Spanish Tax Authority Crypto Audit: What to Expect, How to Act, and What Rights You Have

Receiving a notification from the Spanish Tax Authority (AEAT) related to your cryptocurrencies triggers an immediate mix of uncertainty and concern. What exactly do they know? What will they ask for? Could I end up with a penalty? These are questions that come up more and more frequently in forums, social media, and tax advisory offices.

The truth is that the AEAT has been preparing for this moment for years. With the progressive incorporation of data analysis tools, the DAC8 directive already in its implementation phase, and automatic information exchange agreements with international exchanges, the Tax Authority's ability to detect inconsistencies in cryptocurrency declarations has taken a quantum leap. In 2025, the Tax Agency included cryptocurrencies as a priority line in its Annual Tax Control Plan for the first time, and the results are starting to show.

But here's the part almost nobody talks about: an audit is not synonymous with a penalty. It's a regulated administrative procedure, with deadlines, guarantees, and rights. Those who arrive prepared, with organised documentation and a solid tax report, have a very good chance of closing the procedure without negative consequences.

This article is a comprehensive guide to understanding the process from start to finish.

Before discussing audits, it's worth understanding how the AEAT comes to suspect that something doesn't add up in your tax situation. It's not a lottery: there's a structured system for obtaining and cross-referencing information.

Direct Information Sources

The AEAT receives data from multiple channels, incorporating new ones each year:

Centralised Exchanges (CEX): Platforms such as Coinbase, Kraken, and Bitstamp, which operate under EU licences, already report information about their Spanish users. With DAC8 coming into force, this obligation extends to all exchanges serving European territory. The data includes trading volumes, year-end balances, and verified identity (KYC).

Banking Institutions: Banks report SEPA transfers linked to cryptocurrency platforms to the AEAT. A recurring transfer to Binance or Kraken is recorded in the Tax Agency's systems, even if the exchange hasn't yet reported directly.

Form 721 and Form 720: Informative declarations of foreign assets are another valuable source. If you've declared cryptocurrencies on Form 721 but don't reflect the corresponding gains in your income tax return, an automatic alert is generated.

International Information: Through information exchange agreements (CRS and, soon, CARF), the AEAT receives data from tax authorities in other countries. If you hold cryptocurrencies on an exchange based outside Spain, the information may already be in the Tax Authority's hands.

The Cross-Referencing Algorithm: How Alerts Are Triggered

The AEAT doesn't review declarations one by one. It uses an automated risk management system that cross-references multiple data sources and assigns a risk score to each taxpayer. Factors that raise this score include:

Discrepancies between declared income and bank movements. If your salary is €30,000 annually but you've moved €200,000 in transfers to exchanges, the system detects it.

Unjustified increases in wealth. A significant change in your declared assets (property purchases, high-end vehicles, investments) without a source of income to explain it triggers a review.

Inconsistencies between tax forms. Declaring cryptocurrencies on Form 714 but not including the corresponding gains or losses in your income tax is an unmistakable signal.

Operations with flagged exchanges. Certain platforms or trading volumes are subject to more intensive scrutiny, especially those that have been subject to mass information requests.

In short, the AEAT no longer needs to "look for you": the data arrives on its own and the system analyses it automatically.

One of the most common mistakes is confusing these three procedures. Each has different scope, duration, and consequences, and knowing which one you're in is essential for responding correctly.

Information Request (Requerimiento)

This is the mildest and most frequent procedure. The Tax Authority asks you to provide documentation or clarify certain aspects of your declaration. It doesn't mean an infraction has been detected; it may simply be a routine verification.

Key characteristics:

• Notified by certified letter or through the AEAT's Electronic Office
• You have 10 business days to respond (extendable upon justified request)
• Usually requests specific documentation: transaction receipts, exchange statements, capital gains reports
• If you respond correctly and completely, the procedure closes without consequences
• Not responding is a serious mistake: silence is interpreted as lack of cooperation and can escalate to a review or audit

Limited Review (Comprobación Limitada)

This is an intermediate step. The AEAT analyses specific aspects of your declaration based on information it already has and documentation it requests from you. Unlike a full audit, it cannot examine your complete accounting or carry out actions outside the Agency's offices.

Key characteristics:

• Maximum term of 6 months from notification
• Limited to the tax elements specified in the opening communication
• May result in a provisional assessment (regularisation proposal)
• You may submit objections before a final resolution is issued

Full Tax Audit (Inspección Tributaria)

This is the most exhaustive procedure. A team of inspectors examines your tax situation in depth, with access to all your financial, accounting, and asset information.

Key characteristics:

• Maximum term of 18 months (extendable to 27 in especially complex cases)
• Inspectors can request information from third parties (banks, exchanges, notaries)
• It's an in-person procedure: they may summon you to the AEAT offices
• It can cover several tax years simultaneously
• The resolution may include tax assessment, late payment interest, and penalties

It's important to understand that most cryptocurrency-related procedures are information requests or limited reviews, not full audits. However, poor handling of an information request can escalate the procedure.

Regardless of the type of procedure, the AEAT will request documentation demonstrating the consistency of your declaration. Preparing this documentation in advance is undoubtedly the best investment you can make.

Standard Documentation in Crypto Procedures

Complete transaction history. All transactions carried out across all exchanges and wallets during the tax year in question. This includes purchases, sales, swaps, deposits, withdrawals, staking, airdrops, and any other operation with tax implications. If you need help extracting this data, we have detailed guides for Binance, Kraken, Bybit, MetaMask, and Ledger.

Capital gains and losses report. A document detailing the acquisition price, sale price, commissions applied, and resulting gain or loss for each operation, correctly applying the FIFO method.

Market price evidence. For each operation, the Tax Authority may request proof of the asset's market value at the exact moment of the transaction. This is especially relevant in DeFi operations. See our guide on documenting DeFi transactions to learn how to build a solid evidence system.

Bank statements. To verify euro inflows and outflows associated with cryptocurrency trading.

Informative declarations filed. Copies of Form 721, Form 714, and any other informative form filed in relation to cryptocurrencies.

Balance screenshots or certificates. To verify balances as of 31 December of the audited year, in both exchanges and wallets.

The Role of On-Chain Traceability

With increasing frequency, the AEAT requests on-chain traceability evidence: transaction hashes, wallet addresses, blockchain explorer screenshots. This level of detail is especially important in DeFi operations, where there's no centralised intermediary providing reports.

The good news is that the blockchain is an immutable ledger. If you've correctly documented your operations, the very nature of the technology works in your favour: every transaction is permanently and verifiably recorded.

A tax audit is an administrative procedure subject to the General Tax Law (LGT) and the General Regulation on tax management and inspection procedures. As a taxpayer, you have rights that the Administration is obligated to respect.

Right to Be Informed

You have the right to know, from the start of the procedure, which taxes and periods are being investigated. The opening communication must clearly specify the scope of the proceedings. If the AEAT expands the object of the audit during the process, it must formally notify you.

Right to Professional Assistance

You may appear before the inspection accompanied by a tax adviser, lawyer, or representative. In fact, it is highly recommended not to attend any inspection proceeding alone. A professional knows the procedure, understands what information is mandatory and what exceeds the scope of the request, and can protect your interests throughout the process.

Right Against Self-Incrimination

Although there is an obligation to cooperate with the Administration, you are not obligated to provide documentation that would incriminate you in a penalty or criminal proceeding. This right, recognised by Constitutional Court case law, has important nuances that a specialised adviser can help you navigate.

Right to Submit Objections

Before a final assessment is issued, you have the right to see the regularisation proposal and to submit objections within 15 business days. These objections are your opportunity to rebut the inspection's arguments, provide additional documentation, or correct errors in the Administration's calculations.

Right to Statute of Limitations

The AEAT has a 4-year period to review and investigate a tax year, counted from the day after the voluntary filing deadline. If more than 4 years have passed, the tax year is statute-barred and the Tax Authority cannot review it. However, certain situations interrupt the limitation period, so it's important to calculate deadlines precisely.

Right to Appeal

If you disagree with the resulting assessment or penalty, you can file:

• Appeal for reconsideration before the AEAT itself (1-month deadline)
• Economic-administrative claim before the Economic-Administrative Tribunal (1-month deadline)
• Contentious-administrative appeal before the courts of justice

The best defence against a possible audit is prevention. It's not about "hiding" anything (the blockchain doesn't forget and the Tax Authority has increasingly sophisticated tools), but about having everything in order so the procedure is as quick and painless as possible.

Build Your Tax Archive from Day One

Don't wait for the Tax Authority to ask for documentation. From the moment you make your first cryptocurrency transaction, you should maintain an organised record including:

A consolidated transaction history. All operations from all exchanges and wallets in a single, clean, classified dataset. At Cleriontax, our data cleaning and classification process eliminates duplicates, corrects formatting errors, and normalises information so each operation is perfectly identified.

A detailed FIFO report. The calculation of capital gains and losses operation by operation, with traceable acquisition prices, included commissions, and documented market prices.

Supporting documentation. Year-end balance screenshots, exchange certificates, relevant on-chain transaction hashes, and any documentation supporting the report's figures.

Copies of filed declarations. Always keep a copy of your income tax return, Form 721, and Form 714, along with filing receipts.

Check Consistency Between Your Declarations

One of the main triggers for review procedures is inconsistency between different tax filings. Before filing each year, verify that:

• Capital gains on Form 100 are consistent with assets declared on Form 714
• Balances declared on Form 721 match the operations reported in your income tax return
• Staking, lending, and other DeFi product yields are correctly classified as investment income
• Offset capital losses comply with the anti-avoidance rule (no repurchase of the same asset within 2 months of sale)

Stay Up to Date with Regulations

Cryptocurrency tax regulation evolves every year. What was acceptable in 2023 may not be in 2026. The DAC8 directive is radically transforming the supervisory capacity of European tax authorities.

The moment has arrived. You open the Electronic Office or receive a certified letter with the Tax Agency's seal. Before panic takes over, follow these steps:

Step 1: Read Calmly and Understand the Scope

Before doing anything, read the entire document carefully. Identify:

• What type of procedure is it? (information request, limited review, or full audit)
• Which tax years does it cover?
• What specific taxes or concepts does it mention?
• What is your deadline to respond?
• What documentation is expressly requested?

Step 2: Don't Respond Hastily

You have a deadline (generally 10 business days for information requests). Use it. Don't send rushed or incomplete documentation. A poorly prepared response can generate more questions and complicate the process.

Step 3: Contact a Tax Adviser Specialising in Cryptocurrencies

This is probably the most important advice in this entire article. Cryptocurrency taxation has particularities that many generalist advisers don't master. A specialised professional:

• Understands blockchain terminology and can communicate effectively with the inspection
• Knows the AEAT's specific criteria for crypto operations
• Knows which documentation is essential and which can be omitted
• Can detect errors in the Administration's calculations
• Represents you before the inspection, reducing stress and the risk of inadequate responses

Step 4: Gather and Organise All Documentation

Prepare a complete dossier including everything mentioned in the previous section. The documentation must be:

Clear: Anyone should be able to follow the thread of your operations without deep blockchain technical knowledge.

Complete: Don't omit any operation, even if it's a small amount. Omissions, however small, generate distrust.

Consistent: The numbers must reconcile with each other and with filed declarations.

Traceable: Every figure should be verifiable through a supporting document (statement, hash, screenshot).

Step 5: Respond Within the Deadline

Submit the requested documentation through the indicated channel (generally the AEAT's Electronic Office) within the established deadline. If you need more time, request an extension before the original deadline expires.

Understanding the potential financial consequences is important for sizing the risk and making informed decisions.

Minor Infractions

Penalty amount: Fine of 50% of the unpaid amount, when the sanction base doesn't exceed €3,000 or, when higher, there's no concealment.

Serious Infractions

Penalty amount: Fine of 50% to 100% of the unpaid amount. Applied when the sanction base exceeds €3,000 and there's concealment, or when false invoices or documents are used.

Very Serious Infractions

Penalty amount: Fine of 100% to 150% of the unpaid amount. Applied when fraudulent means have been used (such as using intermediary persons or entities to conceal asset ownership) or when there's resistance, obstruction, or refusal to cooperate with the Administration's proceedings.

Other Financial Consequences

Late payment interest. Applied to the unpaid amount from the day after the voluntary payment deadline until the day of effective payment. The late payment interest rate for 2026 is 4.0625%.

Late filing surcharges. If you regularise voluntarily (without prior request), surcharges are significantly lower: 1% per month of delay during the first 12 months, and 15% from month 13 onwards, plus late payment interest.

The difference between voluntarily regularising and waiting for the Tax Authority to detect the issue can amount to thousands of euros.

Whilst the details of tax audits are confidential, we can share anonymised patterns and situations observed in our professional practice.

Case 1: The Trader Who Only Declared Euro Withdrawals

A high-volume investor on Binance only declared cryptocurrency sales to euros, ignoring swaps between cryptocurrencies (BTC to ETH, ETH to USDT, etc.). The Tax Authority, cross-referencing the exchange's data with the declaration, detected that the traded volume was significantly higher than declared.

Result: Supplementary assessment for undeclared gains on swaps, 50% penalty, and late payment interest. The total cost exceeded €12,000 when the unpaid amount was €4,800.

Lesson: Every exchange between cryptocurrencies constitutes a swap and generates a taxable event. See our article on stablecoins and taxation to understand why even converting BTC to USDT is taxable.

Case 2: The Investor Who Forgot About Staking

A taxpayer correctly declared her buy/sell operations but omitted staking yields obtained throughout the year.

Result: Staking yields are classified as investment income and taxed in the year they're generated, regardless of whether they're withdrawn or reinvested. The regularisation included the unpaid tax plus a 10% surcharge.

Lesson: Staking, yield farming, and lending generate income that's taxed when received. Understanding DeFi taxation is essential.

Case 3: The Taxpayer Who Got Ahead

An investor detected errors in the previous year's declaration and decided to file a supplementary declaration before receiving any communication from the Tax Authority.

Result: By voluntarily regularising, he only had to pay the unpaid tax plus a 5% surcharge. No penalty, no additional interest. The savings compared to a forced regularisation exceeded €3,000.

Lesson: Voluntary regularisation is always cheaper than waiting for the Tax Authority to act. If you detect an error, act as soon as possible.

The regulatory landscape is moving in a clear direction: more transparency, more information exchange, and more analytical capacity.

DAC8 Changes the Rules

The DAC8 directive requires all EU crypto-asset service providers to automatically report their users' operations to national tax authorities. This means that the AEAT will receive detailed information from virtually all regulated exchanges where Spanish taxpayers operate.

But DAC8 isn't limited to centralised exchanges. It also affects custodial wallets, DeFi platforms with identifiable intermediaries, and custody service providers.

Blockchain Analysis Tools

The AEAT has invested in on-chain analysis tools similar to those used by companies like Chainalysis or Elliptic. These tools enable tracing the flow of funds across multiple wallets and blockchains, identifying evasion patterns, and linking wallet addresses to real identities.

2026 Tax Control Plan

The Tax Control Plan for 2026 reinforces the line of action on crypto-assets, with particular attention to:

• Undeclared operations on international exchanges
• Investors with DeFi activity not reflected in their declarations
• Discrepancies between declared assets and bank movements
• Taxpayers who have filed Form 721 without including the corresponding gains in their income tax

Can the Tax Authority see my crypto if it's in a non-custodial wallet?

The wallet itself isn't directly visible to the Tax Authority. However, the AEAT can trace the flow of funds from an exchange (where it does have your data) to your personal wallet. Additionally, when you convert your crypto back to euros or move them to an exchange, the connection is established. The tracking tools used by the AEAT are increasingly sophisticated.

How many years back can the Tax Authority investigate?

The general statute of limitations is 4 years from the day after the voluntary filing deadline. However, this period is interrupted by any action by the Administration directed at the taxpayer.

What if I can't provide the complete history from an exchange that no longer exists?

This situation is more common than it seems (remember cases like FTX). The recommendation is to provide all available documentation and explain the situation. Good faith and demonstrable effort to reconstruct the information work in your favour.

Can I be penalised if I declared in good faith but with errors?

Yes, but good faith and the absence of fraudulent intent are mitigating factors that reduce the penalty. An involuntary error is not the same as deliberate concealment. The key is demonstrating that you tried to comply with your obligations, even if you made errors in the process.

Can I request a payment plan if the resulting assessment is high?

Yes. The AEAT allows payment deferrals and instalments for tax debts. If the debt exceeds €30,000, guarantees will be required (bank guarantee or mortgage). Below that amount, the deferral is granted without guarantees.

What about DeFi operations that aren't on any exchange?

DeFi operations carried out directly from non-custodial wallets are currently the hardest for the AEAT to trace. However, the obligation to declare them is the same. Furthermore, with the progressive implementation of DAC8 and on-chain analysis tools, detection capabilities will continue to increase. Correctly documenting these operations is essential.

At Cleriontax, we understand that facing a Tax Authority procedure for cryptocurrencies generates uncertainty. That's why our service goes beyond generating tax reports.

Our comprehensive approach includes:

Exhaustive analysis of your operations across all exchanges and wallets, with professional data cleaning and precise tax classification of each transaction.

Generation of complete, traceable tax reports, correctly applying FIFO and documenting each operation with verified market prices.

Preparation of defensive dossiers specifically designed to respond to AEAT requests, with clear, consistent documentation backed by on-chain evidence.

Advisory support throughout the procedure, so you know exactly what to do at every step and can make informed decisions.

Request an assessment of your tax situation →

If you've received a notification from the Tax Authority or simply want to ensure your declarations are correct, contact our team. The sooner you act, the better your position will be.

Disclaimer: This article is for informational and educational purposes only. It does not constitute personalised tax or legal advice. Tax regulations are subject to change and each personal situation is unique. Always consult a qualified professional tax adviser for your specific case. Information about penalties and procedures is based on legislation in force as of February 2026.

Last updated: February 2026

Published by: Cleriontax Team — Cryptocurrency Tax and Data Analysis Experts