France’s Council of State has rejected an emergency bid by Bull Bitcoin and Paymium to halt a decree enforcing the EU’s DAC8 crypto tax‑transparency rules.
French Court Rejects Emergency Bid to Halt EU Crypto Data Rules

Key Takeaways
- France’s Council of State rejects Bull Bitcoin and Paymium’s petition to freeze DAC8 rules.
- Critics argue that centralizing data risks hacker attacks, extortion, and crypto home invasions.
- Initial reporting for 2026 ends Sept. 30, 2027, as Bull Bitcoin continues its annulment lawsuit.
Emergency Motion Dismissed
France’s highest administrative court, the Council of State, has rejected an emergency motion seeking the immediate suspension of the French decree implementing the European Union’s Eighth Directive on Administrative Cooperation (DAC8).
The ruling dismisses a summary suspension proceeding brought by cryptocurrency companies Bull Bitcoin and Paymium. The applicants had argued that the centralized collection of digital asset user data poses an immediate threat to user safety and physical security. While the court declined to issue an emergency stay, it has not yet ruled on the underlying legality of the decree. A separate lawsuit seeking the complete annulment of the regulation remains active before the Council of State.
According to Francis Pouliot, founder of Bull Bitcoin, the petition, filed in August 2026, requested an interim suspension of France’s Decree No. 2025-1276. The decree transposes DAC8 into French law, requiring crypto asset service providers to gather sensitive personal and financial data for automatic exchange among EU member states’ tax authorities.
In their filing, Bull Bitcoin and Paymium argued that creating a centralized repository of detailed digital asset records creates an imminent danger of data breaches. The companies warned that leaked databases could be exploited by violent criminals to locate, extort, or kidnap cryptocurrency holders and their families. France accounts for a disproportionate share of home invasions and robberies targeting crypto entrepreneurs.
Suspicions that criminals had accessed the personal data of some of France’s crypto rich were confirmed in August, when the country’s tax agency admitted a hacker had stolen data from 678,438 taxpayers. The breach prompted crypto industry participants to call for a moratorium on state institutions collecting personal data.
However, in its ruling, the French court denied the request for emergency intervention, ruling that the applicants failed to demonstrate a sufficient situation of urgency. According to court documentation cited by the applicants, the tribunal determined that storing transaction data in a centralized register does not automatically heighten the probability of compromise to a level that warrants an immediate freeze.
The court noted that “the mere possibility of a risk, the probability of which is very low, cannot constitute a situation of urgency.” Despite the procedural setback, Pouliot emphasized that the decision does not constitute a loss on the merits of the case.
“This summary suspension proceeding concerns only the grounds of urgency,” Pouliot stated in a post on X. “This refusal in no way means that the Council of State rejects our substantive arguments. Our legal proceeding for the complete annulment of the DAC8 decree is still ongoing.”
Merits Challenge Continues
The substantive legal challenge claims that the decree exceeds government authority and violates fundamental rights under French constitutional law and European privacy standards.
To support their argument regarding data centralization risks, the plaintiffs referenced prior statements from France’s General Directorate of Public Finances. During parliamentary discussions in February 2026 regarding crypto reporting, tax officials acknowledged that centralizing identity and asset values in large databases could create high-value targets for cyberattacks and fraud.
Bull Bitcoin argued that these warnings, alongside documented physical attacks targeting cryptocurrency holders across Europe, demonstrate real-world vulnerability. The plaintiffs indicated they plan to publish the complete legal filings and supporting documentation from the summary proceeding in the coming days.
DAC8 entered into force across the European Union on Jan. 1, 2026. Under the implementation timeline, registered service providers must complete their initial reporting for the 2026 calendar year by Sept. 30, 2027, ahead of automatic cross-border data exchanges among EU tax authorities.

















