Bull Bitcoin filed a petition with France's administrative court asking it to strike down the implementing decree for DAC8, a European Union directive that forces crypto service providers to report customer identity and transaction history to tax authorities.
The exchange argues the decree creates two concrete risks. First, mandatory reporting of personal data and transaction details to government databases could expose up to 135 million European crypto holders to identity theft and financial surveillance. Second, public knowledge of who holds crypto assets invites physical targeting, theft, and extortion. Bull Bitcoin claims the French government failed to assess these harms before issuing the decree.
DAC8 itself came into force across the EU on January 1, 2024. It mirrors the Common Reporting Standard used for traditional banking, but applies to crypto transfers above certain thresholds. France's implementing decree sets the technical and procedural rules for how platforms comply. The petition challenges whether those rules adequately protect personal data or consider the unique risks of crypto holdings.
Why this matters for infrastructure
The case tests whether European courts will treat crypto reporting requirements the same as traditional finance rules. Traditional banking data breaches expose account balances and wire destinations. Crypto addresses are pseudonymous by design, and linking them to real identities at government level is a different animal. If Bull Bitcoin wins, other EU jurisdictions may face pressure to rewrite their own DAC8 rules. If it loses, the standard becomes precedent for how aggressively European regulators can mandate identity disclosure.
The petition also flags a practical problem for non-custodial exchanges. Bull Bitcoin does not hold customer funds directly. It facilitates peer-to-peer trades. Yet DAC8 treats it as a "reporting financial institution," forcing it to collect and transmit data even though it never controls the assets in question. That gap between custody and reporting duty has triggered similar complaints from other platforms across Europe.
France has moved faster than most EU members on DAC8 enforcement. The decree came into effect at the start of 2024, ahead of full EU coordination. Whether the court finds the timeline rushed, the data safeguards inadequate, or the identity-risk analysis missing will shape how other national courts handle parallel challenges already filed in other jurisdictions.
The newsroom will track the court's decision. Oral arguments or a ruling may not come for months.