DAC8 Crypto Tax Reporting Reaches Spain: When Undeclared Crypto Becomes a Criminal Offence

From 2026 the European Union is switching on a cross-border reporting machine for crypto-assets. The eighth amendment to the Directive on administrative cooperation in taxation — known as DAC8 (Council Directive (EU) 2023/2226) — forces crypto platforms to report their clients' operations to the tax authorities, which then exchange that information automatically across the EU. For an investor resident in Spain the message is blunt: the tax office is about to know what you hold and what you traded. This article explains what DAC8 changes, what it does not criminalise, and the exact point at which an undeclared crypto position turns into a criminal offence under Spanish law.

What DAC8 Is and When It Applies

DAC8 extends the EU's automatic exchange of tax information to crypto-assets. It builds on the OECD's Crypto-Asset Reporting Framework (CARF) and dovetails with the MiCA Regulation, which already brings crypto-asset service providers under supervision. In broad terms:

• Who reports: reporting crypto-asset service providers (exchanges, brokers and similar intermediaries) that serve EU-resident clients.
• What is reported: the identity and tax residence of users and their crypto-asset transactions — acquisitions, disposals and transfers.
• To whom: the national tax authority, which then shares the data automatically with the other Member States where the users are resident.

The rules apply from 1 January 2026, with the first automatic exchanges of the collected information taking place the following year. The practical effect is that the old strategy of assuming the platform data would never reach the Spanish Tax Agency (AEAT) no longer holds: increasingly, the AEAT already has it.

Reporting Is Not the Same as a Crime

Two planes must be kept apart, exactly as with the end of the MiCA transition. Being reported under DAC8 is not, in itself, an accusation of anything. The obligation falls on the platform, and the vast majority of investors who declare their gains correctly have nothing to fear from greater transparency. What DAC8 changes is the probability of detection: gains, staking rewards and disposals that go undeclared are far more likely to surface in an inspection. The criminal plane is only reached where an unpaid tax liability crosses a statutory threshold and is accompanied by an intent to defraud.

When Undeclared Crypto Becomes Tax Fraud (Art. 305 CP)

Article 305 of the Spanish Criminal Code (CP) defines tax fraud: defrauding the public treasury by evading the payment of taxes, where the defrauded amount exceeds 120,000 euros per tax and per tax year. The penalty is one to five years' imprisonment and a fine of up to six times the amount defrauded. Below that 120,000-euro threshold the conduct is not a crime but an administrative tax matter, settled with the AEAT through assessments, surcharges and penalties.

The figure is calculated tax by tax and year by year, which is why the correct valuation of crypto gains is decisive. Volatility, the choice of valuation method for successive lots, gas fees and latent losses can all move the defrauded amount above or below the penal line — and that is often the heart of the defence in these cases, as we explain in our guide to crypto-assets and tax fraud.

The offence is aggravated under Article 305 bis CP — punishable with two to six years' imprisonment — where the defrauded amount exceeds 600,000 euros, where the fraud is committed within a criminal organisation, or where interposed persons, fiduciary structures or tax havens are used to hide the taxpayer's identity or the true amount. Using wallets or shell entities abroad precisely to obscure ownership is the kind of conduct that pushes a case into this aggravated bracket.

The Foreign Crypto Declaration (Modelo 721)

Separately from the tax return, Spanish residents must file Modelo 721, the informative declaration of virtual currencies held abroad, when the balances exceed the reporting threshold of 50,000 euros. It is filed between 1 January and 31 March in respect of the previous year. Modelo 721 is an informative obligation: failing to file it is a formal breach with its own penalties under the General Tax Law, and it does not, by itself, amount to the crime of Article 305 CP. But the data it captures — like the data DAC8 will now supply automatically — feeds directly into the AEAT's ability to detect undeclared gains.

The Safety Valve: Regularisation Before the Knock

Spanish tax law rewards those who put their situation right before the authorities move. Under Article 305.4 CP, a full and voluntary regularisation of the tax position — paying what is owed with its interest — before the AEAT formally notifies the start of inspection proceedings (or before a complaint or investigation is directed at the taxpayer) exempts the person from criminal liability. In a world where DAC8 makes detection increasingly likely, the window to regularise on your own terms is precisely the period before the information exchange surfaces the discrepancy. Our guide to tax fraud and regularisation sets out how this works in practice.

How Long the Exposure Lasts

Tax offences do not stay open forever. Under the prescription rules of Article 131 CP, the basic offence of Article 305 CP (punishable with up to five years) becomes time-barred after five years; the aggravated offence of Article 305 bis CP (up to six years) becomes time-barred after ten years. These are the criminal limitation periods and run alongside — but separately from — the administrative periods the AEAT works to.

What the Tax Agency Will Actually See

DAC8 is not a vague transparency gesture; it captures granular data. Reporting platforms must collect and transmit the user's identifying details and tax residence, together with the crypto-asset transactions carried out through them: exchanges between crypto-assets and fiat, exchanges between different crypto-assets, and transfers. Aggregated over a year, that produces a detailed operational picture the AEAT can cross-check against the taxpayer's return. Three consequences follow for investors resident in Spain:

• Mismatches become visible. A return that omits disposals the platform has reported is an obvious inspection trigger.
• Cross-border data flows. If your platform reports in another Member State, the information reaches the AEAT through automatic exchange; using a non-Spanish exchange no longer keeps operations out of view.
• Historic positions surface. Long-held wallets that are finally moved to a reporting platform generate a data point precisely when the disposal — and any gain — occurs.

Tax Fraud Is Not the Same as Money Laundering

A recurring confusion, and a dangerous one, is to treat undeclared crypto gains as automatically amounting to money laundering. They are different offences. Tax fraud (Article 305 CP) concerns evading a tax due on lawfully obtained income; money laundering (Article 301 CP) concerns concealing assets whose origin is criminal. An investor who bought crypto with clean savings and failed to declare a gain has, at most, a tax problem — not a laundering one — however much the two are conflated in an inspection. Keeping the two planes apart is often the first battle of the defence, and it matters because the penalties, the prescription periods and the available regularisation differ sharply between them.

How We Handle These Cases

In our tax-offences defence practice we advise crypto investors, miners and Web3 companies both before and after an inspection begins: we build the economic expert reports that fix the correct taxable base, assess whether the defrauded amount genuinely crosses the 120,000-euro line, and, where appropriate, design a complete regularisation that traces funds from their fiat origin to close off any later criminal action. The point of maximum leverage is before the DAC8 data lands — not after.