Crypto & Virtual Assets Compliance in Bulgaria

Bulgaria is open to crypto businesses, but only under the EU Markets in Crypto-Assets Regulation (MiCA) regime. The national Markets in Crypto-Assets Act names the Financial Supervision Commission as the main licensing and supervisory authority, with the Bulgarian National Bank responsible for e-money tokens and for banks that provide crypto services.

Licensed providers are obliged entities under the Measures Against Money Laundering Act, supervised for anti-money laundering (AML) purposes by the Financial Intelligence Directorate of the State Agency for National Security and by the Commission.

The biggest obstacle for a new entrant is substance: the Commission expects real operations, staff and management in Bulgaria, not a registered address, and documents must be filed in Bulgarian.

1. Who regulates this sector

Bulgaria is a unitary state, so authorisation and supervision are national. EU regulations (MiCA and the Transfer of Funds Regulation) apply directly; the Bulgarian acts designate the authorities and set penalties.

The Registry Agency enters a licensed provider's right to provide crypto-asset services in the Commercial Register.

2. Licensing and authorisation

Under Article 59 of Regulation (EU) 2023/1114 (MiCA), no one may provide crypto-asset services in the EU unless authorised as a CASP, or unless it is a credit institution, investment firm, e-money institution or similar regulated entity using the MiCA notification route. In Bulgaria, applications go to the Financial Supervision Commission under Article 15 of the Markets in Crypto-Assets Act (Закон за пазарите на криптоактиви), promulgated in State Gazette No. 54 of 4 July 2025 and last amended in No. 25 of 10 March 2026.

What a licence requires

• Classes and capital. MiCA Annex IV sets minimum capital by class: EUR 50,000 (class 1, for example order execution, transfer services and advice), EUR 125,000 (class 2, adding custody and exchange services) and EUR 150,000 (class 3, operating a trading platform).
• Substance in Bulgaria. The Commission's MiCA FAQ requires a registered office in Bulgaria, at least one full-time executive residing in Bulgaria, part of the staff working there, and a three-year business plan; it states that "the mere declaration of intentions is not sufficient".
• Filing. Ordinance No. 77 of 12 March 2026 (State Gazette No. 30 of 2026) sets the application file: documents in Bulgarian, electronic filings signed with a qualified electronic signature, internal rules (including AML rules), and fit-and-proper documents for managers and qualifying shareholders.

Timeline

Under MiCA Article 63, the Commission checks completeness within 25 working days and decides within 40 working days of a complete application. Within 7 days of authorisation the provider must apply to the Registry Agency to add the activity to its Commercial Register entry (Article 15(3) of the Act). The Commission issued its first CASP licences in July 2026, for example Decision No. 499-ДУКА of 21 July 2026 covering custody, exchange and transfer services.

Passporting and the end of the transition

A CASP authorised in another member state may start serving Bulgarian customers once its home regulator has passed its notification to the Commission, or at the latest on the 15th calendar day after notifying (MiCA Article 65). Firms that were registered with the National Revenue Agency under the former Article 9a of the AML Act could continue until 1 July 2026 or until their licence was granted or refused (§ 3 of the Transitional and Final Provisions of the Act). The Commission's notice of 2 July 2026 states that from that date only licensed providers may offer crypto-asset services, and that unlicensed providers must offer no new services and help clients exit.

Operating without a licence exposes a firm to an order to cease immediately (Article 32 of the Act), fines and the website blocking procedure described in section 7.

3. AML, KYC and customer due diligence

Licensed CASPs are obliged entities under Article 4, item 19 of the Measures Against Money Laundering Act (Закон за мерките срещу изпирането на пари), consolidated text as amended up to State Gazette No. 51 of 2026. Their advice activity is excluded. Items 38 and 39, which covered virtual currency exchanges and custodian wallet providers, were repealed with effect from 1 July 2026.

When due diligence applies

On establishing a business relationship; on an occasional crypto-asset transaction of EUR 1,000 or more; on any suspicion, regardless of amount; and when earlier identification data is in doubt (Article 11(1)).

What it covers

Identifying and verifying the customer and beneficial owner, understanding the purpose of the relationship, establishing the source of funds, and ongoing monitoring (Article 10).

Enhanced due diligence

Required for politically exposed persons, high-risk third countries, products that could favour anonymity, high-risk new technologies, unusual transactions and cross-border correspondent relationships (Article 35). CASPs apply the EBA guidelines the Commission has adopted (Article 50(2)).

Source of funds

Established using at least two of the methods in Article 66(1), such as customer information and official registers, with a written declaration as a fallback.

Beneficial ownership and correspondent relationships

For corporate customers, firms must establish the ownership, management and control structure (Article 54(3)). Before opening a correspondent relationship with a foreign crypto provider, a CASP must check its licence or registration, assess its AML controls and obtain senior management approval (Article 44a).

EU restrictive measures adopted by the Council bind Bulgarian companies directly, as the State Agency for National Security notes, so customers and counterparties must be screened against them.

Reporting and records

Suspicion of money laundering must be reported to the Financial Intelligence Directorate immediately and before the transaction is carried out, delaying it where permitted; if delay is impossible, the report follows immediately afterwards with reasons (Article 72). Records are kept for five years, counted from the end of the business relationship or from the date of an occasional transaction, and the Directorate may extend this by up to two years (Article 67).

4. Identity verification and onboarding

Article 53 of the AML Act sets the identification data for individuals: names, date and place of birth, an official personal identification number or equivalent from a valid photo identity document, every citizenship held, and country of permanent residence and address (a post office box is not enough). In person, the customer presents an official identity document and the firm takes a copy. When starting a relationship, firms also collect the customer's occupation and the purpose of the relationship, by questionnaire or other means.

Verification methods

Article 55(1) lists the permitted verification methods, including additional documents, official databases on identity document validity, technical means for checking document authenticity, and a first payment from an account in the customer's name at an EU or equivalent bank. Face-to-face, one method can be enough. Non-face-to-face, at least two are required (Article 55(2)), and each check must be documented with its date and time and the name of the employee who carried it out (Article 55(3)).

Electronic identity, video and reliance

For remote customers, identification and verification may use electronic identification means and trust services under the eIDAS Regulation (EU) No 910/2014 (Article 53(8)). The Rules on the Implementation of the AML Act allow video identification (Article 41(5)) if a trained employee or external provider conducts a live, real-time call from a separate room, with the customer's explicit prior consent, and the customer's face and both sides of the identity document are recorded. Firms must also have controls against forged or third-party documents (Article 41(2) to (4)). The reliance rule in Article 56 of the Act covers only certain obliged entities and does not list CASPs, so a CASP should not assume it can rely on another firm's identification.

5. Digital channels: what's different

Bottom line: remote onboarding is permitted and is not an automatic enhanced due diligence trigger, but it doubles the verification burden: at least two independent checks instead of one, documented and retained.

Two checks, not one

Article 55(2) of the AML Act applies whenever a relationship is established "by electronic statement, electronic document or electronic signature, or by another form without the presence of the client".

Risk-based, not automatic, enhanced due diligence

Remote onboarding is not among the enhanced due diligence cases in Article 35 of the Act. Instead, the Rules require firms to assess delivery channels, including whether the customer was physically present (Article 20(2)), and to put controls on the specific risks of remote relationships (Article 41). The Commission has applied the European Banking Authority's Guidelines on remote customer onboarding (EBA/GL/2022/15) in its supervisory practice since Decision No. 584-Н took effect on 1 January 2024.

Pending: the EU AML Regulation

Regulation (EU) 2024/1624 [Adopted, applies 10 Jul 2027] will allow remote verification using eIDAS electronic identification means at assurance level "substantial" or "high" together with qualified trust services (Article 22(6)), and will prohibit anonymous crypto-asset accounts and accounts using anonymity-enhancing coins (Article 79).

6. Data protection and biometrics

The General Data Protection Regulation (Regulation (EU) 2016/679) applies directly, supervised in Bulgaria by the Commission for Personal Data Protection. A facial image used to confirm a person's identity is biometric data (Article 4(14)), and processing it to uniquely identify a person is prohibited unless an Article 9(2) condition applies, such as explicit consent or substantial public interest under Union or national law. The AML Act states that it provides measures for applying the GDPR (§ 4a of its Supplementary Provisions).

For video identification, the Rules already require the customer's explicit prior consent, and the recordings must be kept under the AML Act's retention rules (Article 41(8) of the Rules), that is, five years from the end of the relationship. Large-scale processing of special-category data requires a data protection impact assessment before it starts (GDPR Article 35(3)(b)).

7. Sector-specific obligations

Travel Rule and self-hosted wallets

Regulation (EU) 2023/1113, applicable since 30 December 2024, requires the originator's CASP to send originator and beneficiary information with every crypto-asset transfer, with no minimum amount, before or at the same time as the transfer (Article 14). For a transfer above EUR 1,000 to or from a self-hosted address, the CASP must take adequate measures to assess whether the customer owns or controls that address (Articles 14(5) and 16(2)). The Commission supervises compliance (Article 20 of the Markets in Crypto-Assets Act) and has applied the EBA Travel Rule Guidelines (EBA/GL/2024/11) since 30 December 2024 (Decision No. 824-Н). Under Article 20a of the AML Act, CASPs must assess the risk of self-hosted transfers and apply one or more of the following: risk-based identification of the counterparty, more information on the origin and destination of the assets, or enhanced monitoring.

Tax reporting of customers (DAC8)

The Act amending the Tax and Social Insurance Procedure Code, adopted on 9 September 2026 and published in State Gazette No. 85 of 2026, transposes Directive (EU) 2023/2226 and is in force from 1 January 2026. Licensed CASPs must obtain a self-certification from each user, including tax residence, tax number and date and place of birth (Article 142я6), and report annual totals per crypto-asset to the National Revenue Agency by 30 June of the following year (Article 142я2(7)). The first report covers 2026. Users who do not provide the information within 60 days and after two written reminders must be blocked from transacting (Article 142я8). Due diligence on existing users must be completed by 1 January 2027 (§ 30).

Website blocking and marketing

Under Article 35a of the Markets in Crypto-Assets Act, the Commission publishes decisions naming websites through which unauthorised firms offer crypto-asset services. If the firm does not stop within three days, the Commission asks the Sofia District Court to order internet providers to block the sites or display a warning, and providers must comply within 24 hours of publication of the order. The Commission also applies the ESMA reverse solicitation guidelines to third-country firms (Decision No. 660-Н).

8. Risk indicators and red flags

Crypto-asset risk factors (EBA Guidelines on ML/TF risk factors, Guideline 21)

• Anonymity-enhancing products: assets or services offering a higher degree of anonymity.
• Mixers and self-hosted flows: transfers involving mixer or tumbler platforms, DeFi platforms or self-hosted addresses.
• Anonymising connections: IP addresses linked to darknet or anonymity software, including VPNs.
• Shared devices: several customers using the same IP address or device.
• Inconsistent location: IP location that conflicts with the customer's declared data.
• Money mules: vulnerable customers who may be used to move funds for others.
• Multiple accounts: several accounts with no apparent economic rationale.
• Weak remote onboarding: onboarding not compliant with the EBA remote onboarding guidelines, or verification outsourced to a high-risk jurisdiction.

9. Enforcement and penalties

Penalties come from three acts and are stated below as written in each consolidated text.

Where the profit gained or loss avoided can be determined, MiCA-based fines can reach two times that amount (three times for market abuse). Turnover is taken from the consolidated accounts of the ultimate parent where one exists. The Commission can also suspend services for up to 30 working days and order unauthorised activity to cease, and publishes its measures (Article 46). In Decision No. 385 of 11 June 2026 and Decision No. 533-ДУКА of 13 August 2026 it ended licence proceedings after applicants failed to remedy gaps and withdrew.

10. Recent changes and what to watch

• 10 July 2027 [Adopted, applies 10 Jul 2027] EU AML Regulation 2024/1624 replaces most national customer due diligence rules, including remote verification standards; onboarding flows designed now should anticipate it.
• 9 September 2026 [In force] DAC8 transposed into the Tax and Social Insurance Procedure Code (State Gazette No. 85 of 2026), applying from 1 January 2026; first CASP reports due by 30 June 2027.
• 21 July 2026 [In force] The Commission granted its first CASP licences and adopted joint ESMA, EBA and EIOPA guidelines on crypto-asset classification (Decision No. 497-Н).
• 1 July 2026 [In force] Transitional period ended; former virtual currency registrations under the AML Act lapsed and only licensed providers may operate.
• 27 March 2026 [In force] Ordinance No. 77 on CASP and asset-referenced token licensing published (State Gazette No. 30 of 2026).
• 10 March 2026 [In force] Markets in Crypto-Assets Act amended (State Gazette No. 25 of 2026): CASPs must keep a profile in the state secure electronic delivery system and notify the Commission.

11. What this means for identity verification

• Data set. Capture every citizenship, residence country and full address, occupation and purpose, plus DAC8 tax residence and tax number.
• Two independent checks. Pair document authenticity checks with video identification, an eIDAS electronic identity or a first payment from the customer's own account.
• Video standards. Live, recorded, run by trained staff, capturing the face and both sides of the document, with explicit consent.
• Audit trail. Log the date, time and person responsible for each verification step and keep evidence, including recordings, for five years after the relationship ends.
• Wallet ownership. Above EUR 1,000, add a step that proves the customer controls a self-hosted wallet, and collect Travel Rule data for every transfer.
• Re-verification triggers. Repeat due diligence when identification data is in doubt, and block trading for users who have not supplied tax information within 60 days.