International Banking and Automatic Exchange of Information: CRS, FATCA, DAC8 and CARF

Automatic Exchange of Information (AEOI) does not replace the exchange of information on request. It is a separate mechanism under which predefined categories of information are transmitted periodically without a case-specific request from another jurisdiction. The operation of an automatic reporting regime does not require a prior finding or individual suspicion that the account holder or user has committed a violation.  

From 1 January 2026, the reporting framework also extends to crypto-assets. Amendments to the Bulgarian TSSPC promulgated in State Gazette No. 85 of 15 September 2026 introduced a new Section IIIb governing the automatic exchange of information on crypto-assets. The provisions apply from 1 January 2026 and implement Directive (EU) 2023/2226 (DAC8), which is based on the OECD Crypto-Asset Reporting Framework (CARF).  

CRS and FATCA are distinct financial information reporting regimes. DAC2 is not a separate third standard. It is the EU legal framework through which CRS was implemented within the European Union. For individuals, CRS is principally based on tax residence, while also containing separate rules for entities, financial institutions and controlling persons. Directive 2014/107/EU (DAC2) and CRS are implemented in Bulgaria through Chapter Sixteen, Section IIIa of the TSSPC.  

FATCA is a US reporting regime applied in Bulgaria under a Model 1 Intergovernmental Agreement. Under this model, Reporting Bulgarian Financial Institutions carry out the procedures for identifying U.S. Reportable Accounts, while Bulgaria obtains and annually exchanges the relevant information with the United States.  

FATCA does not rely solely on the tax residence test used under CRS. For FATCA purposes, a US citizen is treated as a US tax resident even where the person is also tax resident in another jurisdiction. A US place of birth, however, is a FATCA indicium that triggers additional due diligence. It does not in every case constitute a final determination that the individual must be treated as a U.S. Person, as the applicable rules allow foreign status to be established through the required documentation.  

The precise reporting dataset depends on the applicable regime, the type of account and the status of the account holder. Under the Bulgarian CRS/DAC2 rules, reportable information includes identification details such as the name, address, tax identification number, tax residence and, for individuals, the date and place of birth. The account number or functional equivalent and identifying information concerning the Reporting Financial Institution are also included.  

Financial information may include the account balance or value at the end of the calendar year or on the date of closure. For custodial accounts, reporting includes gross interest, dividends, other income and certain gross proceeds from the sale or redemption of financial assets. For depository accounts, the aggregate gross amount of interest paid or credited to the account is reported.  

In Bulgaria, information under Article 142b(1) TSSPC must be submitted electronically by Reporting Financial Institutions to the National Revenue Agency (NRA) once a year, by 30 June of the following year. The NRA automatically exchanges the information with the competent authority of each participating jurisdiction with which an exchange arrangement is in place by 30 September of the following year.  

Incorporating a foreign company or using a holding structure does not exclude the application of CRS or FATCA. Where an entity falls within the Passive Non-Financial Entity category, the applicable procedures may require the identification of its controlling persons and the determination of their tax residence or FATCA status.  

Passive NFE classification must be determined under the full set of applicable criteria rather than by reference to a single threshold. Under the standard Active NFE income and asset test, both less than 50% of the entity's gross income for the preceding calendar year must be passive income and less than 50% of its assets must generate, or be held for the production of, passive income. The TSSPC also recognises other independent Active NFE categories, so failure to meet this particular test should not be considered in isolation from the remaining statutory criteria.  

For a Passive NFE, the financial institution identifies controlling persons using information obtained under applicable anti-money laundering procedures and tax residence self-certifications. Under CRS, the account is reportable in respect of a controlling person where that controlling person is itself a Reportable Person. It is therefore not correct to assume that every controlling person of every Passive NFE is automatically reported to every jurisdiction.  

DAC8 extends automatic exchange within the European Union to specified crypto-asset transactions. The rules are based on CARF and apply from 1 January 2026. The Bulgarian TSSPC now contains a dedicated Section IIIb governing due diligence on crypto-asset users, reporting to the NRA and subsequent automatic exchange with EU Member States and applicable partner jurisdictions.  

Reporting Crypto-Asset Service Providers collect identification information on reportable users and, where applicable, controlling persons. They also report information on relevant types of crypto-assets and specified aggregated transaction data for the calendar year. The information must be submitted to the NRA once a year by 30 June of the following year. For the first reporting period, 2026, this means reporting in 2027, while exchanges between EU tax authorities relating to 2026 are due by 30 September 2027.  

The Bulgarian legislation also contains transitional rules reflecting the September 2026 promulgation of the amendments. For customer relationships established between 1 January 2026 and the promulgation of the law, the required due diligence must be completed within three months following promulgation. If due diligence has not been completed within that period, the relevant providers and financial institutions must not allow transactions until the review is completed. For existing crypto-asset users with whom a relationship existed on 31 December 2025, the due diligence procedures must be applied by 1 January 2027.  

When establishing a relationship with an individual crypto-asset user, the provider must obtain a self-certification enabling it to determine the jurisdiction of tax residence and must confirm the reasonableness of that certification against the information available to it. Where a change in circumstances makes the original certification incorrect or unreliable, a new valid self-certification, or explanations and supporting documents substantiating the original certification, must be obtained.  

If a crypto-asset user fails to provide the required information, the provider must not permit transactions after 60 days from the initial request for information, provided that at least two written reminders have been issued.  

The 2026 amendments also update the financial account regime by bringing electronic money and central bank digital currencies within relevant definitions. For the purposes of Section IIIb, however, electronic money and central bank digital currencies are excluded from the definition of a "Reportable Crypto-Asset".  

The Multilateral Competent Authority Agreement for automatic exchange under CARF has been in force for Bulgaria since 22 April 2026. Actual exchange with a particular non-EU jurisdiction also depends on an exchange relationship being in effect between the relevant competent authorities.  

Under the financial account regime, a Reporting Financial Institution must not open a new account where a person refuses to provide the required self-certification or documentary evidence and that refusal prevents the institution from carrying out the required due diligence and reporting. Subject to the same condition, an existing financial account may be closed.  

The TSSPC provides administrative sanctions for both Reporting Financial Institutions and account holders. Current NRA guidance states that an account holder who provides false information in a declaration with the purpose of preventing identification as a Reportable Person may be subject to a fine or administrative pecuniary sanction of up to EUR 511.29, corresponding to BGN 1,000, unless a more severe penalty applies. Separate sanctions apply to failures by financial institutions to report, the reporting of incorrect information, and the opening of new accounts without the required self-certifications and documentary evidence.  

Article 278i TSSPC establishes a separate sanctioning regime for crypto-assets. A Reporting Crypto-Asset Service Provider that is a legal entity or sole trader and fails to report the required information within the statutory deadline may be subject to an administrative pecuniary sanction of EUR 5,000 to EUR 10,000. Incomplete or incorrect information and breaches of the due diligence procedures may result in a sanction of EUR 150 for each affected user or controlling person for legal entities and sole traders. A crypto-asset user who provides false information in the required declaration may be fined EUR 1,000 to EUR 3,000 if an individual, or be subject to an administrative pecuniary sanction of EUR 1,500 to EUR 4,000 if a legal entity or sole trader. Repeated violations under Article 278i are subject to double the applicable sanction.  

Automatic exchange does not make financial information publicly accessible. Under the TSSPC, information exchanged with the competent authorities of participating jurisdictions under the financial account regime is treated as tax and social security information and is subject to statutory restrictions on access, disclosure and use.  

Personal data exchanged for tax purposes is processed in accordance with Regulation (EU) 2016/679 (GDPR) and the specific data protection provisions of the TSSPC. Corresponding rules concerning confidentiality, use of information and personal data protection also apply to information exchanged under the crypto-asset reporting regime.  

Correctly determining tax residence and properly classifying entities are central to compliance with automatic information exchange requirements. For corporate structures, it is important to establish whether an entity is a Financial Institution, an Active NFE or a Passive NFE and, where relevant, which individuals qualify as its controlling persons.  

Tax residence self-certifications and the supporting documentation should remain consistent with the actual circumstances. Changes that make previously provided information incorrect or unreliable may require a new self-certification, further due diligence or restrictions on transactions until the required review has been completed.  

For Reporting Crypto-Asset Service Providers, 2026 is the first reporting year under the new framework. Due diligence, tax residence identification, record-keeping and reporting processes should therefore reflect the new Section IIIb of the TSSPC and the applicable transitional deadlines.  

Vassilev & Chisuse Law Firm provides legal assistance in international tax planning, banking regulation, the application of CRS and FATCA, the classification of corporate entities and the structuring of cross-border operations. Legal assistance may also include an assessment of obligations arising under DAC8 and CARF, including the applicability of the automatic exchange framework for crypto-assets.  

This material is provided for general informational purposes only. It does not constitute individual legal, tax, financial or investment advice. The application of CRS, FATCA, DAC8 and CARF requires an assessment of the specific facts, the status of the relevant persons and the jurisdictions concerned.