Remote VASP serving residents in Bulgaria

The Measures Against Money Laundering Act (SG No. 27/2018) remains Bulgaria's AML/CFT statute for crypto businesses: the Markets in Crypto-Assets Act (SG No. 54/2025), in force since 8 July 2025, amended it in § 18 to add FSC-authorised crypto-asset service providers as obliged entities (Article 4, item 19), repeal the NRA register (Article 9a) and repeal the former VASP items 38 and 39 from 1 July 2026.

The Measures Against Money Laundering Act covered virtual-asset providers through Article 4, items 38 and 39; the Markets in Crypto-Assets Act repealed those items from 1 July 2026, replaced them with item 19 (FSC-authorised crypto-asset service providers) and added definitions of crypto-asset, crypto-asset service provider and self-hosted address (Supplementary Provisions § 1, items 33–35).

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.

SANS does not supervise crypto-asset service providers: under the Markets in Crypto-Assets Act the Financial Supervision Commission authorises and supervises them (Art 3(1)) and monitors their crypto-transfer compliance under Regulation (EU) 2023/1113 (Art 20), and only notifies SANS when it starts enforcing a coercive administrative measure (Art 24).

National Revenue Agency (NRA) (Национална агенция за приходите - НАП)

In Bulgaria, the identification and verification of the beneficial owner is required under the AML Act, but if no individual beneficial owner can be identified through ownership or control criteria, the law provides that members of senior management are treated as the beneficial owner for registration purposes, so the process is not absolute but includes a fallback.

Natural Persons: Name, date and place of birth, nationality, permanent address, unique identification number (e.g., national ID card, passport number). Identity must be verified using reliable, independent source documents or data (e.g., valid official identification document).

Legal Entities: Company name, legal form, registration number, registered address, and the names of the individuals authorized to represent the company. Verification involves obtaining extracts from commercial registers or similar official documents.

For legal entities, VASPs must identify the natural person(s) who ultimately own or control the customer, typically defined as holding 25% plus one share or more of the voting rights or exercising control via other means. This information must also be verified.

Evidence fact bg.aml.understanding-the-purpose-and-intended not found (may have been renamed).

Regular scrutiny of transactions undertaken throughout the course of the business relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Keeping customer documents, data, and information up-to-date.

Politically Exposed Persons (PEPs): Customers who hold or have held prominent public functions, their family members, or close associates.

High-Risk Third Countries: Transactions involving customers or beneficial owners from countries identified by the EU or FATF as having strategic AML/CFT deficiencies.

Complex, Unusual, Large Transactions, or Unusual Patterns: Transactions that have no apparent economic or lawful purpose.

Regulation (EU) 2023/1113 (the recast Transfer of Funds Regulation) has applied directly in Bulgaria since 30 December 2024; under Article 20 of the Markets in Crypto-Assets Act (SG No. 54/2025) the Financial Supervision Commission monitors compliance with its Chapters I, III, V and IX for crypto-asset transfers and receives all notifications under them.

The EU Transfer of Funds Regulation as amended by Regulation (EU) 2023/1113 extends the Travel Rule to crypto‑asset transfers, and these requirements have applied in the EU (including Bulgaria) since 30 December 2024.

For crypto-asset transfers between EU Crypto-Asset Service Providers (CASPs) under Regulation (EU) 2023/1113, there is no de minimis threshold: all such transfers, regardless of amount, must include complete originator and beneficiary information. However, the EU framework now distinguishes these CASP‑to‑CASP transfers from transactions involving self‑hosted wallets, for which additional rules apply above €1,000, so any description of the regime should situate the zero‑threshold rule within this broader, MiCA‑aligned CASP/Transfer of Funds Regulation context rather than as a generic VASP rule.

The travel rule for crypto-asset transfers, including transfers to and from self-hosted addresses involving a CASP, has applied in Bulgaria since 30 December 2024 under Regulation (EU) 2023/1113, and § 3(3) of the Markets in Crypto-Assets Act required NRA-registered firms operating under the transition to apply that Regulation as well.

CASPs must collect originator and beneficiary information for all transfers.

For transfers exceeding €1,000, the CASP must verify that the unhosted wallet is owned or controlled by the originator or beneficiary.

Under Article 14(5) of Regulation (EU) 2023/1113 a CASP must assess whether a self-hosted address is owned or controlled by its client only for transfers exceeding EUR 1,000; below that amount it collects and holds the transfer information, and Bulgaria's Measures Against Money Laundering Act Article 20a (inserted by Markets in Crypto-Assets Act § 18) adds a risk assessment and risk-based measures for all self-hosted-address transfers.

Bulgaria's Markets in Crypto-Assets Act (SG No. 54 of 4 July 2025) gives "crypto-asset service provider" the meaning in Article 3(1)(15) of Regulation (EU) 2023/1114 (§ 1, item 1 of its Supplementary Provisions); MiCA applies directly and the Act provides implementing measures rather than transposing it.

Collect and transmit information: Ensure that crypto-asset transfers are accompanied by the following information:

Originator: Name, crypto-asset account number, address (or national ID number/customer ID number), date and place of birth (for natural persons), legal entity registration number (for legal entities).

Beneficiary: Name, crypto-asset account number.

Verify information: Take reasonable steps to verify the accuracy of the information, especially for transfers to/from unhosted wallets above the €1,000 threshold.

Retain records: Keep records of the collected information for a period of five years.

Detect missing information: Implement systems to detect if the required originator or beneficiary information is missing or incomplete for incoming or outgoing transfers.

Implement risk-based procedures: Establish robust internal policies, controls, and procedures to mitigate money laundering and terrorist financing risks, including procedures for handling transfers with incomplete information or to/from unhosted wallets.

Data Protection: All data processing must comply with the GDPR (General Data Protection Regulation).

Under Article 39 of the Markets in Crypto-Assets Act, a CASP that breaches Chapters I, III, V or IX of Regulation (EU) 2023/1113 faces a pecuniary sanction of BGN 10,000 to 40,000 (BGN 40,000 to 80,000 for a repeat), other legal persons BGN 5,000 to 10,000 (repeat BGN 10,000 to 20,000) and natural persons a fine of BGN 1,000 to 3,000 (repeat BGN 3,000 to 5,000). Amounts are stated in BGN as written in the Act; Bulgaria adopted the euro on 1 January 2026 at 1.95583 BGN per EUR.

Evidence fact bg.travel-rule.sanctions-by-supervisory-bodies not found (may have been renamed).

Since the Markets in Crypto-Assets Act (SG No. 54/2025) the FSC sanctions MiCA breaches under Article 37 (natural persons BGN 1,400 to 700,000; legal persons up to the higher of BGN 5,000,000 or 1.5% to 6.25% of annual turnover, depending on the provision) and travel-rule breaches under Article 39; on its § 5(3) list of former NRA-registered VASPs the FSC has cancelled 47 registrations by decisions dated 12 August 2025 to 24 June 2026. Amounts are stated in BGN as written in the Act; Bulgaria adopted the euro on 1 January 2026 at 1.95583 BGN per EUR.

Outcome: Administrative fines, cessation of non-compliant activities, and potential criminal investigations in severe cases of money laundering.