In this article · 8 sections
If your exchange has asked for your tax residence and tax identification number, the request is very likely genuine. Since 1 January 2026, EU platforms collect this information under the DAC8 directive and report your transactions to their tax authority, which shares it with yours; the first exchanges between countries cover 2026 and take place by 30 September 2027. The UK applies the same OECD standard, CARF. What is not genuine: paper letters asking you to scan a QR code and register on a 'digital asset portal'. Those are a scam campaign that has hit France, the United States and Switzerland this summer.
The short answer
Answer the request inside your exchange account, reached by typing the address yourself, never through a link in an email or a QR code on a letter. Tax authorities do not ask you to register your wallets on a portal, and nobody legitimate ever needs your recovery phrase. If you ignore your exchange's request, EU rules mean it will eventually have to block your transactions.
What DAC8 and CARF are
CARF, the Crypto-Asset Reporting Framework, is the OECD's standard for automatic exchange of crypto tax information between countries. DAC8 is the EU directive (Directive (EU) 2023/2226) that applies it in the European Union. Both put the reporting duty on platforms, not on you: the exchange collects your details and transaction totals and sends them to its tax authority.
| European Union (DAC8) | United Kingdom (CARF) | |
|---|---|---|
| Collection starts | 1 January 2026 | 1 January 2026 (activity covered by the first report) |
| First report | During 2027, for the 2026 year | Between 1 January and 31 May 2027, for the 2026 year |
| Exchange between countries | By 30 September 2027 for 2026 | With other CARF countries |
| Who reports | Crypto-asset service providers serving EU residents | UK-based reporting crypto-asset service providers |
Sources: European Commission: DAC8 · Directive (EU) 2023/2226 (EUR-Lex) · GOV.UK: reporting cryptoasset user and transaction data
What your exchange will ask for, and what it reports
Expect a self-certification form: your name, address, country or countries of tax residence, the tax identification number for each, and your date of birth. The exchange then reports, per crypto-asset, the aggregate amounts you acquired and disposed of, and the value of transfers, along with your identifying details. It does not report your passwords, and it never needs your recovery phrase.
Sources: European Commission: DAC8
What happens if you ignore it
Under DAC8, if a platform has not obtained your information within 60 days and after two reminders, it must prevent you from carrying out exchange transactions until you provide it. The penalties for platforms and users are set by each EU country. In practice, ignoring the request leads to a restricted account, not to the information going away: the platform still holds your identity from onboarding.
Sources: KPMG summary of DAC8 (60 days and two reminders)
Get the Exchange Safety Checklist
Plus an alert whenever a top exchange changes its proof-of-reserves, licensing or security status. No spam, unsubscribe anytime.
We store only your email to send the checklist and safety alerts. See our privacy policy.
The fake letters: what they look like
This summer, scammers turned DAC8 and tax compliance into a postal phishing campaign. The pattern is the same everywhere: an official-looking letter, a deadline, a penalty threat and a QR code to a look-alike website that eventually asks for your recovery phrase.
| Country | What the letter claims | Status |
|---|---|---|
| United States | Enrol in a 'Digital Asset Compliance Portal' by a deadline via a QR code | Confirmed by IRS Criminal Investigation, 30 Jul 2026: the IRS sent no such letter and runs no such portal |
| Switzerland | Install an 'urgent update' for your crypto wallet via a QR code | Confirmed by the national cybersecurity office, 31 Jul 2026 |
| France | A DAC8 'formal notice' to register your crypto assets on a portal via a QR code | Reported by French security blogger Korben and the Signal-Arnaques community, late August–September 2026; the address list is suspected to come from Ledger's 2020 leak |
Sources: IRS-CI fraud alert, 30 Jul 2026 · Swiss National Cyber Security Centre, 31 Jul 2026 · Korben (France)
How to tell a real request from a fake
Five signals separate the two. One fake signal is enough to stop.
- Real: the request appears inside your exchange account, which you opened by typing the address yourself
- Real: it asks for tax residence and a tax ID, the same kind of data a bank asks for
- Fake: a letter or email with a QR code or link to 'register' your wallets or assets
- Fake: any page that asks for a recovery phrase, a private key or your exchange password
- Fake: a short deadline with a large penalty if you do not act through the link
If you already scanned the code
If you entered a recovery phrase on such a site, move any remaining funds immediately to a new wallet with a new phrase: the old one is compromised. If you entered an exchange password, change it and contact the exchange. Keep the letter and screenshots, then report it: IRS.gov/SubmitATip in the US, your national police cybercrime service elsewhere.
Getting your own numbers right
Once tax authorities receive platform data, the figures in your return need to match it. Exchanges report aggregates; your gains depend on your cost basis, which only you can reconstruct, especially if you moved coins between platforms or to a hardware wallet. Crypto tax software imports exchange exports and wallet addresses and calculates gains under your country's rules. It is a tool, not tax advice: rules differ by country, so check with your tax authority or an adviser.
Next step
Reconstruct your cost basis before the data arrives
Tax software imports exchange and wallet history and calculates gains under your country's rules. It is a tool, not tax advice.
Sponsored · affiliate link. We may earn a commission; it never changes our rankings or this article.
Keep reading
Quick answers
Is it legal for my exchange to ask for my tax ID?
Yes. In the EU, DAC8 has required crypto platforms to collect tax residence and tax ID since 1 January 2026; UK platforms do the same under CARF. Answer only inside your account, never through a link or QR code.
What if I don't give my tax ID?
Under DAC8, after two reminders and 60 days without the information, the platform must block your exchange transactions until you provide it. Penalties are set by each EU country.
Does DAC8 report my hardware wallet?
DAC8 obliges platforms, not wallets. Your platform reports transfers you make from it, including to external addresses, but no one reports the contents of a self-custody wallet. Your own tax obligations still apply.
Do tax authorities ask you to register crypto on a portal?
Not the IRS, which says it runs no 'Digital Asset Compliance Portal'. Letters asking you to scan a QR code to register crypto assets have been confirmed as scams in the US and Switzerland, and reported in France.