Malta updates DAC framework following the transposition of DAC8

In Malta, these changes have been implemented through Legal Notice 162 of 2026, which amends Subsidiary Legislation 123.127, the 'Cooperation with Other Jurisdictions on Tax Matters Regulations' (the “Regulations”). Effective from 1 January 2026, DAC8 pursues two distinct but complementary objectives: 

• it introduces a dedicated reporting and automatic exchange-of-information framework for crypto-assets, requiring Crypto-Asset Service Providers (CASPs) and Crypto-Asset Operators (CAOs) to carry out due diligence procedures and submit annual reports to the competent authorities; and

• it introduces a series of targeted amendments and clarifications across the wider DAC framework (DAC 1–DAC 7), aimed at improving the quality, usability and effectiveness of information exchanged between EU tax authorities.

This article summarises the key points under each of these two areas. We begin below with the new crypto-asset reporting framework and the practical implications for CASPs and CAOs.

DAC 8 primarily establishes a comprehensive reporting framework for CASPs and CAOs. Such providers are required to carry out due diligence on their users and to report detailed information on crypto-asset transactions to the Maltese Commissioner for Tax and Customs. This includes, in particular, aggregate gross amounts relating to acquisitions, disposals, exchanges, transfers, and certain retail payment transactions, whether carried out in fiat currency or in other crypto-assets.  

The reporting obligations apply from 1 January 2026, with the first reports required to be submitted within nine months from the end of the relevant calendar year. A dedicated penalty regime applies for non-compliance, including consequences where information is not submitted within the stipulated timeframes, or where the submitted information is incomplete, or inaccurate. In cases of reporting of misleading or false information, the penalties may also extend to  senior managing officials personally, in accordance with the Regulations. 

The framework is primarily relevant to authorised or notified CASPs, CAOs (i.e. crypto services operators other than authorised or notified CASPs) that conduct crypto-asset services effectuating exchange transactions (as defined), and their reportable users being individuals or entities resident in the EU for tax purposes (subject to certain exclusions).

Besides the introduction of DAC 8, other DACs have also been updated to reflect the emergence of crypto-assets, in particular DAC 2 (CRS) legislation. The CRS guidelines have also been refreshed to take these asset types into consideration, making direct reference to (i) “Specified Electronic Money Products” and (ii) “crypto-assets”. In parallel, the definitions and categories of Financial Institutions have been updated to better reflect activities and services provided within the crypto sphere. 

Across the existing DAC framework, several noteworthy amendments stand out:

• DAC 1: Automatic exchange of basic income information - the updated Regulations expand existing obligations to include information on certain non-custodial dividend income and require more detailed information, such as identification details and tax numbers, to improve transparency.
• DAC 2: Financial accounts (CRS) - the updated Regulations strengthen Malta’s reporting framework for banks, investment firms and insurers by expanding the information that must be collected and reported on account holders and controlling persons. They also clarify the treatment of joint accounts, pre‑existing and new accounts, and extend reporting to newer products such as e‑money and central bank digital currencies.
• DAC 3: Cross border rulings and advance pricing arrangements – the updated Regulations introduced the requirement of exchange of rulings concerning a natural person or persons (i.e. an individual or individuals) to the extent that the ruling was or is issued, amended and renewed after 1 January 2026 and involves a transaction or a series of transactions above Euro 1.5 million or determines whether a person is tax resident in Malta or not (excluding rulings on the taxation at source with respect to non-residents’ income from employment, director’s fees or pensions).
• DAC 6: Mandatory disclosure rules - the updated Regulations have significantly narrowed the scope of the legal professional privilege waiver. The amended legislation now limits the right to invoke the waiver exclusively to legal professionals (as defined). As a result, with effect from 1 January 2027, other intermediaries (i.e. intermediaries other than legal professionals) —such as tax advisers and accountants—can no longer rely on the waiver and are required to report in full any reportable cross‑border arrangements in which they are involved. Where such other intermediaries are subject to the reporting obligation, they are no longer required to inform any other intermediary or if there is no such other intermediary, the relevant taxpayer that a DAC 6 report has or will be filed with the competent authority. Consequently, taxpayers may, in certain instances, no longer have visibility over whether a reportable arrangement involving them has been disclosed, increasing the importance of robust internal monitoring and awareness of potential DAC 6 exposures. 
• DAC 7: Digital platform operators - the updated Regulations introduced the concept of an "Identification Service" enabling tax authorities in the EU to issue a government-verified identification number and digital platform operators to use the said government identifier when reporting information on reportable sellers. This improves data quality, legal certainty and administrative efficiency.
   

Finally, DAC 8 strengthens and expands the Tax Identification Number (TIN) reporting across the existing DAC regimes, through a phased approach applying from 2028 and 2030. This is supported by the development of an EU‑wide electronic TIN verification tool aimed at improving data availability and quality.

These developments reinforce the need to review how your business identifies, documents and meets its exchange-of-information reporting obligations under the updated DAC framework. Please reach out to any member of the team should you have any queries or if you require any further information.