Bull Bitcoin petitions France’s Conseil d’État to annul DAC8 implementing decree
The exchange argues DAC8’s identity-and-transaction reporting regime creates unsafe databases ahead of first EU reports due in 2027.
Non-custodial Bitcoin exchange Bull Bitcoin has petitioned France’s top administrative court to strike down the country’s decree implementing the EU’s DAC8 crypto tax reporting rules. The firm is framing the fight as a user-safety and data-security issue as the EU moves toward its first cross-border reporting cycle in 2027.
Key Takeaways
- Bull Bitcoin has asked France’s Conseil d’État to annul Decree No. 2025-1276, the country’s domestic implementation of the EU’s DAC8 regime.
- DAC8 obliges crypto service providers to collect user identity and transaction data and report it to national tax authorities for automatic exchange across EU member states.
- France signed its implementing decree on Dec. 19, 2025, and DAC8 took effect on Jan. 1, 2026.
- The first DAC8 submissions covering 2026 activity are due by Sept. 30, 2027, leaving a long window for litigation and implementation details to evolve.
Bull Bitcoin Takes DAC8 Fight to France’s Conseil d’État
Bull Bitcoin has petitioned France’s Council of State (Conseil d’État) to strike down France’s decree implementing the EU’s DAC8 crypto tax reporting framework. The company said it filed a summary petition on Feb. 24 and followed it with a substantive legal brief laying out its arguments.
The immediate legal target is domestic: France implemented DAC8 via Decree No. 2025-1276, signed on Dec. 19, 2025. That matters because the dispute is not about whether DAC8 exists at the EU level, but about how France applies the framework through its own administrative act.
Bull Bitcoin said it intends to pursue “every legitimate avenue to suspend, delay, annul or amend the effects of DAC8 and its global counterpart, the CARF.” CARF, the Crypto-Asset Reporting Framework, is described as an OECD-developed global standard for jurisdictions to collect and exchange information on crypto transactions.
How DAC8 Data Flows Across the EU—and When Reporting Starts
DAC8 requires crypto service providers to collect users’ identity and transaction data and automatically report it to national tax authorities. Those authorities then exchange the information with counterparts across EU member states, creating a standardized cross-border reporting pipeline.
The market-relevant point is timing. DAC8 went into effect on Jan. 1, 2026, but the first reports are not due until Sept. 30, 2027, and they cover the 2026 calendar year. That gap creates a multi-quarter window where litigation, technical guidance, and operational interpretations can still reshape compliance planning for EU-facing venues.
Even without an immediate court ruling, the case keeps implementation risk on the radar because the reporting architecture explicitly centralizes identity and transaction data for automatic exchange. For traders, that is less about ideology and more about how platforms price regulatory overhead and operational risk into their EU product stacks.
The ‘Mass Database’ Argument: Identity, Addresses, and Physical-Risk Claims
Bull Bitcoin’s core framing is that DAC8 risks creating a “mass database” linking legal identity and home addresses, including transactions it says have “no relevance to taxation.” The company warned: “Against a backdrop of daily data leaks and a surge in kidnappings targeting crypto-asset holders, building such a database endangers the physical safety of millions of holders and their loved ones.”
The packet ties that argument to a rising physical-threat backdrop. An April RTL report cited in the source material said French police counted 41 crypto-related kidnappings since the start of 2026. CertiK data cited in the same material said wrench attacks increased by 75% in 2025 to 72 verified cases worldwide, with France at 19 confirmed incidents in 2025 and Europe representing roughly 40% of global incidents.
Bull Bitcoin also pointed to the data-breach track record at major firms. Coinbase said in May 2025 that less than 1% of its transacting monthly users were affected in an attack that may cost up to $400 million in reimbursement expenses.
Court Signals and Compliance Milestones That Could Shift the Timeline
The near-term swing factor is procedural: whether the Conseil d’État sets a hearing date, accepts the case for review, or issues interim measures that affect Decree No. 2025-1276.
Traders should also watch for French administrative guidance that clarifies how crypto service providers are expected to implement DAC8 ahead of the first reporting cycle. The practical burden will be set as much by implementation detail as by the directive’s headline requirements.
A second-order catalyst would be copycat litigation in other EU member states. If multiple jurisdictions face challenges to their implementing rules, the “harmonized rollout” narrative weakens and compliance timelines can become fragmented.
The long-dated anchor remains Sept. 30, 2027, the first-report deadline for 2026 activity. Any amendments, delays, or court-driven changes will likely show up in the run-up to that date rather than immediately.
Why This Legal Challenge Matters for EU Exchange Risk Premiums
I don’t treat this as a near-term market mover for BTC price. I do treat it as a live input into EU venue risk premiums because DAC8’s design pushes identity and transaction data into an automatic cross-border exchange system, and that concentrates operational and security liability in a way traders can’t ignore.
The threshold that matters is whether France’s Conseil d’État does anything that changes the implementation path, even temporarily. If interim measures or revised guidance alter how Decree No. 2025-1276 is applied, the setup starts to look structural rather than narrative-driven, and EU-facing platforms will have to reprice compliance and security costs into their product and custody choices ahead of the 2027 reporting deadline.
