What the NRA Knows About My Income from Abroad. Part 1: The Channels

This series follows on from two earlier articles. In “NRA Tax Residency Check: Foreign Accounts and Crypto Exchanges” we looked at what to do once a letter from the National Revenue Agency (NRA, the Bulgarian tax authority) has already arrived. In “Tax Resident of Half of Europe (and of One Ship)” we looked at who is a tax resident and which country has the right to tax. Here we answer the question that comes before both: what exactly does the NRA know before it ever writes to you?

1. Three concepts without which the tables make no sense

Worldwide income

A resident individual owes tax in Bulgaria on income from sources in Bulgaria and abroad (Article 6 of the Personal Income Tax Act, PITA). Who is resident is set out in Article 4 PITA: a permanent address in Bulgaria (unless the person’s centre of vital interests is not in the country, Article 4(5)), more than 183 days of presence in any 12-month period, being sent abroad by the Bulgarian state or by a Bulgarian enterprise, or a centre of vital interests in Bulgaria. When two countries both consider you their resident, the double tax treaty (DTT) decides. That is the subject of the article on dual residence.

Income from a Bulgarian source

A non-resident individual owes tax in Bulgaria only on income from a Bulgarian source (Article 7 PITA). Which income has its source in Bulgaria is set out in Article 8 PITA: for example, work performed in the country and services rendered here. For a resident, the distinction matters for another reason: it shows which country has the first right to tax.

Withholding tax at source

The country the income comes from often withholds tax at the time of payment. The US, for example, withholds tax on dividends and royalties, and Germany on salaries. This does not release a resident from the obligation to declare the income in Bulgaria. Double taxation is eliminated under the DTT, since the treaty takes precedence over the law (Article 75 PITA), or through a tax credit. The tax credit is determined separately for each country and each type of income and cannot exceed the Bulgarian tax on the same income (Article 76(3) PITA).

2. A map of the channels

Information reaches the NRA through seven main channels. Six of them are automatic and run on a calendar. The seventh, exchange on request, works when the NRA or the foreign administration decides to ask.

Channel	Legal basis	Who reports and what it contains	Deadline / when it reaches the NRA
DAC1	EU/international: Directive 2011/16/EU, Article 8(1) Bulgaria: Tax and Social Security Procedure Code (TSSPC), Article 143z	Who: The tax administration of the source country, from the data it holds What: Eight categories of income: salaries, directors’ fees, pensions, life insurance, property, rents, royalties, dividends	By 30 June of the year after the year in which the data became available
CRS / DAC2	EU/international: Directive 2014/107/EU; Multilateral Competent Authority Agreement (CRS MCAA) Bulgaria: TSSPC, Section IIIa, Articles 142b–142v	Who: Banks, brokers, custodians, insurers; from 2026 also e-money issuers What: Balance at 31 December, gross interest, dividends, other income, gross proceeds from sales	The institution reports by 30 June; the exchange is by 30 September
DAC7 / DPI-MCAA	EU/international: Directive (EU) 2021/514; the agreement on platforms (DPI-MCAA) Bulgaria: TSSPC, Section VIII, Articles 143ya5–143ya13	Who: Digital platform operators What: Consideration per quarter, number of transactions, fees, taxes withheld, account; for property also the address and the number of days	The platform reports by 31 January; the exchange is within 2 months of the end of the year (by the end of February)
DAC8 / CARF	EU/international: Directive (EU) 2023/2226; the OECD Crypto-Asset Reporting Framework (CARF) Bulgaria: TSSPC, Section IIIb, Articles 142yu–142ya10 (State Gazette No. 85/2026)	Who: Crypto-asset service providers What: Annual totals per type of asset: purchases, sales, exchanges, transfers	The provider reports by 30 June; the exchange is within 9 months of the end of the year (by 30 September). For 2026: by 30 June 2027 and by 30 September 2027
CESOP	EU/international: Directive (EU) 2020/284; Regulation (EU) 2020/283 Bulgaria: VAT Act, Article 123a	Who: Payment service providers What: Payees receiving more than 25 cross-border payments per quarter	Every quarter; the aim is to fight VAT fraud
FATCA	EU/international: Bulgaria–US agreement of 5 December 2014 (Model 1B) Bulgaria: Ratification Act, State Gazette No. 47/2015; TSSPC, Article 142b(7)	Who: Bulgarian financial institutions, to the IRS What: Accounts of US persons	Nothing comes to the NRA: the agreement is non-reciprocal
On request and spontaneous exchange	EU/international: DAC, Articles 5, 5a and 9; DTTs (Article 26 of the OECD Model); Convention on Mutual Administrative Assistance Bulgaria: TSSPC, Section IV (Article 143) and Section V	Who: The foreign tax administration What: Anything “foreseeably relevant”, including full statements	No calendar; also for past years, within the limitation period

3. DAC1: income by category

The oldest automatic channel in the EU. The tax administration of each member state sends the other states information on the income of their residents in eight categories, listed in Article 143z(1) TSSPC:

1. employment income;
2. remuneration under management and control contracts;
3. life insurance benefits and premiums not reported under CRS;
4. pensions;
5. ownership of immovable property and income from its sale or exchange;
6. income from renting out or other paid use of immovable property;
7. royalties (added by State Gazette No. 100/2022, in force from 1 January 2023);
8. dividends paid to individuals, where they are not reported under CRS (added by State Gazette No. 85/2026, in force from 1 January 2026).

DAC1 has an important limitation: a country sends only information that it holds. If your German employer reports your salary to the German tax administration, that data will reach the NRA. If the source country does not collect such data for a given category, it has nothing to send. From 2026 the member states have committed to exchanging at least 5 of the 7 categories in the directive. (The directive treats immovable property as one category, while the TSSPC splits it into two items, which is why the TSSPC lists eight categories.)

The deadline is 30 June of the year following the year in which the data became available (Article 143z(4) TSSPC). That is why a foreign salary for 2025 usually reaches the NRA in the second half of 2026.

4. CRS/DAC2: financial accounts

CRS is the OECD’s Common Reporting Standard for the automatic exchange of financial account information. Within the EU it applies through DAC2, and with third countries through the Multilateral Competent Authority Agreement (CRS MCAA). Which jurisdictions have signed it is listed in section 9. A financial institution identifies its clients by country of tax residence. For the accounts of residents of another participating country, it files an annual report with its own tax administration, which forwards it to the client’s country.

What the report contains (Article 142b TSSPC)

• name, address, tax identification number, date and place of birth of the account holder, and for companies also of the controlling persons;
• account number and details of the financial institution;
• the balance or value of the account at the end of the year or on its closure;
• for a custodial account: gross dividends, interest and other income and gross proceeds from the sale or redemption of financial assets;
• for a depository account: the gross amount of interest paid or credited during the year;
• for other accounts: the gross amount paid or credited to the account holder.

The amendments in State Gazette No. 85/2026 also bring e-money and central bank digital currencies into scope. E-money accounts whose average balance over 90 days does not exceed the equivalent of USD 10,000 are excluded. The report now also states whether the account is joint, what role the controlling person has and whether a valid self-certification was obtained.

Deadlines

Bulgarian financial institutions report to the NRA by 30 June of the following year (Article 142v(1) TSSPC). The NRA exchanges the information with the participating jurisdictions by 30 September. The same calendar applies in the other direction: data on your account in Lithuania, Ireland or Cyprus for 2025 reaches the NRA by 30 September 2026.

CRS does not contain individual transactions, the acquisition cost, the realised gain or loss, or the tax withheld abroad. The balance at 31 December also includes unrealised gains. These limitations are the basis of parts 2 and 3.

5. DAC7: digital platforms

Since 1 January 2023, digital platform operators have collected and reported data on the sellers who carry out one of four relevant activities through them:

• personal services, i.e. work performed at the request of a user, on a time or task basis (freelancing, transport, delivery, commissioned content, tourist services);
• rental of immovable property;
• sale of goods;
• rental of means of transport.

What the NRA receives (Article 143ya8 TSSPC)

• name, address, date of birth, tax identification number and the country that issued it, and VAT number, if any;
• the identifier of the account into which payments are made, and its holder if that is a different person;
• for each quarter: the total consideration, the number of transactions, and the fees, commissions and taxes withheld by the platform;
• for property: the address, the land register number, the number of days rented and the type of property.

Thresholds

Only the sale of goods has a threshold. A seller is not reported if they made fewer than 30 sales and received no more than EUR 2,000 in the year. Both conditions must be met at the same time. For personal services and rentals there is no threshold: the very first euro is reported.

Platforms outside the EU and Bulgarian platforms

An operator outside the EU that works with EU sellers must register in one member state and report there. Patreon, for example, reports in Ireland. The UK applies an equivalent regime, and the data is exchanged under the agreement on platforms (DPI-MCAA). Bulgaria signed it on 3 November 2022 and the UK on 9 November 2022. Bulgarian platforms, for their part, report to the NRA on sellers from Bulgaria as well.

The deadline is 31 January of the following year (Article 143ya11(1) TSSPC). By the same date the platform must send you a copy of what it reported (Article 143ya11(6) TSSPC). The NRA exchanges the data within two months of the end of the year (Article 143ya5(5) TSSPC). Keep the copy and compare it with your tax return. This is exactly the information the NRA will compare with your annual tax return.

6. DAC8 and CARF: crypto-assets

DAC8 was transposed into the TSSPC late: a new Section IIIb “Automatic exchange of information on crypto-assets”, Articles 142yu–142ya10, promulgated in State Gazette No. 85 of 15 September 2026. The transposition deadline was 31 December 2025, and on 30 January 2026 the Commission opened infringement proceedings against Bulgaria. The law, however, is in force retroactively from 1 January 2026. The whole of 2026 is reported, including transactions made before the law was promulgated.

Who reports

Crypto-asset service providers licensed under MiCA (Regulation (EU) 2023/1114), including banks with such a licence. Operators without a MiCA licence that serve EU clients also report; they register in one member state, in Bulgaria with the executive director of the NRA. The user files nothing. Their obligation is to declare their tax residence truthfully.

What is reported (Article 142ya2 TSSPC)

• identification of the user: names, address, country of residence, tax identification number, date and place of birth; for companies also of the controlling persons;
• for each type of crypto-asset, annual totals: purchases for fiat currency (gross amount, number of units, number of transactions) and sales for fiat currency;
• crypto-to-crypto exchanges at fair market value;
• retail payments for goods and services above USD 50,000;
• all other incoming and outgoing transfers, including the total value of transfers to addresses not linked to a service provider, i.e. to wallets you hold yourself.

Deadlines and consequences

• the provider reports once a year, by 30 June of the following year (Article 142ya2(7) TSSPC); the first report is for 2026, due by 30 June 2027;
• the exchange between countries takes place within 9 months of the end of the year; the first exchange is by 30 September 2027;
• existing clients must declare their tax residence by 1 January 2027; if a client does not provide the information within 60 days of the initial request, after at least two written reminders, the provider stops allowing their transactions (Article 142ya8(1) TSSPC);
• a false self-declaration by the user (Article 142ya6 TSSPC) is punishable by a fine of EUR 1,000 to 3,000 for an individual (Article 278i(9) TSSPC).

Third countries under CARF

Outside the EU, crypto data is exchanged under CARF. As of June 2026, the UK, the Cayman Islands, Israel, Japan, Korea, Norway, Liechtenstein, Jersey, Guernsey, New Zealand, Brazil and others have committed to a first exchange in 2027. Switzerland, the UAE, Singapore, Hong Kong, Turkey, Canada, Australia, the Seychelles and others have committed to a first exchange in 2028. The US is not on the list. Neither are Serbia and North Macedonia.

7. CESOP: cross-border payments

Since 1 January 2024, payment service providers (banks, payment institutions, e-money institutions) have kept records of cross-border payments. They report any payee who has received more than 25 cross-border payments in one quarter (VAT Act, Article 123a). The data is submitted every quarter, in the month after it ends, and goes to the central CESOP system. The aim is to fight VAT fraud, so only the payer’s country is recorded, not their name.

A limitation: CESOP covers payments where the payer is in the EU. Payments from clients in the US or the UK do not enter the records. The channel is meant for VAT, but it shows the NRA who is actually selling online. From there it is only one step to the questions of VAT registration and income tax.

8. The US: the big exception

Here is the strongest and most unexpected answer. Practically nothing comes automatically from the US to the NRA.

• FATCA is one-way. The agreement was signed in Sofia on 5 December 2014, ratified by law (State Gazette No. 47/2015) and has been in force since 30 June 2015. It follows the non-reciprocal Model 1B. Article 2 only governs Bulgaria’s obligation to collect information on US accounts and send it to the US. The Minister of Finance defended precisely the non-reciprocal version before Parliament, after the US had refused a reciprocal one.
• The US does not participate in CRS. US banks and brokers do not report their clients under CRS.
• Interest on deposits. US banks report to the IRS the deposit interest of Bulgarian residents. In Rev. Proc. 2022-35, however, Bulgaria is not on the list of countries with which the IRS exchanges this data automatically.
• CARF. As of June 2026, the US is not on the list. The US Treasury sent draft rules to the White House for review on 14 November 2025, and the US says it is working towards implementation by 2029.

9. Third countries and exchange on request

Third countries (outside the EU and the US)

With most major jurisdictions, including the UK, Switzerland, the UAE, Singapore and Hong Kong, CRS exchange works through the CRS MCAA. The list of participating jurisdictions is published by the NRA (Article 142g TSSPC). For platforms the DPI-MCAA applies, and for crypto, CARF. Outside the automatic channels there remains exchange under DTTs and under the Convention on Mutual Administrative Assistance in Tax Matters, ratified by Bulgaria in 2016. Without an international treaty, exchange is possible only on a reciprocal basis and with confidentiality guarantees (Article 143(2) TSSPC).

Who has signed the CRS MCAA

As at 28 October 2026, 126 jurisdictions have signed the CRS MCAA. This is the latest official OECD list, with status as of 13 March 2025. The OECD has not published a newer version, and the date of the file is shown on its website. Hong Kong and Macao are listed separately, as part of China’s signature, and New Caledonia as part of France’s.

• EU (27): all member states, including Bulgaria (signed on 21 October 2015, first exchange in September 2017). Between themselves, however, EU countries exchange under DAC2, not under the MCAA.
• Europe outside the EU (23): Albania, Andorra, Armenia, Azerbaijan, Faroe Islands, Georgia, Gibraltar, Greenland, Guernsey, Iceland, Isle of Man, Jersey, Liechtenstein, Moldova, Monaco, Montenegro, Norway, Russia, San Marino, Switzerland, Turkey, Ukraine, United Kingdom.
• Middle East (8): Bahrain, Israel, Kuwait, Lebanon, Oman, Qatar, Saudi Arabia, United Arab Emirates.
• Asia and the Pacific (25):
  • Australia, Brunei, China (with Hong Kong and Macao), India, Indonesia, Japan, Kazakhstan, Korea, Malaysia, Maldives, Mongolia, Pakistan, Singapore, Thailand, Vanuatu;
  • Cook Islands, Marshall Islands, Nauru, New Caledonia (through France), New Zealand, Niue, Papua New Guinea, Samoa.
• North and South America and the Caribbean (31):
  • Argentina, Brazil, Canada, Chile, Colombia, Costa Rica, Ecuador, Mexico, Panama, Peru, Uruguay;
  • Anguilla, Antigua and Barbuda, Aruba, Bahamas, Barbados, Belize, Bermuda, British Virgin Islands, Cayman Islands, Curaçao, Dominica, Grenada, Jamaica, Montserrat, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, Sint Maarten, Trinidad and Tobago, Turks and Caicos Islands.
• Africa (12): Cameroon, Ghana, Kenya, Liberia, Mauritius, Morocco, Nigeria, Rwanda, Senegal, Seychelles, South Africa, Uganda.

The most recent to join, and the year of their first exchange:

• Trinidad and Tobago and Cameroon: 2026;
• Mongolia and Papua New Guinea: 2027.

Who has not signed. Relevant for Bulgarian clients:

• the US (FATCA applies there, and for Bulgaria it is non-reciprocal; see section 8);
• Serbia, North Macedonia, Bosnia and Herzegovina, Kosovo;
• Belarus, the Philippines, Vietnam, Egypt.

Source: OECD – Signatories of the CRS MCAA, status as of 13 March 2025 (opens in a new tab), published in the Tax Transparency Resource Centre (opens in a new tab).

Exchange on request, including group requests

At any time within the limitation period, the NRA can ask a foreign tax administration for information about a specific taxpayer: statements, contracts, platform data. The standard is “foreseeable relevance”. The Court of Justice of the EU interpreted it in Berlioz (C-682/15) and État luxembourgeois (C-245/19). DAC7 added Article 5a to the directive, which expressly allows group requests, i.e. requests about a group of persons identified by common characteristics rather than by name. The requesting country must describe the group, the applicable law and the facts that point to non-compliance with it.

Exchange on request is not limited to the years for which automatic exchange already exists. It is limited by the limitation period: 5 years from the end of the year in which the tax return should have been filed, with an absolute limitation period of 10 years.

Anti-money laundering data

With DAC5, tax administrations gained access to the information collected under anti-money laundering rules, including on beneficial owners, for the purposes of administrative cooperation (Article 12(9) TSSPC). A source-of-funds check by your bank or exchange is not an NRA inspection. The documents you provide there, however, become part of the picture.

10. Domestic sources that complete the picture

• the returns filed by Bulgarian payers under Article 73 PITA;
• the BNB Register of Bank Accounts and Safe Deposit Boxes (Credit Institutions Act, Article 56a), for accounts with institutions operating in Bulgaria;
• the Registry Agency (property) and the other state registers;
• your own annual tax return: under Article 50(1)(4) PITA you declare shares and holdings in companies, places of business and immovable property abroad, and under item 5 also loans granted and received above the thresholds;
• the data you yourself submit under the VAT Act, including VIES returns, if you are VAT-registered.

In part 2 we look at which specific payer goes through which of these channels and what exactly ends up in the NRA’s hands.

Legislation and sources for part 1

• PITA, Articles 4, 6, 7, 8, 50, 75, 76 (lex.bg, in Bulgarian (opens in a new tab)); TSSPC, Article 12(9), Article 278i(9) and Chapter Sixteen, Sections IIIa, IIIb, IV, V and VIII (lex.bg, in Bulgarian (opens in a new tab)), last amended State Gazette No. 85 of 15 September 2026
• VAT Act, Article 123a (CESOP); KiK – Payment service providers keep a register of cross-border payments (in Bulgarian) (opens in a new tab)
• Directive 2011/16/EU as amended: DAC2 (2014/107/EU), DAC5 (2016/2258), DAC7 (2021/514), DAC8 (2023/2226); European Commission – DAC1 (opens in a new tab)
• Regfollower – Bulgaria amends tax procedure code to implement DAC8 and DAC9 (opens in a new tab); KiK – Crypto transactions from 2026 are reported to the NRA (in Bulgarian) (opens in a new tab); BTA – Parliament adopts the TSSPC amendments at second reading, 9 September 2026 (in Bulgarian) (opens in a new tab)
• Bulgaria–US FATCA agreement, State Gazette No. 47/2015 (text in KiK, in Bulgarian (opens in a new tab)); BTA – Finance Minister Defends Ratification of Non-reciprocal Agreement, 27 March 2015 (opens in a new tab); Regfollower – Bulgaria–US FATCA agreement entered into force (opens in a new tab)
• IRS, Rev. Proc. 2022-35 (opens in a new tab); IFC Review – IRS Steps Closer To Automatic Reporting Under OECD CARF (opens in a new tab)
• Irish Revenue – CARF and DAC8 reportable jurisdictions (as of 10 June 2026) (opens in a new tab); OECD – DPI MCAA signatories (opens in a new tab)
• OECD – Signatories of the CRS MCAA, status as of 13 March 2025 (opens in a new tab), in the Tax Transparency Resource Centre (opens in a new tab)
• Patreon – EU Creator: DAC7 (opens in a new tab); BTTP – Financial data of OnlyFans creators goes to Polish tax offices (opens in a new tab)
• Leiden GlobTaxGov – Foreseeable relevance in the EU: from DAC1 to DAC7 (opens in a new tab); CJEU judgments in Cases C-682/15 Berlioz and C-245/19 État luxembourgeois

This article is for information only and does not replace individual advice. The legislation is stated as at 28 October 2026. Amounts that the laws still state in leva have been converted at the fixed rate of BGN 1.95583 to EUR 1.