Insurance & Insurtech Compliance in Bulgaria

The Bulgarian market is open to digital insurers and insurtech distributors, but it is licensed and supervised nationally by the Financial Supervision Commission, with AML control shared with the Financial Intelligence Directorate of the State Agency for National Security. EU insurers can enter under the freedom to provide services or the right of establishment.

The biggest practical obstacle for a digital-first entrant is the contract-form rule: outside motor liability, an online policy needs qualified electronic signatures from both parties, so the signing step has to be designed in from the start, alongside a two-method remote identity check for life and investment-linked products.

1. Who regulates this sector

Inspections under the AML Act can be carried out jointly by the Financial Intelligence Directorate and the Financial Supervision Commission under joint instructions of the two authorities (AML Act, Art. 108(4)).

2. Licensing and authorisation

A company seated in Bulgaria may carry on insurance only after obtaining a licence from the Financial Supervision Commission, and an unlicensed person may not offer or conclude any contract that assumes insurance risk (Insurance Code, Art. 28). A licence is issued for life classes (Section I of Annex 1) or non-life classes (Section II), class by class (Art. 29). The Commission decides within four months of a complete application; the clock stops while the applicant corrects deficiencies (Art. 34).

The minimum capital requirement has absolute floors set in euro: EUR 4,000,000 for a life insurer or a non-life insurer writing liability, credit or suretyship classes, and EUR 2,700,000 for other non-life insurers (Insurance Code, Art. 192(2), text in force on 24 September 2026). Insurers licensed in another EU member state operate under the right of establishment or the freedom to provide services (Art. 12(1)(2)).

Intermediaries and embedded distribution

Brokers, agents and registrable ancillary intermediaries are entered in the Commission's register; agents are registered at the request of their insurer (Art. 296). "Distribution" expressly includes comparison websites and platforms through which a customer can conclude a contract (Art. 286(3)), so an embedded-insurance partner must check whether it is an ancillary intermediary (Art. 294(2)) or an agent. Sanctions for unlicensed or unregistered activity are covered in section 9.

3. AML, KYC and customer due diligence

Insurers and insurance intermediaries are obliged entities under Art. 4(5) of the Measures Against Money Laundering Act (Закон за мерките срещу изпирането на пари, State Gazette No. 27 of 2018, as last amended by State Gazette No. 51 of 2026) when they write one or more classes in Section I of Annex 1 to the Insurance Code: life assurance, annuities, marriage and birth insurance, unit-linked life insurance and capital redemption operations. A non-life insurer selling only motor, property, health or travel cover is not in scope. Tied agents are covered too, but they apply the internal rules of the insurer they act for (Art. 101(8)).

When due diligence applies

On entering a business relationship, on occasional transactions of EUR 15,000 or more (EUR 5,000 in cash), and whenever there is suspicion or doubt about identity data, whatever the amount (Art. 11(1)). Identification must be completed before the insurance contract is concluded (Art. 15(1)).

Customer data

Names, date and place of birth, personal identification number from a valid photo ID, every nationality, country of residence and address; for a business relationship, occupation and the purpose of the relationship (Art. 53(2) and (3)).

Beneficiaries

Named beneficiaries are identified at conclusion and verified at or before payout; beneficiaries designated by class must be identifiable at payout. A policy assigned to a third party triggers identification of the new recipient and its beneficial owner (Art. 19).

Simplified due diligence

Possible for policies with annual premiums up to EUR 1,000 or a single premium up to EUR 2,500, and for pension policies without surrender clause, after prior notice to the Financial Intelligence Directorate (Art. 30).

Enhanced due diligence

Enhanced measures apply to politically exposed persons, customers from high-risk third countries, products that could favour anonymity, new delivery channels or technologies assessed as high risk, and unusual or complex transactions (Art. 35). Insurers must determine whether policyholders, beneficiaries or their beneficial owners are politically exposed (Art. 43(1)); if a beneficiary is, a senior manager must be informed and the relationship reviewed in depth before any payout (Art. 43(3)). Beneficiary-related risk factors feed the customer risk assessment (Art. 49a).

Source of funds, reporting and records

Source of funds is established with at least two methods, falling back to a written declaration (Art. 66). Suspicion must be reported to the Financial Intelligence Directorate before the transaction, which is delayed where possible (Art. 72); every cash payment above EUR 15,000 to or from a customer is reported separately (Art. 76). If due diligence under Art. 19 cannot be completed, the insurer must refuse the contract or end the relationship (Art. 17(3)). Documents and data are kept for five years from the end of the relationship, extendable by up to two years on the Directorate's instruction (Art. 67). Insurers, though not intermediaries, must maintain a specialised AML unit (Art. 106(1)).

4. Identity verification and onboarding

The default rule is the presentation of an official identity document and the taking of a copy (Art. 53(1)). Where the customer is not physically present, identification may be carried out on a copy of the document, and the collected data are then verified under Art. 55(2) with two or more of the Art. 55(1) methods: additional documents, confirmation by another obliged entity, checks of official document-validity databases or company registers, technical checks of document authenticity, a first payment from an account in the customer's name at an EU or equivalent bank, or another method giving reasonable assurance.

Identification and verification may also be done through electronic identification means and trust services under the eIDAS Regulation (Regulation (EU) No 910/2014), or another electronic identification method recognised by law (Art. 53(8)). Each verification step is documented with date, time and the person who performed it (Art. 55(3)). Reliance on a credit institution's prior identification is allowed, but liability stays with the insurer (Art. 56).

Remote onboarding standard

The Financial Supervision Commission applies in its supervisory practice the European Banking Authority's Guidelines on remote customer onboarding solutions (EBA/GL/2022/15), addressed to credit and financial institutions including life insurers (Commission Decision 987-N of 31 October 2023). For unattended flows they expect photos or video taken live at the time of verification, liveness checks and strong algorithms matching the selfie to the document photo (para. 41); use of chip data where the document allows it (para. 35); and interruption or a switch to face-to-face verification when evidence quality is poor (para. 40). Notified eIDAS schemes at assurance level "substantial" or "high", and relevant qualified trust services, are deemed to meet the identity-matching criteria (para. 45).

5. Digital channels: what's different

Bottom line: online sale is permitted, but it changes two things: a remotely identified customer must be verified with at least two independent methods, and most policies concluded at a distance must carry qualified electronic signatures.

The contract-form rule

Article 332(1) of the Insurance Code allows a contract to be concluded at a distance in only three ways: as an electronic document signed with qualified electronic signatures of the parties, on paper with handwritten signatures, or through a website under Art. 332(4). That website route covers compulsory motor third-party liability only: no policyholder signature is needed if the premium is paid on the site with a card in the policyholder's name, and the paper policy follows within three working days. An online life or home policy therefore needs a qualified electronic signature step.

Website and pre-contract information

Any distributor selling online must publish its name, address and legal basis for operating in Bulgaria on a visible page, give all information in Bulgarian and let the customer read all contract terms freely (Art. 331). Since 24 September 2026 the distance-selling information and withdrawal rules referenced in Arts. 331, 332 and 343 point to Chapter Four, Section I"a" of the Consumer Protection Act instead of the repealed Distance Financial Services Act [In force 24 Sep 2026].

Pending changes

From 10 July 2027 the EU AML Regulation allows verification either by an identity document plus reliable independent sources, or by eIDAS electronic identification at level "substantial" or "high" and relevant qualified trust services (Regulation (EU) 2024/1624, Art. 22(6)) [Adopted, applies 10 Jul 2027]. Separately, regulated private services that must use strong user authentication will have to accept European Digital Identity Wallets 36 months after the Commission's wallet implementing acts entered into force (Regulation (EU) 2024/1183, new Art. 5f(2)) [Adopted, phased application].

6. Data protection and biometrics

The GDPR applies directly. A selfie compared with a document photo to uniquely identify a person is biometric data, a special category whose processing is prohibited unless an Article 9(2) condition applies, typically explicit consent or a legal basis in Union or member state law (GDPR, Arts. 4(14) and 9). Insurers should record the condition relied on and offer a non-biometric route where it is consent.

Insurance adds health data: a life insurer may obtain information on the insured person's age, health and finances and, on a claim, access to medical records (Insurance Code, Art. 454), which § 7(3) of the Code's supplementary provisions treats as an additional condition under GDPR Art. 9(4). Onboarding images and video kept for AML purposes follow the five-year period in Art. 67 of the AML Act.

7. Sector-specific obligations

Due diligence at payout

The payout is the second identity checkpoint. Full identification of the beneficiary under Arts. 53 and 54 and verification under Art. 55 must happen at or before payment (AML Act, Art. 19(3)). The Insurance Code requires a decision on most life and personal-lines claims within 15 working days of receiving all evidence (Art. 108(1)), so verification should run while documents are collected, not after. Where the insurer pays through a bank, it must send the beneficiary's identification data to the bank and state that the payment is made under a life policy (AML Act, Art. 19(6)).

Oversight of agents and partners

Internal AML rules must include policies for bringing agents into scope and monitoring their compliance (AML Act, Art. 101(2)(19)). An insurer that uses unregistered intermediaries is sanctioned under Insurance Code Art. 635(7), and an intermediary may not let another person sell policies or collect premiums through its system access (Art. 635(8)). Outsourced identification counts as the insurer's own act, not as reliance (AML Act, Art. 57a).

Operational resilience

The Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to insurers and insurance intermediaries (Art. 2(1)(n) and (o)), so identity verification vendors fall under its third-party risk rules.

8. Risk indicators and red flags

Drawn from Guideline 14 of the EBA risk factor guidelines (EBA/GL/2021/02), applied by the Commission under Decision 707-N of 23 September 2021, and from the AML Act:

Life and investment-linked insurance typologies

• Early surrender: policy cancelled soon after purchase despite high costs, or frequent use of the cooling-off right with refunds to unrelated parties.
• Third-party premiums: payments from unidentified or unrelated third parties, or from several accounts without explanation.
• Overfunding: large or frequent top-ups that do not match the customer's profile or financial position.
• Beneficiary changes: beneficiary switched to an apparently unrelated person, or the insurer learns of the change only when the claim is filed.
• Assignment: policy transferred to an unrelated third party or used as loan collateral (AML Act, Art. 19(4)).
• Cash and structuring: cash premiums or structured payment instruments; cash payments above EUR 15,000 are reportable (Art. 76).
• Remote sale without safeguards: non-face-to-face sale without qualified electronic signatures or eIDAS-compliant electronic identification.
• Geography: insurer, customer, beneficiary or intermediary linked to higher-risk jurisdictions.

9. Enforcement and penalties

AML Act penalties are set per violation and tiered by type of offender and seriousness (Art. 116). For financial-sector obliged entities, including insurers and intermediaries under Art. 4(5), the sanction is BGN 5,000 to 50,000; BGN 10,000 to 200,000 for a repeat violation; and for serious or systematic violations BGN 20,000 to 10,000,000 or up to 10% of annual turnover. These figures are quoted in leva as they stand in the consolidated text as amended to State Gazette No. 51 of 2026.

Under the Insurance Code, unlicensed insurance costs a company BGN 50,000 to 200,000 (BGN 100,000 to 400,000 on repetition), and unregistered intermediation, or an insurer's use of unregistered intermediaries, BGN 5,000 to 50,000 (Art. 635). The Commission can also apply coercive measures, up to licence withdrawal. On 9 June 2026 the Financial Supervision Commission withdrew the licence of ZAD DallBogg: Life and Health AD after earlier bans on new business, including a domestic ban from 2 April 2026, and a short-term solvency plan it judged insufficient (EIOPA notice, 11 June 2026).

10. Recent changes and what to watch

• 10 July 2027: EU AML Regulation 2024/1624 applies [Adopted, applies 10 Jul 2027]. Directly applicable CDD rules replace much of the national Act; tied intermediaries that do not collect premiums and act under an insurer's responsibility fall outside its definition of financial institution (Art. 2(6)(c)).
• 24 September 2026: Insurance Code distance-selling references moved to the Consumer Protection Act (State Gazette No. 87 of 2026) [In force]. Online pre-contract and withdrawal flows should be checked.
• 9 June 2026: licence of ZAD DallBogg: Life and Health AD withdrawn [In force]. The Commission escalated from business bans to withdrawal.
• 1 January 2026: euro adoption; AML Act thresholds are set in euro [In force]. Penalty amounts in both Acts still read in leva.
• 2025: AML Act Art. 54(1) now requires an original or notarised registry extract for legal-entity customers (State Gazette No. 49 of 2025) [In force]. Corporate onboarding templates should follow it.
• 17 January 2025: Digital Operational Resilience Act applies [In force]. Identity verification providers count as ICT third-party providers.

11. What this means for identity verification

• Scope by product: life, annuity and unit-linked sales need full AML due diligence; non-life sales do not.
• Two methods, documented: a remote flow needs at least two verification methods from Art. 55(1), for example document authenticity checks plus an eIDAS electronic ID or a first payment from the customer's own account, each logged with date, time and operator.
• Liveness and matching: live capture, liveness detection, face matching and chip reading where available (EBA/GL/2022/15).
• Signature in the flow: for most online policies a qualified electronic signature is a legal step; integrate a qualified trust service provider.
• Payout re-verification: verify beneficiaries and their beneficial owners at payout, screen them for politically exposed status and pass identification data to the paying bank.
• Biometric basis and retention: record the GDPR Art. 9 condition for face matching and keep AML evidence for five years from the end of the relationship.