Bull Bitcoin Asks France's Highest Court to Annul the Decree Enforcing EU Crypto Surveillance

What Happened

On July 8, the Bitcoin exchange Bull Bitcoin announced it had opened what it calls the first legal front against DAC8, the European Union's crypto tax reporting directive, by petitioning the Conseil d'Etat, France's highest administrative court, to annul Decree No. 2025-1276. That decree, signed December 19, 2025, is the instrument that transposes DAC8 (the 8th amendment to the EU's Directive on Administrative Cooperation) into French national law.

The company filed a summary petition on February 24, 2026 and a substantive brief afterward, going public with the case this week. No one else has challenged DAC8 in court in any EU member state.

Bull Bitcoin is a distinctive plaintiff: a regulated firm suing over its own reporting obligations. The Canadian company, which describes itself as the oldest Bitcoin-only and non-custodial exchange still operating, holds a Markets in Crypto-Assets (MiCA) license obtained through France's financial markets regulator, the Autorite des marches financiers (AMF), and its French entity is exactly the kind of crypto-asset service provider (CASP) the decree conscripts into data collection.

Chief executive Francis Pouliot said DAC8 'has transformed the concept of Know Your Customer into Kill Your Customer' and committed the company to pursuing 'every legitimate avenue to suspend, delay, annul or amend the effects of DAC8 and its global counterpart, the CARF,' the OECD's Crypto-Asset Reporting Framework.

Alongside the filing, the company launched dac8.com, a public archive of its objections.

The first court test of EU crypto surveillance will not decide whether states may tax crypto. It will decide whether they may inventory everyone who holds it, addresses included, suspicion not required.

Suspicion Is No Longer a Requirement

DAC8 took effect across the EU on January 1, 2026. It requires every regulated crypto platform in the bloc to collect and report customer identities, tax residences, and transaction details to national tax authorities every year, with the first reports covering 2026 due to France's tax administration, the Direction generale des Finances publiques (DGFiP), by January 31, 2027.

Member-state tax authorities are then scheduled to begin exchanging that information automatically across the bloc later in 2027. The petition's core legal objection is what this replaces. Under the prior framework, French authorities could obtain a customer's exchange records through lawful process, typically tied to an investigation or a specific suspicion.

DAC8 removes that threshold. Every customer of every regulated platform is reported, every year, whether or not anyone suspects them of anything.

Bull Bitcoin argues that suspicionless, population-scale reporting fails the proportionality test EU privacy law imposes on interferences with fundamental rights, and that the resulting dataset is a security liability in its own right: a standing, multi-jurisdiction database of names, home addresses, and crypto holdings, with entry points in 27 member states.

The company adds that the rule will not serve its stated goal, because users who want to stay unreported will move to peer-to-peer trades, decentralized platforms, or offshore venues, shrinking the visibility regulated platforms currently give authorities. That argument cuts both ways (it is also what a tax agency would say proves the need for reporting), but the security argument is harder to dismiss, and it has a specifically French context.

The Database Is the Threat Model

France logged 77 crypto-linked cases of kidnapping, unlawful detention, and extortion in the first half of 2026, up from roughly 45 in all of 2025. By mid-April the count stood at 41, an average of about 1 incident every 2.5 days. The global trend points the same direction: the security firm CertiK and researcher Jameson Lopp, whose public tracker documents physical attacks on crypto holders since 2014, counted 72 verified physical-coercion incidents worldwide in 2025, a 75% increase over the prior year.

The French government unveiled a dedicated security plan for crypto holders in early July. Bull Bitcoin's petition connects these facts directly: a government-held database linking identity, home address, and crypto activity is the operational input that lets criminal targeting scale, and databases of this kind leak.

The 2020 Ledger customer-data breach, which exposed the names and home addresses of hundreds of thousands of hardware wallet buyers, remains this industry's canonical example.

The strongest counterargument is that DAC8 is not novel. It extends to crypto the same automatic reporting regime banks have operated under since the Common Reporting Standard took effect in 2017, and bank customers are not being kidnapped at scale because of it. Skeptics can also note that outright annulment is a long shot: France had almost no discretion in transposing an EU directive, and the Conseil d'Etat rarely strikes down a transposition for doing what the directive commands.

But crypto theft, unlike a reversible bank transfer, is final, and self-custodied wealth is portable, which changes what a leaked address list is worth to a criminal. And the realistic prize here is not the decree itself but a referral: the Conseil d'Etat can send questions about DAC8's validity to the Court of Justice of the European Union (CJEU), the court that invalidated the EU's Data Retention Directive in 2014 (Digital Rights Ireland) precisely because indiscriminate, suspicionless data collection failed the proportionality test.

Bull Bitcoin says it is prepared to take the case there, or to France's Constitutional Council.

What This Means for You

Start with the uncomfortable part: self-custody does not remove you from this dataset. If you have bought or sold through a KYC (know your customer) platform in the EU, your identity, tax residence, and transaction history are scheduled to be reported automatically beginning with 2026 data, regardless of where your private keys live.

Key control protects you from custodial failure, freezes, and any policy that reaches assets held on a platform. It does not delete a reporting trail, and it does not stop a leaked database from putting your name, address, and approximate holdings in criminal hands. That is the limit of self-custody this story runs into, and it is the reason a non-custodial exchange is the one suing.

What you can manage is the exposure the reporting creates. Treat any KYC record linking you to crypto as data that will eventually circulate beyond its intended recipients, because the documented pattern (Ledger, repeated exchange breaches, insider leaks) says it will. Audit the public association between your identity and your holdings: what your social media implies, whether your home address is discoverable through data brokers or corporate registries, and whether the people around you know more about your holdings than they need to.

Reports on the French cases suggest attackers often reach the key holder through a spouse, child, or parent, so a physical security plan proportionate to what you hold should include family members, not just you.

For EU readers specifically, this is the case to follow, because it is the first time the reporting mandate itself, rather than a licensing rule or an enforcement action, has been put before a court with the power to escalate it to the EU's highest judicial authority. Whatever the outcome, the first DGFiP reports remain due January 31, 2027, and as of this writing nothing about the petition suspends that deadline.

What to Watch

The most important signal is whether the Conseil d'Etat refers questions about DAC8's validity to the CJEU rather than ruling narrowly on the French decree; a referral would put the directive itself, not just one country's transposition, on trial. Watch also whether other crypto-asset service providers or industry groups file parallel challenges in other member states now that Bull Bitcoin has opened the route.

If the court declines to suspend the decree in the interim, the January 31, 2027 first-reporting deadline will arrive before any final ruling, which means the database gets built while its legality is still being litigated.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.