eCommerce & Marketplaces Compliance in Bulgaria

The Bulgarian market is open to domestic and foreign online sellers and marketplaces. Rules come mainly from directly applicable European Union regulations (the Digital Services Act, the General Product Safety Regulation and the General Data Protection Regulation) and from the Consumer Protection Act, which transposes EU consumer directives.

The Consumer Protection Commission polices distance selling, the Communications Regulation Commission supervises platforms as Digital Services Coordinator, and the National Revenue Agency collects seller data for tax. For a new marketplace, the biggest practical obstacle is building seller onboarding that meets the identity checks of the Digital Services Act and the tax due diligence of the platform reporting rules while copying identity documents only where the law allows it.

1. Who regulates this sector

Bulgaria is a unitary state, so all supervision is national. Product-specific authorities (for example for tobacco, medicines and food) also act against unlawful online offers within their own fields.

2. Licensing and authorisation

Bulgarian law does not make online retail or operating a marketplace a licensed activity. Obligations attach because a business concludes distance contracts with consumers (Consumer Protection Act, Закон за защита на потребителите, State Gazette No. 99 of 2005), provides an information society service (Electronic Commerce Act, Закон за електронната търговия, State Gazette No. 51 of 2006) or provides an intermediary service within the Digital Services Act (Regulation (EU) 2022/2065), which has applied since 17 February 2024.

Authorisation becomes relevant when the goods or the money flows are regulated. A marketplace that collects buyers' funds and pays them on to sellers may be providing payment services, which brings it within the Payment Services and Payment Systems Act and makes it an obliged entity under the AML Act (Article 4, item 2). Restricted goods have their own regimes: for tobacco and related products, the Tobacco Act as amended in State Gazette No. 54 of 2025 empowers control authorities to order access to websites to be stopped where they find cross-border distance sales, or offers and sales to consumers through information society services.

Platform operators that must report under the EU tax transparency rules (Directive (EU) 2021/514, known as DAC7) use the National Revenue Agency's forms to notify their reporting obligation or to claim excluded status.

3. Identity framework (AML rules do not apply)

The Measures Against Money Laundering Act (Закон за мерките срещу изпирането на пари, State Gazette No. 27 of 2018, consolidated to State Gazette No. 51 of 5 June 2026) lists its obliged entities in Article 4. Online retailers and marketplaces are not among them, so a general online shop has no statutory customer due diligence duty. Three exceptions matter in practice:

• Art and collectibles: persons who trade in, or act as intermediaries in the trade of, works of art are obliged where a transaction or linked transactions reach EUR 10,000 (Article 4, item 36). An online art marketplace acting as intermediary falls in scope at that value.
• Weapons, oil and petroleum products: traders in these goods are obliged entities (Article 4, item 20).
• Payments and crypto-assets: payment service providers and their agents (item 2) and licensed crypto-asset service providers (item 19) are obliged, so a marketplace that runs its own payment or crypto function inherits the full regime for that activity.

For obliged entities, Article 11 requires due diligence for occasional transactions of EUR 15,000 or more, cash transactions of EUR 5,000 or more, and for any transaction where money laundering is suspected. These amounts are stated in euro in the June 2026 consolidated text.

Outside the AML regime, identity duties for e-commerce come from four other sources: the trader traceability rule in Article 30 of the Digital Services Act, the platform seller due diligence in DAC7 (transposed in Chapter Sixteen, Section VIII of the Tax and Social Insurance Procedure Code), the marketplace transparency duty in Article 47a of the Consumer Protection Act, and product-specific age rules. They focus on verifying sellers rather than buyers.

4. Identity verification and onboarding

Business sellers on marketplaces

A provider of an online platform that allows consumers to conclude distance contracts with traders may let a trader offer products to consumers in the EU only after obtaining: the trader's name, address, telephone number and email; a copy of an identity document or any other electronic identification as defined in Article 3 of the eIDAS Regulation (Regulation (EU) No 910/2014); payment account details; the trade register and registration number, where registered; and a self-certification that only compliant products will be offered (Digital Services Act, Article 30(1)).

Before the trader goes live, the platform must make best efforts to assess whether this information is reliable and complete, using freely accessible official online databases or interfaces, or by asking for supporting documents from reliable sources (Article 30(2)). If information proves inaccurate, incomplete or out of date and is not corrected, the platform must swiftly suspend the trader's service in the EU (Article 30(3)). The information is kept securely for six months after the relationship ends and then deleted (Article 30(5)). Micro and small enterprises are excluded from these obligations unless they are very large online platforms (Article 29).

All sellers: tax due diligence

Under DAC7, reporting platform operators collect each seller's name, primary address, taxpayer identification number and VAT number where available, and date of birth for individuals (legal name and business registration number for entities), check the information for reliability, and complete due diligence by 31 December of the reportable period. Sellers of goods with fewer than 30 sales and no more than EUR 2,000 in consideration in the period are excluded sellers. If a seller still has not provided the information after two reminders, and not before 60 days have passed, the platform must close the account and prevent re-registration, or withhold payment until the information is provided.

Private sellers and buyers

Marketplace providers must tell consumers whether the third party offering goods is a trader, based on that party's declaration, and that consumer rights do not apply when the seller is not a trader (Consumer Protection Act, Article 47a, inserted by State Gazette No. 20 of 2022). No general rule requires buyer identity verification. Age checks apply where product rules restrict sales to minors; for such products the European Commission's Article 28 guidelines treat age verification as appropriate and do not consider self-declaration an appropriate method.

5. Digital channels: what's different

Bottom line: most e-commerce identity and transparency duties exist only online: a physical shop has no seller verification, platform tax reporting or withdrawal function to build, while document-copying limits apply equally in both channels.

A withdrawal button for every online shop

New Article 52a of the Consumer Protection Act (State Gazette No. 87 of 24 September 2026) requires traders concluding distance contracts through an online interface to provide a withdrawal function labelled "откажете се от договора тук" ("withdraw from the contract here") or an equally clear phrase. It must be visible, easily accessible and available throughout the withdrawal period, and must let the consumer send an online withdrawal statement with their name, contract details and electronic contact details. The amending act transposes Directive (EU) 2023/2673 and applies from its publication, with the green-transition provisions applying from 27 September 2026.

Seller verification is a platform duty

Article 30 of the Digital Services Act puts the seller identity check on the marketplace, not on buyers or payment providers. The rule accepts either an identity document copy or an eIDAS electronic identification, so a platform can meet it with a digital identity credential instead of a stored document image.

Age assurance online

The Commission's guidelines under Article 28(4) of the Digital Services Act (published 10 October 2025) list alcohol, tobacco and nicotine products, pornographic content and gambling as cases where age verification is appropriate, and expect age verification to be handled as a separate process that keeps only the age result. Article 28(3) confirms that platforms are not obliged to process additional personal data merely to assess whether a user is a minor.

Pending: the proposed EU Kids Act [Proposed, 17 Sep 2026] would largely codify the Article 28 guidelines, including rules on age assurance.

6. Data protection and biometrics

The GDPR (Regulation (EU) 2016/679) applies directly, supplemented by the Personal Data Protection Act (Закон за защита на личните данни, consolidated to State Gazette No. 70 of 2024). Two Bulgarian provisions bite on e-commerce onboarding. Article 25г allows a controller or processor to copy an identity document, driving licence or residence document only where a law provides for it. Digital Services Act Article 30(1)(b) supplies that basis for business seller onboarding; buyer-side checks have no equivalent general basis, so age or identity checks that verify an attribute without keeping a document copy fit the rule more easily. Article 25в makes consent-based processing of data of children under 14, including for information society services offered directly to them, lawful only with consent from a parent or guardian.

Face matching against a document photo processes biometric data for the purpose of uniquely identifying a person, a special category under GDPR Article 9 that needs an exception such as explicit consent. The Commission for Personal Data Protection also supervises personal data processing under the Digital Services Act (Electronic Communications Act, Article 49г(4)). Trader data collected under Article 30 must be deleted six months after the relationship ends.

7. Sector-specific obligations

Marketplace transparency

Before a consumer is bound, a marketplace provider must explain the main parameters that rank offers and their relative importance, in a dedicated section reachable directly from the results page; whether the seller is a trader; that consumer rights do not apply to non-trader sellers; and how contractual obligations are shared between seller and platform (Consumer Protection Act, Article 47a(1)). Online sellers must also publish their identification and contact details, register entry and any supervising authority, and may send commercial messages only with prior consent, as the Consumer Protection Commission sets out for information society services.

Distance selling practice

The Consumer Protection Commission's guidance for online traders requires final prices including VAT and all fees, delivery terms, notice of the two-year statutory guarantee, refunds within 14 days of a withdrawal notice by the original payment method, and discount announcements whose reference price is the lowest price applied in the previous 30 days. Since State Gazette No. 58 of 26 June 2026, Article 68н also prohibits economically unjustified price increases, and traders must justify increases when inspectors ask.

Product safety on marketplaces

The General Product Safety Regulation (Regulation (EU) 2023/988), applicable since 13 December 2024, requires online marketplaces to designate single points of contact for market surveillance authorities and for consumers, and to register on the Safety Gate Portal (Article 22).

8. Risk indicators and red flags

Seller and transaction fraud indicators for marketplaces

• Hidden trader: a "private" seller with sales volumes above the DAC7 excluded-seller limits.
• Mismatched identity: payment account, register entry or ID document in a different name from the trader profile.
• Unresponsive seller: tax details still missing after two reminders.
• Non-delivery pattern: repeated complaints of late or no delivery, the most common online violation in Consumer Protection Commission inspections.
• Fake discounts: "was" prices above the lowest price of the previous 30 days.
• Restricted products: nicotine products or prescription medicines offered online, both targeted by 2024 inspection campaigns.
• Unsafe goods: listings matching products flagged on the Safety Gate Portal.

9. Enforcement and penalties

Digital Services Act. The Communications Regulation Commission may fine an intermediary up to 6% of annual income, or impose a property sanction up to 6% of worldwide annual turnover in the previous financial year, for breaching the regulation; up to 1% for incorrect, incomplete or missing information or refusing an inspection; and periodic penalties up to 5% of average daily income or worldwide turnover per day (Electronic Communications Act, Article 323ф). It decides by reasoned decision without the usual act establishing an administrative violation, may accept commitments, and the limitation period is three years (Articles 323ж, 323р and 323х). Appeals go to the Administrative Court of Sofia Region.

Consumer law. For widespread infringements found in coordinated EU actions under Regulation (EU) 2017/2394, the Chair of the Consumer Protection Commission may impose a property sanction of up to 4% of the trader's turnover in Bulgaria in the previous financial year, covering among others breaches of the distance-contract information rules, Article 47a and unfair commercial practices (Consumer Protection Act, Article 203). In 2024 the Commission carried out 6,454 inspections on distance-sales rules, which led to 118 acts establishing violations and 49 penalty decrees, and it checked 24 online shops in its Black Friday campaign.

10. Recent changes and what to watch

• 24 September 2026: Consumer Protection Act amendment (State Gazette No. 87) [In force] adds the online withdrawal function and green-transition rules; review checkout and account pages.
• 17 September 2026: EU Kids Act [Proposed] would codify age assurance expectations for platforms; track it through the EU legislative process.
• 1 July 2026: Council Regulation (EU) 2026/382 [In force] replaces the EUR 150 customs duty relief with a EUR 3 per item duty on low-value consignments until 1 July 2028.
• 26 June 2026: Consumer Protection Act addition (State Gazette No. 58) [In force] bans economically unjustified price increases; keep pricing records.
• 21 November 2025: Electronic Communications Act amendment (State Gazette No. 99) [In force] makes the Communications Regulation Commission the Digital Services Coordinator and repeals the liability chapter of the Electronic Commerce Act.
• 10 October 2025: Commission guidelines on protecting minors under Article 28 of the Digital Services Act [In force] set the age assurance benchmark.
• 4 July 2025: Tobacco Act amendment (State Gazette No. 54) [In force] adds powers to stop access to websites selling tobacco and related products unlawfully.

11. What this means for identity verification

• Verify sellers before listing. Business sellers need identity, contact, payment and register checks before their first offer, with suspension when the trader leaves data inaccurate or incomplete.
• Accept eID as well as documents. Article 30 allows eIDAS electronic identification in place of a document copy, which also eases the Bulgarian restriction on copying identity documents.
• Combine verification and tax data. One onboarding flow can capture both the trader data and the DAC7 data (taxpayer number, VAT number, date of birth).
• Re-verify on change and inactivity. Outdated trader information must be corrected or the seller suspended, and DAC7 reminders run on a 60-day clock.
• Age checks without retention. For restricted goods, use age verification that returns only an over-18 result, not self-declaration.
• Plan retention. Keep trader verification data for six months after the relationship ends, then delete it.