Watch the full episode:
A broker that makes privacy a founding value
Bull Bitcoin is not an exchange like any other. Founded in Canada by Francis Pouliot, it is one of the very few companies in the sector not backed by venture capital – a choice that translates into an operational freedom rare in the crypto world. So explains Martina Melaviola, a lawyer with a long background in corporate and banking law, now head of legal at the Canadian company and guest on the fifth episode of the Atlas21 podcast Quello che i Bitcoiner non dicono.
Bull Bitcoin’s business model is deliberately simple: buying and selling Bitcoin exclusively in self-custody mode. Users cannot leave funds on the platform; custody does not exist. Added to this is a data-collection policy that reduces third-party provider involvement in the onboarding process to almost nothing: data collected remains, for thirty days, solely in the company’s hands, without being distributed among the multiple service providers that characterise the sector average.
«The average exchange in the onboarding process uses no fewer than 10 third-party providers for various functions. There is, depending on the granularity of the verification required, a risk phase that is exponential.»
The MiCA licence obtained without structural compromises
In June 2026, Bull Bitcoin obtained the MiCA licence from the French financial markets authority (AMF), required to continue operating in the European market after the 30 June 2026 deadline. Melaviola clarifies that the process did not entail obligations beyond those already in place: KYC was already applied and internal procedures were already structured. The authority simply verified their correct implementation.
Bull Bitcoin’s open-source wallet, which natively implements protocols such as PayJoin, remains available to all users regardless of whether they purchase on the platform. A technical choice with relevant implications: if even a small share of Bitcoin users adopted PayJoin, chain analysis heuristics would lose much of their effectiveness.
What DAC8 is and why it changes everything
This is where the conversation reaches its core. DAC8 is a European directive that requires Crypto Asset Service Providers (CASPs) to systematically collect fiscal data on their clients and report it to competent authorities by June 2027, covering the 2026 calendar year. The data includes first name, last name, address, and the total amount of crypto asset transactions for each user.
The logic is the opposite of voluntary declaration: it is not the citizen who reports their own assets, but the state that automatically receives, through the CASPs, a complete picture of the taxpayer’s financial situation. Each national tax authority will be able to access a centralised European database, fed by reports from all CASPs active on the continent.
«There is a reporting obligation that will be put into effect in June 2027 and will cover all data collected by CASPs from January to December 2026. We are talking about personal data – first name, last name, address – and the total transaction amounts on an annual basis. Not limited to tax authorities, but indiscriminately available to a broader list of authorities.»
Melaviola also highlights the global dimension of the phenomenon: DAC8 draws from the CARF, an international protocol that by 2029 will be adopted in over 70 countries, from the United States to Japan, from Switzerland to Canada.
The issue goes beyond tax: it is the concentration of risk
Mass fiscal surveillance poses a problem that extends well beyond income tax returns. The centralisation of sensitive data on hundreds of millions of people in databases accessible to multiple national authorities creates a structural risk. Melaviola points to the French case: an official at the equivalent of the national tax agency reportedly sold fiscal data to criminal organisations, contributing to a rise of more than 400% in physical attacks on Bitcoin holders in France over the past year.
The issue is not tax evasion, but the proportionality of the measure. Making an individual’s data available in the context of a motivated judicial investigation is one thing. Preventively and indiscriminately collecting the financial information of all customers of all European exchanges – treating them as potential risk subjects in the absence of any specific suspicion – is another.
Bull Bitcoin opens proceedings: the challenge against DAC8
Bull Bitcoin has decided to act. The company has initiated proceedings before the French courts to contest the compatibility of DAC8 with the privacy rights of European citizens – a challenge that Melaviola is handling directly in her role as head of legal.
Governments have progressively eroded financial privacy over the past thirty years, and DAC8 represents the most visible acceleration of that process in the crypto asset world. Bull Bitcoin has chosen not to accept this trajectory in silence, bringing the matter before the courts while continuing to operate under the MiCA licence it has just obtained. The consistency between stated values and concrete action is, according to Melaviola, the main reason she chose to join the project.
Watch the full episode on YouTube
Share on X
