On 27 March 2026, Luxembourg adopted the Law of 27 March 2026 transposing the Council Directive commonly referred to as “DAC8” into national law. The transposition brings crypto‑asset service providers (CASPs) within an automatic exchange of information framework, updates certain Common Reporting Standard (CRS) provisions, and sets out registration, due diligence, reporting, and sanction rules. This Tax Alert summarises the main points of the new Luxembourg provisions.
Scope, definitions and registration
The law adopts DAC8’s functional approach to capture entities providing crypto‑asset services (custody, exchange, transfer, trading facilities, and related activities). It distinguishes custodial and non‑custodial arrangements and defines “reportable accounts” and “reportable arrangements” in a manner consistent with the Directive’s taxonomy.
Importantly, the Luxembourg statute introduces an express obligation for entities subject to the reporting regime to register with the Administration des contributions directes (ACD). Entities established in Luxembourg, and non‑resident entities operating via a Luxembourg branch or otherwise carrying on relevant activities in the country, must ensure they are registered with the ACD in accordance with the registration rules set out in the law and any administrative guidance. Registration is a distinct compliance step, separate from filing reports.
The law expressly lists the full set of information that reporting CASPs must provide to the ACD. This includes identification and tax‑residence details for reportable users and their controlling persons, the CASP’s own identifiers, and aggregated transaction and transfer data by crypto‑asset type. Examples include: a user’s name, address, tax identification number and date/place of birth (for individuals); an entity’s name, jurisdiction(s) of residence and controlling‑person functions (for entities); and per‑asset aggregates such as gross amounts paid/received in fiat, total units and number of transactions, market‑value totals for crypto‑to‑crypto trades, counts and values of retail payment operations, and totals for transfers to on‑chain addresses not associated with VASPs or financial institutions. The data must be provided annually for each calendar year.
CASPs must be able to collect, aggregate and retain identity, control, and detailed on‑ and off‑chain transaction data (including classification of transfer types and identification of certain on‑chain addresses) to meet the reporting requirements. The law requires reporting CASPs to submit an annual report to the ACD even if they have no reportable users or transactions; a nil (zero) report is therefore required.
Exemption where reporting takes place in another jurisdiction
The law recognises that a CASP may already be carrying out due diligence and reporting in another Member State or in a jurisdiction subject to equivalent reporting rules. In such situations, an exemption may apply: where the reporting obligation is effectively fulfilled through reporting by another jurisdiction, Luxembourg’s ACD may accept that the Luxembourg filing requirement is satisfied.
CRS amendment and new information to be reported
Significantly, the law amends the CRS definition of “investment entity” in Luxembourg’s automatic exchange rules. The revised definition clarifies that an investment entity includes entities whose principal business is investing, managing, or administering funds or money on behalf of other persons, and specifically encompasses entities operating pooled investment vehicles that hold participation interests in crypto‑asset baskets. In addition, the definition of “deposit account” is extended to cover accounts holding electronic money or central bank digital currencies on behalf of clients, and the definition of “depositary institution” is extended to cover entities holding electronic money or central bank digital currencies on behalf of clients.
The law amends Luxembourg’s CRS framework to include additional fields and confirmations to be communicated by the ACD to partner jurisdictions for reportable accounts for periods of taxation beginning on or after 1 January 2026. Concretely, in addition to the standard identifying and transactional information required by DAC8, Financial Institutions will now have to report additional information in their annual reports:
Reportingstart date, jurisdictions list and technical rules
The law specifies that the first sets of information relating to DAC8/CRS amendments will be communicated for any calendar year starting on or after 1 January 2026. The statute also provides that the list of non‑Member State jurisdictions that are subject to declaration (i.e., jurisdictions other than EU Member States that must be included in exchanges) will be established by grand‑ducal regulation. The ACD and the Ministry will therefore publish the list of jurisdictions in scope by regulation, and entities must monitor those publications to determine cross‑border reporting obligations.
Although the law sets out the substantive fields and timing, the precise technical transmission format and electronic protocols are to be specified by the ACD’s implementing rules and administrative guidance. Entities should expect the ACD to publish technical specifications including data schemas, secure transmission mechanisms and filing deadlines. Until then, CASPs should prepare their systems to the capture required fields and to retain documentation supporting the items reported.
Practical next steps
To prepare for operationalisation, CASPs and intermediaries should first confirm whether registration with the ACD is required and complete any registration formalities promptly. Where reporting is, or will be, performed in another Member State or jurisdiction, firms must obtain and retain evidence of that reporting and notify or register with the ACD as required to avoid duplicate filings. For CRS purposes, systems should be updated to capture self‑certifications, controlling‑person functions and account‑type flags (pre‑existing/new, joint accounts) so that the tax reporting obligations are applied consistently across the organisation.
Conclusion
Luxembourg’s Law of 27 March 2026 transposes DAC8 and amends the CRS framework to require expanded data collection and automatic exchange beginning for calendar years from 1 January 2026. It introduces registration obligations, allows dispensations where reporting is performed in another jurisdiction, mandates specific additional information to be exchanged under CRS, and provides for administrative sanctions. The list of non‑Member State jurisdictions in scope will be set by grand‑ducal regulation and technical reporting rules will follow in ACD guidance.
Country-by-country reporting (CbCR)
Among other things, the DAC8 transposition law also amended some provisions related to CbCR, namely:
- The imposition of administrative fines is now assigned to the Interest Withholding Tax Office.
- An appeal against a decision to apply fines is available before the Administrative Tribunal, open to the Reporting Entity and to any Resident Constituent Entity concerned.
- For taxable periods starting on 1 January 2028, the required identity information must include, for each Constituent Entity, its Tax Identification Number (TIN) issued by a reportable jurisdiction, or a functional equivalent, where no tax identification number exists.
- The investigative powers of the tax authorities are subject to a ten‑year time-limitation period running from the end of the relevant reportable fiscal year.
What’s next?
Following this legislative update, we finally expect the ACD and relevant supervisors to issue detailed guidance, including technical reporting specifications, the grand‑ducal list of jurisdictions subject to declaration, and practical instructions on registration, dispensations, and sanctions, to implement the law effectively. KPMG Tax teams stand ready to assist with registration, gap analyses, policy updates and system implementations.
Our experts
