DAC7: Reporting Requirements for Digital Platforms in the EU

Sales channels have become complex technological ecosystems. The rise of marketplaces and the sharing economy has transformed commerce, but it has created a significant information asymmetry for European tax authorities regarding sellers’ actual revenue. To address this lack of transparency, the European Union has implemented the DAC7 Regulation.

If you operate a digital platform, complying with DAC7 is an unavoidable operational obligation. In this article, we’ll break down who the directive affects, what data Form 238 requires, and what the severe penalties for non-compliance are. Plus, you’ll discover how to automate this process using digital identity technology without adding friction for your users.

The DAC7 Directive is a European Union regulation that establishes a standardized legal framework to require digital platform operators to collect, verify, and report tax information on their users. It affects all digital platforms—whether based in the EU or abroad—that facilitate commercial activities for sellers located in any Member State.

To understand the scope of DAC7 (officially, Directive (EU) 2021/514), here are its three fundamental pillars:

• Scope of application: It applies across the board to all digital platforms, whether based in the EU or abroad, that facilitate commercial activities for sellers based in any Member State.
• New reporting obligations: Platforms must collect reliable financial data from sellers and report it periodically and in a standardized manner to the competent tax authorities.
• Main objective: It seeks to eliminate digital opacity. By receiving automatic reports, tax authorities such as the AEAT can cross-reference data on a massive scale and compare the revenue generated on the platform with what is declared on personal income tax or corporate tax returns, detecting fraud with great precision.

Which platforms and sellers are affected by the DAC7 Regulation?

Determining compliance with this directive requires a detailed technical analysis: not all websites are considered "platforms" from a legal standpoint, nor must all users who sell items be reported. The regulation defines a platform as any software (websites, integrated portals, or mobile apps) that actively connects sellers with buyers to facilitate a "relevant activity."

Platforms that are limited solely and exclusively to: processing payments (such as traditional payment gateways), listing or advertising goods and services without intervening in the final transaction, and redirecting or transferring users to an external digital platform are explicitly excluded.

Relevant sectors and activities included

The activities that trigger the platform’s reporting obligation are divided into four operational categories:

• Real estate leasing: Temporary transfer of residential properties (vacation and tourist rentals), commercial properties, and parking spaces.
• Personal services: Time-based or task-based work provided by individuals, both in person and online (freelancers, deliveries, repairs, software development).
• Sale of goods: Sale of any type of physical and tangible product (new or second-hand items).
• Transportation rentals: Car rentals, carsharing, motorcycles, electric scooters, and bicycles.

Exceptions and thresholds for sellers

The directive protects occasional sellers by establishing specific "exclusion thresholds." Platforms are not legally required to report a seller if they simultaneously meet these two conditions during a calendar year: they have completed fewer than 30 sales transactions and the total amount earned does not exceed 2,000 euros. 

In addition, government entities, publicly traded companies, and large real estate/hotel operators (those with more than 2,000 annual rentals within a single property portfolio, as they are subject to other tax regimes) are excluded from the report.

What data must platforms report under Form DAC7

The transposition of the DAC7 Directive in Spain is carried out through Form 238 (Informative Declaration for Platform Operators). For each seller exceeding the exclusion thresholds, the platform is required to extract, certify, and report the following set of data:

• Seller identification: First and last names (individuals) or business name (legal entities), along with the primary address.
• Tax ID: The Tax Identification Number (NIF). If the seller is a natural person and does not have a NIF, their place of birth will be required. If they have a NIF, their VAT registration number is also required.
• Bank and payment details: The IBAN or account identifier where proceeds are paid. If the account holder is different from the registered seller, they must also be identified.
• Financial metrics (quarterly breakdown): Total consideration paid, exact number of transactions (sales or rentals) carried out, and the fees, commissions, or taxes withheld or collected by the platform.
• Property details (for rentals only): Full address of each property, cadastral reference, and the number of days the property was actually rented.

How to automate the DAC7 form

Filling out Form 238 manually is unsustainable for any platform, as the Tax Agency does not accept PDFs but requires the transmission of a structured XML file with strict metadata schemas. To address this immense operational burden, leading digital platforms use Onboarding and KYB/KYC platforms that automate this workflow through the following actions:

• Dynamic data collection: Through APIs, the system monitors a user’s sales in real time. When the user approaches the threshold (e.g., 25 sales or €1,500), the system triggers an automated workflow requesting tax information.
• Dynamic data request: The platform sends automatic notifications so the user can provide their tax and banking information exactly when needed, without any prior friction.
• Instant verification (KYC/KYB): It uses OCR engines to instantly extract data from identity documents and validates that the tax ID number matches the bank account holder.
• eIDAS validation against official databases: These tools instantly cross-reference the user’s tax ID or passport against government databases, ensuring the information is accurate and strictly complying with the due diligence required by law.
• XML Generation and Transmission: At the end of the fiscal year, the system structures thousands of verified records in the required format and transmits them directly to the authorities via Web Services.

Key Deadlines and Compliance Calendar for the DAC7 Directive

This regulatory obligation for digital platforms is strictly annual. The reporting period for collecting information runs from January 1 through December 31 of the current year.

To avoid operational and financial penalties, the filing deadline requires platforms to submit the declaration no later than January 31 of the calendar year following the one in which the sellers were identified. As a one-time exception, for the first year of implementation corresponding to the 2023 tax year, Spain established a special filing period from February 6 to April 8, 2024, with the deadline standardizing to January for subsequent tax years.

Consequences of DAC7 Non-Compliance for Platforms

Failure to comply with the DAC7 Directive entails a severe penalty regime capable of crippling the viability of any digital platform. In Spain, the Tax Agency imposes fines of 200 euros for each seller omitted or reported with false information. At the European level, financial penalties are even more severe, potentially reaching up to 2% of the offending platform’s global annual revenue.

In addition to these fines, the regulation requires the application of the 60-day rule, which mandates the blocking of accounts. If a seller exceeds the legal thresholds and fails to provide their tax information after two warnings, the platform must immediately close their account or permanently withhold all payments after 60 days. In cases of outright refusal, authorities may order the cessation of operations within the EU, forcing internet service providers and payment gateways to completely block the domain and its financial operations.

How to Comply with DAC7: Technical Steps and Solutions for Digital Platforms

To turn this legal requirement into an efficient digital workflow, platforms must integrate RegTech and digital identity technologies. The first step is to conduct a data audit to determine precisely what user information is already collected and what elements are missing according to the DAC7 standard. Next, it is vital to implement an automated identity verification system (KYC/KYB). 

This process combines corporate data extraction with biometric verification using tools such as Tecalis Identity, ensuring that the tax ID number is valid. Additionally, for legal entities, the AML6 directive requires identifying the company’s Ultimate Beneficial Owner (UBO).

Finally, the infrastructure must integrate with eIDAS 2.0 and the EUDI Wallet. This allows users to submit their tax data via digital wallets, eliminating the hassle of uploading photos or typing in their IBAN. This entire ecosystem requires strict compliance with the GDPR, adapting privacy policies for sensitive data and applying encryption to biometric information.

Integrating DAC7 flows without increasing user drop-off

Requiring a tax ID or bank account upon downloading the app would drastically lower conversion rates. To avoid this, the most efficient solution is to structure validation in progressive phases. Thus, regulatory friction applies exclusively to profiles that are already profitable and are genuinely motivated to complete the process without abandoning it.

This validation, structured to minimize drop-off, is divided into the following three main phases:

• Frictionless initial registration: The user registers and begins trading by providing only an email address.
• Automated DAC7 trigger: Using AI, the system detects sales patterns and proactively requests tax information just before legal thresholds are reached (for example, upon making their 25th sale), the app requests tax information.
• In-app verification: A fast, automated identity verification flow is displayed within the app itself.

In this way, regulatory friction applies exclusively to users who are already generating revenue and are highly motivated to complete the process.

Tags