KStTG deadline: German crypto platforms must collect tax self-certifications by 1 January 2027

Crypto platforms that fall under Germany’s crypto tax transparency law, the KStTG (Kryptowerte-Steuertransparenz-Gesetz), must finish collecting a tax self-certification from their existing customers by 1 January 2027, in the law’s own wording. The deadline is the provider’s. For customers it shows up as a message from the exchange asking for their tax residence and tax identification number, which anyone who opened an account with such a platform by the end of 2025 should expect, if it has not already arrived.

The KStTG is the law of 22 December 2025 that brings the EU’s DAC8 directive into German law. The deadline sits in section 7 of the KStTG, and the Bundeszentralamt für Steuern (BZSt), the federal tax office that receives the data, repeats it on its procedure page.

What the KStTG requires by 1 January 2027

Section 7 has two paragraphs. The first covers new customers: a provider must complete its due-diligence checks before it carries out any reportable transaction for them. The second covers everyone who entered a business relationship with the provider by 31 December 2025. For those users, the checks of sections 4 to 6 must be completed by 1 January 2027.

At the heart of those checks is the self-certification in section 4. The provider has to obtain a valid statement from each customer who is a natural person, detailed enough to determine every country where that person is tax resident. The customer, for their part, is obliged by section 4 to provide it within a reasonable deadline that the provider sets. The provider then tests the answer for plausibility against everything it already holds, including the identity data collected under the anti-money-laundering rules. If a customer’s circumstances change, for example after a move abroad, the provider must obtain a new self-certification without delay. Companies and other legal entities go through the same process under section 5, with extra questions about the people who control them.

A “provider” here means a crypto-asset service provider in the sense of the EU’s MiCA regulation, or a crypto-asset operator outside MiCA, that carries out exchange transactions for reportable users. The law’s definition of crypto-asset services also takes in staking and lending.

Which exchanges fall under the German law

Not every platform that German residents use. Section 2 ties the law to the provider’s home. A MiCA-licensed provider is covered when Germany is its MiCA home member state. Operators without a MiCA licence are covered when they have a German link: tax residence, a registered or administrative seat, or regular business in Germany. Most of them are released if they already meet the same duties in another EU country or a qualifying non-EU state. Transactions run through a German branch are covered too.

In practice, an exchange based in another member state applies that country’s DAC8 law, with its own deadlines, even for German customers. Coindaro has not verified which of the large platforms used in Germany count as German under section 2, so this page does not name any.

Crypto tax self-certification: what you will be asked

The statute spells out the content. Section 6 says a self-certification from a natural person is valid only if it gives first and last name, address, every country of tax residence, the tax identification number (or its equivalent) for each of those countries, and date of birth. The customer has to sign it or confirm it in another way, and it must be dated no later than the day the provider receives it. The tax number can be left out only for a country that issues none.

A guide published by the advisory firm Ecovis on 12 August 2025 names the same core data: residence, country of residence, tax identification number and date of birth. On the platform side, the German site CryptoTicker checked the public help pages of Bitvavo, Bitpanda, BISON, Gemini, Luno and Bybit (published 17 August 2026, updated 25 October 2026). It found 24 relevant articles at five of them and none at Bybit. They ask for tax residence, the tax ID and a confirmation that the details are correct, and one provider also asks for the place of birth. Not one of the 24 articles names 1 January 2027, and one describes the deadline for existing customers only as “bis 2027”. On those platforms the request appears as a form in the app or the web account.

What happens if you ignore the request

Section 8 gives providers a fixed sequence. When a customer does not answer, or answers only in part, the provider must first send a reminder. If that brings nothing, it must send a formal demand, a Mahnung. Those two steps apply to all customers.

For customers whose relationship began by 31 December 2025, the law adds a third step. If the information still has not come in after the Mahnung, the provider must stop the customer from carrying out reportable transactions through the platform. The block takes effect no earlier than 60 days and no later than 90 days after the original request. Each platform sends that request on its own schedule, so the date differs from one customer to the next, and the law sets no general block on 1 January. Once the customer supplies the information, the business relationship can resume.

The block covers reportable transactions, which section 1 defines as exchange transactions and transfers of crypto-assets. Section 8 says nothing about the balance itself or about closing the account. CryptoTicker sums it up the same way: a customer who does not answer keeps the balance but loses the ability to trade with it. It adds that one provider still lets restricted customers withdraw to their own bank account, and that the 60-to-90-day window appears in none of the help texts it checked.

The timeline from 2026 data to the EU exchange

Under section 21, the due-diligence and reporting duties apply for the first time to calendar year 2026, and section 10 makes the calendar year the reporting period. Section 9 requires providers to report to the BZSt each year by 31 July for the previous year. Before that first report, section 13 obliges them to tell each reported customer that their data goes to the BZSt, early enough for the customer to exercise their rights. The law gives no number of days.

The last date is the subject of our page on the first EU exchange of crypto tax data under DAC8. The European Commission sets that exchange within nine months of the reporting year, and the BZSt procedure page confirms that the first German transmissions run in 2027 and are forwarded by 30 September.

Fines for platforms, and for customers

Section 18 lists the administrative offences, all of which require intent or recklessness. Most concern the provider: obtaining or checking self-certifications wrongly, incompletely or late, failing to apply the section 8 block on time, reporting errors and registration failures. Each can carry a fine of up to EUR 50,000. Record-keeping failures, including not keeping the records for ten years, carry up to EUR 10,000.

One item is aimed at the customer. Section 18(1) no. 2 covers anyone who, against section 4, does not provide a self-certification, or provides it incorrectly, incompletely or late. It falls in the EUR 50,000 band, which is a ceiling, not a set amount. The BZSt is the authority that imposes the fines, and it tells the financial supervisor BaFin when a crypto-asset service provider is fined a second time. Whether a customer’s gains are taxable is a separate question that the KStTG leaves alone; our guide to crypto tax basics covers the general principles.

Germany only

This deadline, the 60-to-90-day block and the fines are German rules. Every EU country has transposed DAC8 on its own, and a platform applies the law of its home state. Readers in France and Italy can find their national rules in our guides to crypto tax in France and crypto tax in Italy.

What is still unclear

Both the statute and the BZSt say “by 1 January 2027” without saying whether the work may still run on 1 January itself or must end on 31 December 2026; this page keeps the law’s wording. Nor have the platforms named in the CryptoTicker survey published a date for their own last request. This page is general information about the law, not tax advice.