Investigators in North Rhine-Westphalia are running criminal probes into roughly €300 million in suspected tax evasion by influencers, with around 200 proceedings open, while Hamburg's tax office audits 140 creators and the first mass letters built on DAC7 data landed on German doorsteps in 2026.
Gigapay is the Merchant of Record for creator payouts: we become the payer of record for your creators, so campaigns launch at marketing speed while tax reporting, including DAC7, becomes ours.
DAC7 is one EU directive, but 27 member states transposed it into 27 national laws, each with its own portal, its own penalty schedule, and its own quirks, and the UK runs a parallel regime of its own.
This article breaks down what finance teams owe under DAC7 in every relevant country, what the fines look like, where the calendar diverges, and how the reporting burden can move off your desk entirely.
Key Takeaways
- DAC7 is one directive, but penalties, portals, and TIN formats differ in every member state.
- Germany fines up to €50,000 per report; the Netherlands up to roughly €1 million.
- Sweden and Spain fine per seller, so exposure grows with your creator roster.
- Service sellers have no de minimis threshold; every paid creator is reportable.
- A Merchant of Record files DAC7 for you, in one country, for all EU creators.
The 2026 Enforcement Wave: DAC7 Data Is Now Being Used
The first DAC7 reports were filed in January 2024. For two cycles, most of that data sat in databases while authorities built the matching infrastructure. That period is over.
Germany's Bundeszentralamt für Steuern now matches DAC7 files against tax returns via each seller's Steuer-ID, and local Finanzämter started sending letters at scale in 2026 (Gigapay, July 2026). Skatteverket in Sweden runs targeted influencer reviews and treats gifted products as taxable at market value.
HMRC, which mirrors the OECD model rules behind DAC7, sends platform-data nudge letters directly to creators and recovered more than £41 billion in FY2024 with employment status flagged as a priority.
The pattern is the same everywhere. Authorities receive platform data, cross-reference it against what sellers declared, and act on the gaps. For a finance team, the uncomfortable part is that the data authorities are acting on a platform, and if you pay creators at scale without an intermediary, that platform may be you.
The wider stack is tightening at the same time:
- CESOP has been live since 2024, giving authorities a second dataset of cross-border payment records to reconcile against DAC7 files.
- DAC8 extends automatic exchange to crypto assets in 2026.
- The EU Platform Work Directive lands on 2 December 2026 with a rebuttable presumption of employment for digital labour platforms.
Every creator payment is now a compliance event, and DAC7 is the instrument that makes it visible.
Why Creator Payouts Put Finance Teams in Scope
Around 8.6 million Europeans now earn from creator work, and brand budgets for creator marketing compound at roughly 26% a year. Most of that money moves like it did in 2015: a marketer agrees a fee in a DM, finance onboards a 19-year-old as a vendor, someone chases a tax ID, and the payment goes out weeks later. What changed is that the tax authorities now expect a report on that flow.
DAC7 defines a platform broadly: any software, website, or app that connects sellers with users for a relevant activity, where the operator knows or can reasonably know the consideration. Personal services are a relevant activity, and paid creator work is a personal service.
A brand running its own creator marketplace, an agency operating a portal that matches creators with campaigns, or a creator-economy product that pays out to talent can all fall within the definition of a reporting platform operator. The moment you do, you inherit seller due diligence, TIN collection and validation, annual XML filings, and mandatory offboarding of creators who will not cooperate.
Finance teams rarely planned for this. Marketing bought the tool or built the workflow, procurement approved the vendors, and the reporting obligation quietly landed on finance because finance owns tax.
Understanding what that obligation looks like country by country is the first step to deciding whether to carry it or transfer it.
The DAC7 Baseline Every Country Shares
Before the national differences, here is the core that Council Directive (EU) 2021/514 imposes uniformly.
1. Who reports
Reporting platform operators that are tax resident, incorporated, managed, or have a permanent establishment in the EU (union platform operators), plus non-EU operators that facilitate relevant activities by EU-resident sellers or rentals of EU property. Non-EU operators register in a single member state of their choice.
2. Which sellers
Reportable sellers are EU tax residents who sold goods, provided personal services, rented immovable property, or rented transport through the platform. Governmental entities, listed companies, hotel operators with more than 2,000 rentals per property listing, and casual goods sellers (fewer than 30 sales and no more than €2,000 in a year) are excluded.
There is no de minimis threshold for personal services. A creator paid €150 once is reportable.
3. What data
- For individuals: name, primary address, TIN and issuing member state, VAT number if any, date of birth.
- For entities: legal name, address, TIN, VAT number, business registration number, and any EU permanent establishment.
- For everyone: financial account identifier, total consideration paid per quarter, number of relevant activities per quarter, and fees, commissions, or taxes withheld per quarter.
That is 22 data points per seller in a full record (Omnivoo, May 2026).
4. When
Due diligence must be completed by 31 December of the reporting period. Reports are filed by 31 January of the following year, in XML, with the competent authority of the member state where the operator is resident or registered.
Sellers must receive a copy of the reported information by the same date. The competent authority then exchanges the data with each seller's home state by the end of February.
5. Offboarding
If a seller fails to provide required information after two reminders, and 60 days have passed since the second, the operator must close the seller's account or withhold payment until the information arrives.
6. Records
Documentation supporting the due diligence must be kept for at least five years, and in several states for up to ten.
Everything above is common ground. Everything below is where the countries diverge.
How the Country Layer Works
DAC7 uses a single-filing model. You report once, in one member state, and that authority distributes the data to the other 26 through automatic exchange. This has three practical consequences.
First, the country you file in determines your portal, your XML schema flavour, your language, your support desk, and your penalty regime.
- A Swedish operator files with Skatteverket and answers to Swedish penalty law.
- A German operator uses the BZSt DAC7 portal and answers to the Plattformen-Steuertransparenzgesetz (PStTG).
- A non-EU operator that chose Ireland answers to Irish Revenue.
Second, the country of your creators determines what data you must collect and validate.
- A German creator needs a Steuer-ID and, if VAT registered, a USt-IdNr.
- A Spanish creator needs a NIF or DNI.
- A Dutch sole trader uses their BSN, and a French micro-entrepreneur uses their numéro fiscal.
Each format has its own check digits and its own validation service, and each authority receiving the data will match on it.
Third, penalties are set nationally, not by the EU. The directive only requires them to be effective, proportionate, and dissuasive. Member states interpreted that instruction very differently, which is why the ceilings below range from a few thousand euros to more than a million.
Country-by-Country Breakdown: What You Owe and What It Costs to Get Wrong
The table below summarises the headline penalty ceilings and filing routes as published by national authorities and compiled by compliance vendors. Deadlines are the statutory 31 January unless a national portal or authority notice moved them; treat every date as something to confirm against the authority's own calendar each cycle.
A few of these deserve more than a row.
Germany: the hottest enforcement environment in Europe
Germany implemented DAC7 through the Plattformen-Steuertransparenzgesetz, with the Bundeszentralamt für Steuern as the competent authority and a dedicated DAC7 portal for XML submission.
Fines run to €50,000 per report for late, incomplete, or incorrect filings. The real risk sits in what happens with the data afterwards. The BZSt matches reported income to Steuer-IDs, and 2026 was the year the resulting letters went out at scale.
Around that sit the North Rhine-Westphalia criminal probes covering roughly €300 million in suspected evasion, Hamburg's audit of 140 influencers, and the Deutsche Rentenversicherung running out-of-cycle KSK-only audits with retroactive years and fines to €50,000.
A German creator's DAC7 record is one dataset among several that an auditor can pull, and a company that paid that creator directly should expect its own name to appear in the file.
France: DAC7 plus Loi Influence plus e-invoicing
France files through the impots.gouv DPI portal with penalties up to €50,000. The DAC7 filing is the easy part for French finance teams in 2026. The Loi Influence (2023-451) makes written contracts mandatory above €1,000 per advertiser per year with required clauses on pain of nullity, ARPP is actively enforcing disclosure, and every French company must be able to receive e-invoices from 1 September 2026.
A finance team paying French creators is running three compliance workstreams on the same population.
Spain: per-seller fines and a bespoke form
Spain transposed DAC7 through Ley 13/2023 and reports through Modelo 238, with platform registration on Modelo 040. The penalty is roughly €200 per seller, which sounds small until you multiply it by a creator roster of 500 and add the reputational cost of an incorrect Modelo 238 sitting in AEAT's system.
Direct payers to Spanish creators also face IRPF withholding at 15% or 7% and the Modelo 111/190 filings that go with it. Zexel built an entire business on Spanish creator-payment complexity alone, which tells you how much work sits behind that one row in the table.
The Netherlands: the highest ceiling in the EU
The Dutch implementation carries a fine of up to €1,030,000 for a platform operator that knowingly evades its reporting duty. Dutch sole traders use their BSN as a TIN, and Belastingdienst is developer-friendly enough that non-EU platforms often choose the Netherlands as their single member state of registration. That means Dutch penalty law applies to your entire EU filing, not only your Dutch creators.
Sweden: per-seller fines and the home of the KU-forms
Skatteverket collects DAC7 data through kontrolluppgifter from platform operators, with fines of SEK 2,500 to 12,500 per seller for defective records. At 500 misreported sellers the exposure runs to SEK 6.25 million.
Sweden also operates KU14 reporting under bilateral exchange agreements with Denmark, Norway, Iceland, and others, and the plattformsarbete law (SOU 2026:3) is in consultation. Skatteverket's influencer reviews use DAC7 data as their starting point.
Ireland and Luxembourg: the outliers on dates
Irish Revenue's ROS platform accepted 2025 filings until 7 February 2026, and Luxembourg's window ran to 15 February. Ireland's penalty structure is worth remembering because it accrues daily: €19,045 for the initial failure plus €2,535 for every day late. A report that is three weeks overdue costs more than €70,000.
Poland: the late arrival
Poland transposed DAC7 with effect from July 2024, so the first Polish reports covered 2023 and 2024 together and were due 31 January 2025. The penalty ceiling is PLN 1,000,000 per breach. Finance teams with Polish creators who assumed nothing was owed for 2023 discovered otherwise in 2025.
Outside the EU: What Changes for the UK, Norway, Switzerland, and the US
United Kingdom
DAC7 does not apply post-Brexit. The UK implemented the OECD Model Reporting Rules for Digital Platforms from 1 January 2024, with first reports due 31 January 2025 to HMRC.
Penalties include £5,000 for failure to register or report, £100 per inaccurate seller record, and daily penalties for continued failure. HMRC has been unusually forward in using the data, sending nudge letters directly to creators.
UK finance teams also carry IR35 fee-payer liability and, since 6 April 2026, umbrella joint and several liability for PAYE.
Norway, Iceland, Liechtenstein, Switzerland
None are EU member states, so their resident creators are not reportable sellers under DAC7. A Swedish platform operator still reports Nordic and EEA payees through KU14 under bilateral exchange, and Switzerland exchanges information with Sweden through treaty channels. The absence of DAC7 does not mean the absence of reporting.
United States
DAC7 and Form 1099-K run in parallel with no offset. A platform paying both US and EU creators maintains two reporting stacks. If your creator roster spans both, DAC7 compliance is one of at least two annual filings, and the data models do not line up.
The DAC7 Calendar by Country
Most of the year looks the same in every member state. The differences cluster around January and February.
- 1 January to 31 December: collect and validate seller data at onboarding; complete due diligence on every new seller by 31 December. In the first year of operation, pre-existing sellers may be validated by 31 December of the following year.
- Throughout the year: issue reminders to non-cooperating sellers; freeze payment or close accounts 60 days after the second reminder.
- 31 January: statutory filing deadline in Germany, France, Spain, Italy, the Netherlands, Belgium, Austria, Sweden, Denmark, Finland, Poland, Portugal, and the majority of the EU. Sellers must receive their statement by the same date.
- Early February: Ireland (7 February in the 2026 cycle) and Luxembourg (15 February in the 2026 cycle) closed later; several authorities, including the BZSt, have published tolerance windows in previous cycles.
- End of February: competent authorities exchange the data with each seller's member state of residence.
- March onwards: authorities match, reconcile, and write to sellers; audit activity in Germany, Sweden, and the UK follows from this exchange.
Build a January that starts in October. Teams that discover a missing Steuer-ID on 20 January have no lawful way to pay that creator and no time to reach them.
What It Costs to Run DAC7 In-House
Finance leaders tend to price DAC7 as a January project. The actual cost is spread across the whole year and across several roles.
People
A tax compliance specialist in Germany, the Netherlands, or Sweden typically costs €65,000 to €95,000 in salary before employer contributions, and DAC7 across multiple countries needs someone who understands TIN formats, XML schema differences, and the offboarding rules well enough to defend the file under audit.
Most mid-market teams do not have that person and borrow time from a controller who already runs month-end.
Time
Manual creator payments cost roughly €40 to €60 each in true cost and consume around six hours per creator payment across marketing, finance, and support once you include onboarding, chasing documents, and reconciliation. Layer DAC7 due diligence on top of that and each new creator becomes a small compliance file.
Systems
Building payout and DAC7 infrastructure in-house typically costs €80,000 to €250,000 up front, plus permanent maintenance as 27 national schemas evolve. Vendors that sell tooling rather than liability transfer leave the reporting duty with you.
Exposure
A per-seller regime such as Sweden or Spain scales your fine with your growth. A per-report regime such as Germany caps the fine but signals to the receiving authority that your wider tax operation deserves a look.
The remediation cost after an audit reliably exceeds the cost of doing the collection right at onboarding; one Gigapay client came to us for a DAC7 rescue spanning creators in 42 countries.
What DAC7 Does Not Cover: The Parallel Obligations by Country
DAC7 is a transparency instrument. It creates no new tax and satisfies none of the local obligations that already exist. Finance teams paying creators directly still owe, depending on the country:
- Germany: KSK levy of 4.9% on commissioned creative work, including via agencies, and §50a withholding at 15.825% on foreign creators, with the company liable if it fails to deduct.
- Spain: IRPF withholding at 15% or 7% with Modelo 111 and 190 filings, RD 1619/2012 self-billing rules, and VeriFactu invoicing-software requirements.
- France: Loi Influence contract requirements and e-invoicing readiness from September 2026.
- UK: IR35 fee-payer liability and umbrella joint and several liability from April 2026.
- Denmark and the Nordics: KU14 reporting for Swedish operators under bilateral exchange.
- Everywhere in the EU: VAT reverse charge on cross-border B2B creator invoices, e-invoicing mandates arriving in Belgium, Croatia, France, Germany, and Poland on staggered timelines, and the Platform Work Directive from December 2026.
DAC7 tells the tax authority who you paid. These rules determine whether you paid them correctly. Getting the first right while ignoring the second is how audits start.
Where Finance Teams Get DAC7 Wrong, Country by Country
The same errors surface in every DAC7 remediation we see.
- Applying the goods threshold to services: The 30-sale, €2,000 exclusion applies only to goods. Every paid creator is a personal-service seller and is reportable from the first euro.
- Wrong or unvalidated TINs: German Steuer-IDs are 11 digits with a check digit; Spanish NIFs are eight digits plus a letter; Dutch BSNs are nine digits with an eleven-test; Portuguese NIFs begin with 1 or 2 for individuals. Authorities match on these numbers, and a transposed digit turns a compliant record into a defective one.
- Filing in the wrong state: Non-EU operators sometimes register where the portal is easiest without checking the penalty regime that comes with it. Your member state of registration is hard to change and governs your entire EU filing.
- Ignoring the offboarding rule: Operators keep paying creators who never supplied a TIN because marketing needs the campaign live. Two reminders plus 60 days is the law, and continued payment after that is a breach in every member state.
- Missing the seller statement: Reporting to the authority is only half of 31 January. Each seller must receive their own statement by the same date, and creators who receive nothing cannot reconcile their own returns.
- Treating the file as finished: Records must be retained for five to ten years and produced on request. An audit in 2028 will ask for the due diligence behind a 2025 file.
The Structural Option: Move the Reporting to the Platform That Pays
Everything above is what a finance team owes if it operates the platform. There is a second design. Instead of building the reporting function, you place a Merchant of Record between your company and your creators. Gigapay purchases each creator's deliverable and resells it to you, which makes Gigapay the counterparty, the payer of record, and the platform operator for DAC7 purposes.
In practice that means Gigapay collects and validates each creator's name, address, TIN, VAT number, and company details at onboarding, files DAC7 with Skatteverket for every EU-resident creator across 65+ markets, files KU14 for Nordic and other bilateral-exchange payees, handles the KSK position for German creators, and takes the creator support that comes with all of it.
- You receive one contract and one invoice.
- Your creators get paid instantly when accounts are pre-funded, and on all new plans you cover the fees, so creators keep what they earn.
- Payment rails and AP tools move money and generate paperwork while leaving the liability with you; a Merchant of Record absorbs it.
The kill question we put to any team weighing the two designs is simple: who files your DAC7 report in January, and who pays the fine if it is wrong? If the answer is your controller and your company, the by-country table above is your operating manual. If the answer is Gigapay, it is background reading.
Conclusion
Gigapay is the Merchant of Record for creator payouts, the one vendor that pays your creators on your behalf by taking on the compliance, the payouts, and the support so you do not have to.
DAC7 turned every platform that connects sellers with buyers into an annual reporter, and 27 national implementations turned one directive into 27 penalty regimes, from €200 per seller in Spain to more than €1 million in the Netherlands, with Germany's enforcement machinery now converting the data into audits.
Finance teams paying creators directly own that reporting, the parallel local obligations that DAC7 leaves untouched, and the January that starts in October.
Book a demo to see how one counterparty replaces the entire by-country reporting burden.
Read Next:
- Tail Spend Management for Marketing Departments: A Procurement Guide
- Gigapay vs PayPal: FX, Fees, and the Compliance Gap in Global Payouts
- Paying Freelancers and Creators in Spain: IRPF Withholding, Modelo 111/190, and Self-Billing
FAQs:
1. What does DAC7 require finance teams to report by country?
DAC7 requires finance teams operating a platform to report the same seller data in every EU country: name, address, TIN and issuing state, VAT number, date of birth or business registration number, financial account identifier, and quarterly consideration, activity counts, and fees withheld. What differs by country is the filing portal, XML schema flavour, penalty schedule, and TIN format that must be validated.
2. What are the DAC7 penalties by country in 2026?
The DAC7 penalties by country in 2026 range from €200 per seller in Spain and SEK 2,500 to 12,500 per seller in Sweden, to €50,000 per report in Germany, France, Belgium, and Portugal, €200,000 in Austria, €250,000 in Luxembourg, PLN 1,000,000 in Poland, and up to €1,030,000 in the Netherlands for knowing evasion.
3. When is the DAC7 reporting deadline in each EU country?
The DAC7 reporting deadline in each EU country is 31 January for the previous calendar year, with due diligence completed by 31 December. Ireland's ROS accepted filings until 7 February in the 2026 cycle and Luxembourg until 15 February, and authorities such as the BZSt have published tolerance windows in earlier cycles.
4. Does DAC7 apply to creator and influencer payments?
DAC7 applies to creator and influencer payments because paid creator work is a personal service, which is a relevant activity under the directive, and personal services carry no de minimis threshold. Any brand, agency, or platform that connects creators with buyers and knows the consideration paid can qualify as a reporting platform operator.
5. Who files DAC7 when a company uses a Merchant of Record for creator payouts?
When a company uses a Merchant of Record for creator payouts, the Merchant of Record files DAC7 as the platform operator and payer of record. Gigapay collects and validates creator data at onboarding, files DAC7 with Skatteverket for EU-resident creators across 65+ markets, files KU14 where bilateral exchange applies, and issues one contract and one invoice to the client.
.jpg)
.jpg)
.jpg)
