Bull Bitcoin Petitions French High Court to Annul DAC8 Crypto Surveillance Decree
Bull Bitcoin petitioned France's Conseil d'État on February 24 to annul Decree No. 2025-1276, the French rule implementing DAC8's mandatory crypto identity and transaction reporting. The exchange argues the decree fails the EU Charter's proportionality standard and creates a kidnapping-target
France's DAC8 implementing decree would tie real identities to permanent Bitcoin address histories. Bull Bitcoin is asking the country's highest administrative court to kill it before the first data dump happens.
Key takeaways
- Bull Bitcoin filed a summary petition before France's Conseil d'État on February 24, 2026, to annul Decree No. 2025-1276, France's implementation of the EU's DAC8 crypto reporting regime.
- The exchange argues the decree violates Article 52 of the EU Charter of Fundamental Rights because linking a real-world identity to a Bitcoin address discloses an entire permanent financial history, far exceeding what any proportionate tax investigation would require.
- If Bull Bitcoin does not secure a suspension or annulment before September 30, 2027, France executes the first cross-EU mass exchange of Bitcoin holders' personal data, setting the template for all 27 member states.
Non-custodial Bitcoin exchange Bull Bitcoin announced Wednesday it had filed a legal challenge before France's Conseil d'État, the country's highest administrative court, seeking to annul Decree No. 2025-1276, the French regulation implementing the EU's DAC8 crypto tax reporting directive. The petition was filed February 24, 2026, followed by a substantive legal brief. The stakes extend well beyond France: a ruling here sets the precedent for every EU member state still standing up identical infrastructure.
What DAC8 Actually Requires
DAC8, which entered force January 1, 2026, requires crypto asset service providers (CASPs) to collect users' full identity, including name, address, date of birth, and tax identification number, alongside transaction data, and auto-report it to national tax authorities. Those authorities then exchange the information across all 27 EU member states. France implemented DAC8 through Decree No. 2025-1276, signed December 19, 2025, and published in the Journal Officiel on December 24.
The first mandatory reports cover calendar year 2026 and are due to France's DGFiP by January 31, 2027. The subsequent cross-border exchange between EU member states is scheduled for September 30, 2027. Bull Bitcoin filed its petition 55 days after the decree took force.
DAC8 itself is the EU's implementation of the OECD's Crypto-Asset Reporting Framework (CARF). Forty-eight countries are implementing CARF in 2026, with 75 committed globally. Whatever legal record gets built in Paris becomes the playbook for challenges in every jurisdiction adopting CARF.
The Proportionality Problem
Bull Bitcoin's core legal argument invokes Article 52 of the EU Charter of Fundamental Rights, which requires that any limitation on fundamental rights be necessary, adequate, and proportionate. The exchange argues DAC8 fails all three.
The distinction that matters: a bank account number reveals a balance and recent transactions. A Bitcoin address reveals a complete, permanent, publicly queryable transaction history. Tying a real-world identity and home address to that address does not just satisfy a tax reporting requirement. It creates a comprehensive financial dossier on every holder, most of whom have no tax liability in question.
Bull Bitcoin stated in its press release, per Cointelegraph: "Against a backdrop of daily data leaks and a surge in kidnappings targeting crypto-asset holders, building such a database endangers the physical safety of millions of holders and their loved ones."
The physical danger framing is not rhetorical. France led Europe in wrench attacks in 2025, with 19 confirmed incidents, and Europe accounted for roughly 40% of global incidents as worldwide cases rose 75% year-over-year to 72 verified attacks, according to CertiK's Skynet Wrench Attacks Report. French police counted 41 crypto-related kidnappings since the start of 2026, per RTL. A centralized, government-held database linking names, home addresses, and Bitcoin holdings is the operational input that makes those attacks possible at scale.
Bull Bitcoin also challenges the decree on "over-transposition" grounds, arguing France implemented DAC8 more expansively than the directive itself requires.
The exchange says it intends to pursue, per Cointelegraph, "every legitimate avenue to suspend, delay, annul or amend the effects of DAC8 and its global counterpart, the CARF."
Worth noting for context: a recent SCOTUS ruling on geofence warrants established that bulk data collection tied to location requires Fourth Amendment scrutiny. The EU Charter's proportionality standard is a parallel constraint, and Bull Bitcoin is running the same structural argument: mass collection to satisfy a targeted enforcement goal is disproportionate by design.
The Thesis and the Clock
The falsifiable thesis here: DAC8's French implementing decree fails the EU Charter's proportionality test because linking a real identity to a permanent, public Bitcoin address discloses far more than any targeted tax investigation requires, making the bulk collection structurally unlawful under Article 52.
That thesis collapses if the Conseil d'État rules the data collection scope is genuinely necessary and proportionate for tax enforcement, and that the security risks Bull Bitcoin cites do not constitute a legal defect in the decree's design. A loss would entrench DAC8 across all 27 member states with essentially no viable legal recourse remaining.
The timeline is unforgiving. The January 31, 2027, DGFiP filing deadline is the first hard date: that is when holders' data first moves to the French state. Bull Bitcoin needs a suspension or annulment before that date to stop the initial collection. The September 30, 2027, cross-EU exchange deadline is when the data becomes a 27-country surveillance asset.
Bull Bitcoin is a non-custodial exchange, meaning it does not hold users' bitcoin. Yet DAC8 still requires it to collect and report identity and transaction data. That is the regulatory pressure point: the decree captures the last regulated, privacy-respecting on-ramp to self-custody, not just custodians. The Dutch Knaken case illustrates how quickly European regulators move to shut down exchanges that fall outside the compliance architecture. The non-custodial model is under siege continent-wide.
What to Watch
The Conseil d'État can grant an interim suspension, proceed to a full annulment proceeding, or reject the petition outright. Any interim suspension before January 31, 2027, would immediately freeze French DAC8 enforcement and generate legal ammunition for parallel challenges in other EU member states. A referral to the Court of Justice of the EU on the proportionality question would extend the fight to the supranational level. Watch Bull Bitcoin's X and Nostr accounts for procedural updates, and watch whether any other European exchange files a copycat challenge in a different member state.
Sources
- Decree No. 2025-1276, Légifrance
- DAC8 official EU Commission page
- CertiK Skynet Wrench Attacks Report
- First reported in English by Cointelegraph
Frequently Asked Questions
DAC8 does not directly require reporting from fully self-custodied wallets with no CASP involvement. However, any transfer from an exchange to a self-custody wallet above 1,000 EUR triggers Travel Rule identification requirements, which links the on-chain withdrawal address to a verified real-world identity at the point of exit. The surveillance chain reaches self-custody through the off-ramp, not directly.
DAC8 is the EU's implementation of the OECD's CARF standard. DAC8 binds 27 EU member states; CARF is being adopted by 48 countries in 2026, with 75 committed globally. A successful DAC8 challenge under the EU Charter does not automatically invalidate CARF in non-EU jurisdictions, since the EU Charter has no force outside the EU. But the evidentiary record Bull Bitcoin is building, covering data breach risk, wrench attack statistics, and the disproportionate scope of address-linked identity collection, becomes the factual foundation for legislative and legal challenges wherever CARF is being implemented.
The Conseil d'État will assess whether Decree No. 2025-1276 satisfies the necessity, adequacy, and proportionality requirements of Article 52 of the EU Charter of Fundamental Rights. The court will also examine whether France over-transposed the DAC8 directive, meaning it imposed obligations more burdensome than the directive itself mandates. If either defect is established, the court has authority to annul the decree in whole or in part.
