Luxembourg has passed a new law implementing EU Directive DAC8, requiring crypto-asset service providers to report user information and transactions. The legislation also updates rules for life insurance, digital currencies, and advance tax rulings, with fines of up to EUR 250,000 for non-compliance.
Luxembourg’s parliament passed a law implementing EU Directive 2023/2226 (DAC8), introducing stricter reporting and due diligence requirements for crypto-asset service providers (CASPs).
Under the law, CASPs must collect users’ tax residency, names, addresses, tax IDs, dates of birth, and transaction details. They must submit reports to the Administration des contributions directes (ACD) by 30 June each year. The ACD will then automatically share this information with tax authorities in other EU countries by 30 September.
The legislation also updates rules for life insurance, advance tax rulings, electronic money, and central bank digital currencies.
Exchanged data can also be used to support anti-money laundering, counter-terrorism, and customs enforcement.
Non-compliance can result in penalties, including a flat fine of EUR 5,000 for failing to register or submitting reports late, and fines of up to EUR 250,000 for failing to meet due diligence and reporting obligations following an official control. Repeated failures may also lead to the revocation of a crypto-asset service provider’s registration by the Administration des contributions directes (ACD).
Earlier, Luxembourg’s Government Council approved a series of draft laws and regulations on 24 July 2025, including key measures to transpose EU tax directives and implement expanded information exchange requirements. Among the approvals were draft laws to transpose Council Directive (EU) 2023/2226 (DAC 8) and Council Directive (EU) 2025/872 (DAC 9), targeting reporting obligations for crypto-asset service providers and the exchange of information related to the Top-up tax under Pillar Two.
