Bitcoin Austria Takes the E.U. Crypto Reporting Rule DAC8 to Court

Set Trending Topics as a preferred source on Google.

Austria’s oldest Bitcoin association wants to keep the tax office out of people’s wallets: With its dac8.org campaign, Bitcoin Austria is fighting the E.U. directive DAC8, which requires crypto exchanges, brokers and apps to report data on their customers to the tax authorities every year. At the association’s initiative, the Vienna lawyer Oliver Völkel of the law firm CERHA HEMPEL has already filed a complaint with Austria’s data protection authority, with the aim of reaching the Constitutional Court and, if necessary, the European Court of Justice. The campaign has just launched with the support of Coinfinity, a Bitcoin broker based in Graz.

What DAC8 Requires

The E.U. directive DAC8 extends the automatic exchange of tax information between E.U. member states to crypto assets. Austria implements it through its Crypto Reporting Obligation Act, which has been in force since the start of the year. Providers are therefore already collecting the data, and the first report covering 2026 goes to the tax office by the end of July 2027. According to the campaign website, the following is reported:

• Identity: Name, address, date of birth, tax number and tax residence.
• Annual totals: For each crypto asset, the totals of purchases, sales, swaps and transfers, including the value in euros, the number of units and usually the number of transactions.
• Transfers to private wallets: Anyone who moves Bitcoin from an exchange to a self-custodied wallet will generally show up in the report as a total, without the wallet address.

People who only hold Bitcoin in self-custody and never buy through an exchange, broker or app are not reported. Identity documents, wallet addresses and individual transactions are already stored by providers under anti-money laundering rules.

The Opponents’ Arguments

On dac8.org, Bitcoin Austria lists a whole series of reasons against the reporting obligation. The most important ones:

• Data collection without suspicion: Everyone who uses a provider is reported, regardless of any suspicion. The campaign draws a comparison with data retention for telecommunications, which Austria’s Constitutional Court struck down in 2014.
• Reporting what triggers no tax: A transfer to one’s own wallet is not taxable in itself. The association compares this to a bank reporting to the tax office how much cash someone has withdrawn.
• Ten years of storage: Providers must keep every annual report for ten years, which the explanatory notes to the law justify with administrative simplicity. For bank accounts, the period is five years, and Ireland sets six years for crypto providers.
• Austria goes beyond the E.U.: Providers must prepare the reporting data for all customers, including those who are never reported. Germany and the Netherlands require this only for people who are actually reported.
• Data leaks as a threat: The campaign points to leaks at Coinbase, the wallet maker Ledger, the French crypto tax service Waltio and the French tax administration. Such data could become target lists for fraud, extortion and robbery. According to the website, 45 attacks on crypto holders have become known in the E.U. so far this year, compared with 29 in all of 2025.

From this, Bitcoin Austria derives concrete demands: no financial files without suspicion, no data retention, no reporting of transfers to private wallets, shorter storage periods and clearly limited access to the data.

The Road to the Highest Court

Formally, the complaint concerns a single case. Mr. Völkel, a partner at CERHA HEMPEL in Vienna, filed it in October at the initiative of Bitcoin Austria, as a customer of Coinfinity. He is challenging, before Austria’s data protection authority, how the provider processes his data for DAC8. In substance, though, the case is about the law behind it, meaning the obligations that DAC8 and the Austrian reporting act impose on all providers. Mr. Völkel also serves as the campaign’s contact for legal questions about the proceedings.

The detour is necessary because a law can only be challenged directly before the Constitutional Court if no other reasonable route is available. After the data protection authority, the case would therefore go to the Federal Administrative Court and then to the Constitutional Court. The Constitutional Court could review the law and refer the E.U. directive to the European Court of Justice, but it is not obliged to do so. The reporting obligation remains in force while the case is pending. How long it will take is unclear. The proceedings are financed through donations in Bitcoin or by bank transfer.

“How Much Information May the State Collect as a Precaution?”

Mr. Völkel himself expects to lose in the first instance. “The data protection authority is of course bound by the law. We therefore expect our complaint to be dismissed,” he told Trending Topics. The authority could, however, carry out further inquiries into whether the concerns are justified. After that, the case would proceed via the Federal Administrative Court to the Constitutional Court, “which can then also refer the E.U. directive to the European Court of Justice for review.”

On the substance, the lawyer’s main objection is that transfers to a customer’s own wallet must be reported. “It is as if banks were required to report, for every customer, how much cash they withdrew in the past year,” Mr. Völkel said. Cash withdrawals are, as a rule, not taxable in themselves, “just like the transfer of Bitcoin and other crypto assets to one’s own wallet.” The reporting obligation, he argued, has a scope “that society would probably no longer accept if it were not about Bitcoin and crypto but, say, about cash.” Whether collecting the data is even necessary and proportionate to fight tax evasion is a question that needs to be settled, he said.

Then there is the question of safety. Self-custody is a fundamental part of Bitcoin, he said, and as with cash kept at home, disclosed information about supposed holdings could “help criminals select their victims.” As evidence, Mr. Völkel points to France, where the rise in kidnappings and violent extortion in the crypto space has also been linked to a data leak at a provider of crypto tax software, and to the fraudulent letters to customers documented by Ledger. “Such data is in fact being used to pick potential victims.” Particularly galling, he said, is that the reported totals do not even prove a current level of wealth, because with repeated deposits and withdrawals “the same money” is counted several times. “Anyone who withdraws Bitcoin or other crypto assets can still end up in the crosshairs.”

For Mr. Völkel, the case is therefore about more than crypto: “How much information may the state have collected as a precaution, and what risks does that create for us and our families?” It is conceivable, he said, that a future DAC directive could extend such collection obligations to cash withdrawals.

Behind dac8.org is Bitcoin Austria, officially the Verein zur Förderung von Bitcoin in Österreich (Association for the Promotion of Bitcoin in Austria). The nonprofit association from Vienna was founded in 2011 and describes itself as Europe’s oldest Bitcoin association. The campaign is supported by Coinfinity, which recently appointed Raimund Ortner as its new managing director. Notably, as a Bitcoin broker, Coinfinity is itself one of the providers that must report under DAC8. Alongside the legal action, the association is calling on people to write to members of Parliament and provides a ready-made template letter.

France as the Model

The idea comes from France. There, the Bitcoin broker Bull Bitcoin asked the Conseil d’État in February to annul the decree through which France implements DAC8. According to Bitcoin Austria, its campaign on dac8.com inspired the Austrian one. It has not succeeded so far: In September, the court declined to suspend the decree in summary proceedings, and no decision has yet been made on the annulment itself. Bitcoin Austria wants to take the campaign to other E.U. countries as well.

The association also has a model in Austria. Data retention for phone and internet data was struck down in 2014 after the group AKVorrat, now known as epicenter.works, brought the issue before the Constitutional Court. The court referred the questions to the European Court of Justice, which declared the E.U. directive invalid.

Tax Fairness as the Counterargument

The E.U. and tax authorities see DAC8 differently. The directive aims to curb tax evasion involving crypto assets, just as the automatic exchange of account data already does for traditional bank accounts. According to dac8.org, the European Commission estimated additional tax revenue of up to €2.4 billion a year.

Tax advisers expect the reports to have an effect. Christian Massoner and Christoph Finsterer of EY told Trending Topics in an earlier interview that the risk of detection for previously undeclared crypto gains would rise dramatically with DAC8. If a provider reports large holdings for which no income was taxed in the past, they said, it would be natural for the tax office to look into earlier years as well.

Austria’s Constitutional Court has already ruled that the state may automatically exchange account data, though only for account balances and interest. According to the court, such data does not touch the core of private life. Whether the same applies to the much more detailed crypto reports is precisely the question Bitcoin Austria now wants answered.