Bulgaria
Bulgaria is a unitary state, so supervision is national. The Bulgarian National Bank licenses banks, payment and e-money firms, the Financial Supervision Commission licenses insurers and crypto firms, and the National Revenue Agency licenses gambling. The Financial Intelligence Directorate of the State Agency for National Security receives suspicious transaction reports. Remote onboarding needs two verification methods or eIDAS eID; telecom, health and travel have their own rules.
Compliance guides by industry
More countries in this region
Launching in a new market?
Navigate local compliance requirements with confidence. Identomat helps you build verification workflows tailored to your business and the markets you operate in.
Frequrently asked questions
The Financial Intelligence Directorate of the State Agency for National Security is Bulgaria's financial intelligence unit. It receives suspicious transaction and cash reports, inspects obliged entities and imposes AML penalties. Sector supervisors share the work: the Bulgarian National Bank supervises banks, payment and e-money firms, the Financial Supervision Commission covers insurers and crypto-asset service providers, and the National Revenue Agency covers gambling operators.
Yes. Under the Measures Against Money Laundering Act, a business onboarding a customer who is not present may work from a copy of an identity document, but must verify the data with at least two independent methods, such as a document authenticity check, a register check, a video call or a first payment from the customer's own bank account. eIDAS electronic identification and qualified trust services are an accepted alternative.
Immediately, and before the transaction is carried out. Obliged entities report to the Financial Intelligence Directorate and delay the operation within the time the law allows; if delay is impossible, they report straight after execution and give the reason. The Directorate may suspend a transaction for up to five working days. Every cash payment above EUR 15,000 made by or to a customer must also be reported.
Usually. Matching a selfie to a document photo processes biometric data, a special category under the GDPR, so it needs an Article 9 exception, typically explicit consent, and a non-biometric route is the safer design. For banks and payment firms, the AML Rules also require explicit prior consent for video identification. Separately, Bulgarian law allows copying an identity document only where a law provides for it.
Telecom providers, medical facilities and pharmacies, online shops and marketplaces, hotels and travel agents, and public bodies are not obliged entities under the Measures Against Money Laundering Act, nor are insurers selling only non-life cover. Their identity duties come from sector rules instead. Activity that is in scope brings the AML duties back: handling buyers' payments, trading art from EUR 10,000 or exchanging currency.