Automatic Exchange of Information for Digital Platform Operators ("DAC7") - an introduction & the impact on Middle East businesses

In brief

DAC7 enters into force in the EU on 1 January 2023, Middle East businesses have less than 18 months to assess whether they are impacted by DAC7 and if so, ensure implementation of the requirements is performed to enable capture, processing and reporting of data.

Background

The digitalization of the economy has been identified as a critical matter for tax authorities as digital activities are experiencing rapid growth in recent and upcoming years. This has been more recently accelerated by the COVID-19 pandemic and the challenges the pandemic has posed globally. Concern has been raised that income earned from activities carried out through digital businesses and more specifically digital platforms is not being reported in full to tax authorities and therefore as these businesses grow and increase market share, there is an increased risk of a loss of tax revenue. This is particularly challenging to monitor when taxable income is derived via digital platforms in other jurisdictions. It has been estimated there is an approximate $166bn tax gap in the EU from a Value Added Tax ("VAT") perspective and an equally significant tax gap from a corporation tax perspective.

Timeline, penalties, collection of data and reporting requirements

DAC7 needs to be transposed into domestic law by each EU Member State by 31 December 2022, and therefore, DAC7 is required to go live 1 January 2023. This leaves less than 18 months for businesses to prepare for DAC7 go live, including an implementation of controls and measures to collect, process and report information required under DAC7. 

Non-compliance with the DAC7 would lead to the application of penalties. At this stage, DAC7 outlines that each Member State should lay down rules on such penalties which must be effective, proportionate and dissuasive. Regarding non-EU digital platforms, the worst-case-scenario could be  preventing them to practice any further activity in the EU or included in a blacklist issued by each Member State. We await guidance to be released to clarify the amounts and further implications. 

If a business is in scope for DAC7, they are expected to collect the following information on sellers (both individuals and entities):

1. legal name (entities), first and last name (individuals);

2. primary address;

3. TIN, including each EU Member State of issuance, and in the absence of a TIN, the place of birth of that seller;

4. VAT identification number (where available);

5. date of birth (individuals only);

6. business registration number (entities only); and

7. existence of permanent establishment through which Relevant Activities are carried out in the EU, where available, indicating each respective EU Member State, where such a permanent establishment is located.

The above is not an exhaustive list. This therefore means digital platforms will be required to significantly change their onboarding and client data collection processes in order to collect and maintain sufficient data to comply with the requirements.  

The first reports are to be submitted by January 31, 2024 (in respect of calendar year 2023) and the responsibility for submitting reports lies at the digital platform itself. In addition to the above information, it is expected digital platforms will also be required to report the following information on the users of the platform (however this is likely to be clarified closer to the time):

1. Financial account identifier and the competent authority of the EU Member State where the reportable seller is resident,

2. Each EU Member State in which the reportable seller is resident; and

3. Amounts paid or credited and the number of relevant activities; 

4. Fees; commissions or taxes withheld or charged by the platform operator.

The information requirements regarding relevant activities involving immovable property rental will also include details on the properties in EU Member States.

Illustrative example of DAC7

As DAC7 is expected to impact a wide range of businesses, we have outlined below an illustrative example of how DAC7 may operate in practice.

DAC7 implications on the Middle East 

Given DAC7 impacts both EU and non-EU businesses, Middle East platforms bringing users and sellers together through a digital platform based in the Middle East as the DAC7 has extraterritorial impact. In this regard, impacted business based in the Middle East should kickstart activities aimed to identify the DAC7 impact on their activities.

Next steps

To assess the impact of DAC7 on your business, we are supporting organizations with an impact assessment and implementation, particularly given the extensive work involved to comply with the requirements. Our immediate recommendations would be to:

1. Perform an impact assessment to determine if your business is in scope of DAC7; 

2. If impacted, design and implement the relevant controls and processes to collect and report information. This should include identification of a governance framework; and

3. Prepare for collection of the required information beginning 1 January 2023.