On-shore VASP in Bulgaria

Measures Against Money Laundering Act (MAMLA) (Закон за мерките срещу изпирането на пари - ЗМИП).

This act defines "virtual assets" and "virtual asset service providers" and brings them within the scope of obliged entities. It outlines the specific requirements for customer due diligence, reporting, and record-keeping.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.

Participation in and provision of financial services related to an issuer’s offer and/or sale of a virtual asset are subject to AML/CFT regulation and are treated as financial activities for regulated virtual asset and stablecoin issuers.

In Bulgaria, AML/CFT supervision of VASPs is shared among multiple authorities, with the National Revenue Agency (NRA) as the leading registration and enforcement body, the Financial Supervision Commission (FSC) overseeing crypto-asset service providers within its regulatory perimeter, and DANS-FID retaining a role but no longer the sole or primary supervisor.

National Revenue Agency (NRA) (Национална агенция за приходите - НАП)

Bulgarian law now mandates continuous identification and verification of beneficial owners, requiring ongoing monitoring and periodic updates beyond a static registration step.

Natural Persons: Name, date and place of birth, nationality, permanent address, unique identification number (e.g., national ID card, passport number). Identity must be verified using reliable, independent source documents or data (e.g., valid official identification document).

Legal Entities: Company name, legal form, registration number, registered address, and the names of the individuals authorized to represent the company. Verification involves obtaining extracts from commercial registers or similar official documents.

Bulgarian law now mandates continuous identification and verification of beneficial owners, requiring ongoing monitoring and periodic updates beyond a static registration step.

For legal entities, VASPs must identify the natural person(s) who ultimately own or control the customer, typically defined as holding 25% plus one share or more of the voting rights or exercising control via other means. This information must also be verified.

Understanding the Purpose and Intended Nature of the Business Relationship:

VASPs must gather information on why the customer wants to use their services, the expected transaction patterns, and the source of funds/wealth where relevant.

Regular scrutiny of transactions undertaken throughout the course of the business relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Keeping customer documents, data, and information up-to-date.

Politically Exposed Persons (PEPs): Customers who hold or have held prominent public functions, their family members, or close associates.

High-Risk Third Countries: Transactions involving customers or beneficial owners from countries identified by the EU or FATF as having strategic AML/CFT deficiencies.

Complex, Unusual, Large Transactions, or Unusual Patterns: Transactions that have no apparent economic or lawful purpose.

Adopted: Yes, the principles of the FATF Travel Rule for crypto assets are adopted in Bulgaria through the Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets, also known as the amended Transfer of Funds Regulation (TFR). This regulation is directly applicable in all EU member states, including Bulgaria, without the need for national transposition.

The EU Transfer of Funds Regulation as amended by Regulation (EU) 2023/1113 extends the Travel Rule to crypto‑asset transfers, and these requirements have applied in the EU (including Bulgaria) since 30 December 2024.

For crypto-asset transfers between EU Crypto-Asset Service Providers (CASPs) under Regulation (EU) 2023/1113, there is no de minimis threshold: all such transfers, regardless of amount, must include complete originator and beneficiary information. However, the EU framework now distinguishes these CASP‑to‑CASP transfers from transactions involving self‑hosted wallets, for which additional rules apply above €1,000, so any description of the regime should situate the zero‑threshold rule within this broader, MiCA‑aligned CASP/Transfer of Funds Regulation context rather than as a generic VASP rule.

As of July 1, Bulgaria applies MiCA’s strict rules to all crypto transfers, including those involving self-hosted wallets, ending any prior unregulated status.

For transfers exceeding €1,000, the CASP must verify that the unhosted wallet is owned or controlled by the originator or beneficiary.

Verification is now mandatory for all unhosted wallets in Bulgaria, regardless of transaction value below €1,000.

Collect and transmit information: Ensure that crypto-asset transfers are accompanied by the following information:

Verify information: Take reasonable steps to verify the accuracy of the information, especially for transfers to/from unhosted wallets above the €1,000 threshold.

Retain records: Keep records of the collected information for a period of five years.

Detect missing information: Implement systems to detect if the required originator or beneficiary information is missing or incomplete for incoming or outgoing transfers.

Implement risk-based procedures: Establish robust internal policies, controls, and procedures to mitigate money laundering and terrorist financing risks, including procedures for handling transfers with incomplete information or to/from unhosted wallets.

Data Protection: All data processing must comply with the GDPR (General Data Protection Regulation).

For legal entities in Bulgaria, fines can vary widely and may be set as fixed amounts or as a percentage of annual turnover, with some regimes allowing penalties up to BGN 1,000,000 or more depending on the specific law, the severity of the breach, repeat offenses, and the type of entity.

Sanctions by supervisory bodies:

National Revenue Agency (NAP/NRA): The official body for tax administration in Bulgaria.

Tax Rate: 10% flat rate on the positive difference (gain) between the sale price and the acquisition price. This falls under income from the sale of "financial assets" or "other property" under the Personal Income Tax Act (ZDDLF - Закон за данъците върху доходите на физическите лица).

Companies (Legal Entities): The profit from mining operations is included in the company's overall financial result and is subject to the 10% Corporate Income Tax (under the ZKPO - Закон за корпоративното подоходно облагане). All legitimate business expenses (electricity, hardware, hosting, etc.) are deductible.

Violation Type: Non-compliance with the Measures Against Money Laundering Act (MAMLA), specifically regarding VASP registration, customer due diligence (CDD), ongoing monitoring, suspicious transaction reporting (STR), record-keeping, internal control rules, etc. Outcome: Administrative fines, cessation of non-compliant activities, and potential criminal investigations in severe cases of money laundering.

Outcome: Administrative fines, cessation of non-compliant activities, and potential criminal investigations in severe cases of money laundering.