EU: DAC7 reporting rules - What will be expected from online platform operators and other businesses?

In brief

With the rise of digital platforms and the possibilities internet provides for businesses, more and more sellers are able to offer goods and services via these platforms and the internet. In this context, it has become difficult for tax authorities to trace the flow of goods and services as well as to identify sellers to ensure that these goods and services are taxed in accordance with EU tax principles.

The EU Council approved new rules earlier this year that seek to collect, verify and share data from online sellers and service providers (DAC7). DAC7 must be implemented under the national laws of the respective EU member states by 31 December 2022 at the latest, with effect as of 1 January 2023.

Recommendations for action

Digital platform operators and other businesses should consider whether they might be affected by the very broadly defined DAC7 obligations and consider, among others, the following points:

  • Am I in scope of DAC7?
  • What are my obligations for my own activities under DAC7 and in respect of sellers and service providers active on my platform?
  • What should I do if want such sellers and service providers to remain active on my platform in the future?
  • Do I have adequate processes and procedures in place to ensure I can comply with the due diligence and reporting obligations under DAC7? How will the information be collected as efficiently as possible, and how can we verify the accuracy of such information?
  • What is the effect of DAC7 on possible limitations in contractual arrangements in place in respect of sharing information with third parties?

Businesses will need to consider the DAC7 obligations and take appropriate measures. 

Furthermore, the new due diligence requirements may require considerable resources from platform operators such as software solutions to capture and verify the required data and information.

Finally, please note that member states such as Belgium have already introduced similar reporting obligations. See our separate news flash on the topic here in respect of Belgium

Even though 2023 still seems far away, businesses should start considering the above-mentioned questions and the impact on their processes and operations. Please do not hesitate to reach out if you would like to discuss the impact of the above on your business.  


Goods and services are increasingly sold on digital platforms and the internet by both professional businesses and private individuals. This makes it difficult for tax authorities to trace the identities of sellers and the flow of goods and services, as well as to ensure that the supplies of goods and services are effectively reported and taxed in the correct jurisdiction.

The OECD has been trying to address this problem for quite some time, resulting in the OECD Model Rules for Reporting by Platform Operators, which were published in July 2020. However, the EU is now pursuing its own, more far-reaching, plan with yet another amendment to the Directive on Administrative Cooperation in the Field of Taxation (Council Directive 2011/16/EU) — this time with the goal to have qualifying platform operators to play a key role. Through this initiative, qualifying platform operators will be obliged to share information with the local tax authorities regarding their users' data and the transactions carried out through their platforms.

On 22 March 2021, the EU Council approved the draft DAC7, which provides a number of due diligence and reporting obligations for qualifying operators, which must be implemented in the national law of the respective EU member states by 31 December 2022 at the latest, with effect as of 1 January 2023. DAC7 also foresees the automatic exchange of the reported data with other EU member states concerned through the Common Communication Network (CCN).

DAC7 due diligence and reporting obligations: the main questions

Who needs to collect and report information?

The due diligence and reporting obligations under DAC7 fall on the platform operators, as the entities that contract with sellers to make available all or part of a platform to them. DAC7 defines a platform as any digital interface that connects sellers of certain qualifying goods and services with potential buyers. The scope is broad and may extend to non-traditional platforms, such as software integrated into a website or an online platform. Specific exceptions are provided, including for software that, without any further intervention, exclusively processes payments or allows users to list or advertise a qualifying activity.

Both EU and non-EU resident platform operators are targeted but only need to report transactions concerning sellers that have a sufficient nexus in the EU.

However, if a platform operator is located in a jurisdiction outside of the EU and there is an information exchange agreement between the EU and that respective jurisdiction comparable to DAC7, then the reporting obligation of the platform operator does not apply in the EU.

DAC7 provides that if there are multiple platform operators, an operator will be exempt from reporting if it obtains proof that the same information has been reported by one of the other platform operators.

What kind of information does the platform operator need to collect and share?

On the one hand, platform operators are subject to due diligence obligations for the collection and verification of seller-relevant information, and on the other hand, platform operators need to collect and share information on transactions carried out by qualifying sellers.

a)    Due diligence procedures

The due diligence requirements go beyond the standard KYC requirements and require comprehensive collection and reporting of the seller's personal data to the competent authorities (including name, (primary) address, tax identification number, VAT identification number, date of birth/commercial register number, and the existence and location of a permanent establishment through which the activities are carried out). Depending on the specific activity of the seller, information about the object of sale or rent must also be collected (e.g., in the case of the rental of immovable property, the address and land register identification of the property must be collected).

In addition, the platform operator must verify the collected personal and factual information for accuracy and reliability (especially the tax numbers on the portals of the competent tax authorities). In some cases and with respect to certain data, the platform operator may rely on identification services made available by the relevant EU member state. In a case of doubt, the platform operator must obtain further documents such as a tax residency certificate or an identification document (such as an ID card or passport).

Finally, the platform operator must disclose the seller's data to the relevant tax authorities.

b)    Transactional information

In addition to the above-mentioned due diligence procedures and the information collected through its framework, the platform operator must also collect transaction-related information (e.g., account number, amount of seller's compensation paid and credited, any fees, commissions and taxes, lease term in case of immovable assets, etc.) and report such information to the tax authorities of the relevant EU member state.

Does the platform operator need to collect information on each seller? 

Platform operators must report certain data and information on qualifying sellers active on their platform. The definition of a seller includes both private individuals and entities (e.g., companies) that have a sufficient nexus in the EU (i.e., they are either resident in the EU or are renting out real estate located in the EU) and are registered on the platform.

Not every activity of the targeted sellers falls within the scope of DAC7. The scope is limited to the following reportable activities:

  • the leasing of real estate located in the EU (e.g., residential, holiday and commercial properties and parking lots)
  • the provision of personal services by an EU-based provider (time or task-based work, such as freelance, whether on or offline)
  • the sale of goods by a seller established in the EU (B2C as well as B2B, new as well as used goods)
  • the rental of any means of transport by a seller established in the EU (car/ridesharing, etc.)

Certain sellers are explicitly excluded from being reportable sellers (e.g., governmental entities, listed entities and entities related thereto, sellers whose consideration did not exceed EUR 2,000 in a given reporting period, etc.).

By when does the information need to be reported? 

The reporting obligation, which covers the transactions in a given calendar year (reporting period), must be fulfilled by 31 January of the following year. EU member states will need to implement the reporting obligations by 31 December 2022 at the latest, with effect as of 1 January 2023. Hence, the first reporting will need to be done with respect to transactions covering the calendar year 2023 by 31 January 2024 at the latest.

Note that the platform operator must put in place due diligence procedures by 31 December of the reporting period (or by 31 December of the second reporting period with respect to sellers that were already registered on 1 January 2023).

Other practical considerations

Platform operators will need to review contractual arrangements with their sellers and service providers to verify whether the current contracts allow the platform operators to collect and share the above-mentioned information.

A platform operator with an EU nexus needs to report the relevant information to the tax authorities of its state of tax residence or of the state in which it is incorporated, has its place of management or a permanent establishment, as the case may be. If a platform operator is subject to reporting in more than one EU member state (e.g., tax resident in one EU member state with a PE in another EU member state), it has to choose one EU member state in which to report and notify the competent authorities of all EU member states concerned of its choice. Non-EU platform operators need to report the relevant information to the tax authorities of the EU member state where it is registered.

With respect to the due diligence procedures, the platform operator may rely on a third-party service provider to fulfill these obligations. However, the obligations will remain the full responsibility of the platform operator.

What sanctions are imposed for non-compliance?

DAC7 states that penalties for violating the reporting obligations should be "effective, proportionate and dissuasive." The concrete implementation of such penalties is left to the individual EU member state. In this respect, fines are likely to be the main sanction. Note that the wording under DAC7 is identical to DAC6 in this regard, so it is expected that EU member states will align their penalty provisions with the ones foreseen for the DAC6 obligations.

DAC7 also provides for measures against the seller if the latter does not provide the reportable information to the platform operator after two reminders. The platform operator can either close the seller's user account and prevent a reregistration by the seller, or withhold the payment of the consideration as long as the seller does not provide the information requested (these measures need to be implemented into domestic legislation).

Contact Information

Copyright © 2023 Baker & McKenzie. All rights reserved. Ownership: This documentation and content (Content) is a proprietary resource owned exclusively by Baker McKenzie (meaning Baker & McKenzie International and its member firms). The Content is protected under international copyright conventions. Use of this Content does not of itself create a contractual relationship, nor any attorney/client relationship, between Baker McKenzie and any person. Non-reliance and exclusion: All Content is for informational purposes only and may not reflect the most current legal and regulatory developments. All summaries of the laws, regulations and practice are subject to change. The Content is not offered as legal or professional advice for any specific matter. It is not intended to be a substitute for reference to (and compliance with) the detailed provisions of applicable laws, rules, regulations or forms. Legal advice should always be sought before taking any action or refraining from taking any action based on any Content. Baker McKenzie and the editors and the contributing authors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The Content may contain links to external websites and external websites may link to the Content. Baker McKenzie is not responsible for the content or operation of any such external sites and disclaims all liability, howsoever occurring, in respect of the content or operation of any such external websites. Attorney Advertising: This Content may qualify as “Attorney Advertising” requiring notice in some jurisdictions. To the extent that this Content may qualify as Attorney Advertising, PRIOR RESULTS DO NOT GUARANTEE A SIMILAR OUTCOME. Reproduction: Reproduction of reasonable portions of the Content is permitted provided that (i) such reproductions are made available free of charge and for non-commercial purposes, (ii) such reproductions are properly attributed to Baker McKenzie, (iii) the portion of the Content being reproduced is not altered or made available in a manner that modifies the Content or presents the Content being reproduced in a false light and (iv) notice is made to the disclaimers included on the Content. The permission to re-copy does not allow for incorporation of any substantial portion of the Content in any work or publication, whether in hard copy, electronic or any other form or for commercial purposes.