French Council of State Rejects Emergency Request to Suspend EU DAC8 Crypto Data Decree

France’s Council of State has dismissed an emergency motion filed by cryptocurrency firms Bull Bitcoin and Paymium that sought an immediate suspension of the French decree transposing the EU’s DAC8 directive. The decree, issued as Decree No. 2025‑1276, requires crypto‑asset service providers to collect and exchange detailed personal and financial data with tax authorities across the European Union.

Emergency motion denied

The court ruled that the applicants did not demonstrate a sufficient level of urgency to justify a summary suspension. It noted that a mere possibility of risk, especially when the probability is considered low, does not meet the threshold for emergency relief.

Arguments presented by the petitioners

• Centralized storage of digital‑asset user data could become a target for cyber‑attacks, extortion, or kidnapping.
• Recent incidents in France, including a breach affecting over 678,000 taxpayers and a series of home invasions targeting crypto entrepreneurs, were cited as evidence of real‑world threats.
• The petitioners warned that leaked databases could enable violent criminals to locate and target cryptocurrency holders and their families.

Court’s reasoning

The Council of State emphasized that the decree’s requirement to store transaction data in a centralized register does not automatically increase the likelihood of compromise to a level that warrants an immediate freeze. The decision addresses only the procedural urgency claim, not the substantive merits of the case.

Substantive challenge continues

Bull Bitcoin and Paymium maintain a separate lawsuit seeking the full annulment of the DAC8 decree, arguing that it exceeds governmental authority and infringes on constitutional and European privacy rights. The plaintiffs reference statements from France’s General Directorate of Public Finances that acknowledge the potential security risks of large, centralized databases.

Implementation timeline

DAC8 became effective across the EU on 1 January 2026. Service providers must complete their initial reporting for the 2026 calendar year by 30 September 2027, after which data will be automatically exchanged among EU tax authorities.