Potentially, even companies outside of Europe could be forced to disclose user holdings according to the EU.

The European Union indicated Thursday that it will make cryptocurrency companies report their European users’ holdings to tax authorities. The proposed eighth Directive on Administrative Cooperation was previously reported on by CoinDesk, and could have wide-reaching implications including forcing non-EU based companies to have to register with tax entities there.

In a statement, the EU Commissioner for tax, Paolo Gentiloni said, “Anonymity means that many crypto-asset users making significant profits fall under the radar of national tax authorities. This is not acceptable.”

The enforcement of the measures was not made entirely clear, as the cryptocurrency industry has various entities and actors residing in various jurisdictions, including some who claim no base of operations. Beyond that, there should be concern for the honeypot of user data that registering user holdings creates. Often, holdings on centralized exchanges (which are dangerous in their own right) are paired with sensitive identifying information which could potentially be used by criminals to attach people to their holdings.

There have been various cases of documented data leaks in and outside of the cryptocurrency industry: and these are simply the ones that surface. Forcing companies to provide European tax authorities — including companies based outside of the EU — once again forces firms to collect copious amounts of data exposing user holdings, and then transmit them to tax authorities in Europe whom they must trust to keep them safe.

Concerns have also been voiced that this could have ramifications for the EU’s Markets in Crypto Assets Regulation (MiCA) which is the “first all-encompassing effort to tackle cryptoassets and brings rules contained in Mifid, Market Abuse and the Prospectus Regulation to the cryptoasset industry,” according to the International Financial Law Review (IFLR).

The European Crypto Initiative made a statement indicating it was “concerned that it would apply to a far wider range of obliged entities and individuals” than MiCA.

The EU has said it believes the move could generate as much as $2.5 billion (2.4 billion euros) through the introduction of the directive.