Luxembourg implements DAC 8 on exchange of information and cryptoassets

Bill of law 8592 (Law), which implements Directive (EU) 2023/2226 (known as DAC 8) into Luxembourg law, was voted through Parliament at first reading on 19 March 2026 and published in the Luxembourg Official Journal. The Law applies as from 1 January 2026.

It extends the scope of automatic exchange of tax information to new categories of digital transactions, in particular those involving cryptoassets, and updates and consolidates the existing automatic exchange of information regimes.

The main provisions of the Law are detailed below.

Automatic exchange of information on cryptoassets

The Law introduces mandatory reporting and due diligence obligations for certain reporting cryptoasset service providers (CASPs) in respect of their reportable users. It follows the OECD’s Crypto-Asset Reporting Framework (CARF) and works in conjunction with the Markets in Crypto-Assets Regulation (MiCA).

The definition of cryptoassets under DAC 8 is broader than that under MiCA, as it covers all cryptoassets that may be used for payment or investment purposes.

• Reporting CASPs in Luxembourg: the reporting obligations apply to two distinct categories of entities, both of which constitute reporting CASPs: MiCA-authorised CASPs and CASPs not authorised under MiCA (Crypto-Asset Operators) that have a sufficient nexus to Luxembourg. Crypto-Asset Operators with a sufficient nexus to Luxembourg must register with the Luxembourg tax authorities.
• Reportable users: these are individuals or entities resident in a reportable jurisdiction who are customers of a reporting CASP for the purposes of carrying out reportable transactions. The Law incorporates comprehensive exclusions for users that are publicly traded entities (including their related entities), governmental entities, international organisations, central banks and financial institutions other than specific investment entities.Reporting obligations and filing deadlines: reporting CASPs must report information on their reportable cryptoasset users to the Luxembourg tax authorities annually by 30 June of the following year, with the first reporting covering the calendar year commencing on 1 January 2026 and due by 30 June 2027. A nil return must be filed by the same annual deadline if there are no reportable users.
• Due diligence procedure: reporting CASPs must carry out due diligence procedures on their cryptoasset users in order to identify any who are reportable users, and obtain a self-certification to determine whether they qualify as a reportable user. For entity users, due diligence must include controlling persons.

The Law exempts reporting CASPs from Luxembourg due diligence and reporting obligations where, under certain conditions, equivalent obligations are met in another Member State or in a jurisdiction with which Luxembourg has concluded a qualifying exchange of information agreement. Reporting CASPs that also qualify as Financial Institutions under the CRS Law may rely on their existing CRS due diligence procedures to satisfy their DAC 8 obligations.

• Specific penalties: the Law establishes a three-tier penalty structure. A fixed fine of EUR 5,000 applies to: (i) registration failures (including late registration), failure to update registration information and submission of incomplete or incorrect registration information, and (ii) late filing of required information. In addition, a fine of up to EUR 250,000 may be imposed for any other due diligence or reporting breaches identified following an audit by the tax authorities.

Other modifications

New common reporting standard (CRS) obligations

The law of 18 December 2015 (known as the CRS Law) is modified to integrate the latest OECD CRS developments and the DAC 8 developments.

• Newdefinitions: the definition of “investment entity” is updated to include (i) entities whose principal activity consists of the investment, administration or management of reportable cryptoassets on behalf of third parties, and (ii) entities whose gross income derives principally from investing, reinvesting or trading in reportable cryptoassets where the entity is managed by a depositary institution, custodial institution, specified insurance company or another investment entity. In addition, the definition of “Deposit Account” is extended to cover, among other things, accounts holding electronic money or Central Bank Digital Currencies on behalf of clients, and the definition of “Depositary Institution” is extended to cover entities holding electronic money or Central Bank Digital Currencies on behalf of clients.
• Enhanced reporting requirement: Financial Institutions will now have to report additional information in their annual report, such as whether valid self-certifications were provided for each account holder, the role(s) in which each controlling person exercises control and account types.

Automatic exchange of certain advance cross-border rulings extended to individuals

The Law extends the automatic exchange of advance cross-border tax rulings to those granted to individuals where the value of the transaction or series of transactions concerned exceeds EUR 1.5 million, or where the ruling determines whether an individual is tax resident in Luxembourg. Rulings on withholding tax from employment income, directors’ fees and pensions of non-residents are excluded to limit the administrative burden. The new exchange requirements apply only to rulings issued, modified or renewed after 1 January 2026.

New automatic exchange obligation for life insurance proceeds

A new automatic exchange obligation is introduced covering income from life insurance products paid to beneficiaries resident in another Member State following the death of the insured, provided that the contracts in question are not already subject to reporting under the CRS Law.

DAC 6 and legal professional privilege

The law of 25 March 2020 on reportable cross-border arrangements (known as the DAC 6 Law) is amended so that lawyers acting as intermediaries who are exempt from the reporting obligation by virtue of legal professional privilege are only required to notify their own client of that client’s reporting obligations. They are no longer required to notify other intermediaries involved in the arrangement who are not their clients. This reflects the CJEU’s judgment in Case C-694/20 (Orde van Vlaamse Balies, 8 December 2022).

Other professionals subject to professional secrecy, notably auditors and certified accountants, remain obliged to notify their reporting obligations to other intermediaries involved in the arrangement (even where those intermediaries are not their clients) or, in the absence of another intermediary, to the relevant taxpayer directly.

Country-by-country reporting: communication of TIN

The law of 23 December 2016 on country-by-country reporting is amended to provide for the collection and communication of the tax identification number (TIN) of each constituent entity, where a TIN has been assigned by a jurisdiction. This obligation applies for fiscal years beginning on or after 1 January 2028.