DAC7: the EU digital platform operator reporting rules explained

If your firm lets third parties sell goods, rent property or transport, or offer services to users — and takes a cut — you may be a “platform operator” who has to report every reportable seller to a tax authority once a year. That is DAC7: Council Directive (EU) 2021/514, the sixth amendment to the EU’s administrative-cooperation directive, which extended automatic tax-information exchange to the digital platform economy. This piece explains who is caught, what has to be collected and reported, the due-diligence and deadline mechanics, how a payments or fintech firm tells whether it is in scope, and — with worked examples — how the rule actually applies.

1. What DAC7 is

DAC7 is Council Directive (EU) 2021/514 of 22 March 2021, amending Directive 2011/16/EU on administrative cooperation in taxation (the “DAC”). It obliges digital platform operators to collect, verify and report information about the sellers active on their platform, and it plugs that data into the automatic exchange between member-state tax authorities. It is deliberately aligned with the OECD Model Reporting Rules for Digital Platform Operators, so a group already reporting under the OECD framework outside the EU is working from the same due-diligence logic. The rules applied from 1 January 2023, with the first reports due in early 2024 for the 2023 period.

2. Who is a “platform operator” — and who is caught

A platform is software (a website or app) that connects sellers to users to carry out a relevant activity; a platform operator is the entity that contracts with sellers to make the platform available. DAC7 catches operators whether they are established inside or outside the EU, as long as they facilitate a relevant activity for reportable sellers or the rental of EU-located immovable property. The relevant activities are a closed list:

• rental of immovable property (residential, commercial, parking spaces);
• a personal service (time- or task-based work performed at a user’s request);
• sale of goods;
• rental of any mode of transport.

Pure payment processing, listing/advertising without contracting sellers, and redirecting users to a platform are carved out of the definition — which is why most payment institutions and EMIs are not platform operators in their core business. The exposure arises where a fintech also runs a marketplace: an app that lets users sell goods or offer gig services to each other, and settles the money, can be both a payment firm and a reporting platform operator.

3. What has to be collected and reported

For each reportable seller, the operator must collect and report identifying data — name, primary address, tax identification number (TIN) and issuing member state, VAT number where held, business registration number, and for entities any permanent establishment in the EU through which relevant activities are carried out. For sellers renting property, the address of each listed property and its land-registration number where available. The financial data reported is the consideration paid or credited each quarter, the number of relevant activities, and any fees, commissions or taxes the operator withheld — reported per quarter and per activity, together with the financial-account identifier (such as the IBAN) to which the consideration was paid.

4. Excluded sellers — who you don’t report

Not every seller is reportable. DAC7 excludes defined categories, so due diligence is as much about filtering out as reporting in:

The small-goods-seller carve-out is the one that matters most for consumer marketplaces: a casual user who sells a handful of items below the threshold is not reported, but crosses into scope the moment either limit is exceeded.

5. Due diligence, deadline and the reporting channel

The operator runs due-diligence procedures (set out in Annex V of the DAC) to identify reportable sellers, collect the data, and verify its reliability using records it holds and public interfaces such as the EU VIES VAT system. Reporting is annual: the operator files with the tax authority of a single member state where it is resident or registered, and that authority exchanges the data with the other member states where the sellers are tax-resident or the property is located. The filing deadline is 31 January of the year following the reportable period. A single reporting in one member state, plus a registration duty for non-EU operators, avoids duplicate filing across the EU.

6. How it landed in a member state: Spain’s Modelo 238

DAC7 is a directive, so each member state transposes it. Spain is a useful worked instance: Real Decreto 117/2024 of 30 January set the due-diligence rules, and Orden HAC/72/2024 of 1 February approved two forms — Modelo 040 (registration/census of platform operators) and Modelo 238 (the annual DAC7 information return). Modelo 238 is filed electronically in January of the year after the reportable period (so 2025 data is filed 1–31 January 2026); the exceptional first filing for 2023 data ran into early 2024. Other member states have their own form and portal, but the underlying data set and 31-January rhythm are common across the EU.

7. How the rule applies — three worked examples

Scenario A — a fintech that adds a marketplace.

• Facts: An EMI launches an in-app second-hand marketplace where users sell goods to each other and the EMI settles payments and takes a fee.
• Rule: Facilitating the sale of goods for consideration and contracting with the sellers makes the EMI a platform operator for that activity — separate from its e-money licence.
• Action: Build DAC7 due diligence into marketplace onboarding (collect TIN/VAT, verify), track sales count and consideration per seller, and register plus file the annual return (Modelo 238 in Spain).
• Outcome: The core payments business stays out of scope; only the marketplace layer reports, and only for sellers above the small-goods threshold.

Scenario B — the casual seller who crosses the threshold.

• Facts: A user sells 22 items for EUR 1,400 in the first half of the year, then 15 more for EUR 900 in the second half.
• Rule: The small-goods exclusion needs both fewer than 30 sales and ≤ EUR 2,000 for the whole period; here the year totals 37 sales and EUR 2,300 — both limits are breached.
• Action: The platform must have collected and verified the seller’s data during the year and reports the full-period consideration, split by quarter, on the annual return.
• Outcome: Because thresholds are tested over the whole period, the operator cannot decide reportability sale-by-sale — it needs running totals and a back-stop that forces data collection before the limit is hit.

Scenario C — a non-EU platform with EU sellers.

• Facts: A platform operator established outside the EU facilitates short-term rentals of apartments located in two member states.
• Rule: DAC7 reaches non-EU operators that facilitate the rental of EU-located immovable property; the operator must register in a single member state and report there.
• Action: Register (in Spain, via Modelo 040), run Annex-V due diligence including each property’s address and land-registration number, and file the annual return in the chosen member state.
• Outcome: The data is exchanged with the member states where the properties sit, without the operator filing separately in each.

8. Where DAC7 sits next to the other reporting regimes

DAC7 is one of a family of EU tax-transparency regimes a fintech group has to keep straight. It is distinct from DAC8, which extends the same DAC framework to crypto-asset service providers; from CRS, the financial-account reporting standard for financial institutions; and from CESOP, the payment-data reporting that payment service providers file for VAT-fraud detection. A firm can be caught by several at once — the analysis is activity-by-activity, and the obligor differs (platform operator, crypto service provider, financial institution, payment service provider).

9. FAQ

10. What to do, today

• Run an activity-by-activity scoping test: does any part of the business contract with sellers to facilitate a relevant activity? If so, that layer is likely a platform operator.
• Build Annex-V due diligence into onboarding — collect and verify TIN/VAT and, for rentals, property address and land-registration number.
• Track sales count and consideration per seller on a running, whole-period basis so threshold tests and quarterly figures are ready at year-end.
• Implement the account-closure/payment-withholding back-stop for sellers who won’t provide data after reminders.
• Register and file in one member state (Modelo 040 + 238 in Spain) by the 31-January deadline, and keep DAC7 separate from your DAC8, CRS and CESOP obligations.

Related: DAC8 crypto-asset reporting · CRS for EMIs · What is CESOP reporting · CESOP in Spain (Modelo 379)