.jpg)
Germany's Finanzamt began sending its first mass wave of DAC7-triggered letters to platform sellers in 2026, built on data from the January 2026 filing cycle, in a country that estimates over €300 million in annual tax losses from undeclared platform income.
Gigapay is the Merchant of Record for creator payouts: one counterparty that pays your creators on your behalf and takes on the compliance, payouts, and support so you don't have to.
DAC7 is the EU directive that turned every digital platform into a data-collection arm of the tax authorities, and 2026 is the year the collected data started producing audits, seller letters, and fines.
This article breaks down who qualifies as a reporting platform operator, exactly what data you owe, the deadlines that structure your compliance year, the penalties per country, and what your options are if the obligation has landed on your finance team.
Key Takeaways
- DAC7 obliges platform operators to collect, verify, and report seller data annually.
- Reports for each calendar year are due 31 January; Germany's deadline is 2 February.
- Sellers below 30 goods sales and €2,000 are excluded; service sellers are not.
- Non-compliant sellers must be offboarded after two reminders plus 60 days.
- Penalties reach €50,000 per report in Germany and SEK 12,500 per seller in Sweden.
The Platform Economy Grew Faster Than Its Paperwork
Europe's creator payment economy now counts 8.6 million creators earning income, with brand budgets compounding at 26% per year. The infrastructure underneath that growth, however, kept moving money the way it did in 2015: individual invoices, informal onboarding, tax status nobody checked, and income that national tax authorities could not see.
That gap is what DAC7 was written to close. Directive (EU) 2021/514, in force since 1 January 2023, requires digital platforms to report who earns money through them and how much. The logic is simple from the regulator's side.
Instead of auditing millions of individual sellers, tax authorities compel the platforms in the middle to hand over structured data once a year, then cross-reference it against tax filings automatically.
For finance teams, the practical consequence is that any company operating a platform that connects sellers of goods or personal services with buyers has inherited a reporting function it never planned for: seller due diligence, TIN collection and verification, annual XML filings, and mandatory offboarding of sellers who won't cooperate.
2026 Is the Year DAC7 Data Started Biting
The first DAC7 reports were filed in January 2024. For two cycles, the data mostly sat in databases. That changed in 2025 and 2026, and the enforcement pattern now looks like this:
- Germany: The Bundeszentralamt für Steuern matches DAC7 data against tax filings via each seller's Steuer-ID, and the first mass letters from local Finanzämter landed in 2026. In parallel, investigators in North Rhine-Westphalia are running criminal probes into roughly €300 million in suspected evasion, with around 200 proceedings open, and Hamburg's tax office is auditing 140 influencers.
- Sweden: Skatteverket runs targeted influencer reviews and treats gifted products as taxable at market value. DAC7 kontrolluppgifter carry fines of SEK 2,500 to 12,500 per seller.
- UK: HMRC, which mirrors the OECD model rules behind DAC7, sends platform-data nudge letters directly to creators and recovered over £41 billion in FY2024, with employment status flagged as a priority.
- Spain: The Spanish DAC7 implementation runs through Modelo 238, with per-seller fines of roughly €200.
The pattern matters more than any single number. Tax authorities no longer need to find undeclared platform income. Platforms deliver it to them in a standardised schema every January. Every payment to a creator is now a compliance event, and the question for your team is whether your reporting holds up when the data is checked against it.
Who Counts as a Reporting Platform Operator
DAC7 applies to any software, app, website, or part of a website that connects sellers to buyers and facilitates a "relevant activity." The four relevant activities are:
- Sale of goods
- Personal services (this is where creator work, gig assignments, and freelance deliverables sit)
- Rental of immovable property
- Rental of any mode of transport
The scope is deliberately wide, and it does not stop at the EU border. A US or UK marketplace with EU-resident sellers must register in one EU member state and file there. The one-stop-shop structure means you file once, and that member state shares the data automatically with every country where your sellers are tax resident.
Three categories are carved out:
- Pure payment processors: Companies that only process payments are exempt, which is why Stripe, PayPal, and Wise carry no DAC7 duty on your behalf. If you use their rails, the reporting obligation stays with you.
- Listing-only platforms: Sites that advertise or list offers without facilitating the transaction or knowing its value.
- Redirect platforms: Services that only pass users to another platform where the transaction happens.
The exemption for payment processors is the detail finance teams most often miss. Running payouts through a payment rail feels like outsourcing the problem, but the rail moves money and generates paperwork while the reporting duty, the seller due diligence, and the fines all remain yours. Stripe's own documentation states that it accepts no liability and that users remain fully responsible.
Which Sellers You Must Report, and Which You Can Leave Out
Not every account on your platform is a "reportable seller." The directive draws these lines:
Reportable: Any active seller resident in an EU member state, or renting property located in the EU, who received consideration during the calendar year. The residence of the seller decides reportability, not where your platform sits.
Excluded:
- Casual goods sellers: individuals with fewer than 30 sales of goods and no more than €2,000 in total consideration for the year. This is the threshold that keeps someone clearing out a wardrobe on a resale app out of scope.
- Large accommodation providers: entities with more than 2,000 property rentals per listed property group (hotels, essentially).
- Government entities and listed companies.
Note what is missing from that exclusion list: there is no de minimis threshold for personal services. A creator who earned €150 through your platform in a single collaboration is just as reportable as one who earned €150,000.
For creator platforms, marketplaces, and agencies operating platform-like models, that means effectively every paid EU creator on your books belongs in the January file.
The Data You Owe: Due Diligence Requirements
For each reportable seller, your platform must collect and verify:
Individuals:
- Full legal name
- Primary address
- Tax Identification Number (TIN) and the member state that issued it
- VAT number, where available
- Date of birth
Entities:
- Legal name and primary address
- TIN and issuing member state
- VAT number, where available
- Business registration number
- Any permanent establishment in the EU
Transaction data, per seller, per quarter:
- Total consideration paid or credited
- Number of relevant activities
- Fees, commissions, and taxes withheld or charged by the platform
- The financial account identifier the consideration was paid to
The verification duty is real work, not a checkbox. TIN formats differ per country: a Belgian national number runs 11 digits in a YY.MM.DD-SSS.CC format, a Bulgarian EGN runs 10 digits, an Irish PPS number is 7 digits plus letters, and an incorrect format in your file can invalidate the record. Platforms must confirm the information is reliable, using all records available to them, and re-verify when circumstances suggest the data has gone stale.
GDPR runs alongside all of this. You are collecting tax identifiers and dates of birth at scale, which means lawful-basis documentation, seller notification that their data will be reported, retention policies, and secure handling. DAC7 compliance done badly can create a data-protection problem on top of a tax one.
The Compliance Calendar: What Happens When
DAC7 runs on an annual cycle with two hard dates and one process deadline that most teams discover too late:
The trap in this calendar is the offboarding mechanism. If a seller fails to provide required information, you must send two reminders. If 60 days pass after the second reminder without a response, you are required to either close the seller's account and block re-registration, or withhold their payments until the data arrives.
Work backwards from 31 December and the operational reality appears: any seller with missing data in October is already inside the danger window. Chasing TINs from hundreds of creators in December, during campaign season, is how platforms end up choosing between filing an incomplete report and freezing payouts to the exact people their business depends on. The Q4 data-collection panic among platforms is predictable enough that it recurs every year.
What Non-Compliance Costs, Country by Country
Each member state sets its own penalty regime, and the spread is wide:
- Germany: fines up to €50,000 per report under the PStTG, alongside the criminal-probe environment described above.
- Sweden: SEK 2,500 to 12,500 per seller for defective kontrolluppgifter. At 500 unreported or misreported sellers, the exposure runs to SEK 6.25 million.
- Spain: roughly €200 per seller under the Modelo 238 regime. Small per unit, but per-seller fines scale with exactly the thing your platform is trying to grow.
- Other member states: penalty ceilings reach €2 million or more in some countries, including percentage-based penalties on unreported amounts and daily fines for continuing non-compliance.
The direct fines are only the first layer. A defective DAC7 file signals to the receiving authority that your wider tax operation deserves a look, and DAC7 data is precisely what feeds the influencer audits now running in Germany, Sweden, and the UK.
One anonymised Gigapay client came to us for a DAC7 rescue spanning creators in 42 countries, and the cost of remediation after the fact reliably exceeds the cost of doing the collection right at onboarding.
DAC7 Does Not Arrive Alone: The Wider Reporting Stack
Finance teams tend to meet DAC7 first, but it is one instrument in a stack that is tightening around platform payments:
- CESOP (live since 2024): payment service providers report cross-border payment data, giving authorities a second dataset to reconcile against DAC7 files.
- DAC8 (2026): extends automatic exchange to crypto-asset reporting.
- EU Platform Work Directive: transposition due 2 December 2026, introducing a rebuttable presumption of employment for digital labour platforms, with the burden of proof on the platform. Creator marketplaces are plausibly in scope.
- ViDA: mandatory e-invoicing and digital reporting for intra-EU B2B, phasing in from 2030, with national mandates like France's September 2026 e-invoicing requirement arriving earlier.
- VAT reverse charge (Art. 44): already live, putting self-assessment duties on brands and agencies buying cross-border creator services.
The direction is one-way. Each instrument gives authorities another dataset, and each dataset makes gaps in the others visible. A platform that treats DAC7 as a standalone January exercise will meet the same problem again under a different acronym within eighteen months.
Build the Reporting Function, or Move the Obligation
Once DAC7 lands on your roadmap, you have three options, and each has a real cost profile.
1. Build in-house
You need onboarding flows that collect and validate TINs across 27 national formats, quarterly consideration tracking, reminder-and-offboarding logic, XML generation to the official schema, and someone who owns the January filing. Building payout and compliance infrastructure of this kind typically runs €80,000 to €250,000 up front plus permanent maintenance, and the true cost of manual creator payments already sits at €40 to 60 per payment with roughly 6 hours of admin per creator payment before DAC7 work is added.
2. Buy tooling
AP platforms and compliance vendors sell DAC7 modules that generate the file for you. Tooling helps with the mechanics, but the legal position is unchanged: you remain the reporting platform operator, the data quality is your problem, and the fine arrives addressed to you.
3. Change the structure
A Merchant of Record sits in the transaction differently. Gigapay purchases the creator's deliverable and resells it to you, becoming the formal counterparty to the creator. Your creators onboard with Gigapay, where KYC, self-employment status checks, and DAC7 reporting scope are handled by us: Gigapay files with Skatteverket, and Skatteverket exchanges the data with each creator's home tax authority.
Your vendor master shows one counterparty instead of a thousand micro-vendors, and your finance team's January looks like every other month.
The kill question we put to any team evaluating payout rails applies here: who files your DAC7 report in January, and who pays the fine if it's wrong? If the honest answer is "we do, on both counts," the build-versus-buy question deserves a place on this quarter's agenda rather than next December's.
What This Means for Your 2026–27 Planning
Three moves worth making now, in order:
- Classify yourself honestly: Map your model against the relevant activities and the facilitation test. "We're just a marketplace feature" has not survived contact with a regulator yet, and the processor exemption does not cover you just because a processor sits in your flow.
- Audit your seller data before Q4: Count how many active EU sellers have a verified TIN on file today. Every gap is a reminder letter, a 60-day clock, and a potential frozen payout during your busiest quarter.
- Price the obligation properly: Put the build cost, the tooling cost, and the structural option side by side, including the admin hours and the penalty exposure. The comparison rarely favours the status quo once the invisible costs are on the page.
Conclusion
Gigapay is the Merchant of Record for creator payouts: for companies working with creators at scale, we become the payer of record of your creators, so campaigns launch at marketing speed while tax, reporting, and the associated support become ours across 65+ markets.
DAC7 turned platform operators into annual reporters of seller identity and income, with due diligence closing 31 December, filings due 31 January, mandatory offboarding rules for uncooperative sellers, and per-seller fines that scale with your growth.
The 2026 enforcement wave shows the data is now being used, and the teams that get ahead of it are restructuring who carries the obligation rather than adding headcount to carry it themselves.
Book a demo with Gigapay to see how one counterparty replaces the entire reporting burden.
Read Next:
- Tipalti + Gigapay: Where Your AP Suite Ends and Liability Transfer Begins
- Gigapay vs. Stripe Connect vs. Tipalti vs. PayPal Payouts
- The Best Influencer Payment Platforms in 2026: Why Gigapay Leads the Field
FAQs:
1. What is DAC7 and who does it apply to?
DAC7 is the EU directive (2021/514) that applies to digital platform operators, inside or outside the EU, that facilitate the sale of goods, personal services, property rentals, or transport rentals involving EU-resident sellers, requiring them to collect, verify, and report seller data annually.
2. When is the DAC7 reporting deadline for platform operators?
The DAC7 reporting deadline for platform operators is 31 January each year, covering the previous calendar year, with seller due diligence completed by 31 December; Germany's national deadline under the PStTG is 2 February.
3. Which sellers are excluded from DAC7 reporting?
The sellers excluded from DAC7 reporting are casual goods sellers with fewer than 30 sales and no more than €2,000 in annual consideration, large accommodation providers with over 2,000 rentals per property group, government entities, and listed companies; personal-service sellers such as creators have no exclusion threshold.
4. What are the penalties for DAC7 non-compliance?
The penalties for DAC7 non-compliance vary by member state: up to €50,000 per report in Germany, SEK 2,500 to 12,500 per seller in Sweden, roughly €200 per seller in Spain, and ceilings of €2 million or more in some countries.
5. How does a Merchant of Record change DAC7 obligations for platforms?
A Merchant of Record changes DAC7 obligations for platforms by becoming the formal counterparty to each creator: with Gigapay, creators onboard with us, KYC and DAC7 reporting scope are handled by us through Skatteverket, and your platform keeps one vendor of record instead of running its own seller due diligence and January filing.
