Something is beginning to move against EU abuses. Léonod SARL and Satoshi Portal Inc., the French-Canadian companies operating under the Bull Bitcoin brand (a Bitcoin-only, non-custodial exchange), have challenged before the Council of State Decree No. 2025-1276 of December 19, 2025, the act by which Paris implemented the European Directive on the Automatic Exchange of Tax Data relating to cryptocurrencies. This is the first legal case against DAC8 in the European Union.
WHAT IS DAC8?
DAC8, Directive (EU) 2023/2226, applies from January 1, 2026 and requires every crypto-asset service provider serving European customers to collect and report to the tax authorities the full identity, tax code, balances, and transactions of their users. The information then travels automatically between the administrations of the 27 Member States and to the CARF network partners. First declaration by June 15, 2027, first exchange between administrations by September 30 of the same year, but operational obligations with data collection and KYC checks have already been in force since January 1 of this year. The "official" reason is the fight against AML, but in reality (in my opinion) the real reason is to control and limit the sector. Plus a bit of taxation/extortion, which never hurts. The big problem, however, is that this information collection creates a gigantic archive of personal data:
-Tax code.
-Phone number.
-First and last name.
-Country.
-Home address.
If this data is leaked or sold on the black market (as already happened in France, due to a corrupt tax agency official), attacks and robberies against crypto holders occur (the $5 Wrench Attack). The more foreign authorities, officials, systems, and jurisdictions have access to this data, the greater the risk that it will eventually be stolen, illegally accessed, or sold to criminal organizations. Essentially, criminal organizations will have a ready-made map of who to target and where to find them.
While exchanging data with foreign banks is feasible and less risky with fiat money (credit cards and ATMs have monthly withdrawal limits), the situation for Bitcoin and crypto holders is much more delicate because criminals know that by obtaining the seed, they can move any amount irreversibly (without monthly limits or controls).
APPEAL AGAINST DAC8
The appeal attacks the decree from two angles: Article 1 extends reporting requirements to staking and lending crypto-assets, but French law did not authorize the government to go that far, as Article 34 of the French Constitution reserves this matter for the legislature.
The second angle is one that could change the rules for the entire continent. The appeal argues that DAC8 is incompatible with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, on privacy and the protection of personal data, and with Article 8 of the European Convention on Human Rights. However, no national court can invalidate a directive: for this reason, it would be important to refer the matter to the Court of Justice of the European Union. Is the "automatic, systematic, and indiscriminate" collection and exchange of all users' data, in the absence of any indication of fraud and without adequate procedural safeguards, compatible with fundamental rights? The French tax authorities already have a targeted tool, the droit de communication, which allows them to request specific data on specific taxpayers when there is a reason to do so. DAC8 is a mass collection without distinction.
Generally, two conditions are met: doubt about the legitimacy of the decree and the costly and difficult-to-disassemble data collection systems, exposure to sanctions, and concrete risks for customers. If the judge suspends a regulatory act, the suspension could also apply to other member states or at least pave the way for protecting the privacy of other EU citizens.
Go here for more information: DAC8.
Remember to follow me on X: 0x_Davide.
SOCIAL PAGE
X: Bull Bitcoin
X: Francis Pouliot (Founder)
