Automatic Exchange of Information (AEOI) services: DAC7, DAC8 and CESOP

New rules, namely CESOP, DAC7 and DAC8 will require digital businesses to report information on their users to tax authorities. These rules will affect digital platforms, payment service providers, cryptocurrency, and e-money. Although the rules can sound simple, they require change throughout an organization’s business model – and EY teams can help.

Discuss your results 

Contact the EY Customer Tax Reporting team. 

Contact us

What EY can do for you

The implementation of three new regimes (DAC7, DAC8 and CESOP), along with the expansion of current rules known as the Common Reporting Standard (CRS), are likely to result in a substantial proportion of the digital economy being brought into scope for Automatic Exchange of Information (AEOI).

Having helped in delivering over 1,000 AEOI-related engagements across the globe, the EY Customer Tax Reporting team can help your organization prepare for the coming changes.

  • Payments — Central Electronic System of Payment (CESOP)

    Payment service providers in the EU will be required to report where they make more than 25 cross-border payments to a recipient in a quarter.

    The scope is wide and will include:

    1. Merchant acquirers and others in the card payment infrastructure
    2. Payments by banks and others
    3. e-wallets
    4. Online payment facilitators
    5. Digital platforms acting as payment intermediaries between buyers and sellers

    Many organizations will find themselves in the scope of payments reporting as well as other reporting regimes.

  • Foreign Account Tax Compliance Act (FATCA) and the Common Reporting Standard (CRS)

    Existing rules, which apply to banks, asset managers and some insurance companies, require reporting on clients which are resident outside of the jurisdiction of the financial institution.

    FATCA and the CRS forms the basis of the next wave of AEOI; many financial institutions will be in scope of new rules as well as existing rules.

    In parallel, the Organisation for Economic Co-operation and Development (OECD) is encouraging tax authorities to step up the level of compliance checking, with particular focus on accounts missing taxpayer identification numbers and institutions currently not reporting accounts.

  • Digital platforms — DAC7 and the Organisation for Economic Co-operation and Development (OECD)

    Digital platforms will be brought into scope initially in the EU and the UK, with the OECD expected to push for adoption globally from 2024. Information will be shared automatically between tax authorities to allow them to target under-declared income.

    The new rules are likely to be extraterritorial in effect — platforms which facilitate transactions by EU and UK sellers will be required to report even where they are located elsewhere — unless their jurisdiction has signed up to the OECD’s exchange program.

    The rules will affect digital platforms that allow sellers to:

    • Rent immovable property (e.g., short-term accommodation)
    • Provide personal services (e.g., on-demand household and professional services)
    • Rent transport
    • Sell goods (EU and UK only)
  • Cryptocurrency — DAC8 and the OECD

    The proposed Crypto-Asset Reporting Framework will bring digital assets and cryptocurrency into the scope of AEOI reporting. The proposed rules are broad; they are likely to bring a substantial portion of the digital assets sector into the scope – including stablecoins, non-fungible tokens and many other digital assets as well as cryptocurrencies themselves.

    Not only the cryptonative clients, but also many financial institutions will find themselves in scope of these rules as they bring their own cryptocurrency and digital asset offerings to market.

  • e-money — expansion to CRS

    The OECD has proposed an expansion to the CRS that would bring e-money into scope alongside banking and asset management services. The proposed rules treat e-money in the same way as a deposit account — requiring e-money providers to collect self-certifications from users and report where the user is resident in a reportable jurisdiction.


Regardless of the regime, the requirements for affected organizations are broadly the same:

  1. Onboard and collect additional information from sellers — including Taxpayer Identification Numbers, dates of birth, and potentially declarations of tax residence.
  2. Classify users (customers, sellers, and payees) and determine reportable status.
  3. Monitor for changes to the status.
  4. Report annually to their tax authority.
  5. Provide information to users on what has been reported.
  6. Maintain records by reconfirming information with sellers every three years.
  7. For digital platforms and cryptocurrency, freeze the accounts where information is not provided.


AEOI Timelines

Show resources

  • Download EU Payments reporting: How to respond to the challenge of CESOP requirements

EY webcast exploring DAC7

Transparency in the sharing economy: Reporting rules for digital platforms

Watch now

EY Customer Tax Operations and Reporting Services

Explore how EY can help

Learn more

EY global Tax Alert library

Keep up-to-date on significant tax developments around the globe.

Find out more