Online shops and the tax office: registers, SUPTO and the audit file

This topic throws more people into a panic than anything else in e-commerce. The panic is usually disproportionate to the actual work — but the gaps really do get fined, so let's lay it out.

This is a plain-language explainer, not tax advice. For your specific case, ask your accountant — they cost less than one penalty.

First: declare the shop

If you sell goods or services through a website, in Bulgaria it must be declared to the revenue agency (NAP). This is a separate step from registering the company and from VAT registration.

In practice you submit information about the online store — domain, type of activity, where the data is hosted, what software you use. It's filed electronically with a qualified electronic signature.

If you change platform or domain, the details must be updated. That's the part people most often forget.

Second: do you need a cash register?

The answer depends entirely on how the money arrives.

You usually do NOT need a fiscal device if:

• Customers pay only by bank transfer
• Customers pay cash on delivery and the courier wires the money to your bank account
• Payments go through a payment provider and land in your bank account

You usually DO need one if:

• You take cash in person (shop, stall, you deliver yourself)
• You take card payments on a physical terminal

The logic is simple: the state wants a trace for every cash payment. When the money passes through a bank or a courier, the trace already exists.

If you sell both online and in person, the in-person rules apply to those payments.

Third: SUPTO

SUPTO stands for "software for managing sales in a commercial establishment". The definition is broader than it sounds: software that processes sales information and manages the sales process.

If your software falls under the definition, extra requirements follow — including that it be declared, keep an audit log, and not allow sales data to be deleted.

Two nuances save a lot of nerves here:

1. The regime is tightly linked to whether you have a fiscal device at all and how you accept payments.
2. Many small shops working purely with cash on delivery and bank payments do not fall into the heaviest scenario.

Pinning this down exactly is an accountant's job — but it's worth asking before you pick a platform, not a year later.

Fourth: the audit file (Annex 38)

If you're covered, the revenue agency can demand a standardised audit file of your sales data. The format is described in Annex 38 and it is very specific:

• XML, not Excel, not PDF
• CP1251 encoding (not UTF-8 — the classic mistake)
• An exact element structure, validated against a schema
• Period and scope set by the request

A file with the wrong encoding or a misplaced element is rejected as if you'd submitted nothing. And that is where penalties come from — a format error rather than hidden income, which is particularly galling.

If you're on Brandolog, NAPpy generates the file for you: it reads your sales, produces validated XML in the correct encoding, and hands it over ready to submit. On another platform, ask your provider whether they can export per Annex 38 — an answer of "we can give you a CSV" means no.

Fifth: invoices and VAT

Briefly, so we don't drift:

• An invoice is issued on customer request, and always to businesses.
• VAT registration has a turnover threshold; above it, it's mandatory, below it optional.
• Sales to consumers in other EU countries have their own regime above a certain volume.

In detail and in plain language: VAT, invoices and registration.

Checklist

• The shop is declared to the revenue agency
• You know whether you need a fiscal device given how you're paid
• You've checked with an accountant whether your software counts as SUPTO
• You can produce an Annex 38 audit file on request
• You issue invoices when required
• Terms and policies are published — the full list here

Realistically: how much work is this?

For a new shop taking cash on delivery and bank payments:

• Declaring the shop: one afternoon with an electronic signature
• Checking the cash register question: one phone call to an accountant
• Audit file: zero minutes, if your platform generates it

That's it. It isn't a six-month project and it isn't a reason not to launch. It's a list you walk through once — then update when something changes.