#768: DAC8 Is A Kidnapping Factory with Francis Pouliot

— Bull Bitcoin is launching a legal challenge against France's DAC8 implementation (and the broader CARF framework), arguing it violates proportionality and EU Charter of Human Rights by creating a pan-European database of all crypto user transaction data and identity information shared across 27 government bureaucracies.

— DAC8 represents a fundamental shift from traditional KYC/AML regimes: instead of reporting only suspicious activity on warrant, governments now mandate reporting of all users' complete financial and identity data annually, creating a mass surveillance database accessible to criminals (Pouliot cited convicted French civil servants selling crypto user data to criminal gangs for kidnappings and extortion).

— The FATF (Financial Action Task Force) and supranational bodies like the OECD and BIS operate as unelected bureaucratic institutions that mandate compliance regimes (travel rule, KYC/AML) through leverage (blacklisting), bypassing democratic legislative processes; countries face penalties for non-compliance despite having no formal obligation to adopt guidelines.

— Bull Bitcoin is deploying privacy technologies including PayJoin (breaking the common-input-ownership heuristic that chain analysis relies on), Silent Payments (solving address reuse problems), and Liquid swaps to resist surveillance, with PayJoin now integrated into their exchange (breaking news in the conversation).

— Chain analysis companies provide unreliable evidence used in criminal cases and warrants; Pouliot documented false positives and noted the system lacks transparency—courts treat chain analysis reports with unwarranted certainty despite faulty heuristics, yet defendants cannot audit the methodology.

— Regulatory compliance (MiCA license cost ~€1 million, two-year process) has created a moat that kills startups and small exchanges; 90% of European crypto companies failed to obtain licenses by the July 1, 2024 deadline, consolidating power among well-funded incumbents like Coinbase, Kraken, and Binance.

— If you operate a Bitcoin exchange or custody service, review your compliance assumptions around chain analysis, address reuse requirements, and data-sharing practices; Pouliot demonstrated that voluntarily exceeding legal mandates (e.g., adopting third-party chain analysis) creates false industry expectations that later become regulatory burden for competitors.

— Use privacy technologies available now: PayJoin (breaking chain analysis heuristics), Silent Payments (eliminating address reuse), and Liquid swaps are production-ready and available in wallets like Bull, Sparrow, Cake, and Aqua; adoption by exchanges and swap providers (e.g., Boltz) amplifies their effectiveness by creating thousands of privacy-preserving transactions by default.

— Educate yourself at [https://dac8.com/en/](https://dac8.com/en/) on the legal strategy and arguments for repealing DAC8; this precedent may influence similar constitutional challenges in Canada (CARF coming this year) and the US (CARF arriving 2028–2029), so supporting the legal framework now strengthens defenses elsewhere.