Bulgaria has published a law amending its Tax and Social Security Procedure Code to transpose two EU tax transparency directives and update its transfer pricing rules, after missing the EU transposition deadline.
Bulgaria’s government has promulgated the Law amending the Tax and Social Security Procedure Code (TSSPC), published in State Gazette No. 85 on 15 September 2026 under Decree No. 302. The Law transposes Council Directive (EU) 2023/2226 (DAC8) and Council Directive (EU) 2025/872 (DAC9) and revises the transfer pricing provisions. In general, its measures apply retroactively from 1 January 2026.
The transposition deadline was 31 December 2025. The European Commission opened infringement procedures against Bulgaria on 30 January 2026.
DAC9 and Pillar Two
Under DAC9, the NRA will exchange the GloBE information return with other Member States. Each Member State receives the sections relevant to its taxing rights under the European Union Minimum Taxation Directive (Directive (EU) 2022/2523). The rules enable ultimate parent entities or designated filing entities of a multinational enterprise group to file the top-up tax information return centrally. This relieves other constituent entities in different Member States from filing it separately.
Exchanges take place within three months of the filing deadline. For the first reporting fiscal year, the deadline is six months, but the first exchange will not occur before 1 December 2026. The Law also provides for exchanges with non-EU jurisdictions under a qualifying agreement.
Transfer pricing
The Law aligns the definition of market price (arm’s length price) with the OECD Transfer Pricing Guidelines. Market price is the price that would be agreed in a transaction with comparable terms between independent persons under comparable circumstances.
Taxpayers may also use a method other than the five recognised transfer pricing methods when those are inappropriate or not sufficiently reliable. The conditions will be laid down in an ordinance of the Minister of Finance.
CRS and other DAC8 changes
E-money and central bank digital currencies now fall within the scope of Common Reporting Standard (CRS) reporting. E-money accounts with a 90-day rolling average balance not exceeding the euro equivalent of USD 10,000 are excluded, as are capital contribution accounts, subject to conditions. Additional data must be reported, including the role of controlling persons, whether an account is joint and whether a valid self-certification has been obtained.
Non-custodial dividends paid to individuals become a mandatory category of automatic exchange, and the Personal Income Tax Act is amended so that payers report them. Advance cross-border rulings for individuals will be exchanged where the amount exceeds EUR 1.5 million or the ruling concerns tax residence. Exchanged information may also be used for VAT, customs, anti-money laundering and restrictive measures.
Under DAC6, intermediaries bound by legal professional privilege will now notify only their client, following the CJEU judgment in Orde van Vlaamse Balies and Others (Case C-694/20).
DAC8 is largely based on the OECD’s Crypto-Asset Reporting Framework and the amended CRS.
Crypto-asset reporting
A new section IIIb (articles 142yu to 142ya10) requires reporting crypto-asset service providers (RCASPs) to report to the National Revenue Agency (NRA). RCASPs include providers authorised under MiCA (Regulation (EU) 2023/1114) and crypto-asset operators that are not MiCA-authorised but have a Bulgarian nexus. These operators must register with the NRA. An operator that meets the conditions in more than one Member State may register in only one of them, of its choice.
RCASPs must report:
- aggregate data per crypto asset on exchanges against fiat currency and other crypto assets;
- reportable retail payment transactions above the euro equivalent of USD 50,000; and
- transfers, including those to unhosted wallets.
Reports are due annually by 30 June of the following year, and nil reports must also be filed. The first reports, covering 2026, are due by 30 June 2027.
RCASPs must obtain self-certifications from users and complete due diligence on pre-existing users by 1 January 2027. If a user does not provide the required information within 60 days and after two reminders, the RCASP must block that user’s transactions. The NRA may deregister non-compliant operators and ask the court to block their websites.
Penalties
A new article 278i sets out the penalties, which include:
- up to EUR 10,000 for failure to report;
- EUR 100 for individuals or EUR 150 for entities, per affected user or controlling person, for incomplete or incorrect reporting; and
- penalties for due diligence failures.
Penalties are doubled for repeated violations.
Transitional rule and open points
Because the Law was published more than eight months after its stated entry into force, parliament added a transitional rule. RCASPs and financial institutions must complete due diligence within three months of promulgation, by 15 December 2026, for customers onboarded since 1 January 2026. Failing this, transactions must be blocked. This is a national catch-up rule with no equivalent in DAC8.
The TSSPC also still requires consent, deemed given after 15 working days, before information is forwarded to a third Member State. Article 16(3) of the DAC, as amended by DAC8, only gives the Member State of origin a right to object within 15 calendar days.
The NRA is expected to issue orders on reporting formats and to publish the list of partner jurisdictions.
Earlier, Bulgaria’s Council of Ministers approved and submitted a draft bill to the National Assembly on 7 May 2026 to transpose two European Union directives into national law: Council Directive (EU) 2023/2226 (DAC8) and Council Directive (EU) 2025/872 (DAC9).
