Germany and Finland do not postpone DAC6 reporting

The deadline for initial reports is 31st July 2020.

In June, the European Union Council approved an optional six-month deferral of DAC6 reporting requirements due to COVID-19. 22 member states have availed themselves of that deferral but two, Germany and Finland, have not.

On 6 July 2020, Kristina Wogatzki, a spokesperson for the German Finance Ministry announced at a press conference that “Germany will not postpone the deadline, the reporting obligation begins on July 1”. Wogatzki stated that the Finance Ministry’s reporting systems are ready and can accept reports. She dismissed deferment by saying that since it was only tabled in June, she expects most firms to have prepared for 1 July implementation. She added that this deadline only affects firms that have a reporting obligation in Germany.

Despite Germany’s clear position, there are some early reports that several associations and interest groups will still approach the Federal Ministry of Finance and lobby for a postponement.

German press conference

In late June, Finland confirmed that reporting will begin as scheduled on 1 July.

What are the deadlines?

For Germany and Finland, the reporting deadline for any reportable transactions from June 2018 to June 2020 is 31 August 2020. Any reportable transactions after 1 July have a rolling 30-day window.

The remaining 22 member states have postponed to varying degrees, most of them by six months.

How to report?

VinciWorks’ DAC6 reporting tool is configured to generate XML reports that adhere to the German specification. These reports are now being rolled out to all VinciWorks clients with a German reporting requirement.

In Germany, you can make XML reports via the ELMA API or individual reports through the BOP portal. Click here for more details regarding Germany’s DAC6 reporting API including its DAC6 XML schema.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”