France's Council of State has rejected an emergency request from Bull Bitcoin and Paymium to suspend the country's implementation of the EU's DAC8 crypto tax reporting rules while a separate challenge seeking to annul the measure remains before the court. As reported by Bull Bitcoin, the companies filed a summary suspension proceeding in August 2026, focusing on what they described as immediate security risks created by collecting and centralizing information about cryptocurrency users. The court found that Bull Bitcoin and Paymium had not established a level of urgency sufficient to justify suspending the decree, with the court stating that 'the mere possibility of a risk, the probability of which is very low, cannot constitute a situation of urgency'. The companies had argued that concentrating information about crypto users in databases accessible for tax reporting creates security risks if the records are compromised.
The security argument comes amid a series of physical attacks targeting cryptocurrency holders and their relatives in France. According to crypto.news, France recorded 77 crypto-linked cases involving kidnapping, unlawful detention, extortion or attempted offenses during 2026 by early July, compared to 45 cases in 2025. Around 200 people had been arrested following attacks or preventive operations, while authorities introduced measures including stronger intelligence sharing and rapid identification systems for industry participants considered at risk. Blockchain security firm CertiK recorded 52 verified physical crypto attacks worldwide during the first half of 2026, with France accounting for 33 of them, resulting in total financial exposure of $124.1 million. Chainalysis counted 46 documented physical crypto attacks globally through late June, with more than $30 million taken in successful incidents during the period, while home invasions represented 37% of documented attacks.
Bulgaria's parliament approved comprehensive crypto tax reporting amendments on September 9, 2026, with 149 votes in favor, zero against, and 10 abstentions in the 240-seat chamber. According to reports from crypto.news, the legislation transposes the EU DAC8 directive into Bulgarian law, effectively aligning with European Union rules despite falling over eight months behind schedule. The measures allow tax authorities in EU member states and participating jurisdictions to exchange information on people conducting crypto transactions, addressing tax evasion concerns where cross-border transactions can make it harder for national authorities to identify taxable activity.
The new rule mandates that crypto platforms must collect required information from January 2026, with the first cross-border sharing of crypto tax reports expected to begin in January 2027. Under the DAC8 implementation timetable, crypto asset service providers must report information covering the 2026 calendar year by September 30, 2027, before the data is automatically exchanged among EU tax authorities. According to AMBCrypto, providers must report all types of transactions, ensuring both crypto-to-fiat and crypto-to-crypto trades are covered under the new regime. The legislation includes transitional provisions to give providers time to update systems and designate officers responsible for reporting.
Bulgaria's move aligns with the EU's broader AML package targeting crypto, scheduled to go live in mid-2027, as reported by AMBCrypto. The country is ranked 19th across the EU for crypto adoption, and it remains unclear whether the new rules will foster growth or stifle it. The legislation mirrors the FATF's anti-money laundering push to get more transparency into DeFi transfers, with the EU wanting full traceability of crypto transactions across the region by next year. However, the new rules have sparked immediate concerns about their impact on Bulgaria's fintech sector competitiveness, with crypto traders and small businesses expressing concern about compliance costs and some stating that the registration and reporting requirements would push smaller providers out of the market.
The new law includes comprehensive data-protection safeguards, limits on access to legitimate tax investigations, penalties for misuse by officials and procedures for appeals by firms and taxpayers. As reported by GNcrypto, the National Revenue Agency plans to publish guidance for providers and taxpayers and carry out targeted audits of large platforms and checks on high-value transactions flagged by the new reporting channels. Ministry and tax officials engaged industry participants during the drafting process to identify technical needs for secure data transfers. However, privacy advocates have criticized the scope of data collection, calling it excessive and warning that mandatory disclosure of personal details could expose users to security risks, with France currently battling physical attacks and crypto kidnappings linked to a tax authority hack highlighting potential vulnerabilities in cross-border reporting systems.
