Bull Bitcoin challenges France DAC8 crypto rules

• Bull Bitcoin has asked France's highest administrative court to overturn a decree implementing the European Union's DAC8 cryptocurrency tax reporting rules.
• The exchange argues the reporting requirements could expose millions of cryptocurrency holders to privacy and physical security risks.
• Bull Bitcoin said it will continue pursuing legal action against DAC8 and the OECD's Crypto-Asset Reporting Framework.

Bull Bitcoin has petitioned France's Council of State to annul a decree implementing the European Union's DAC8 cryptocurrency tax reporting rules, arguing the framework creates excessive privacy and security risks for digital asset holders.

The exchange said DAC8 requires cryptocurrency service providers to collect users' identities and transaction data before sharing the information with tax authorities across European Union member states, with the rules taking effect on Jan. 1, 2026.

“Against a backdrop of daily data leaks and a surge in kidnappings targeting crypto-asset holders, building such a database endangers the physical safety of millions of holders and their loved ones,” Bull Bitcoin said.

Bull Bitcoin said it filed its initial petition in February and later submitted a detailed legal brief, while adding that it intends to pursue all available legal avenues to suspend, delay, amend or overturn DAC8 and the Organisation for Economic Co-operation and Development's Crypto-Asset Reporting Framework.

Under DAC8, cryptocurrency service providers must submit their first reports covering the 2026 calendar year by Sept. 30, 2027, and because the announcement relates to legal proceedings rather than a listed company, there was no share price reaction.

France implemented the rules through Decree No. 2025-1276 in December 2025, while the country has experienced a rise in so-called wrench attacks targeting cryptocurrency holders, with police reportedly recording 41 crypto-related kidnappings since the start of 2026.

Bull Bitcoin also cited previous customer data breaches at cryptocurrency companies as evidence of the risks associated with large databases of personal information, including Coinbase's disclosure in 2025 that a cyberattack affected less than 1% of its monthly transacting users.