under Section 371 of the German Fiscal Code (AO) is only possible as long as the offense remains undiscovered. With the increasing flow of data, this window of opportunity is significantly reduced.
• Forensics fills historical gaps: Missing or incomplete transaction data can be traced via the blockchain and converted into an auditable proof.

KStTG, DAC8 and CARF: What's behind the new reporting requirement

Behind the cumbersome name lies a simple goal. The tax authorities want to see crypto assets as transparent as traditional investments. Until now, banks automatically reported interest and capital gains, while cryptocurrency exchanges were largely excluded. This gap is now being closed.

The Crypto Asset Tax Transparency Act (KStTG) is the German implementation of the eighth amendment to the EU Directive on Administrative Cooperation in the Field of Taxation (DAC8) and the OECD's Crypto Asset Reporting Framework (CARF). Both pursue the same goal: the automatic, cross-border exchange of information on crypto assets. The law was passed at the end of 2025, and the first reporting period is the calendar year 2026.

For practical purposes, this represents a turning point. Anyone trading via a reportable provider in 2026 must assume that the associated master data and transactions will be recorded and reported to the Federal Central Tax Office (BZSt) in the following year. From there, the data flows to the responsible tax offices and, via the EU mechanism, to other member states and CARF partner countries. A foreign stock exchange is therefore no longer a blind spot.

Who reports and from when: the deadlines for the DAC8 crypto asset reporting obligation

Under the German Corporate Income Tax Act (KStTG), reporting obligations apply to so-called reporting providers. These include, firstly, crypto asset service providers as defined by the EU regulation MiCAR, specifically exchanges and custodians with the appropriate authorization. Secondly, the law covers crypto asset operators who provide services not covered by MiCAR. The definition is deliberately broad to ensure that as few trading channels as possible are excluded.

The timing is crucial. The due diligence and reporting obligations apply for the first time in the 2026 calendar year. The data collected in that year will be transmitted by the providers to the Federal Central Tax Office (BZSt) in 2027. The BZSt will then forward the information to the responsible German tax offices and, via the European data exchange mechanism, to other countries. There are conflicting reports regarding the exact transmission deadline within 2027, so Section 21 of the German Corporation Tax Act (KStTG) and the BZSt's pronouncements remain the authoritative sources.

For you as a lawyer, this means specifically: The 2026 data will be with the tax office no later than sometime in 2027. Anyone handling their client's 2026 tax return should not assume that any crypto-related matters will go unnoticed. The data matching process will already be underway.

What reporting data is transmitted: identity, wallet and transactions

The scope of the report is surprising many investors. It's not about a rough sum, but rather a detailed picture of crypto exposure. Providers are required to collect, verify, and disclose several categories of data.

Identity and master data

The following information is reported: name, address, date of birth, tax identification number, and country of tax residence. In addition, the user provides a self-declaration regarding their residency, and the Know Your Customer (KYC) verification is documented. This ensures the unambiguous identification of the person behind the account.

Wallet withdrawals and balances

The system records wallet addresses used for transactions and year-end balances. This creates a link to the public blockchain. Anyone who knows a reported address can then trace subsequent transactions.

Transaction data

The reports cover acquisitions and disposals with amounts in fiat and crypto, the date, and the type of cryptocurrency involved. This includes not only Bitcoin, Ether, and Solana, but also exchanges between cryptocurrencies and, according to regulations, NFTs. The tax authorities can therefore see not only that someone has traded, but also what, when, and in what amount.

The risk of discrepancies with the tax return

The real leverage of the new reporting requirement lies in the reconciliation process. The tax authorities receive reliable figures from third parties and can compare them with the declared information. Where declared profits and reported transactions diverge, inquiries arise.

For clients with unclear tax histories, this is the critical point. If profits in previous years were not declared or were incompletely declared, a report can reveal the discrepancy. We have explained how to properly document profits and losses in complex transactions in our article on... Legally compliant crypto documentation 2026 Described in detail.

The situation becomes particularly tricky in cases of fraud or loss. A reported inflow of funds to a fraudulent platform can appear as a taxable transaction, even though the money is actually lost. Whether and when such losses are recognized for tax purposes depends on the evidence provided. We discuss this in our article. Crypto fraud and taxes 2026 the current line is classified.

Those who anticipate the reconciliation early on have an advantage. A clean, complete Tax report, A report that aligns with the expected reporting data takes the edge off the whole situation. This is especially true when trading took place across multiple exchanges, wallets, and networks.

Self-disclosure under Section 371 of the German Fiscal Code: Why the time window is getting smaller

Those who have failed to declare cryptocurrency profits in the past have previously faced the option of a voluntary disclosure under Section 371 of the German Fiscal Code, which allows them to return to tax compliance without penalty under strict conditions. These conditions include the complete and time-barred disclosure of all tax offenses of a given type and the repayment of the evaded taxes, including interest.

Timing is crucial. A self-report is no longer possible once the offense has been discovered and the perpetrator knows this or should expect it. This is precisely where mandatory reporting changes things. With the automatic flow of data, the risk increases that a matter will be considered discovered before the client reacts. This narrows the window for an effective self-report and increases the time pressure.

For you as a lawyer, this means recognizing the need for action early on. Whether a voluntary disclosure is the right course of action is always a case-by-case legal decision that you make together with a tax defense attorney and your tax advisor. Our contribution lies in this: We provide the reliable historical data to ensure that any subsequent declaration is complete and accurate. An incomplete voluntary disclosure will fail to achieve its intended effect.

Incomplete transaction history: forensic reconstruction

The biggest practical problem is rarely malicious intent, but rather the availability of data. After years with multiple exchanges, closed accounts, lost CSV exports, and switching between networks, one's trading history is often a patchwork. It is precisely then that clients and advisors need a reliable reconstruction.

This is where our work comes in. The public blockchain allows us to track transactions, even without exchange exports. We monitor transactions across addresses, allocate inflows and outflows, and visualize where funds have flowed. We demonstrate how we use clustering and attribution in our [section/document/etc.]. forensic analysis methods.

The result is more than just a table. We create a comprehensible, legally admissible report that documents the origin and whereabouts of the funds. Such a report Proof of origin of funds for cryptocurrencies It is valuable not only to the tax authorities, but also to banks and compliance departments.

We work behind the scenes as a forensic partner for your law firm. We provide the technical information you, as a lawyer, need for your arguments. We describe the specifics of this collaboration on our website. Financial forensics for lawyers.

What you and your client should do now

Panic is the wrong approach, but so is inaction. The reporting obligation is already underway, and the 2026 data is being generated anew every day. Therefore, it's worthwhile to proceed systematically now, instead of waiting for the first inquiry from the tax office.

The first step is an honest inventory. Which exchanges and wallets have been used over the years? Where are exports available, and where are they missing? Are there any closed accounts, hardware wallets, or activity on different networks? This overview alone reveals the gaps that could later lead to inconsistencies.

The second step is to close these gaps. Missing data can be reconstructed via the blockchain, resulting in a complete picture of all inflows and outflows. Based on this, the transactions can be correctly assessed and, if necessary, a complete and reliable supplementary explanation can be prepared.

The third step is early legal assessment. Whether a situation requires a subsequent declaration or a voluntary disclosure is a case-by-case decision that you, as a lawyer, make for your client. Those who ask this question before the data matching process begins have more leeway than those who only react after receiving an audit order. Time is the most crucial factor here.

Clear figures before the tax office asks questions

The reporting obligation is no longer abstract, but a reality. Anyone with an unclear or incomplete crypto history benefits now by organizing it before automatic data matching raises inconsistencies. A forensic reconstruction provides the necessary factual basis: complete, reliable, and consistent with what the providers will report.

Talk to us before deadlines and data flows restrict your options. We discreetly reconstruct your or your client's history nationwide and typically respond within one business day. Call us at +49 6057 9189145, write to postfach@finanz-forensik.de or use our Contact form.