Setting Up DAC8 Data Collection Systems

Effective DAC8 reporting starts long before the report is generated. The foundation of compliance is a data collection infrastructure that captures the right information, at the right time, in the right format. This guide covers how to modify your onboarding flows, integrate data collection into your platform, and implement quality checks to ensure reporting readiness.

> Disclaimer: The data fields and processes described here are based on the general DAC8 framework established by Council Directive (EU) 2023/2226. National implementations may impose additional requirements. Always check with your national tax authority for specific data collection obligations.

Understanding What Data You Need

DAC8 reporting generally requires two categories of data: user-level data and transaction-level data. Your systems need to capture both reliably.

User-Level Data

For each potentially reportable individual, you should plan to collect:

• Full legal name (first name, last name, and middle name if applicable)
• Date of birth
• Place of birth (may be required in some Member States)
• Residential address (street, city, postal code, country)
• Tax residency jurisdiction(s) as declared by the user
• Tax Identification Number (TIN) for each jurisdiction of tax residence
• Nationality (may be useful for due diligence, though not always a required reporting field)

For entity users, additional fields may include:

• Legal entity name
• Entity type (corporation, partnership, trust, etc.)
• Country of incorporation or registration
• Entity TIN or registration number
• LEI (Legal Entity Identifier) if available

Transaction-Level Data

Your platform should capture and retain:

• Transaction timestamp (date and time, preferably in UTC)
• Transaction type (crypto-to-fiat, crypto-to-crypto, transfer, retail payment)
• Crypto-asset type (e.g., BTC, ETH, specific token identifiers)
• Quantity of crypto-asset exchanged or transferred
• Fair market value at the time of the transaction (in the relevant fiat currency)
• Fees charged and how they are allocated
• Counterparty information where applicable and available
• Wallet addresses involved in the transaction

Modifying Your Onboarding Flow

The most effective point to collect DAC8-required data is during user registration and KYC (Know Your Customer) onboarding. Here is how to approach the modifications:

Step 1: Audit Your Current Onboarding

Review your existing registration and KYC process to identify:

1. Which DAC8-required fields you already collect
2. Which fields are missing entirely
3. Which fields are collected but in an incompatible format
4. At which point in the flow each field is gathered

Step 2: Add Missing Fields

Common fields that crypto platforms often need to add include:

• Tax residency declaration (many platforms collect nationality but not tax residency, which can differ)
• TIN for each tax residency jurisdiction (this is frequently missing from standard KYC flows)
• Self-certification form (a formal declaration where the user confirms their tax residency and TIN information)
• Place of birth (not always collected during standard KYC)

Step 3: Design the Self-Certification Step

The self-certification is a critical component of DAC8 data collection. It should be presented as a distinct step in the onboarding process, not buried in general terms and conditions. The self-certification form should:

• Clearly explain why the information is being collected
• Ask the user to declare their jurisdiction(s) of tax residence
• Collect the TIN for each declared jurisdiction
• Include a declaration statement that the user certifies the information is correct
• Record the date and method of certification (e.g., electronic acceptance with timestamp)
• Be available in relevant languages for your user base

Step 4: Handle Multiple Tax Residencies

Some users may be tax resident in more than one jurisdiction. Your onboarding flow should:

• Allow users to declare multiple jurisdictions of tax residence
• Collect a separate TIN for each jurisdiction
• Not limit the number of jurisdictions a user can declare
• Clearly label each jurisdiction and its corresponding TIN

Step 5: Implement Progressive Collection

Not all data needs to be collected at the very first step. Consider a progressive approach:

1. At registration: Collect name, email, and basic identity information
2. At KYC verification: Collect address, date of birth, nationality, and identity documents
3. At self-certification: Collect tax residency, TIN(s), and self-certification declaration
4. Before first transaction: Ensure all mandatory fields are complete

However, be cautious about allowing users to transact before self-certification is complete, as this may create gaps in your reportable data.

System Integration Points

DAC8 data collection should not exist in isolation. It needs to integrate with several other systems.

CRM and User Database

• Store DAC8-related fields alongside existing user profile data
• Ensure fields are clearly labeled as DAC8-relevant for reporting purposes
• Implement versioning so that changes to tax residency or TIN are tracked with effective dates

KYC/AML System

• Coordinate with your KYC provider to ensure DAC8 fields are included in the identity verification workflow
• If you use a third-party KYC provider, confirm they can collect and return the required fields
• Ensure that the self-certification is stored as part of the user's compliance record

Transaction Processing System

• Tag each transaction with the necessary metadata at the time it occurs
• Record fair market values contemporaneously (not retrospectively)
• Ensure transaction types are categorized in a way that maps to DAC8 reporting categories

Reporting Engine

• Design your data model so that the reporting engine can query user and transaction data efficiently
• Create clear interfaces between your data collection layer and your report generation layer
• Consider building an intermediate staging database specifically for DAC8 reporting

Data Quality Checks

Collecting data is only useful if the data is accurate and complete. Implement these quality checks:

At the Point of Collection

• Format validation: Ensure TINs match expected patterns for the declared jurisdiction
• Mandatory field checks: Block progression in the onboarding flow if required fields are empty
• Country code validation: Verify that jurisdiction codes are valid ISO 3166-1 alpha-2 codes
• Date validation: Ensure date of birth is a valid date and within a reasonable range
• Address completeness: Check that all address components (street, city, postal code, country) are present

On an Ongoing Basis

• Periodic data quality reports: Run regular checks to identify users with missing or invalid DAC8 fields
• Change of circumstances monitoring: Prompt users to update their self-certification if they indicate an address change or if other triggers suggest a change in tax residency
• TIN re-validation: Periodically re-validate TINs against updated format databases
• Stale data alerts: Flag users who have not updated their self-certification within the required renewal period (if applicable)

Before Report Generation

• Completeness sweep: Identify all users who will appear in the report and verify that all required fields are populated
• Consistency checks: Cross-reference declared tax residency against address country, and flag discrepancies for review
• Duplicate detection: Check for duplicate user records that may need to be merged before reporting

Handling Existing Users (Data Remediation)

If DAC8 obligations apply to your existing user base, you will likely need to conduct a remediation exercise to collect missing data from users who registered before your DAC8-compliant onboarding flow was in place.

Remediation Strategy

1. Identify the gap: Determine which existing users are missing required data
2. Prioritize by risk: Focus first on users who are most likely to be reportable (e.g., those with significant transaction volumes or those resident in EU jurisdictions)
3. Communicate clearly: Send targeted communications explaining why additional information is needed and what the legal basis is
4. Set deadlines: Give users a reasonable timeframe to provide the missing information
5. Follow up: Send reminders to non-responsive users
6. Escalate if necessary: Consider whether to restrict services for users who do not provide the required information within the specified timeframe, in accordance with your terms of service and applicable regulations

Remediation Tracking

Maintain a remediation dashboard or tracker that shows:

• Total number of users requiring remediation
• Number of users who have completed the process
• Number of users who have been contacted but not yet responded
• Number of users for whom data collection has been escalated
• Completion rate over time

Record Retention

DAC8 requires that certain records be retained for a specified period, which is typically at least 5 years but may vary by Member State. Ensure your systems:

• Retain self-certification forms and their supporting data
• Maintain an audit trail of when data was collected and any changes made
• Store data securely in compliance with GDPR
• Can produce records upon request from the tax authority

Summary

Setting up DAC8 data collection is a cross-functional effort that involves your product, engineering, compliance, and legal teams. The key principles are: collect the right data during onboarding, validate it at every stage, integrate it with your existing systems, and remediate gaps in your existing user base. Starting early and building robust systems will make each subsequent reporting period significantly smoother.

This article is for informational purposes only and does not constitute legal or tax advice. Check with your national tax authority for specific data collection requirements in your jurisdiction.