Part 2 of our "Crypto Explained Well" series. Most people treat their crypto exchange like a private bank account. It is closer to a glass office where the tax authority has a standing invitation.
When you use a regulated exchange, you hand it two things: your identity, and a complete record of what you do. From 2026, in the EU and beyond, the exchange doesn't just hold that record — it is legally required to report it to your tax authority automatically. Here is what they see, and what gets sent on.
What the Exchange Knows
From the moment you pass KYC, the exchange links your real identity — name, address, tax ID, often a photo of your ID — to everything you do on the platform: every trade, every deposit, every withdrawal, and crucially the external wallet addresses you send to and receive from. That last part matters most: your withdrawals connect your verified identity to your on-chain activity, which (as part 1 explained) is public and permanent.
What Goes to the Taxman — Automatically
This is the part that surprises people. Under frameworks like the EU's DAC8 and the OECD's CARF, crypto platforms are now required to report their users' transaction data to tax authorities automatically each year — the same way banks already do. That means:
- You don't have to be asked — the data flows by default, not in response to an investigation
- Foreign exchanges count — if you're tax-resident in a reporting country, an exchange abroad reports your data back to your home authority through the exchange-of-information network
- It's cross-checked — what the exchange reports gets compared against what you declared; the gap is what triggers a letter
The mismatch is what gets you, not the activity
Tax authorities are not guessing about crypto anymore — they receive structured data on it. The risk for an ordinary holder isn't that crypto is illegal (it isn't) but that what the exchange reports won't match what they declared. The fix is simple and boring: keep your own records, understand your transaction history, and declare it. The era where "they'll never know" was a viable tax strategy ended when automatic reporting switched on.
Know Your Own History First
The people who get caught out are usually not evaders — they're people who lost track of their own activity across several exchanges and wallets over several years. The defence is to reconstruct and understand your full history before the authority does it for you. For how that reconstruction works at the business level, see DAC8 Explained.
Next in the series: How to Spot a Crypto Scam in 60 Seconds: 7 Red Flags.
Understand your own transaction history before the taxman does
Screen wallets, monitor entities, and generate compliance reports with 1B+ labeled addresses and 305+ data sources.
See Tax Solutions