The companies behind the Bull Bitcoin brand have challenged before the Conseil d’État the decree by which France implemented the directive. If the Court of Justice accepts their arguments, the registration of crypto holders would lose its legal basis across all 27 member states.
For the first time, DAC8 will have to defend itself in a courtroom. Léonod SARL and Satoshi Portal Inc., the French and Canadian companies operating under the Bull Bitcoin brand, have challenged before the Conseil d’État – the apex of French administrative justice – decree no. 2025-1276 of 19 December 2025, the act by which Paris transposed the European directive on the automatic exchange of tax data relating to crypto assets. It is the first legal challenge against an implementing measure of DAC8 in the European Union.
The introductory application was filed on 24 February 2026, the supplementary merits brief on 1 May. The respondent is the French Ministry of Economy and Finance. Atlas21 has reviewed the legal documentation in the case. One procedural detail is worth more than many declarations: the decree is a regulatory act of general scope, so any annulment or suspension would apply to all operators active in France, well beyond the companies that signed the challenge.
Bull Bitcoin, founded in Montreal in 2013 and self-funded, is among the longest-running Bitcoin-only, non-custodial exchanges in the world. In Europe it operates through its French subsidiary, which obtained a MiCA licence, and it announced its entry into the French market with a phrase that already read like a manifesto: “a call to reclaim sovereignty”.
An archive for twenty-seven administrations
DAC8, directive (EU) 2023/2226, has applied since 1 January 2026 and transposes into European law the OECD’s Crypto-Asset Reporting Framework. Every crypto-asset service provider serving European customers must collect and report to the tax authorities the full identity, tax identification number, balances and transactions of its users. The information then travels automatically between the administrations of the 27 member states and to the partners of the CARF circuit, which as of March 2026 counted 56 signatory states. We covered it when the directive entered into force: the largest database of crypto holders ever conceived.
The French calendar is already set: registration of operators by 31 December 2026, first declaration to the tax authority by 15 June 2027, first exchange between administrations by 30 September of the same year. The operational obligations, however, are already running: data collection and KYC checks have been law since 1 January of this year.
That an archive of this kind is a target has been demonstrated for months by the French experience. According to CoinDesk, in the first months of 2026 alone France recorded at least 41 robberies and home invasions linked to crypto assets. Every reporting obligation produces somewhere the proof that a name and an address correspond to a bearer asset: a single disloyal employee or a data breach is enough for that proof to change hands. DAC8 multiplies the points of access: more data, in more hands, across more countries.
Two tracks toward Luxembourg
The legal strategy runs on two tracks. The first is the merits before the Conseil d’État, where the challenge attacks the decree from two directions. The first is entirely French: article 1 of the decree extends reporting obligations to staking and lending of crypto assets, but according to the brief the transposition law did not authorise the government to go that far, because article 34 of the French Constitution reserves this matter to the legislature. If the court agrees, that part of the decree falls for lack of competence – a ground the Conseil d’État can decide on its own, within a relatively short time.
The second direction is the one that could change the rules for the entire continent. The challenge argues that DAC8 is incompatible with articles 7 and 8 of the Charter of Fundamental Rights of the Union – privacy and protection of personal data – and with article 8 of the European Convention on Human Rights. No national court can however invalidate a directive: for this reason the brief asks the Conseil d’État to stay the proceedings and refer the question to the Court of Justice of the European Union. The question posed is clear-cut: is the “automatic, systematic and indiscriminate” collection and exchange of all users’ data, in the absence of any suspicion of fraud and without adequate procedural safeguards, compatible with fundamental rights?
A precedent that weighs in favour of the applicants already exists. In 2022, with the judgment Orde van Vlaamse Balies, the Court of Justice declared invalid a provision of DAC6 – the notification obligation on lawyers – precisely for violation of article 7 of the Charter. The regulatory architecture that now houses DAC8 has already been cut back once.
There is also the proportionality argument, the technical heart of the case. The French tax authority already has a targeted instrument, the droit de communication, which allows it to request specific data on specific taxpayers when there is a reason to do so. DAC8 replaces that selective mechanism with mass collection without suspicion, lacking any prior review by a court or an independent authority. In European case law, the existence of a less intrusive alternative that is already functioning often weighs decisively against the more invasive measure.
The second track is speed. Bull Bitcoin is preparing to file a référé-suspension, the emergency suspension request on which a dedicated judge decides within weeks or months. Two conditions are required: a serious doubt about the legality of the decree – which rests on the same arguments as the merits – and urgency, which the applicants anchor to the obligations already in force since January: costly data collection systems that are difficult to dismantle, exposure to sanctions, and concrete risks for customers. If the judge suspends a regulatory act, the suspension applies erga omnes, to all operators in the French market and, by extension, to their European customers. A victory on the fast track would freeze the registration in France while the slow track runs its course: via Luxembourg, Bull itself estimates realistic timelines of three to five years.
Italy has seen this film before
Two Italian precedents give the case a particular resonance. The first is judicial: on 8 January 2026, in the case Ferrieri and Bonassisa v. Italy, the European Court of Human Rights condemned Italy for the tax authority’s access to taxpayers’ banking data without adequate safeguards: excessive discretion, no independent oversight, remedies only contingent. The case concerns current accounts, but the principle transfers effortlessly to DAC8 data flows: what matters are the safeguards surrounding state access to data, even before the nature of the data itself.
The second precedent is administrative and illustrates where data collected for one purpose eventually ends up. The OAM register, operational since 2022, required crypto operators active in Italy to transmit quarterly the identity of customers and transaction data, with ten-year retention. Stated purpose: exclusively anti-money laundering. Three years later, the legislative decree by which Italy transposed DAC8 – decree 194/2025 – replaced that quarterly channel with the European automatic exchange: a register born for anti-money laundering closed its arc as a tax reporting infrastructure, without any law ever having formally reclassified it as such. In the meantime, the 2023 budget law had brought crypto assets into the tax base and authorised the tax authority to build on those flows a structured information asset of its own.
DAC8 writes this drift directly into the rule: article 16 of the directive on administrative cooperation allows member states to extend the use of exchanged data to other purposes by simple notification, without independent oversight. What happened in Italy through accumulation is, under the new regime, available by design. Lawyers call it purpose creep: data collected for one purpose always finds a second use.
There is finally a paradox that makes the case interesting beyond Europe’s borders. The United States is proceeding with considerably more caution: the domestic reporting regime is still being run in and American accession to CARF remains under study, with an entry into multilateral exchanges that observers place at 2029. The Union has built, before anyone else, the most advanced and most intrusive iteration of the global reporting architecture currently in force. It is also the only legal order to possess an instrument – the Charter of Fundamental Rights – with which a court can dismantle it. The ground that produced the surveillance is the same ground that offers the tool to contest it.
The Conseil d’État will say whether the question merits Luxembourg; the emergency judge, even sooner, whether in the meantime data collection may continue. Either way, for the first time the fiscal registration of crypto assets will have to justify itself before a court against fundamental rights standards – standards it has never previously had to meet. If permanently archiving the financial lives of everyone is the price for taxing the capital gains of some, the question arriving in Luxembourg comes down to a single one: can a state that suspects no one afford to know everything about everyone?
