Travel & Hospitality Compliance in Bulgaria

Bulgaria is open to online travel and hospitality businesses, and since January 2025 it applies the Schengen rules in full, with no checks at internal land, air or sea borders. Accommodation must be categorised or registered with the Ministry of Tourism or the municipality before it is offered, and tour operators and travel agents must be entered in the National Tourist Register and hold compulsory liability insurance.

The principal authorities are the Ministry of Tourism, which runs the guest data system and registers operators, and the Ministry of Interior, which uses guest data for immigration control and runs the borders. The biggest practical obstacle for a digital entrant is building check-in around a fixed national data set that is reported in near real time, while staying within a strict national limit on copying identity documents.

1. Who regulates this sector

2. Licensing and authorisation

Accommodation. Under the Tourism Act (Закон за туризма, ДВ, бр. 30 от 2013), hotel and restaurant services may be provided only in a categorised or registered establishment, or one holding a temporary certificate while categorisation is pending (Article 114, item 1). Guest rooms, guest apartments and guest houses may also be run by individuals who are not traders, including within their own home; uncategorised guest rooms and apartments are registered under the categorisation ordinance (Article 113(2)). Licensing is national. The Minister of Tourism categorises three- to five-star hotels, apartment complexes, holiday villages and villas (Article 127), while the mayor categorises one- and two-star hotels, motels and other listed establishments (Article 128).

Tour operators and travel agents. Article 61(2) requires anyone carrying on tour operator or travel agency activity in Bulgaria to be registered under the Act. The applicant must be a trader or legal entity (including one established in another EU or EEA state or Switzerland) with premises and/or an online platform for the activity, qualified staff and valid liability insurance. A supplementing act published in State Gazette No. 80 of 30 September 2025 extended eligibility to entities from states that apply the OECD Codes of Liberalisation. Operators established outside the EU that sell or direct package travel to Bulgaria must meet the same conditions (Article 97a).

Insolvency protection. A tour operator established in Bulgaria must take out compulsory "tour operator liability" insurance every year (Article 97(1)), and a trader facilitating linked travel arrangements needs its own equivalent policy (Article 97(2)). On first registration the policy must be presented to the Minister of Tourism within 7 days of notice that the registration certificate has been issued (Article 97(3)). The cover must include repatriation and refunds of payments made by travellers (Articles 97(5) and 97г). A bill to add a Tourist Guarantee Fund [Bill, first reading only] passed its first reading in February 2026.

3. Identity framework (AML rules do not apply)

Hotels, other accommodation providers, tour operators and travel agents are not obliged entities under the Measures Against Money Laundering Act (Закон за мерките срещу изпирането на пари, ДВ, бр. 27 от 2018, consolidated to ДВ, бр. 51 от 2026). The exhaustive list in Article 4 covers banks, payment providers, insurers, investment firms, gambling operators, crypto-asset service providers, real estate agents and others, but no tourism activity. The Act's customer due diligence thresholds (for example, occasional transactions of 15,000 euro or more, or 5,000 euro or more in cash, under Article 11) therefore do not apply to bookings or stays.

The exception is currency exchange: exchange bureaux are obliged entities in their own right (Article 4, item 4), so a travel business that offers exchange services should assess that activity separately against the Act.

Identity in this sector is governed instead by three instruments:

Tourism Act, Article 116

Every accommodation provider keeps a register of accommodated tourists, with the content set by the Minister of Tourism, and makes each entry immediately on check-in. Data flows to the Unified Tourist Information System.

Foreigners Act, Article 28

Accommodation providers register every foreign guest immediately in the Article 116 register. Private individuals or companies that give short-term lodging to a foreigner must notify the Ministry of Interior in writing within 3 days.

Foreigners Act, Article 20

Land, air and sea carriers must check, before carrying a foreigner, that the travel document and any visa are present, valid and free of visible tampering.

There is no beneficial ownership verification of guests, no transaction monitoring and no suspicious activity reporting duty for hotels or travel agents under these instruments. Sanctions screening is not imposed by the tourism rules; EU sanctions regulations apply directly to all businesses.

4. Identity verification and onboarding

The data set the register must hold

Order No. Т-РД-04-10 of 11 June 2019 of the Minister of Tourism fixes the register content. For Bulgarian, EU, EEA and Swiss citizens it includes full name, Bulgarian personal or foreigner's number (or other personal identification number), date of birth, sex, citizenship, identity card or national document number, issuing state, room, arrival and departure dates, nights and use of a package. For other nationals it requires the same items, with the number and series of the identity document. The Order sets a minimum retention of 2 years.

The Foreigners Act (Закон за чужденците в Република България, ДВ, бр. 153 от 1998, as amended by ДВ, бр. 52 от 2025) adds a statutory floor for foreign guests: the full names as written in the passport or substitute travel document, date and year of birth, citizenship, passport number and the period of stay (Article 28(4)). The document is therefore the source of the data, and a passport or national identity card is the expected document for foreign guests.

What is sent to the state

From 1 October 2025, Article 116(5) of the Tourism Act, as amended by § 52 of the Foreigners Act amendment in ДВ, бр. 52 от 2025 [In force], requires the following to be entered in the Unified Tourist Information System:

• Bulgarian, EU, EEA and Swiss guests: full names and administrative identifier as shown in the identity document, type, number and date of issue of that document, and registration and departure dates;
• all other guests: the number of guests, the identifying data under Article 28(4) of the Foreigners Act, and registration and departure dates.

Before that date only head counts and dates were reported for EU guests, so any system built on the earlier specification needs updating.

Verification methods

Neither act prescribes how the document is checked, requires a biometric comparison, or sets an assurance level. The obligation is to record accurate data from the document at the point of accommodation. Biometric face matching is optional and, if used, brings in the special category rules described in section 6.

5. Digital channels: what's different

Bottom line: the guest identity rules are channel-neutral, with the same data and the same "immediately on accommodation" timing at a desk or in an app, but online platforms carry their own listing, payment and blocking rules, and the national limit on copying identity documents shapes every digital check-in design.

Platform listing and payment rules

Since 1 January 2020, accommodation may be offered online, including through a platform connecting guests and providers, only if it is categorised or registered (Tourism Act, Article 113(3)). For accommodation offered through such a platform, electronic payment through the platform must be available (Article 113(4)).

Blocking of non-compliant sites

If an online intermediary breaches Article 113(3), the Minister of Tourism may, in addition to fines, ask the President of the Sofia District Court to order electronic communications providers to block access to the relevant web pages for up to 14 days on a first breach and up to 30 days on a later one (Article 176(7)). The court rules within 72 hours, the order is published on the Ministry's website, and providers must block within 24 hours of publication.

Electronic registers and transmission

The register may be kept in the Ministry's central web application, in the provider's own system meeting the Electronic Governance Act, or on paper (Article 116(2)); classes A and B of accommodation must use one of the electronic options (Article 116(3)). Providers with their own systems must ensure automated, interoperable exchange with the Unified Tourist Information System; paper registers are keyed in within 24 hours, or weekly in listed areas without connectivity (Article 116(6)).

6. Data protection and biometrics

The General Data Protection Regulation (Regulation (EU) 2016/679) applies directly, supplemented by the Personal Data Protection Act (Закон за защита на личните данни), supervised by the Commission for Personal Data Protection. For travel businesses three points matter most.

• Copying identity documents. Article 25г of the Personal Data Protection Act (added by ДВ, бр. 17 от 2019) allows a controller or processor to copy an identity document, driving licence or residence document only where a law provides for it. The Tourism Act and the Foreigners Act require specified data to be recorded; Article 28(4) and Article 116 describe entries in a register rather than a copy of the document. Storing passport images during online check-in needs a separate legal basis in a statute.
• Biometric data. Facial images processed to uniquely identify a person are biometric data (GDPR Article 4(14)) and their processing is prohibited unless an Article 9(2) condition applies, typically explicit consent. Because no travel rule requires a face match, a business offering one should make it optional, with a non-biometric alternative.
• State access. Register data in the Unified Tourist Information System are not public (Tourism Act, Article 116(7)). Since 1 October 2025 the Ministry of Interior and the State Agency for National Security access all data "in accordance with the Personal Data Protection Act", while municipalities and the National Revenue Agency receive only guest numbers, citizenship and nights.

7. Sector-specific obligations

Carriers: document checks, the Entry/Exit System and travel authorisations

Before carrying a foreigner to or from Bulgaria, a land, air or sea carrier must check that the travel document and any required visa are present and valid, and look for visible alterations, erasures, additions or signs of photo substitution (Foreigners Act, Article 20(1)). Once the relevant EU systems operate, carriers must also check, through the EU carrier portal, that a travel authorisation is held where required, and whether a single- or double-entry short-stay visa has already been used (Article 20(1), items 3 and 4). A carrier whose passenger is refused entry must return the passenger at its own cost (Article 20(2)).

The Entry/Exit System, which records third-country nationals' entries, exits and biometrics at the external Schengen border, started operations on 12 October 2025 (Commission Implementing Decision (EU) 2025/1544), with a 180-day progressive start during which stamping continued (Regulation (EU) 2025/1534). The travel authorisation check for carriers applies from the date the Commission sets for the start of the European Travel Information and Authorisation System [Adopted, start date set by the Commission].

Passenger data

Air carriers' handling of passenger name records is governed by Directive (EU) 2016/681. Regulation (EU) 2025/12 on advance passenger information [Adopted, applies two years after the EU router starts] will require air carriers on flights into the EU to collect passport data (name, date of birth, sex, nationality, document type, number, issuing country and expiry) by automated reading of the machine-readable document, with manual entry only as an exception.

Private and short-term lets to foreigners

Hosts outside the Article 116 regime, such as individuals or companies giving a foreigner short-term lodging, must notify the Ministry of Interior's foreigners' control office or district police in writing within 3 days, giving names, date of birth, citizenship and document number and series (Foreigners Act, Article 28(3)).

8. Risk indicators and red flags

Travel and hospitality fraud and identity-abuse indicators

• Unregistered accommodation: a property offered for stays but absent from the National Tourist Register.
• Deposit scams: requests for advance payment for stays or holiday packages from unverified sellers, flagged by the Ministry of Tourism in December 2025.
• Uninsured operator: a tour operator whose "tour operator liability" policy is missing or has lapsed.
• Altered documents: erasures, additions or signs of photo substitution in a travel document.
• Unrecognisable photo: a document image that does not allow the holder to be identified.
• Exhausted visa: a single- or double-entry short-stay visa already used for its permitted entries.
• Unreported lodging: foreigners housed privately without the 3-day notification to the Ministry of Interior.

9. Enforcement and penalties

Penalties under the Tourism Act are fixed amounts or ranges per breach, doubled or raised for a repeat breach, with a fine for individuals and a "property sanction" for sole traders and legal entities. The consolidated text states them in leva:

The Minister of Tourism checks compliance with Article 116(1) and (6) at the establishments it categorises and with the platform rule, and imposes the platform fines (Tourism Act, Article 176(5)-(6)). Where Ministry inspections find breaches, the findings are sent to the Consumer Protection Commission for follow-up and sanctions (Article 176(4)). For online intermediaries, blocking of web pages is available on top of fines (section 5).

10. Recent changes and what to watch

• May 2026: Foreigners Act amendment [Draft, consultation closed 4 May 2026]. The Ministry of Interior's draft implements EU border screening rules and the single permit directive and refines post-Schengen controls; watch for changes affecting guest or carrier checks.
• February 2026: Tourist Guarantee Fund [Bill, first reading only]. A collective fund for refunds and repatriation on tour operator insolvency; insurance under Article 97 remains the rule until any law is adopted.
• 12 October 2025: Entry/Exit System [In force]. Biometric registration of third-country nationals at the external border, after a 180-day progressive start.
• 1 October 2025: expanded guest data [In force]. Names, personal identifier and identity document details of Bulgarian and EU guests now go to the Unified Tourist Information System.
• 30 September 2025: Tourism Act supplement (ДВ, бр. 80 от 2025) [In force]. Operators from states applying the OECD liberalisation codes may register as tour operators and travel agents.
• 1 January 2025: full Schengen membership [In force]. Internal land border checks lifted (Council Decision (EU) 2024/3212), following air and sea borders on 31 March 2024.
• Pending: travel authorisations and advance passenger information [Adopted, dates set by the Commission]. Carrier checks and automated passport data capture will follow EU start dates.

11. What this means for identity verification

• Document types: passports or substitute travel documents for third-country guests; national identity cards or passports for EU, EEA and Swiss guests, with document type, number and date of issue captured.
• Data, not images: extract and validate the fields the register needs (by machine-readable zone or chip reading, for example) and avoid retaining document copies unless a statute supports it.
• Timing: pre-arrival collection is useful, but the register entry is made at accommodation and must reach the state system without delay.
• Biometrics: optional; offer a non-biometric route and rely on explicit consent where a face match is used.
• Integration: classes A and B need an electronic register linked to the Unified Tourist Information System; build to the post-October 2025 data set.
• Retention: keep register data for at least 2 years, and no longer than the purpose requires.
• Platforms and carriers: verify a property's registration before listing; carriers should prepare for automated passport reading and travel authorisation checks.