iGaming & Gambling Compliance in Bulgaria

Bulgaria's online gambling market is open to licensed operators, but it is one of the most technically demanding in the EU. A licensee must keep a data server physically in Bulgaria, report every registration and every completed game to the tax authority in real time, and give both the NRA and the State Agency for National Security continuous remote access to its player data.

The principal regulators are the NRA, which licenses operators and supervises their AML compliance, and the Financial Intelligence Directorate of the State Agency for National Security, Bulgaria's financial intelligence unit. For a new entrant the biggest obstacles are the upfront cost (a one-off fee of BGN 400,000, investments of at least BGN 1 million and paid-in capital of BGN 1.5 million) and the local technical setup needed before launch.

1. Who regulates this sector

Bulgaria is a unitary state, so gambling is licensed and supervised nationally. Under Articles 16 and 17 of the Закон за хазарта (Gambling Act), state supervision belongs to the Executive Director of the NRA, who took over from the abolished State Commission on Gambling under amendments in State Gazette (ДВ) No. 69 of 2020.

2. Licensing and authorisation

Every gambling game and activity needs a licence from the NRA Executive Director, and a licence covers only the game named in it (Gambling Act, Art. 3). All permitted games except tombola and instant lottery may be offered online, and the channel does not change a game's type (Art. 41). Lotteries other than tombola, bingo and keno may be licensed only to the state (Art. 4(3)).

Online betting licence

Online licences are open to companies registered in Bulgaria, another EU or EEA state, or Switzerland (Art. 4(1)). Under Article 6(1), the applicant must:

• have had no coercive measures applied in the previous five years;
• host servers in Bulgaria, the EU, the EEA or Switzerland;
• bank stakes and winnings through a licensed bank;
• run a certified central system that identifies players and reports to the NRA in real time;
• if foreign, appoint an authorised representative in Bulgaria.

Paid-in capital must be at least BGN 1,500,000 (Art. 4(2)), with investments and operating funds of at least BGN 1,000,000 each (Art. 5(1)(5)). The origin of funds must be proven, owners in offshore zones are barred (Art. 8(2)), and probity checks extend to beneficial owners (Art. 8(1), as amended by ДВ No. 49 of 2025). The fee is a one-off BGN 400,000 plus 20% of gross gaming revenue, declared monthly (Art. 30(4) and (8)), with a BGN 60,000 annual social-responsibility contribution (Art. 10a(1)). A licence lasts five years, or ten if investments exceed BGN 2,000,000 (Art. 26).

The NRA decides on a first licence within 60 days, extendable by 30 (Art. 23(3)-(4)), after positive opinions from the State Agency for National Security, the Ministry of Interior and the Bulgarian Institute of Metrology (Art. 22(1)). Facts proven for a licence in another EU or EEA state may be taken into account (Art. 23(8)). Amounts appear in leva as in the consolidated text and apply in euro since 1 January 2026 under the euro conversion rules. Stakes and winnings must be in euro (Art. 3(4)).

Land-based licences and affiliates

Casino and gaming-hall licences are issued per venue, with separate capital, investment and location rules (Art. 4, 5 and 44). Since 1 August 2026, anyone promoting gambling for commission tied to results needs an affiliate licence and may promote only licensed operators (Art. 4(7)-(9), 9(19)-(20)). The fee is EUR 6,000 a year plus 10% of commission, withheld by the operator (Art. 30a).

Operating without a licence

Unlicensed online betting carries a sanction of BGN 1,000,000 to 2,000,000 for a company (Art. 96(1)). Higher ranges, up to BGN 5,000,000, apply where receipts are large, and penalties double on repeat (Art. 96(2)-(5)). Equipment and money received are confiscated (Art. 93).

3. AML, KYC and customer due diligence

Licensed gambling organisers are obliged entities under Article 4, item 21 of the Закон за мерките срещу изпирането на пари (Measures Against Money Laundering Act, ZMIP), consolidated to ДВ No. 51 of 2026. The Financial Intelligence Directorate controls compliance (Art. 108(1)), and the NRA supervises gambling operators using a risk-based approach (Art. 108(6), item 3).

When CDD applies

Article 12(1): entry in a casino's visitor register, and winnings, stakes or chip transactions totalling EUR 2,000 or more, alone or linked. The general Article 11 triggers also apply: a business relationship, suspicion, or doubt about identification data.

Identification data

Names, date and place of birth, an official identification number from a valid photo ID, all citizenships, and country of residence and address (Art. 53(2)). For a business relationship, also occupation and purpose (Art. 53(3)).

Enhanced due diligence

Required for politically exposed persons and their associates, high-risk third countries, unusual transactions and high-risk new technologies (Arts. 35-36).

Source of funds

At least two methods, such as a questionnaire, public registers or tracking money flows. A written declaration is a fallback only (Art. 66).

Reporting. Suspicions go to the Financial Intelligence Directorate immediately, before the transaction where possible (Art. 72(1)). The Directorate may suspend a transaction for up to five working days (Art. 73). Cash payments above EUR 15,000 must also be reported (Art. 76(1)).

Beneficial ownership and retention. For corporate customers, operators must establish the ownership and control structure (Art. 54(3)). CDD records, including electronic identification data, are kept for five years from the end of the relationship or the date of the transaction (Art. 67).

4. Identity verification and onboarding

Two rulebooks overlap: the Gambling Act and its ordinance decide who may play, and the ZMIP decides how identity is verified.

Gambling Act registration

Only adults with full legal capacity may gamble (Art. 2(3)), and online players must register individually (Art. 47a). Under the Ordinance on registration and identification of participants (ДВ No. 14 of 2021), registration is a condition of play. Players in Bulgaria are identified by geolocating their IP address, and only those aged 18 or over may register (Art. 2(2)-(3)). The minimum data are citizenship, names and a personal identification number. Players without a Bulgarian number must also give address, date of birth and identity document details (Art. 3(1)). Doubtful data require more evidence (Art. 3(2)), and each operator publishes its identification procedure (Art. 6).

Verification without physical presence

If the customer is not present, a copy of an official identity document is acceptable (ZMIP Art. 53(7)), but the data must be checked by two or more Article 55(1) methods (Art. 55(2)). These include additional documents, confirmation by another obliged entity, official database and register checks, technical checks of document authenticity, and a first payment from an account in the customer's name at an EU or equivalent bank. Alternatively, eIDAS electronic identification or qualified trust services may be used (Art. 53(8)). Each check is documented with date, time and the responsible person (Art. 55(3)). No specific liveness or biometric standard is prescribed: face matching can serve as a technical check alongside a second method.

Exclusion register

The NRA's exclusion register (Art. 10g) covers self-excluded players, for at least 12 months, and since 1 January 2025 people automatically listed because they receive monthly social assistance, appear in the Health Act mental-health register or are under interdiction (Art. 10e). Operators may not admit anyone listed (Art. 10d(3); Ordinance Art. 4(1)).

5. Digital channels: what's different

Bottom line: AML thresholds are the same in every channel, but online players must be fully registered, geolocated and reported to the NRA before their first bet. Land-based customers face AML checks mainly at EUR 2,000, except casino visitors, who are registered on entry.

Real-time reporting and local data

Registration data must reach the NRA's server immediately after registration and every change, followed by per-player data on each completed game, including stake, winnings and IP address (Ordinance Art. 8, Annexes 2-3). A mirror copy stays in Bulgaria (Art. 19(2)), and the local server may be unavailable to the authorities for no more than six hours a month (Art. 16).

Blocking of unlicensed sites

Internet providers must block sites named in NRA orders within 24 hours (Art. 17(6)). Banks, payment institutions and e-money firms may not process gambling payments to or from listed operators (Art. 9(13)), and since August 2026 receive their account and POS numbers monthly (Art. 10з). Prepaid betting vouchers are banned (Art. 9(17)), and removal orders under Article 9 of the Digital Services Act cover unlicensed apps (Art. 88a).

Pending: limits on risky play

Article 10ж, in force since 1 January 2025, obliges online operators to limit risky play and requires an ordinance on maximum time on site, losses and stakes, with lower limits for players under 24. The Ministry of Finance consulted on a draft [Draft, consultation closed 5 Jul 2025].

6. Data protection and biometrics

The GDPR applies directly, supervised by the Commission for Personal Data Protection, and the ordinance requires operators to comply with it (Art. 2(5)). Identification data, IP addresses and game records are collected under legal obligations in the Gambling Act and the ZMIP. Biometric data used to uniquely identify a person is special-category data (GDPR Art. 9(1)). Face matching therefore needs an Article 9(2) exception, typically explicit consent, and operators should keep a non-biometric route among their verification methods.

7. Sector-specific obligations

Responsible gambling

Operators must show addiction warnings and treatment information and tell players about the exclusion register (Art. 10b). Lending or credit for gambling is prohibited (Art. 46). Websites must show, in Bulgarian, the licence, game rules, payment methods and how to complain to the NRA (Art. 47c).

Advertising

Gambling advertising is banned on radio, television, print and websites, with narrow exceptions such as certain billboards and sport sponsorship, which must carry an addiction warning (Art. 10). Publishers must check the NRA register before contracting (Art. 10(7)).

Tax reporting of winnings

By 28 February, operators report resident players whose annual winnings exceed BGN 5,000 (Art. 47e).

8. Risk indicators and red flags

Bulgaria's 2023 national money laundering risk assessment, published by the Financial Intelligence Directorate, rates money laundering through online gambling as a medium risk, with high likelihood and moderate consequences. It finds online gambling used mainly to layer criminal proceeds and give them the appearance of legitimate winnings.

Online gambling typologies and red flags

• Winnings as cover: deposits of unclear origin cashed out as apparent gambling winnings.
• Cash-out after transfer: winnings paid to a payment account and then withdrawn in cash or sent on.
• Displacement from banks: customers refused by banks moving to less regulated payment channels.
• Unlicensed sites: play on sites that do not require deposits through licensed financial institutions.
• Reliance on banks: few suspicious activity reports from operators that leave detection to banks.
• Criminal infiltration: people with criminal records, or their associates, in ownership or management.
• Linked stakes: stakes or winnings split to stay below the EUR 2,000 CDD threshold (ZMIP Art. 12(1)).

9. Enforcement and penalties

ZMIP penalties are set per breach. An operating company faces BGN 2,000 to 20,000, or BGN 5,000 to 50,000 on repeat (Art. 116(1)-(2)). Serious or systematic breaches carry BGN 10,000 to 2,000,000, or up to twice the benefit gained (Art. 116(3)). Managers and compliance officers can be fined personally, up to BGN 3,000,000 (Art. 117).

Licence consequences. Since ДВ No. 49 of 2025, systematic breaches of core ZMIP duties (five or more of the same kind within a year, § 1, item 29) can lead to temporary withdrawal of the licence for three to six months, or permanent withdrawal. The NRA can act on its own initiative or on a proposal from the State Agency for National Security, after giving one month to remedy (Gambling Act, Art. 85(2), 86(2) and 86a). Admitting minors or excluded players costs BGN 5,000 to 20,000 (Art. 110).

Recent actions. The Financial Intelligence Directorate's sanctions list (updated 20 February 2026) shows a licensed gambling operator fined BGN 1,400 for each of six identification failures in September 2025 (ZMIP Art. 53 with Art. 12(1)(1)). Another operator's fines of BGN 2,000 per breach, for not establishing customers' source of funds (Art. 66(1)), were upheld by the Sofia City Administrative Court in November 2025.

10. Recent changes and what to watch

• 10 July 2027 [Adopted, applies 10 Jul 2027]: the EU Anti-Money Laundering Regulation (EU) 2024/1624 sets directly applicable CDD rules, keeping a EUR 2,000 gambling threshold (Art. 19(5)) and accepting eIDAS means at substantial or high assurance for verification (Art. 22(6)).
• 1 January 2027 [Adopted, effective 1 Jan 2027]: social-responsibility contributions must be declared electronically with a qualified electronic signature (Art. 10a(3)).
• 23 September 2026 [Proposed, comments close 23 Oct 2026]: a Ministry of Finance bill amending the Gambling Act proposes a full ban on gambling advertising, with the stated aim of raising budget revenue and limiting addiction.
• 1 August 2026 [In force]: licensing of results-based affiliates, NRA blocking of affiliate sites and apps (Art. 17(1), item 9a), and monthly lists of blacklisted operators' accounts and POS terminals sent to payment providers.
• 1 January 2026 [In force]: euro adoption; stakes and winnings must be in euro (Art. 3(4)).
• 5 July 2025 [Draft ordinance]: consultation closed on time, loss and stake limits for online players, with lower limits for under-24s; operators should prepare to configure them.
• June 2025 [In force]: ДВ No. 49 of 17 June 2025 lets the NRA withdraw licences for systematic AML breaches and extends licence checks to beneficial owners.

11. What this means for identity verification

• Verify before the first stake. Age, location and exclusion checks are conditions of play online.
• Build for two methods. Remote AML verification needs two Article 55 methods (for example document authenticity plus a payment from the player's own account) or eIDAS electronic ID.
• Capture Bulgarian identifiers. Collect the civil or foreigner's number; others need date of birth, address and document details.
• Geolocate every session and keep the records for at least 12 months.
• Rescreen the exclusion register, which the NRA updates monthly (Art. 10e).
• Re-verify on triggers: EUR 2,000 in winnings or stakes, doubtful data, or higher risk.
• Keep audit-grade evidence: date, time and operator for each step (ZMIP Art. 55(3)), reachable remotely by the authorities.