New FinanzOnline Ordinance 2027 replaces old regulation and tightens access rules

The Federal Minister of Finance has issued a comprehensive new regulation of the electronic tax procedure with the FinanzOnline Ordinance 2027 (FOnV 2027). The ordinance was promulgated on September 11, 2026, in the Federal Law Gazette for the Republic of Austria (Part II, BGBl. II No. 274/2026) and enters into force on January 1, 2027. It thereby replaces the previous FinanzOnline Ordinance 2006 together with the FinanzOnline Declaration Ordinance and regulates the entire procedure anew.

Legal Basis and Scope

The ordinance is based on more than twenty tax laws, including the Federal Tax Code (BAO), the Income Tax Act 1988, the Value Added Tax Act 1994, and the Corporate Income Tax Act 1988. It regulates the electronic data transfer between participants and the federal financial administration, as well as the authentication and identification function of FinanzOnline for other portals.

Eligible participants include, among others:

• Persons subject to tax and reporting obligations
• States and municipalities
• Professional party representatives such as tax consultants, notaries, and lawyers
• Gratuitous representatives pursuant to § 83a BAO

Identification and Access Data

Participation in FinanzOnline will in the future only be possible via three routes: via an electronic proof of identity (E-ID) according to the E-Government Act, via an electronic identification means within the meaning of the eIDAS Regulation with a “high” security level, or via the entry of access data together with a second authentication factor.

Access data will only be issued on a limited basis. Natural persons may only apply for them if they possess neither an E-ID nor an eIDAS-compliant identification means, or if the use thereof is unreasonable. As of October 1, 2029, the Austrian Tax Office must revoke the access data of natural persons if no exceptional case exists.

Penalty for Willful Non-Compliance and Obligations

Anyone who does not submit a filing for which an explicit electronic transmission obligation exists and a specified function is available via this function may, in the event of a repeat offense, be subject to a penalty for willful non-compliance of up to 700 euros. Before the penalty is imposed, the participant must have been requested in writing to comply, under threat of the penalty.

Participants are furthermore obliged to exercise due diligence and maintain confidentiality: access data and the second authentication factor must be kept secret and protected against disclosure. Filings made through the abusive use of access data by third parties are considered irrelevant, provided the participant proves their due diligence obligations.

Portal Use and Data Processing

The authentication and identification function of FinanzOnline will in the future enable the use of several electronic portals, including the Transparency Portal, the Social Security Portal, the portal of the Austrian Research Promotion Agency (FFG), and the Excise Tax Portal. For the transmission of municipal tax returns, the Federal Minister of Finance acts as a processor within the meaning of the GDPR and forwards the data to the municipalities without delay.

Significance for Taxpayers

The new regulation prepares the mandatory transition to modern identification methods such as E-ID and eIDAS. Taxpayers and legal representatives should check their access data and identification means in a timely manner, as access data without E-ID or an eIDAS-compliant means will be invalidated as of October 1, 2029.

Source: Federal Law Gazette for the Republic of Austria, Part II, No. 274/2026 of September 11, 2026, pp. 1–15 (official reference: BGBl. II No. 274/2026).