Bulgaria -- AML/CFT Compliance Regulatory Overview
Methodology
AI-generated synthesis from web search results.
Limitations
- AI-generated content -- not reviewed by human expert
- Source URLs not independently verified
Bulgaria, as a Member State of the European Union, has transposed the relevant EU Anti-Money Laundering Directives (AMLDs) into its national legislation, which now explicitly includes cryptocurrency/virtual asset service providers (VASPs) as "obliged entities."
This means VASPs operating in Bulgaria are subject to the same stringent AML/CFT (Anti-Money Laundering/Combating the Financing of Terrorism) obligations as traditional financial institutions.
AML/CFT Legislation in Bulgaria for VASPs
The primary piece of legislation governing AML/CFT in Bulgaria, which has been amended to incorporate the EU's 5th and 6th AML Directives, is the:
- Measures Against Money Laundering Act (MAMLA) (Закон за мерките срещу изпирането на пари - ЗМИП).
- This act defines "virtual assets" and "virtual asset service providers" and brings them within the scope of obliged entities. It outlines the specific requirements for customer due diligence, reporting, and record-keeping.
Definition of Virtual Assets and VASPs:
Bulgarian law generally aligns with the FATF (Financial Action Task Force) definitions, categorizing virtual assets as digital representations of value that can be digitally traded or transferred and used for payment or investment purposes.
VASPs typically include entities that perform one or more of the following activities for or on behalf of a customer:
- Exchange between virtual assets and fiat currencies.
- Exchange between one or more forms of virtual assets.
- Transfer of virtual assets.
- Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.
- Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.
Regulatory Authorities
In Bulgaria, the oversight and enforcement of AML/CFT requirements for VASPs are primarily shared between two key authorities:
State Agency for National Security (SANS) - Financial Intelligence Directorate
- Role: This is Bulgaria's Financial Intelligence Unit (FIU). It is the primary recipient of Suspicious Transaction Reports (STRs) and other AML-related information from obliged entities. SANS is responsible for analyzing suspicious activities and disseminating intelligence to law enforcement.
- Website: https://www.dans.bg/
National Revenue Agency (NRA) (Национална агенция за приходите - НАП)
- Role: The NRA is responsible for the registration and general supervision of VASPs for AML/CFT purposes. VASPs in Bulgaria are typically required to register with the NRA and demonstrate compliance with AML obligations. The NRA may conduct inspections and impose administrative sanctions for non-compliance.
- Website: https://nra.bg/ (Relevant sections often pertain to registration, tax obligations, and specific guidance for businesses, including VASPs.)
Customer Due Diligence (CDD) Requirements
VASPs in Bulgaria must apply a risk-based approach to CDD, meaning the intensity of the measures should be commensurate with the assessed risk of money laundering or terrorist financing.
Standard CDD Measures Include:
Identification and Verification of the Customer:
- Natural Persons: Name, date and place of birth, nationality, permanent address, unique identification number (e.g., national ID card, passport number). Identity must be verified using reliable, independent source documents or data (e.g., valid official identification document).
- Legal Entities: Company name, legal form, registration number, registered address, and the names of the individuals authorized to represent the company. Verification involves obtaining extracts from commercial registers or similar official documents.
Identification and Verification of the Beneficial Owner (BO):
- For legal entities, VASPs must identify the natural person(s) who ultimately own or control the customer, typically defined as holding 25% plus one share or more of the voting rights or exercising control via other means. This information must also be verified.
Understanding the Purpose and Intended Nature of the Business Relationship:
- VASPs must gather information on why the customer wants to use their services, the expected transaction patterns, and the source of funds/wealth where relevant.
Ongoing Monitoring:
- Regular scrutiny of transactions undertaken throughout the course of the business relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.
- Keeping customer documents, data, and information up-to-date.
Enhanced Due Diligence (EDD) Requirements:
EDD must be applied in situations that present a higher risk of money laundering or terrorist financing. These typically include:
- Politically Exposed Persons (PEPs): Customers who hold or have held prominent public functions, their family members, or close associates.
- High-Risk Third Countries: Transactions involving customers or beneficial owners from countries identified by the EU or FATF as having strategic AML/CFT deficiencies.
- Complex, Unusual, Large Transactions, or Unusual Patterns: Transactions that have no apparent economic or lawful purpose.
- Non-Face-to-Face Business Relationships: Although technology can mitigate some risks, remote onboarding often triggers EDD by default in the crypto sector.
- Transactions exceeding a certain threshold: While not always mandatory for all virtual asset transactions, specific fiat-to-crypto exchanges above certain amounts might require EDD as per internal risk policies.
EDD measures can include obtaining additional information on the customer and BO, conducting more extensive verification, obtaining senior management approval for the relationship, and increasing the frequency of ongoing monitoring.
Suspicious Transaction Reporting (STR)
- Obligation: VASPs are legally obliged to report any transaction (or attempted transaction) where they know, suspect, or have reasonable grounds to suspect that funds are derived from criminal activity or are related to terrorist financing.
- Recipient: All STRs must be submitted to the State Agency for National Security (SANS) - Financial Intelligence Directorate.
- Timeliness: Reports must be submitted without delay after forming a suspicion.
- No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer or third parties that a STR has been, or will be, submitted.
Record-Keeping Obligations
VASPs must retain comprehensive records to facilitate investigations and demonstrate compliance:
- CDD Documentation: All documents and information obtained during the CDD process (identification, verification, beneficial ownership, purpose of relationship).
- Transaction Records: Records of all transactions, including amounts, currencies, dates, parties involved (senders and recipients), and virtual asset addresses or unique transaction identifiers.
- STRs and Related Analysis: Copies of all STRs submitted, along with any internal analysis or documentation supporting the decision to file or not to file a report.
- Correspondence: Records of relevant internal and external communications related to AML/CFT compliance.
Retention Period: Records must generally be kept for a period of 5 years after the end of the business relationship with the customer or from the date of an occasional transaction. This period can be extended by judicial order if necessary for ongoing investigations.
Additional Key Requirements for VASPs
Beyond the core elements, VASPs in Bulgaria must also:
- Appoint an AML Compliance Officer: A designated person responsible for the implementation and oversight of the VASP's AML/CFT program.
- Establish Internal AML/CFT Policies and Procedures: Develop and implement comprehensive internal rules, procedures, and controls tailored to the VASP's specific risks, covering all aspects of AML/CFT compliance (risk assessment, CDD, STR, record-keeping, training).
- Conduct Regular Risk Assessments: Periodically assess the money laundering and terrorist financing risks associated with their products, services, customers, delivery channels, and geographical areas of operation.
- Provide Employee Training: Ensure all relevant employees receive ongoing training on AML/CFT legislation, internal policies, and how to identify and report suspicious activities.
- Registration: VASPs are required to register with the National Revenue Agency (NRA) prior to commencing operations.
Disclaimer: This information is provided for general guidance and informational purposes only and does not constitute legal advice. Cryptocurrency and virtual asset regulations are complex and subject to change. Any VASP operating or intending to operate in Bulgaria should seek independent legal counsel to ensure full compliance with all applicable laws and regulations.
Source Data
The Measures Against Money Laundering Act (SG No. 27/2018) remains Bulgaria's AML/CFT statute for crypto businesses: the Markets in Crypto-Assets Act (SG No. 54/2025), in force since 8 July 2025, amended it in § 18 to add FSC-authorised crypto-asset service providers as obliged entities (Article 4, item 19), repeal the NRA register (Article 9a) and repeal the former VASP items 38 and 39 from 1 July 2026.
The Measures Against Money Laundering Act covered virtual-asset providers through Article 4, items 38 and 39; the Markets in Crypto-Assets Act repealed those items from 1 July 2026, replaced them with item 19 (FSC-authorised crypto-asset service providers) and added definitions of crypto-asset, crypto-asset service provider and self-hosted address (Supplementary Provisions § 1, items 33–35).
SANS does not supervise crypto-asset service providers: under the Markets in Crypto-Assets Act the Financial Supervision Commission authorises and supervises them (Art 3(1)) and monitors their crypto-transfer compliance under Regulation (EU) 2023/1113 (Art 20), and only notifies SANS when it starts enforcing a coercive administrative measure (Art 24).
The National Revenue Agency no longer registers or supervises VASPs: on 8 July 2025 it discontinued its MAMLA Art 9a register and handed it to the FSC (Markets in Crypto-Assets Act § 5(1)–(2)), and firms on that list are under FSC supervision during the transition (§ 3(4)).
Until 8 July 2025 Bulgarian VASPs had to register with the National Revenue Agency under Article 9a of the Measures Against Money Laundering Act; the Markets in Crypto-Assets Act repealed Article 9a, the NRA discontinued the register on the Act's entry into force (§ 5(1)) and pending registration proceedings were terminated (§ 4).
Since 1 July 2026 the Measures Against Money Laundering Act no longer has a separate virtual-asset provider category: items 38 and 39 of Article 4 were repealed, and custody and administration of crypto-assets makes a firm an obliged entity only as a crypto-asset service provider authorised under the Markets in Crypto-Assets Act (Article 4, item 19).
Registration with the National Revenue Agency (НАП) under the Measures Against Money Laundering Act was an AML registration, not a licence; under § 3(1) of the Markets in Crypto-Assets Act, firms registered before 30 December 2024 could continue without MiCA authorisation only until 1 July 2026.
Registration of crypto businesses with the National Revenue Agency under Article 9a of the Measures Against Money Laundering Act ended when the Markets in Crypto-Assets Act entered into force on 8 July 2025 (§ 5(1)); crypto-asset service providers now need FSC authorisation under MiCA Article 63, and providers registered after 30 December 2024 had to apply within three months (§ 3(2)).
The Measures Against Money Laundering Act was promulgated in the State Gazette (Държавен вестник) No. 27 of 2018 and has been amended many times, including by the Markets in Crypto-Assets Act (SG No. 54/2025, § 18).
The NRA's VASP register closed when the Markets in Crypto-Assets Act entered into force on 8 July 2025 (§ 5(1)); the FSC now publishes it as the § 5(3) register, which on 14 October 2026 listed about 210 former NRA-registered firms, roughly 47 of them marked cancelled, none holding a MiCA licence.
Segregation of client crypto-assets and funds by crypto-asset service providers in Bulgaria is governed directly by MiCA (Regulation (EU) 2023/1114, Articles 70 and 75), not transposed; the Markets in Crypto-Assets Act makes the Financial Supervision Commission the competent authority (Art 3(1)) and sets pecuniary sanctions for breaches of MiCA Articles 59–83 (Art 37(4)).
VASP registration under the Measures Against Money Laundering Act ended on 8 July 2025 (Markets in Crypto-Assets Act § 5); crypto-asset service providers now need FSC authorisation under MiCA, whose prudential requirements (Article 67) can be met with own funds, an insurance policy or a combination of both.
The Financial Supervision Commission (Комисия за финансов надзор) is Bulgaria's MiCA competent authority (Markets in Crypto-Assets Act Art 3(1)); its register lists five licensed CASPs, authorised by decisions dated 22 December 2025 to 10 September 2026, the same five ESMA lists with Bulgaria as home state.
Bulgaria implemented MiCA nationally through the Markets in Crypto-Assets Act (Закон за пазарите на криптоактиви), promulgated in State Gazette No. 54 of 4 July 2025 and in force since 8 July 2025, which sets out authorisation, supervision, penalties (Arts 37–47) and transitional rules (§§ 3–6).
Bulgaria's Markets in Crypto-Assets Act entered into force on 8 July 2025; it designates the FSC as competent authority for CASPs (Art 3(1)), with authorisation decisions under MiCA Art 63 and penalty decrees issued by the FSC Deputy Chairperson in charge of investment supervision (Arts 3(3)–(4), 45).
The Markets in Crypto-Assets Act (SG No. 54/2025, in force 8 July 2025) amended the Financial Supervision Commission Act (§ 12), the Payment Services and Payment Systems Act (§ 9) and the Measures Against Money Laundering Act (§ 18) to give the FSC and the BNB their MiCA powers; it took effect after MiCA's 30 December 2024 application date.
The BNB is not Bulgaria's supervisor of crypto service providers: the Markets in Crypto-Assets Act makes the Financial Supervision Commission the MiCA competent authority (Art 3(1)), adds authorised CASPs to the obliged entities of the Measures Against Money Laundering Act (Art 4 item 19) and repeals the NRA's VASP register (Art 9a); the BNB's crypto role covers e-money token issuers (PSPSA Art 182a).
The Bulgarian National Bank supervises anti-money-laundering and counter-terrorist-financing compliance in the banking sector and, under Article 122(1)–(2) of the Measures Against Money Laundering Act (ZMIP), publishes the enforced administrative measures and penalty decrees it has imposed on banks for breaches of that Act.
The Bulgarian National Bank is the competent authority under MiCA Title IV for issuers of e-money tokens with a registered office in Bulgaria, under Article 182a of the Payment Services and Payment Systems Act inserted by § 9 of the Markets in Crypto-Assets Act (SG No. 54/2025).
The Financial Supervision Commission is the Bulgarian competent authority for issuers of asset-referenced tokens: Art 3(3) of the Markets in Crypto-Assets Act assigns it the MiCA powers under Arts 17–25 and 35 (ART authorisation and own funds), and Art 3(1) names it the Article 93 competent authority.
In Bulgaria the Financial Supervision Commission authorises and supervises crypto-asset service providers and issuers of asset-referenced tokens (Markets in Crypto-Assets Act Art 3(1)); the Bulgarian National Bank is competent only for issuers of e-money tokens (Act Art 1(2); PSPSA Art 182a).
Since 1 July 2026 only CASPs licensed by Bulgaria's Financial Supervision Commission, or authorised in another EU state and passported into Bulgaria, may provide crypto-asset services in Bulgaria; ESMA's register on 14 October 2026 showed 5 Bulgarian-authorised CASPs and 175 CASPs passporting into Bulgaria.
The Bulgarian National Bank is the competent authority for e-money token issuers seated in Bulgaria (PSPSA Art 182a, inserted by MCAA § 9) and Bulgaria's Article 96 MiCA cooperation authority with the EBA and ESMA for those issuers (Art 182a(2)).
MiCA alignment was enacted by the National Assembly in the Markets in Crypto-Assets Act (SG No. 54/2025), which inserted Article 182a into the Payment Services and Payment Systems Act making the Bulgarian National Bank the competent authority only for e-money token issuers with a registered office in Bulgaria; the Financial Supervision Commission is the competent authority for all other MiCA matters (Art 3(1)).
Bulgaria's Payment Services and Payment Systems Act (SG No. 20/2018) governs payment and e-money institutions; Article 182a, inserted by the Markets in Crypto-Assets Act (§ 9), makes the Bulgarian National Bank the competent authority under MiCA Title IV for e-money token issuers with a registered office in Bulgaria.
Bulgaria has not implemented the EU Anti-Money Laundering Regulation (EU) 2024/1624, which applies directly from 10 July 2027; until then crypto-asset service providers are obliged entities under the Measures Against Money Laundering Act, Article 4, item 19, inserted by the Markets in Crypto-Assets Act (SG No. 54/2025, § 18).
Bulgaria's Markets in Crypto-Assets Act (SG No. 54/2025) governs offers to the public and admission to trading of crypto-assets and the authorisation and supervision of crypto-asset issuers and CASPs (Art 1(1)), and requires white papers and marketing communications offered in Bulgaria to be in Bulgarian or a language customary in international finance (Art 4).
Virtual-asset providers in Bulgaria registered with the National Revenue Agency, not SANS; since 8 July 2025 the Financial Supervision Commission authorises crypto-asset service providers and monitors their compliance with Regulation (EU) 2023/1113 on crypto transfers (Markets in Crypto-Assets Act Art 20), notifying SANS when it starts enforcing a coercive administrative measure (Art 24).
The Financial Supervision Commission is Bulgaria's MiCA competent authority (Markets in Crypto-Assets Act Art 3(1)); most MiCA powers are exercised by the FSC Deputy Chairperson in charge of the Investment Supervision Directorate, with listed decisions taken by the Commission on that Deputy Chairperson's proposal (Art 3(3)–(4)).
Bulgaria's current Measures Against Money Laundering Act was promulgated in State Gazette No. 27 of 2018; the Markets in Crypto-Assets Act (SG No. 54/2025, § 18) amended it to make FSC-authorised crypto-asset service providers obliged entities (Article 4, item 19).
Bulgarian virtual-asset providers registered with the National Revenue Agency under Article 9a of the Measures Against Money Laundering Act, not with SANS; the Markets in Crypto-Assets Act repealed Article 9a and closed that register on 8 July 2025, and FSC-authorised crypto-asset service providers are now obliged entities under Article 4, item 19.
Crypto-asset services are lawful in Bulgaria only with MiCA authorisation: since 1 July 2026 only crypto-asset service providers licensed by the Financial Supervision Commission (or EU CASPs passporting in) may provide them, and the FSC had licensed five Bulgarian CASPs between 22 December 2025 and 10 September 2026.
Bulgarian VASPs (Measures Against Money Laundering Act Art 4 items 38–39) registered with the National Revenue Agency under MAMLA Art 9a, not with the State Agency for National Security; the Markets in Crypto-Assets Act repealed Art 9a (§ 18 item 3) and items 38–39 from 1 July 2026, replacing registration with FSC authorisation under MiCA.
Operating a crypto exchange in Bulgaria requires authorisation as a crypto-asset service provider by the Financial Supervision Commission under MiCA and the Markets in Crypto-Assets Act (Art 3(1)); the former NRA registration under the Measures Against Money Laundering Act gave transitional rights only until 1 July 2026 (§ 3(1)).
Bulgaria used MiCA's transitional period: VASPs registered with the NRA before 30 December 2024 could keep operating without authorisation until 1 July 2026 or an earlier FSC decision (Markets in Crypto-Assets Act § 3(1)); since 1 July 2026 only FSC-licensed CASPs or CASPs passported from another EU state may serve Bulgarian clients.
151 fact(s) collected but awaiting source verification. View in explorer →
References
This article was generated by SearXNG+LLM .
Primary Sources
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114. (n.d.). eur-lex.europa.eu. Retrieved April 21, 2026, from https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R1114. (n.d.). eur-lex.europa.eu. Retrieved April 21, 2026, from https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R1114
Secondary Sources
dans.bg. (n.d.). dans.bg. Retrieved April 22, 2026, from https://www.dans.bg/
nra.bg. (n.d.). nra.bg. Retrieved April 22, 2026, from https://nra.bg/
Edit History
This article is maintained by AI research workers and reviewed by human editors. Learn about our methodology →