France’s top administrative court has refused to hit pause on DAC8 crypto reporting rules, leaving Bull Bitcoin and Paymium to keep fighting the decree on privacy and legal grounds while the broader challenge continues.
- Emergency suspension denied
- DAC8 remains in force
- Privacy and security concerns stay live
- Main annulment case is still pending
France’s Council of State rejected Bull Bitcoin and Paymium’s emergency request to suspend the French decree implementing the EU’s DAC8 crypto tax reporting framework. The court said the companies had not shown enough urgency to justify freezing the measure while the main case moves forward.
That does not mean the court has settled the bigger dispute. It only means the fast-track request failed. Bull Bitcoin says its separate annulment challenge is still active before the Council of State and goes to the deeper questions: privacy, fundamental rights, and whether France’s implementation of DAC8 overreaches European protections.
According to Bull Bitcoin, the court’s reasoning was summarized this way:
“The mere possibility of a risk, the probability of which is very low, cannot constitute a situation of urgency, ”
That line is about emergency relief, not the merits of DAC8 itself. In plain English: the court was not convinced that the companies had shown immediate harm serious enough to justify stopping the decree before the full case is heard.
DAC8 is already in force across the EU. The European Commission says the rules entered into application on Jan. 1, 2026, and crypto-asset service providers must collect information on reportable transactions involving EU-resident users. First reporting and automatic exchange of that data are scheduled for 2027, with providers due to report 2026-calendar-year information by Sept. 30, 2027.
For readers who do not live and breathe tax acronyms, DAC8 is the EU’s latest push to expand automatic exchange of tax information to crypto. The goal is simple: make it harder for digital assets to sit outside the normal reporting rails.
The data collected can include names, addresses, tax identification numbers, dates of birth, and tax residence details. The framework covers crypto-to-fiat transactions, exchanges between crypto assets, and certain transfers. In practice, exchanges and other reporting providers are being turned into information bridges between users and tax authorities.
That is the part critics hate. Their argument is not just ideological posturing about privacy. It is that centralized pools of identity and transaction data are attractive targets for hackers, and potentially useful to criminals if they ever leak.
Bull Bitcoin says France’s own tax authority has already acknowledged the risk. The company cited comments it says the General Directorate of Public Finances made during parliamentary discussions in February, warning that a general declaration system for crypto portfolios could centralize sensitive information such as identities and asset values.
That warning lands harder in France than it would in a more abstract policy debate. The country has become one of the most alarming flashpoints in Europe for physical attacks tied to crypto wealth, kidnappings, extortion, home invasions, and threats designed to force victims to hand over access to their coins. Call them wrench attacks, call them extortion, call them what they are: ugly, real-world crime.
France’s Interior Minister Laurent Nuñez said the country had recorded 77 crypto-linked cases involving kidnapping, unlawful detention, extortion or attempted offenses during 2026 by early July, compared with 45 in 2025. He also said around 200 people had been arrested following attacks or preventive operations.
Chainalysis has also flagged France as a major hotspot in its analysis of rising crypto-related violent attacks and shifting trends. The analytics firm counted 46 documented physical crypto attacks worldwide through late June 2026, with 12 resulting in payments to attackers. More than $30 million was taken in successful incidents during that period, and home invasions accounted for 37% of documented attacks.
Chainalysis also said France had the highest number of attacks in its dataset through mid-2026, with the country standing out sharply from the rest of Europe. The important caveat here is methodology: law-enforcement figures, public-case counts, and analytics-firm datasets do not measure exactly the same thing. They should not be mashed together like they came from one neat spreadsheet, because they did not.
Still, the direction of travel is hard to ignore. If tax-reporting systems centralize more names, balances, residence details, and transaction histories, critics argue that any breach could do more than embarrass a ministry. It could help criminals identify who has money, where they live, and how to target them.
That is the real fault line in this fight. Regulators want transparency and compliance. Crypto users want not to become entries in a database that could be misused, leaked, or exploited by violent thieves. Both sides have a point, and both sides also have blind spots.
The state’s case is not nonsense. DAC8 is a tax transparency regime, not a cartoon villain scheme to spy on everyone holding sats or altcoins. The EU wants standardized reporting because crypto can move across borders faster than tax bureaucracies can keep up. That is the tradeoff: more visibility for compliance, but also more data concentration and more risk if the system is breached.
And governments do not exactly have a flawless record on data security. Centralizing sensitive financial information always creates a honeypot. If that honeypot gets cracked, the damage can go well beyond tax headaches.
Bull Bitcoin said the refusal to suspend the decree “in no way means that the Council of State rejects our substantive arguments, and concerns only the grounds of urgency.” The company added that it plans to publish its filings, supporting documents, and arguments from the suspension case in the coming days.
It also framed the dispute in combative terms, saying: “We are waging this war against mass surveillance on multiple fronts and in multiple countries, ” and adding, “We have won battles and suffered setbacks.”
That sounds dramatic, and sure, it is. But the underlying issue is not theater. DAC8 is now live, and France is forcing a blunt policy question: how much data should the state demand from crypto users in the name of tax enforcement, and how much risk is acceptable when that data could make people easier to target in the real world?
France’s court has not answered that yet. It has only refused to hit pause.
Key takeaways
-
Why did the court reject the emergency request?
The Council of State said Bull Bitcoin and Paymium did not show enough urgency to justify suspending the DAC8 decree immediately. That was a procedural ruling, not a final decision on whether the decree is lawful. -
Does this end the fight over DAC8 in France?
No. Bull Bitcoin says the annulment case is still pending, and that separate challenge is where the privacy and fundamental-rights arguments will be tested. -
What does DAC8 require?
It requires crypto-asset service providers to collect and report information on reportable transactions involving EU-resident users, including identity and tax-residence details, so authorities can exchange that data automatically. -
Why are critics worried about the data collection?
Because centralized tax databases can become targets for hackers, and leaked crypto-holder information could also be useful to kidnappers, extortionists, and home-invasion crews. In France, that risk is not hypothetical. -
Why is France such a flashpoint?
France has seen a sharp rise in crypto-related violent attacks, and both official figures and analytics firms have flagged it as a major hotspot. That makes the privacy-versus-tax debate much more than a theoretical argument.
The blunt truth is that tax transparency and personal security are colliding head-on here. Regulators want visibility. Crypto holders want to avoid becoming soft targets. And when the state starts building a large centralized data machine, “trust us” is not a policy, it is a shrug in a suit.
DAC8 is now a live test of how much financial visibility Europe is willing to demand from crypto users, and how much risk governments are willing to take on when they gather that data. France’s court has not settled that question yet. It has only refused to freeze the clock.
For a wider view of how the rules are being interpreted across the bloc, the European Commission clarifies DAC8 scope in ways that matter for both resident and non-resident users, while the Commission’s own page on EU Directive DAC8 expanding tax transparency to crypto-assets lays out the official framework in black and white.
France’s approach also fits into a broader European push that is now showing up in other jurisdictions. A recent breakdown of Poland cracking down on crypto tax evasion with EU’s DAC8 shows the same playbook spreading, while an in-depth look at France’s $9.4 billion crypto activity estimate makes the scale of the reporting push harder to ignore.
For investors trying to separate policy reality from influencer nonsense, a practical EU DAC8 crypto regulation guide can help cut through the fog. And if you want a reminder that privacy still matters in Bitcoin, Payjoin DevKit shipping as Bitcoin privacy gets more practical on mobile is exactly the kind of tooling that matters when surveillance pressure keeps rising.
One more wrinkle worth noting: this is not just about compliance paperwork and tax offices flexing their database muscles. The more crypto identity and transaction data that gets concentrated, the more painful the consequences become if things go sideways. That is the ugly little detail policymakers tend to wave away until it is too late.
And for readers following the legal angle closely, Frances top court rejects emergency challenge to DAC8 and the parallel coverage from French Court Denies Emergency Suspension of Crypto Data show how quickly this fight is becoming a Europe-wide test case for tax transparency, privacy, and whether governments can actually keep sensitive crypto data safe.
