Crypto-Asset Tax Reporting from 2026: What Service Providers, Financial Institutions and Their Clients Need to Do

The new rules on tax reporting for crypto-assets do not begin to apply in 2027. The Act Amending and Supplementing the Bulgarian Tax and Social Security Procedure Code was promulgated in State Gazette No. 85 of 15 September 2026, but entered into force with effect from 1 January 2026. As a result, the first reporting period is already underway, and crypto-asset service providers and certain financial institutions must also complete due diligence procedures in respect of client relationships established before the Act was promulgated.

The change is not limited to the submission of another annual report to the Bulgarian National Revenue Agency. It affects the entire process through which clients are onboarded and serviced, including establishing their tax residence, identifying controlling persons, verifying the declarations provided, classifying transactions and retaining evidence of the steps taken. Certain operators are also subject to a separate registration requirement with the National Revenue Agency.

Where due diligence has not been completed, the consequence may extend beyond an administrative penalty. In certain circumstances, the service provider or financial institution may no longer permit the relevant client to carry out transactions until the required information has been provided and verified.

The practical task for 2026 is therefore to establish whether the organisation holds sufficiently reliable information about its clients and their transactions, whether that information can be extracted in the required format and whether the due diligence performed can be traced and evidenced during a subsequent inspection by the National Revenue Agency. If this work is left until immediately before the first filing in 2027, some of the missing information may no longer be capable of reliable reconstruction.

What Is Changing and Who Is Affected

The amendments affect several categories of persons, but their obligations are not identical. The principal part of the new regime is directed at crypto-asset service providers and operators. They must establish the tax status of their users, determine which transactions are reportable and provide the relevant information to the National Revenue Agency on an annual basis.

At the same time, the rules applicable to financial institutions and financial accounts are being expanded. New categories of information concerning account holders and controlling persons are being introduced, while certain products involving electronic money and central bank digital currencies may also fall within the scope of the regime.

A third group of amendments concerns other forms of automatic exchange of tax information. These include certain dividends paid to individuals, certain cross-border tax rulings and information filed in connection with the top-up tax applicable to multinational enterprise groups.

These developments form part of a broader trend towards increased tax transparency, but they need to be considered separately. Not every crypto-asset service provider is a financial institution, not every financial institution falls within the crypto-asset reporting regime, and the specific registration requirement before the National Revenue Agency does not apply in the same manner to all participants.

MiCA Authorisation and Tax Reporting Are Separate Regimes

The new Section IIIb of Chapter Sixteen of the Tax and Social Security Procedure Code introduces a specific regime for the automatic exchange of information on crypto-assets. It is connected with the European framework under Directive (EU) 2023/2226, commonly known as DAC8, but it should not be equated with the authorisation regime under Regulation (EU) 2023/1114 on markets in crypto-assets, known as MiCA.

MiCA governs who may provide certain crypto-asset services and under what conditions. The Tax and Social Security Procedure Code introduces a different set of obligations concerning the tax identification of clients, the identification of controlling persons, the collection of transaction information and its annual reporting to the National Revenue Agency.

Holding an authorisation or notification under MiCA does not mean that the requirements of the Tax and Social Security Procedure Code have been satisfied. Conversely, the absence of authorised service provider status under MiCA does not necessarily mean that the person falls outside the tax reporting regime.

The Tax and Social Security Procedure Code covers not only entities authorised to provide crypto-asset services under MiCA, but also certain operators that provide relevant services without falling within that category. The assessment cannot therefore end with the question of whether the company holds an authorisation. It is necessary to analyse the services it actually provides, its role in the execution of transactions, the place from which it is managed, where it is resident for tax purposes, whether it has branches and the jurisdictions in which it serves clients or performs comparable reporting obligations.

This analysis is particularly important for international structures. A client agreement may be concluded by one company, the technical infrastructure may be operated by another, while the actual execution of transactions and storage of client data may be divided between several entities. In such circumstances, the contractual allocation of roles is relevant but not conclusive. It is necessary to determine which entity actually provides the relevant service and the basis on which it becomes subject to a registration or reporting obligation.

When an Operator Must Register with the National Revenue Agency

The specific registration requirement under Article 142ya¹ of the Tax and Social Security Procedure Code applies to crypto-asset operators that fall within the scope of the regime but are not MiCA service providers. Registration must be completed before the end of the period for which the obligation to provide information arises.

Where an operator has a sufficient connection with more than one Member State and simultaneously satisfies the registration conditions in several countries, it may select one of them for registration. This does not mean that its connections with the other jurisdictions may be disregarded. They must be analysed and documented so that the choice of the particular country for registration and reporting can be substantiated.

The registration information includes the operator’s name, postal and electronic addresses, websites, tax identification numbers, the countries in which reportable users are resident for tax purposes and the relevant qualified jurisdictions. Any change to the registration information must be notified to the Executive Director of the National Revenue Agency within 14 days.

Registration is therefore not a one-off administrative formality. The organisation must have an internal process ensuring that changes to its corporate structure, management, websites, services or the geographical scope of its client base are promptly communicated to the persons responsible for tax reporting.

How the Client Must Be Reviewed

The new regime places tax residence at the centre of the due diligence process. In the case of an individual, the service provider must obtain a self-certification enabling it to determine the country or jurisdiction in which the user is resident for tax purposes. The self-certification cannot be considered in isolation and must be checked against the information already held by the provider, including the documents collected during the client identification process.

The review is more complex for a corporate client. It is necessary to determine where the entity itself is resident for tax purposes, whether it qualifies as an excluded person or an active entity, and whether it has one or more controlling persons in respect of whom a reporting obligation also arises. Where such persons exist, their tax residence and the basis on which they exercise control must also be established.

This is particularly relevant for holding structures, companies with nominee shareholders, trusts, foundations, unincorporated entities and international groups. The jurisdiction in which a company is incorporated does not always determine conclusively where it is resident for tax purposes. Its place of effective management, the applicable foreign law and the relevant double taxation treaty may require a separate analysis.

The self-certification of an individual or controlling person must be signed or otherwise positively affirmed and dated no later than the date on which it is received. It must contain the necessary identification and tax information, including the country or countries of tax residence and the relevant tax identification numbers, where such numbers are issued. In the case of entities, the information provided must also make it possible to determine their status and, where applicable, identify their controlling persons.

The review does not end when the initial self-certification is received. If circumstances change and the service provider knows or has reason to know that the information already held has become incorrect or unreliable, the self-certification can no longer be used without further verification. A new self-certification must be obtained, or the client must provide an adequate explanation supported by documents confirming the circumstances initially declared.

The client file should therefore not be treated as a static archive. The organisation must be able to identify changes in address, management, ownership, tax identification numbers, banking information or other circumstances that may call the existing information into question.

AML/KYC Documentation May Assist, but Is Not Sufficient on Its Own

Existing anti-money laundering due diligence may be used in meeting the new obligations, but it does not automatically replace them. Tax residence and the status of controlling persons must be established specifically for the purposes of the automatic exchange of tax information.

In practice, the service provider should compare the tax residence self-certification with the client’s permanent and correspondence addresses, tax identification numbers, country of incorporation, place of management, representation documents, beneficial ownership information, banking and payment details, and any other relevant information held in the client file. Where these data point in different directions, the self-certification should not be accepted mechanically.

Simply adding another form to the client onboarding process will therefore not be sufficient. The organisation needs clear rules identifying which data are to be compared, who is responsible for the verification, when a matter must be referred for additional legal or tax analysis, and how the final determination is to be documented.

Which Transactions and Transfers Will Be Reported

The reporting obligation is not limited to purchases or sales of crypto-assets against the euro or another traditional currency. For each relevant type of crypto-asset, aggregated information must be collected concerning acquisitions and disposals against fiat currency, exchanges between different crypto-assets, certain payments for goods and services, other transfers to or from the user, and transfers to certain external distributed ledger addresses.

The information to be reported for the relevant categories includes not only the values involved, but also the number of units and the number of transactions. A general annual statement of movements on the client’s account will therefore not be sufficient if the system cannot distinguish between the legal and economic characteristics of the individual transactions.

Transfers to external wallets require particular attention. Not every movement of a crypto-asset constitutes a sale or exchange. The service provider may be unable to establish whether an operation represents an exchange transaction, a transfer between the client’s own addresses or a transfer to another person. The new regime also provides for the reporting of certain transfers where the receiving address is not known to be associated with another service provider or financial institution.

In practical terms, information systems must be able to distinguish purchases and sales against fiat currency, exchanges between crypto-assets, transfers to and from the client, transfers to external addresses and reportable payments for goods or services. If this classification is not performed reliably when the transactions are processed, a subsequent manual reconstruction of the entire 2026 transaction history may prove difficult and inaccurate.

How Transaction Values Are Determined

For transactions against fiat currency, the amount paid or received in the relevant currency must be reported. Where different currencies have been used during the year, the service provider must apply a consistent approach to currency conversion.

For exchanges between crypto-assets and other reportable transfers, the fair market value must be determined at the time of the relevant transaction. This requires a predefined methodology identifying the source of market data, the valuation time and the approach to be followed where liquidity is low, no reliable price is available or material variations exist between different markets.

Calculating the overall value of the client’s portfolio at the end of the year is not sufficient. The reported value must be capable of being linked to the relevant transaction category and supported by a consistently applied method. During a subsequent inspection, the National Revenue Agency may require not only the final figure, but also an explanation of how it was determined.

What Happens if the Client Does Not Provide the Required Information

Where a user fails to provide the necessary information, the service provider must issue an initial request followed by at least two written reminders. If the information remains outstanding after 60 days from the initial request, the service provider must no longer permit the relevant user to carry out transactions.

This mechanism makes tax due diligence part of the operational management of the client account. The organisation must be able to establish when the initial request was made, what information was requested, when the reminders were sent, whether the client responded, whether the response was sufficient, and the precise date on which the 60-day period expires.

It is also necessary to determine who decides that transactions are to be restricted, how that restriction is implemented technically and under what conditions access is restored. If the platform does not allow restrictions to be imposed on a particular client account, the company may be unable to comply with a direct statutory requirement.

The user also bears separate responsibility for the information provided. An individual or entity that provides incorrect data or circumstances in a self-certification may be subject to a penalty. For corporate clients, this means that the self-certification should not be completed mechanically by an administrative employee solely by reference to the company’s registered address. An international corporate structure, the place of effective management and the status of controlling persons may require a separate legal and tax assessment.

Deadlines Requiring Immediate Attention

The information must be submitted electronically to the National Revenue Agency once a year, by 30 June of the year following the reporting year. For the first reporting period, which begins on 1 January 2026, the filing must therefore be completed by 30 June 2027. Where there is no information to report for the relevant year, the law nevertheless requires a notification to be made.

The National Revenue Agency will then exchange the information received with the competent authorities of the relevant countries within nine months following the end of the calendar year. For information concerning 2026, this period expires on 30 September 2027.

The most immediate issue, however, is the transitional regime. For client relationships established between 1 January 2026 and the promulgation of the Act on 15 September 2026, crypto-asset service providers and financial institutions must complete the relevant due diligence within three months of promulgation. In practical terms, the deadline is 15 December 2026. If the review has not been completed, the relevant transactions must not be permitted until the due diligence process has been concluded.

For crypto-asset users with whom relationships had already been established as at 31 December 2025, a deadline of 1 January 2027 is provided. The wording of the transitional provision should be considered carefully because it refers to both individuals and entities while cross-referring to the provision governing due diligence for individuals. Due diligence for entities and their controlling persons is regulated separately. For corporate clients, it would therefore be inappropriate to rely solely on the literal cross-reference without considering the regime as a whole and the applicable EU framework.

The practical timeline may be summarised as follows:

This timeline explains why implementation cannot be treated as a project commencing in 2027. The work concerning client files, transaction data, internal procedures and technical restrictions must be undertaken during 2026.

Penalties and Other Consequences of Non-Compliance

The law provides for different penalties depending on the nature of the infringement. A legal entity or sole trader that fails to provide the required annual information may be subject to a pecuniary penalty ranging from EUR 5,000 to EUR 10,000. Separate penalties apply for failure to submit a notification where there are no reportable data, the provision of incomplete or incorrect information, breaches of the due diligence procedures, carrying on activities without the required registration and failure to comply with the document retention requirements.

Where incomplete or incorrect information has been provided, or where the due diligence rules have been breached, the penalty may be calculated in respect of each affected user or controlling person. For a provider with a larger client base, the exposure is therefore not limited to a single general penalty relating to the submitted report.

Separate liability also arises where an operator fails to notify changes to its registration information within the prescribed period or permits transactions despite the client’s failure to comply with the information requirements. In the event of a repeated infringement, penalties are imposed at twice the standard amount.

The risk is not purely financial. In cases of continuing non-compliance, an operator’s registration may be terminated. In the case of an unregistered operator, the law also allows the National Revenue Agency to apply to the court for an order suspending access to the relevant website or application. A failure in tax reporting compliance may therefore have a direct impact on the operator’s ability to continue its business.

What Must Be Capable of Proof During an Inspection

The National Revenue Agency may inspect compliance with the new regime, require documents and information, assess the quality of the data submitted and issue binding instructions. It is therefore not sufficient for the annual report merely to contain figures that appear formally correct. The service provider must be able to demonstrate how those figures were reached.

It should be possible to trace how the provider’s status was determined, how the client was identified, which documents were used to establish the client’s tax residence, which persons were classified as controlling persons and the reasons for that classification. The self-certifications received, the checks performed to verify their reliability, subsequent updates and decisions taken where discrepancies were identified must all be capable of production.

The same applies to the transaction data. The organisation must be able to explain how it classified each type of transaction, how it determined fair market value, which exchange rates and data sources were used, and how identified errors were corrected.

Where clients have failed to provide information, evidence must be available of the initial request, the two reminders, the expiry of the 60-day period, the restriction imposed and its subsequent removal. Documents and data relating to due diligence and reporting must be retained for a period of not less than five and not more than ten years following the end of the relevant calendar year.

What Is Changing for Financial Institutions

The amendments also expand the information that financial institutions must collect and report in relation to financial accounts. The new elements include whether the account holder has provided a valid self-certification, the basis on which a person qualifies as a controlling person, whether valid self-certifications have been obtained for controlling persons, the type of account, whether it is an existing or new account, and whether it is a joint account, including the number of account holders.

The connection with AML/KYC procedures is also strengthened. Where a financial institution updates information relating to an existing account for anti-money laundering purposes, this may also trigger a requirement to collect or update information for automatic tax exchange purposes. Periodic KYC reviews should therefore not be managed separately from tax reporting.

The definitions of a depository institution and a depository account are also being amended. Entities holding electronic money or central bank digital currencies for the benefit of clients may fall within the scope of the regime. This is relevant to payment institutions, electronic money institutions and other fintech businesses that may not previously have regarded certain products as financial accounts for the purposes of automatic exchange.

The assessment should not be based solely on the commercial name used for the product. It is necessary to examine how the product actually operates, whether monetary value is held for the benefit of the client, what rights the client has, and whether the product falls within the new statutory definitions.

For products that begin to be treated as financial accounts from 1 January 2026, the law distinguishes between existing and new accounts. An account maintained as at 31 December 2025 may be treated as an existing account, while an account opened on or after 1 January 2026 falls within the rules applicable to new accounts.

For the 2026 and 2027 reporting periods, some of the additional information required in respect of existing accounts must be reported only if it is available in electronically searchable records held by the institution. This does not remove the need for a review. The financial institution must determine what information is actually contained in its systems, whether it can be extracted and whether it can be linked to the correct client, account and controlling person.

Other New Areas of Automatic Exchange

The amendments also cover certain dividends paid to individuals where the information is not already reported under the financial accounts regime. The change does not itself impose a new tax on dividends, but increases transparency between tax administrations. It is particularly relevant to payments with a cross-border element, where the payer, intermediary and recipient are located in different countries. Information concerning the distribution, the recipient and the recipient’s tax residence must be aligned with the accounting records and tax returns.

The exchange of certain advance cross-border tax rulings concerning individuals is also being expanded. The regime applies, among other circumstances, where the value of the transaction or series of transactions specified in the ruling exceeds EUR 1,500,000, or where the ruling determines the individual’s tax residence. This is relevant to high-value investment structures, changes in tax residence, international asset management and other cross-border arrangements.

The law also regulates the exchange of information contained in returns relating to the global minimum taxation of multinational enterprise groups. For affected groups, the task is not limited to ensuring that the return is filed by the correct entity. It is necessary to determine what information is included in the general section and in the jurisdictional sections, the countries to which the information will be sent, and whether the local data are consistent with the group return. A discrepancy between the information of a local entity and the group-level return may create exposure even where each individual filing appears formally correct.

The change in the permitted use of exchanged information is also significant. Subject to the conditions laid down by law, the information may be relevant not only to direct taxation, but also to VAT, other indirect taxes, customs duties, anti-money laundering measures and certain restrictive measures of the European Union. A discrepancy arising under one reporting regime may therefore be identified and used in another form of regulatory or tax control.

Key Practical Risks

What Businesses Should Reasonably Do Now

Preparation should begin by determining the company’s precise status and the obligations applicable to it. It should be established whether the company is a MiCA-authorised service provider, an operator outside that category, a financial institution or a person that does not fall within the regime. In an international structure, the analysis should also cover the allocation of functions between the various companies, branches and technical operators.

The next step is a review of the client base by reference to the date on which each relationship was established. In practical terms, a distinction should be made between clients serviced as at 31 December 2025, clients onboarded between 1 January and 15 September 2026, and clients accepted after the promulgation of the Act. The relevant transitional deadline should be applied to each group, and the existing documentation should be reviewed against the new requirements.

The review should determine whether a valid tax residence self-certification is available, whether it is consistent with the other information in the client file, whether controlling persons have been identified and whether there is any evidence of a subsequent change in circumstances. Corporate clients with international structures may require a separate analysis rather than the administrative completion of a standard form.

In parallel with the client file review, transaction information covering the entire period from 1 January 2026 should be examined. The systems must be able to distinguish between the different categories of transactions and produce values, numbers of units and numbers of transactions. A consistent methodology for determining fair market value must also be in place and capable of being defended during an inspection.

A separate procedure must be established for cases where the client does not provide the necessary information. Internal rules should determine who sends the initial request, who monitors the reminders and the 60-day deadline, who decides whether the response received is sufficient, who authorises restrictions on transactions, and how those restrictions are implemented technically.

Finally, the full audit trail must be organised. Self-certifications, due diligence documents, system logs, valuations used, client correspondence, decisions to impose restrictions and subsequent corrections must be capable of being linked to the relevant client and reporting period.

Before concluding that it is ready for the new regime, the organisation should establish whether it has classified its own status correctly, covered all client groups, obtained valid self-certifications and reconciled them with AML/KYC information, identified controlling persons, ensured that its transaction systems can produce the required information, and implemented a workable mechanism for restricting transactions. It is equally important to allocate responsibilities between the legal, tax, compliance, IT and operations functions and to adopt an internal timetable for the first filing by 30 June 2027.

What the Changes Mean for Users of Crypto-Asset Services

The new regime is not relevant only to exchanges, platforms and other service providers. Companies and individuals using these services should expect more detailed requests for information concerning their tax residence, corporate structure and controlling persons.

In international structures, this information should be reviewed before it is provided. A company’s jurisdiction of incorporation does not always determine its tax residence conclusively. An individual’s address may also be insufficient, while the beneficial owner identified for AML purposes does not automatically resolve all questions concerning controlling persons for the purposes of tax information exchange.

It should not be assumed that a self-certification already provided remains valid irrespective of subsequent changes. If a company changes its place of management, ownership or structure, if an individual moves to another country, or if other relevant circumstances arise, the information must be updated.

International groups should also seek to coordinate the information provided to different platforms and financial institutions. A discrepancy between two tax residence self-certifications, or between a self-certification and the corporate documents, may be identified following the automatic exchange of information between tax administrations.

Practical Conclusion

The September 2026 amendments to the Tax and Social Security Procedure Code create a comprehensive system for the collection, verification and exchange of information on crypto-assets. For service providers, this means not merely an annual data filing, but a change in how clients are onboarded and serviced, how controlling persons are identified, how transactions are classified and how decisions are documented.

For financial institutions, both the information to be collected concerning account holders and accounts and the range of financial products potentially falling within the regime are being expanded. At the same time, automatic exchange is being extended to certain dividends, cross-border tax rulings and information relating to the global minimum taxation of multinational enterprise groups.

The most important practical conclusion is that preparation cannot be postponed until the first filing in 2027. The reporting period begins on 1 January 2026, while certain due diligence procedures must be completed before the end of 2026. If client files and transaction data are not reviewed in time, the consequence may be not only a penalty, but also the need to restrict transactions, the termination of registration or difficulty proving that the relevant obligations have been fulfilled.

The appropriate approach therefore combines legal, tax, documentary and technical review. It is necessary to determine who falls within the regime, what client information is missing, how tax residence and control are determined and evidenced, whether transactions can be classified correctly, and whether the information systems are actually capable of meeting the statutory requirements.

Vassilev & Partners Law Firm can assist in determining the applicable regime, reviewing client and compliance procedures, preparing and verifying self-certifications and internal policies, analysing cross-border structures, and organising the documentary framework required for a subsequent inspection by the National Revenue Agency.

Disclaimer

The information contained in this article is of a general informative nature only and is intended to provide a basic overview of the subject matter in light of the legal position as at the date of publication. Although we seek to ensure the highest possible level of accuracy, legal provisions and their interpretation may change. Verification of the current wording of the applicable provisions and their application to specific circumstances requires individual legal advice. We accept no liability for any loss or damage resulting from reliance on the information contained in this article without prior individual legal advice. This article does not constitute a legal opinion.