Line 12 of the schedule carries a watch mark that is really a countdown. Since 1 January 2026, crypto service providers across the EU have collected identity and transaction data on their customers under DAC8 — the European implementation of the OECD's CARF. In 2027 the first reports reach the tax authorities, matched automatically between all member states. For Austrian holders this changes not a single tax rate. It changes who sees what.
What actually changes
On the tax side: nothing. Every rule on the schedule applied before DAC8 and applies after. What changes is the asymmetry. Until now the Finanzamt knew little about foreign exchange accounts — the withholding world was split in two: domestic providers have deducted automatically since 2024, while foreign platforms and self-custody ran on self-declaration, meaning on trust. DAC8 ends precisely that split: the exchange in another member state reports too — identity, tax number, transaction volumes — and the report lands, through automatic exchange, with the Austrian Finanzamt. The population this reaches is precisely the one whose self-declaration nobody could cross-check before.
The mechanics, briefly
Reporting providers — exchanges, brokers, certain wallet services — must identify their users (self-certification including tax number) and report transaction data annually: purchases, sales, swaps, transfers. Refusing the self-certification risks account restrictions; providers face their own sanctions. The first reporting period is calendar 2026. If a platform recently asked for your tax number and residency: this is why.
An information request today means somebody found something. An information request in 2028 means the data was delivered on schedule — with your tax number in the subject line.
What it does to the Selbstanzeige window
Austria's Selbstanzeige fails on one blocking ground above all: discovery. As long as nobody holds the foreign data, little is discovered; once the DAC8 reconciliation runs, any discrepancy between report and return can constitute discovery — closing the window for the affected years without a single letter being sent. The practical translation: the distance between today and the first data delivery is the time remaining in which a correction can safely be filed as voluntary, surcharge-free and immunity-granting. That distance is a calendar, not a concept.
The honest read for a holder
- The correctly declared have documentation work, not fear. When platform reports arrive in 2027, your own wallet-level record answers any query in one attachment. Without it, even a correct return becomes laborious to defend.
- The old-stock boundary will be visibly tested. Tax-free sales of large positions stand out in the data picture. The pre-March-2021 proof belongs secured now, not searched for in 2028.
- Imported staking errors become matchable. Reported reward streams against declared receipts: applying the zero-cost rule backwards goes from a theory to a line in a reconciliation.
- Undeclared foreign years have a dated window. Reconstruction, advice, Selbstanzeige — in that order, before the data delivery. Afterwards it is no longer the holder who decides which door is open.
Why the line stays "watch"
The first reporting cycle has not yet run, implementation details are still being settled, and how the authorities operationalise the first data wave is a forecast, not a fact. We publish the dates that are fixed and mark the consequences as watch — updates flow, as everywhere, through the change log.
This is a position note on a reporting system in its first cycle. It is not advice on your affairs, and reading it creates no professional relationship.