The French Senate has given its approval to a bill that would allow French tax authorities to automatically exchange information on cryptocurrency transactions with foreign counterparts. The bill secured support during its initial reading on Tuesday and has now been forwarded to the National Assembly for further evaluation as Bill no. 3421.
New standards for crypto tax information
The proposed legislation outlines an agreement for the exchange of crypto tax data as well as updates to an existing framework around financial account information sharing. This initiative is grounded in the Crypto-Asset Reporting Framework (CARF), developed by the Organisation for Economic Co-operation and Development (OECD). CARF establishes internationally recognized standards for participating countries to systematically collect and exchange details about cryptocurrency transactions.
France’s efforts build on the reporting mandates introduced under its 2025 Finance Act. This legislation already integrates requirements from the European Union’s Directive on Administrative Cooperation, known as DAC8, which took effect earlier this year. DAC8 compels crypto service providers to supply customer identification and transaction details to tax agencies, facilitating the exchange of information with authorities in other EU member states where users reside.
Alongside these international commitments, French lawmakers are actively considering further crypto tax measures. An amendment adopted by the National Assembly on October 16 would make gains from converting crypto into certain fiat-pegged stablecoins taxable starting January 1, 2027. While this provision could influence crypto investors, it has yet to become law.
Parliamentary discussions on the broader national budget, including various taxation aspects, resumed this week, with a decisive vote on the revenue section scheduled for November 3.
Mini dictionary: Crypto-Asset Reporting Framework (CARF), an OECD-developed framework establishing standardized procedures for the collection and automatic cross-border sharing of crypto-asset transaction data among participating jurisdictions.
Data sharing and security risks under DAC8
The European Commission has indicated that it will set up a central repository for crypto-related tax reports by the end of 2026. This repository would enable tax authorities from every EU member state to access detailed transaction information about their residents. However, the initiative has raised concerns within the crypto industry regarding the safety and privacy of sensitive information.
Faustine Fleuret, global head of public affairs at Morpho, a lending protocol, pointed out that the centralization of personal crypto transaction information could increase the risk of data breaches. She cautioned that storing names, addresses, tax identification numbers, and transaction amounts in a single repository might represent a significant vulnerability for EU tax systems.
Faustine Fleuret emphasized that creating a central access point for sensitive crypto data could expose it to heightened risks, describing the repository as a potential “single point of failure.”
| DAC8 Reporting Requirement | Potential Security Issue |
|---|---|
| Automatic exchange of transaction data | Centralized storage of sensitive information |
| Inclusion of personal details (names, addresses, tax IDs) | Increased vulnerability to hacking or unauthorized access |
Fleuret’s concerns are underscored by a rise in attacks targeting cryptocurrency holders, a phenomenon often referred to as “wrench attacks.” Blockchain security firm CertiK reported that there were 33 verified wrench attacks in France during the first half of 2026, out of 52 cases worldwide. This included a March incident in which a French couple in their 50s was robbed of around $1 million in Bitcoin by criminals impersonating police officers.
Mini dictionary: Wrench attack, a term referring to physical attacks or threats against individuals to force them to surrender access to their crypto assets, typically involving violence or intimidation rather than technical hacking.
France has emerged as one of the most affected countries by these physical security threats, raising further questions about the protection of personal data in the crypto sector.
Reports by CertiK revealed that France experienced 33 out of 52 confirmed wrench attacks worldwide during the first six months of 2026, highlighting increasing risks for crypto holders in the country.
