Key Takeaways
- • Bull Bitcoin has filed a legal petition with France's Conseil d'État (highest administrative court) seeking to annul the EU's DAC8 crypto reporting framework, which took effect January 1, 2026, arguing it mandates excessive collection and cross-border sharing of personal user data.
- • DAC8 requires crypto asset service providers across the EU to systematically report customer identities, residences, transaction details, and transfer data to tax authorities, with first reports due September 30, 2027 for the 2026 calendar year.
- • Bull Bitcoin contends the framework creates dangerous centralized databases and physical security risks for crypto holders, citing 41 crypto-related kidnappings in France since January 2026 as evidence of heightened vulnerability from systematic data collection.
- • The company is prepared to escalate the case to the Court of Justice of the European Union if the French court does not annul the implementing decree, mirroring privacy litigation strategies used by US industry groups challenging IRS broker reporting rules.
- • The lawsuit reflects broader tension between regulatory transparency mandates and privacy protection in digital asset markets, with implications for how crypto service providers operate across EU jurisdictions.
Summary
Bull Bitcoin, led by Canadian Bitcoin entrepreneur and privacy advocate Francis Pouliot, has initiated a high-stakes legal challenge against the European Union's DAC8 cryptocurrency reporting framework by filing a petition with France's Conseil d'État. The challenge targets the French implementing decree for DAC8, which officially came into force on January 1, 2026. Bull Bitcoin argues that the framework violates user privacy rights by compelling crypto asset service providers to collect and systematically share excessive personal and transaction data across EU member states without requiring suspicion of wrongdoing.
The DAC8 directive significantly expands the EU's existing tax cooperation mechanisms to encompass cryptocurrency transactions. Under the framework, all crypto asset service providers operating in the EU must annually report comprehensive customer information—including identities, residential addresses, transaction details, and transfer data—to their national tax authorities. These authorities then facilitate automatic information exchange across participating EU jurisdictions. Service providers are required to submit their first reports covering 2026 calendar-year activity by September 30, 2027.
Bull Bitcoin's core argument centers on security and privacy hazards created by centralized data repositories. The company specifically cited rising violent crime targeting crypto holders as evidence of tangible risk: since January 2026, France has recorded 41 crypto-related kidnappings. The plaintiff asserts that mandatory, suspicion-free data collection and cross-border sharing create attractive targets for criminals seeking to identify and locate crypto asset holders. This framing positions the lawsuit as a privacy protection action rather than purely a tax avoidance challenge.
The legal strategy mirrors enforcement actions pursued by cryptocurrency industry groups in the United States, where trade associations have contested IRS broker reporting rules on similar privacy and compliance grounds. Bull Bitcoin has signaled willingness to pursue the case to the Court of Justice of the European Union if the French administrative court does not annul the implementing decree, indicating preparation for prolonged regulatory litigation.
The lawsuit reflects deepening friction between EU regulatory objectives—establishing transparent, tax-compliant digital asset markets—and industry concerns regarding data security, customer privacy, and unintended consequences for personal safety. The outcome may significantly influence how crypto service providers structure compliance operations across EU jurisdictions and could reshape the practical implementation of DAC8 reporting obligations.
The DAC8 directive significantly expands the EU's existing tax cooperation mechanisms to encompass cryptocurrency transactions. Under the framework, all crypto asset service providers operating in the EU must annually report comprehensive customer information—including identities, residential addresses, transaction details, and transfer data—to their national tax authorities. These authorities then facilitate automatic information exchange across participating EU jurisdictions. Service providers are required to submit their first reports covering 2026 calendar-year activity by September 30, 2027.
Bull Bitcoin's core argument centers on security and privacy hazards created by centralized data repositories. The company specifically cited rising violent crime targeting crypto holders as evidence of tangible risk: since January 2026, France has recorded 41 crypto-related kidnappings. The plaintiff asserts that mandatory, suspicion-free data collection and cross-border sharing create attractive targets for criminals seeking to identify and locate crypto asset holders. This framing positions the lawsuit as a privacy protection action rather than purely a tax avoidance challenge.
The legal strategy mirrors enforcement actions pursued by cryptocurrency industry groups in the United States, where trade associations have contested IRS broker reporting rules on similar privacy and compliance grounds. Bull Bitcoin has signaled willingness to pursue the case to the Court of Justice of the European Union if the French administrative court does not annul the implementing decree, indicating preparation for prolonged regulatory litigation.
The lawsuit reflects deepening friction between EU regulatory objectives—establishing transparent, tax-compliant digital asset markets—and industry concerns regarding data security, customer privacy, and unintended consequences for personal safety. The outcome may significantly influence how crypto service providers structure compliance operations across EU jurisdictions and could reshape the practical implementation of DAC8 reporting obligations.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.