TL;DR
- France’s Conseil d’État rejected an emergency request to suspend DAC8 crypto reporting requirements.
- The court found that Paymium and the other applicants had not demonstrated sufficient urgency to justify suspending the decree.
- The ruling keeps the reporting framework in place but does not decide whether the French decree is ultimately lawful.
France’s highest administrative court has rejected an emergency attempt to suspend the country’s crypto reporting requirements under the European Union’s DAC8 framework. The September 14 decision keeps those rules in place. A broader legal challenge is still pending.
French exchange Paymium brought the case alongside Leonod and Satoshi Portal Inc., companies associated with Bitcoin services provider Bull Bitcoin. They challenged a December 2025 decree requiring crypto service providers to collect and report information about users and transactions to French tax authorities.
Court finds no grounds for emergency suspension
The companies filed their emergency request on August 26, seeking suspension of Decree No. 2025-1276 while their challenge proceeds. Under French administrative law, an interim suspension requires two things. Applicants must demonstrate urgency, and they must raise an argument capable of creating serious doubt about the legality of the disputed measure.
The Conseil d’État found that the companies had not met the urgency requirement.
According to the decision, the applicants argued that requiring crypto companies to collect, process, verify and retain personal information interferes with users’ privacy and data-protection rights. They also challenged the requirement to transmit relevant information to the tax administration.
The court weighed those concerns against the public interest attached to preventing tax fraud and tax evasion. The alleged privacy impact was not sufficient, the court concluded, to establish the immediate urgency needed to suspend the decree before the main case is decided.
>>> Related: EU Activates DAC8: Crypto Reporting Rules Take Effect in 2026
Data security becomes central to the challenge
Data security was another part of the companies’ case. The applicants argued that the reporting system could increase the risk that sensitive information about crypto users and transactions is compromised.
The court found that the companies had not demonstrated how the storage arrangements they described would increase that risk. The possibility of a data breach, where the probability was very low, was insufficient on its own to establish urgency, the court added.
The companies pointed to the breadth of the reporting requirement itself. DAC8 expands the EU’s system of administrative cooperation on taxation to crypto assets, requiring covered service providers in France to conduct due diligence and report specified information.
>>> Read more: Chainalysis: CARF Reporting Captures Only Part of Crypto Activity
France’s crypto reporting decree remains active
France implemented the relevant requirements through legislation and Decree No. 2025-1276. The decree entered into force on January 1, 2026 and applies to transactions conducted from that date, with declarations covering those transactions beginning in 2027. The information covered can include identifying details such as a reportable person’s name, address, tax residence and tax identification number, alongside information about reportable crypto transactions.
France’s tax administration has published technical information for providers preparing to transfer information under the CARF/DAC8 reporting system. The guidance points providers to provisions of the French General Tax Code and the December 2025 decree governing the obligations.
Providers must now proceed under that framework. The decree sets June 15, 2027 as the deadline for the first declarations, covering transactions carried out in 2026.
>>> Related: What is CARF 2027
Court did not decide whether DAC8 implementation is lawful
Paymium and the other applicants raised several arguments questioning the legality of the French decree. They alleged that the decree violates EU privacy protections and that regulators skipped a required consultation with France’s data-protection authority, CNIL. They also disputed the scope of the reporting requirements as applied to certain crypto services.
The Conseil d’État did not resolve those arguments. The court rejected the emergency request once it determined that the applicants had failed to demonstrate urgency. It did not examine whether their legal arguments were capable of creating serious doubt about the decree’s validity.
The September ruling is not a final judicial endorsement of the French rules.
The broader proceedings will determine whether the privacy, data-protection and EU-law arguments behind the challenge hold up.
