Automatic Exchange of Information for Digital Platform Operators ("DAC7") - an introduction & the impact on Middle East businesses

March 09, 2022

In brief

DAC7 enters into force in the EU on 1 January 2023, Middle East businesses have less than 18 months to assess whether they are impacted by DAC7 and if so, ensure implementation of the requirements is performed to enable capture, processing and reporting of data.


The digitalization of the economy has been identified as a critical matter for tax authorities as digital activities are experiencing rapid growth in recent and upcoming years. This has been more recently accelerated by the COVID-19 pandemic and the challenges the pandemic has posed globally. Concern has been raised that income earned from activities carried out through digital businesses and more specifically digital platforms is not being reported in full to tax authorities and therefore as these businesses grow and increase market share, there is an increased risk of a loss of tax revenue. This is particularly challenging to monitor when taxable income is derived via digital platforms in other jurisdictions. It has been estimated there is an approximate $166bn tax gap in the EU from a Value Added Tax ("VAT") perspective and an equally significant tax gap from a corporation tax perspective.

In detail

In response to this, the European Union ("EU") recognized action must be taken and on March 22, 2021, the EU adopted a new directive introducing the automatic exchange of information for both EU and non-EU digital platform operators (directive referred to hereafter as “DAC7”). Automatic exchange of information regimes are not new, the United States ("US") introduced the Foreign Account Tax Compliance Act ("FATCA") which went live in 2014 and the Organization for Economic Co-operation and Development ("OECD") introduced the Common Reporting Standard ("CRS") which went live in 2016. Both the FATCA and CRS regimes are largely intended to mandate collection of data and reporting by financial institutions, DAC7 has been introduced to mandate collection of data and reporting by a wider group of businesses, coined digital platform operators, therefore many organizations are expected to be brought into scope of DAC7. 

DAC7, unlike other directives issued by the EU, has extraterritorial impact. DAC7 mandates that both EU and non-EU (including Middle East) digital platform operators must collect, process and report certain information about sellers of certain services and goods that use digital platforms. DAC7, in summary, has three key drivers: 

  1. The COVID-19 pandemic and the related negative economic impacts in EU public finances; 

  2. Strengthen the fight against tax fraud, tax evasion and tax avoidance and enhance the tax transparency among EU Member States; and 

  3. Facilitate multilateral automatic exchange of information.

Who is expected to be in scope for DAC7?

DAC7 is expected to capture a wide range of businesses across several industries and the legislation intends to bring into scope businesses that connect buyers and sellers together via digital means, including websites and mobile applications, digital platform operators.  

Organizations that operate such a business are expected to be impacted. DAC7 impacts both EU and non-EU digital platforms that have EU sellers where certain activities are performed through a digital platform, therefore Middle East businesses must assess to what extent they are impacted. 

It is expected DAC7 will apply to digital platforms that are aware of the revenues generated by sellers on the platform. Digital platforms that facilitate advertising or transferring of buyers to sellers are not expected to be caught under the rules. An example of this could be a mobile application that helps booking of tables at a restaurant. Such a digital platform would not be reasonably expected to know the value of the transaction between a seller and a buyer; therefore, such digital platforms are not expected to be brought into scope. We await guidance to be released to clarify this position. 

DAC7 formally defines a platform as "any software, including a website or a part thereof and applications, including mobile applications, accessible by users and allowing Sellers to be connected to other users for the purpose of carrying out a Relevant Activity, directly or indirectly, to such users. It also includes any arrangement for the collection and payment of a Consideration in respect of Relevant Activity." Therefore, importance is placed upon such platforms that facilitate transactions that involve relevant activities.

 How does DAC7 define a Relevant Activity?

To come into scope for DAC7, a digital platform should facilitate connecting buyers and sellers together for the purpose of carrying out a relevant activity. A relevant activity is an activity carried out for a consideration (consideration for these purposes is compensation in any form, net of any fees, commissions or taxes withheld or charged by the digital platform), limited to the following:

  1. the rental of immovable property, including both residential and commercial property, as well as any other immovable property and parking spaces;

  2. a Personal Service;

  3. the sale of Goods; and

  4. the rental of any mode of transport.

The Directive states, "The term "Relevant Activity" does not include an activity carried out by a Seller acting as an employee of the Platform Operator or a related Entity of the Platform Operator." As such, activities performed by employees or related entities are not deemed a relevant activity and are therefore not in scope for DAC7. This only applies to cases where the "seller" is an employee of a related entity.  Therefore, a facilitating role of employees does not alter a DAC7 obligation for third party sellers.

Timeline, penalties, collection of data and reporting requirements

DAC7 needs to be transposed into domestic law by each EU Member State by 31 December 2022, and therefore, DAC7 is required to go live 1 January 2023. This leaves less than 18 months for businesses to prepare for DAC7 go live, including an implementation of controls and measures to collect, process and report information required under DAC7. 

Non-compliance with the DAC7 would lead to the application of penalties. At this stage, DAC7 outlines that each Member State should lay down rules on such penalties which must be effective, proportionate and dissuasive. Regarding non-EU digital platforms, the worst-case-scenario could be  preventing them to practice any further activity in the EU or included in a blacklist issued by each Member State. We await guidance to be released to clarify the amounts and further implications. 

If a business is in scope for DAC7, they are expected to collect the following information on sellers (both individuals and entities):

  1. legal name (entities), first and last name (individuals);

  2. primary address;

  3. TIN, including each EU Member State of issuance, and in the absence of a TIN, the place of birth of that seller;

  4. VAT identification number (where available);

  5. date of birth (individuals only);

  6. business registration number (entities only); and

  7. existence of permanent establishment through which Relevant Activities are carried out in the EU, where available, indicating each respective EU Member State, where such a permanent establishment is located.

The above is not an exhaustive list. This therefore means digital platforms will be required to significantly change their onboarding and client data collection processes in order to collect and maintain sufficient data to comply with the requirements.  

The first reports are to be submitted by January 31, 2024 (in respect of calendar year 2023) and the responsibility for submitting reports lies at the digital platform itself. In addition to the above information, it is expected digital platforms will also be required to report the following information on the users of the platform (however this is likely to be clarified closer to the time):

  1. Financial account identifier and the competent authority of the EU Member State where the reportable seller is resident,

  2. Each EU Member State in which the reportable seller is resident; and

  3. Amounts paid or credited and the number of relevant activities; 

  4. Fees; commissions or taxes withheld or charged by the platform operator.

The information requirements regarding relevant activities involving immovable property rental will also include details on the properties in EU Member States.

Illustrative example of DAC7

As DAC7 is expected to impact a wide range of businesses, we have outlined below an illustrative example of how DAC7 may operate in practice.

DAC7 implications on the Middle East 

Given DAC7 impacts both EU and non-EU businesses, Middle East platforms bringing users and sellers together through a digital platform based in the Middle East as the DAC7 has extraterritorial impact. In this regard, impacted business based in the Middle East should kickstart activities aimed to identify the DAC7 impact on their activities.

Next steps

To assess the impact of DAC7 on your business, we are supporting organizations with an impact assessment and implementation, particularly given the extensive work involved to comply with the requirements. Our immediate recommendations would be to:

  1. Perform an impact assessment to determine if your business is in scope of DAC7; 

  2. If impacted, design and implement the relevant controls and processes to collect and report information. This should include identification of a governance framework; and

  3. Prepare for collection of the required information beginning 1 January 2023.

The Takeaway

Businesses bringing together sellers and buyers through digital platforms should take note of the DAC7 implications. This will allow an early identification of the DAC7 impact of such and the potential modifications it may represent for their ongoing business.


Follow us