Bulgaria adopts DAC8: crypto providers will report user data to the NRA
By xChange.bg team
Published
Bulgaria has written the EU's crypto tax reporting rules, known as DAC8, into national law. The National Assembly adopted the Act amending and supplementing the Tax and Social Security Procedure Code (ДОПК) on 9 September 2026, and the President's promulgation decree, No. 302, followed on 11 September 2026.
What the amendment adds
The law inserts a new Section IIIb, "Automatic exchange of information on crypto-assets", into the Code, covering Articles 142yu to 142ya10. It sets out who must collect data on crypto users, what they must check, and what they must send to the National Revenue Agency (НАП).
Under § 33 of the amending act, the rules apply from 1 January 2026. The law was passed in September, but it reaches back to the start of the year. Providers therefore have to cover the whole of 2026 in their first reports.
Who reports
Article 142ya(3) lists three groups of reporting providers:
- firms licensed by the Financial Supervision Commission (КФН) under the Markets in Crypto-Assets Act;
- banks licensed to provide crypto-asset services;
- registered crypto-asset operators.
The reporting obligation is on these providers, not on their users.
What they report and when
Once a year, reporting providers send the NRA's executive director:
- user details: identity, tax residence and tax identification number;
- transaction totals per crypto-asset: yearly totals for purchases, sales and exchanges.
Article 142ya2(7) requires the report "once a year, electronically, by 30 June of the year following the year to which it relates". Under § 27, the first reports cover periods from 1 January 2026, so they are due by 30 June 2027.
Deadlines for users
Due diligence is the check a provider runs to confirm a user's identity and tax residence. The law sets two deadlines:
| Group | Deadline to complete due diligence | Source |
|---|---|---|
| Users onboarded from 1 January 2026 | Within 3 months of the law's publication in the State Gazette | § 29 |
| Users who were clients on 31 December 2025 | By 1 January 2027 | § 30 |
Users onboarded from 1 January 2026 who have not completed due diligence in time cannot transact with the provider until it is done. In practice, expect providers to ask for your tax residence and tax number.
What it means for individuals
The tax does not change. Crypto-assets remain taxed under Article 33(3) of the Personal Income Tax Act: gains minus losses for the year, less 10% statutory expenses, taxed at the 10% rate in Article 48(1). You still declare the result in Annex 5 of your annual return, filed and paid by 30 April. The crypto tax calculator applies this formula.
The NRA will see more. From the 2026 reports onward, the NRA will receive yearly purchase, sale and exchange totals from reporting providers. It can compare these with what taxpayers declare in Annex 5. Keeping your own records of each disposal, including the purchase price, becomes more useful than before. The NRA already asks individuals to keep supporting documents for 5 years after the limitation period for the tax expires.
Answer your provider's requests. If a provider asks for your tax residence or tax number, the request is likely linked to the new due diligence rules. Delays can limit what you can do on the account.
This article is general information, not tax or legal advice. Read our guide to crypto tax in Bulgaria and the DAC8 glossary entry for background.
Frequently asked questions
Does DAC8 introduce a new tax on crypto?
- No. DAC8 is a reporting regime. The tax rules for individuals stay in the Personal Income Tax Act: net yearly gains from crypto-assets are reduced by 10% statutory expenses and taxed at 10%, and declared in Annex 5 of the annual return.
When is the first report due?
- The law applies to periods from 1 January 2026, and reports are filed once a year by 30 June of the following year. The first reports, covering 2026, are therefore due by 30 June 2027.
Who has to report?
- Firms licensed by the FSC under the Markets in Crypto-Assets Act, banks licensed to provide crypto-asset services, and registered crypto-asset operators, as listed in Article 142ya(3) of the Tax and Social Security Procedure Code.
What will my provider ask me for?
- Providers need the details they must report: identity, tax residence and tax identification number. Clients onboarded from 1 January 2026 must complete due diligence within three months of the law's publication, and clients who held accounts on 31 December 2025 by 1 January 2027.
What happens if I do not complete due diligence in time?
- For users onboarded from 1 January 2026, the law says they cannot carry out transactions with the provider until due diligence is completed. Answer your provider's requests for tax details promptly to avoid interruptions.