Malta transposes DAC8: Crypto-Asset tax reporting rules now in force

By virtue of Legal Notice 162 of 2026, the Cooperation with Other Jurisdictions on Tax Matters (Amendment) Regulations, 2026 (the ‘Regulations’) have been enacted. The Regulations amend the Cooperation with Other Jurisdictions on Tax Matters Regulations (Subsidiary Legislation 123.127) and transpose Council Directive (EU) 2023/2226 (‘DAC8’), which amends the EU Directive on Administrative Cooperation in the field of taxation (Directive 2011/16/EU), into Maltese law. The Regulations shall generally be deemed to have come into force on 1 January 2026.

The Regulations introduce, inter alia, a tax reporting and due diligence regime applicable to Reporting Malta Crypto-Asset Service Providers (‘Reporting Malta CASPs’), which includes any Crypto-Asset Service Provider authorised under the Markets in Crypto-Assets Regulation (EU) 2023/1114 (‘MiCA-authorised CASP’) and any Crypto-Asset Operator (‘CAO’) that conducts one or more crypto-asset services effectuating exchange transactions for, or on behalf of, a Reportable User (‘RU’), which refers to a crypto-asset user that is a reportable person resident in a Member State. 

A Reporting Malta CASP is subject to the obligations under the Regulations if it:

1. is authorised by the Malta Financial Services Authority (‘MFSA’) or is allowed to provide crypto-asset services following a notification to the MFSA; or
2. is neither authorised by nor has filed a notification with the MFSA, but is:

• resident for tax purposes in Malta;
• incorporated or organised under Maltese law and has legal personality or a tax filing obligation in Malta;
• managed from Malta;
• has a regular place of business in Malta; or
• effects transactions through a branch situated in Malta.
  

What must be reported?

The reporting obligations shall apply in relation to transactions involving Reportable Crypto-Assets (‘RCA’), comprising of any crypto-asset other than:

• Central Bank Digital Currencies;
• Electronic Money; or
• Any crypto-asset for which a Reporting Malta CASP has adequately determined that it cannot be used for payment or investment purposes.

In this regard, a reportable transaction encompasses:

• Exchange Transactions, being exchanges between RCA and fiat currencies, or exchanges between different RCAs; and
• Transfers of RCAs, being transactions that move a RCA from or to a crypto-asset user's address or account, where the Reporting Malta CASP cannot determine that the transaction is an Exchange Transaction.

In addition to the above, transfers involving RCAs in consideration of goods or services with a value exceeding USD 50,000 (or equivalent in any other currency) shall be reportable as Reportable Retail Payment Transactions (‘RRPTs’).

For each RU, a Reporting Malta CASP must report the following to the Commissioner for Tax and Customs (‘CfTC’):

• Name, address, Member States of residence, Tax Identification Numbers (‘TINs’), and (for individuals) date and place of birth of each RU;
• In the case of an entity with controlling persons who are reportable persons: the entity's name, address, Member States of residence, and TINs, together with the equivalent information for each such controlling person.
• Aggregate gross amount paid, number of units, and number of transactions in respect of acquisitions against fiat currency;
• Aggregate gross amount received, number of units, and number of transactions in respect of disposals against fiat currency;
• Aggregate fair market value, number of units, and number of transactions in respect of acquisitions against other RCAs;
• Aggregate fair market value, number of units, and number of transactions in respect of disposals against other RCAs;
• Aggregate fair market value, number of units, and number of RRPTs;
• Aggregate fair market value, number of units, and number of transactions in respect of transfers to the RU (not otherwise captured above);
• Aggregate fair market value, number of units, and number of transactions in respect of transfers by the RU(not otherwise captured above); and
• Aggregate fair market value and number of units of transfers effectuated to distributed ledger addresses not known to be associated with a virtual asset service provider or financial institution.

Registration requirements

MiCA-authorised CASPs are not required to separately register with the CfTC for the purposes of the Regulations, as the MFSA will communicate a list of all authorised CASPs to the CfTC on a regular basis and at the latest before 31 December of the relevant calendar year.

CAOs are required to register with the CfTC in such manner and within such period as the CfTC may require, by means of guidelines to be published on the CfTC's website. Where a CAO operates in multiple Member States, it must register with the competent authority of one of those Member States (single registration). 

Penalties

Reporting Malta CASPs that fail to comply with any of the obligations established under the Regulations shall be subject to the following administrative penalties:

• A Reporting Malta CASP that fails to register with the CfTC is liable to a fixed penalty of €500. The manner and timing of registration will be communicated by the CfTC through guidelines published on the CfTC website.
• A Reporting Malta CASP that fails to retain documentation and information collected in the course of its due diligence and reporting obligations for a minimum period of five years from the end of the relevant year is liable to a fixed penalty of €2,500.
• A Reporting Malta CASP that fails to submit the required information:
  • A fixed penalty of €2,500; and
  • A daily penalty of €100 for each day the default continues;
  • Subject to a combined cap of €20,000.
• A Reporting Malta CASP that fails to report information in a complete and accurate:
  • Minor errors: a fixed penalty of €200, plus €50 per day, subject to a combined cap of €5,000;
  • Significant non-compliance: an administrative penalty of up to €50,000.
• A Reporting Malta CASP that fails to apply the due diligence procedures is liable to a fixed penalty of €5,000. This penalty may be imposed in addition to any reporting-related penalties arising from the same compliance gap.
• Without prejudice to any of the above, where a Reporting Malta CASP is found to have submitted information that is misleading or false, every senior managing official of that Reporting Malta CASP is personally liable to a penalty of:
  • Not less than €10,000; and
  • Not more than €30,000.

Reporting deadline

The first reporting period under the new framework is the calendar year commencing 1 January 2026. Information must be reported to the CfTC within nine months following the end of the relevant calendar year (i.e., by 30 September 2027 for the first reporting period). The CfTC will then communicate the information to the competent authorities of the relevant Member States within the same deadline.

Deloitte’s view

The transposition of DAC8 into Maltese law establishes a clear legal framework for crypto-asset tax reporting with effect from 1 January 2026. That said, the practical implementation of the regime is still evolving, the CfTC has yet to publish guidance on the manner and timing of CAO registration, the format and channel for reporting, and the broader procedural framework governing compliance.