Crypto ATM operators — entities that deploy and manage physical machines enabling users to buy or sell crypto-assets with cash or cards — face a distinctive set of challenges under DAC8. The combination of physical infrastructure, cash-based transactions, and walk-up users creates reporting considerations that differ significantly from those of online platforms.
Crypto ATMs Within DAC8's Scope
Crypto ATMs typically facilitate the exchange of fiat currency for crypto-assets (and sometimes the reverse). Operators of these machines are generally acting as intermediaries that provide exchange services on behalf of users, which should place them within DAC8's definition of a Reporting Crypto-Asset Service Provider (RCASP).
Whether the operator owns the machines, leases them, or operates them under a franchise arrangement, the entity providing the exchange service to the end user should assess its reporting obligations carefully.
User Identification at ATMs
Perhaps the most significant challenge for crypto ATM operators under DAC8 is user identification. The directive requires RCASPs to perform due diligence on Reportable Users, collecting information such as:
- Full legal name
- Date of birth
- Country of tax residence
- Tax Identification Number (TIN)
- Address
Collecting this level of information at a physical ATM presents practical difficulties:
Walk-Up Users
Unlike online platforms where users create accounts and complete onboarding flows, crypto ATMs often serve walk-up users seeking quick transactions. Requiring extensive identification at the machine may be operationally challenging and may reduce usage.
Existing AML Thresholds vs. DAC8 Requirements
Many crypto ATMs already implement identity verification at certain transaction thresholds as part of anti-money laundering (AML) compliance. However, DAC8's due diligence requirements may apply regardless of transaction size, meaning that even small-value transactions could require user identification for tax reporting purposes.
Operators should assess whether their current AML-driven identification processes capture all the data points DAC8 requires, and whether identification needs to be performed for transactions below existing AML thresholds.
Technology Solutions
Some operators may need to invest in enhanced identification technology at their ATMs, such as:
- Document scanning capabilities for identity verification.
- Integration with mobile applications where users pre-register and complete due diligence before using the ATM.
- Biometric verification linked to pre-existing user accounts.
Transaction Reporting for Cash-to-Crypto
Cash-to-crypto transactions at ATMs should typically be reported under DAC8. Key reporting elements may include:
- The fair market value of crypto-assets purchased at the time of transaction.
- The fiat amount exchanged by the user.
- The type and quantity of crypto-asset purchased.
- Aggregate transaction data per user per reporting period.
For crypto-to-cash transactions (where users sell crypto-assets for fiat currency), the same data points should generally apply in reverse.
Destination Wallet Tracking
When a user purchases crypto-assets at an ATM, the assets are typically sent to a wallet address provided by the user. The destination address may need to be recorded as part of the transaction data, particularly for transfer reporting purposes.
Aggregation Across Multiple Machines
Operators that manage networks of ATMs across different locations — potentially in multiple Member States — should ensure they can aggregate transactions at the user level across all machines. A user who makes purchases at several different ATMs operated by the same entity should have all transactions aggregated for reporting purposes.
This requires that user identification data be consistent and linkable across machines, which may necessitate a centralized user account system rather than treating each machine transaction independently.
Location-Based Considerations
Crypto ATMs are deployed in specific physical locations, which may create additional considerations:
- Member State determination: The location of the ATM may determine which Member State's competent authority receives the report, particularly if the operator is established in a different jurisdiction from where the machine is located.
- Cross-border users: Users may use ATMs in a country other than their country of tax residence. The operator should still collect tax residence information and report accordingly.
Operational and Cost Considerations
Implementing DAC8-compliant identification and reporting at crypto ATMs may involve significant costs:
- Upgrading hardware and software at each machine.
- Implementing or expanding centralized user management systems.
- Training maintenance and support staff on new identification procedures.
- Potentially reducing transaction throughput due to longer identification processes.
Operators should factor these costs into their compliance planning and assess whether their current business model remains viable under the enhanced requirements.
Practical Steps for ATM Operators
- Evaluate current identification processes against DAC8's due diligence requirements.
- Assess technology upgrades needed at ATM terminals to support enhanced user identification.
- Implement centralized user systems that link transactions across multiple machines.
- Establish aggregation processes for annual reporting across the entire ATM network.
- Clarify reporting jurisdiction for each machine location relative to the operator's establishment.
- Seek legal guidance on the interaction between AML identification thresholds and DAC8 requirements.
Conclusion
Crypto ATM operators face unique DAC8 compliance challenges rooted in the physical, cash-based nature of their services. User identification at the point of transaction and aggregation across machine networks are likely the most demanding requirements. Operators should begin planning for these obligations early, as the hardware and process changes involved may require substantial lead time.
This article provides general information and should not be treated as legal or tax advice. ATM operators should consult qualified professionals for guidance specific to their circumstances.
Need help with DAC8 reporting?
Our team handles XML generation, TIN validation, and submission for CASPs across all 27 EU Member States.