MV Capital - Bull Bitcoin Challenges France's DAC8 Crypto Rules in Court

Bull Bitcoin has filed a petition with France’s Conseil d’État to annul the national decree implementing the EU’s DAC8 directive, citing risks to user privacy and physical safety from mandatory data reporting and sharing

Background on the Legal Action

Bull Bitcoin, a non-custodial Bitcoin exchange, has taken action before France’s highest administrative court against the decree that puts the EU’s DAC8 rules into effect in the country. The case targets the automatic collection and cross-border exchange of user identity and transaction data required under the framework.

The directive, in force since January 1, 2026, obliges qualifying crypto service providers to gather detailed customer information and transaction records. Authorities then share this data automatically among EU member states. France implemented these obligations through Decree No. 2025-1276, signed in December 2025.

Bull Bitcoin’s PositionThe rules create a centralized database linking legal identities and home addresses to crypto transactions, including those with no tax relevance.
This setup replaces targeted access with systematic reporting, increasing exposure of sensitive information.
The company filed an initial petition on February 24, 2026, followed by a full legal brief.

Security and Privacy Concerns

Bull Bitcoin argues that the scale of data collection and sharing poses direct threats to users. With reports of data leaks from government and financial systems in France, the firm warns that such a database could become a target for criminals. This comes amid a documented rise in violent incidents targeting crypto holders.

Key Risks CitedIncreased potential for leaks, theft, or unauthorized access as data moves across more systems and jurisdictions.
France has recorded a high number of crypto-related kidnappings and assaults, known as wrench attacks.
Industry data breaches, such as the one reported by Coinbase in 2025, demonstrate vulnerabilities in handling large user datasets.

Under previous arrangements, customer data stayed with providers unless authorities had specific cause or made lawful requests. DAC8 shifts to automatic transmission regardless of suspicion.

“Against a backdrop of daily data leaks and a surge in kidnappings targeting crypto-asset holders, building such a database endangers the physical safety of millions of holders and their loved ones.”Bull Bitcoin press release

Scope of the Challenge

The petition seeks outright annulment of the French implementing decree. Bull Bitcoin states it will pursue all available legal paths, including potential escalation to the Court of Justice of the European Union and the French Constitutional Council. The action also addresses the broader global Crypto-Asset Reporting Framework (CARF) developed by the OECD, which aligns with DAC8 standards.

Reports must cover the 2026 calendar year and are due by September 30, 2027, after which automatic exchanges begin. The company describes the measures as disproportionate and in conflict with fundamental rights.

Main Arguments in the CaseAutomatic mass reporting exceeds necessary tax oversight.
The resulting data pool creates unnecessary security vulnerabilities.
Proportionality and privacy protections under law are not met.

Context Within the Crypto Sector

This legal effort represents an early direct challenge to DAC8 implementation in Europe. Bull Bitcoin positions the case as a necessary step to protect users from overreach in data mandates. Similar concerns about reporting rules have appeared in other jurisdictions, including disputes over IRS requirements in the United States.

The outcome in France could influence how other EU countries approach enforcement and set precedents for balancing tax compliance with data protection. Bull Bitcoin has indicated readiness to sustain the effort as needed to address these issues.