AML in Bulgaria: the ZMIP, the Financial Intelligence Directorate and a Licensed Firm's Duties

A payment institution, e-money institution (EMI), crypto-asset service provider (CASP) or investment firm licensed in Bulgaria takes on a second legal relationship on the day it is licensed. The Bulgarian National Bank (BNB) or the Financial Supervision Commission (FSC) grants the licence, but the Measures Against Money Laundering Act (ZMIP) makes the firm an obliged entity. Its anti-money-laundering (AML) duties are policed by an intelligence unit inside the State Agency for National Security (DANS) as well as by the licensing authority.

How Bulgarian AML law is built

Why the licence creates the duties

ZMIP Art. 4 lists the obliged entities by category, and each financial licence maps onto one or more items. The AML duties therefore attach to the status the licence confers, not to any separate AML registration.

The double entry for payment institutions and EMIs has consequences for how their AML function must be organised. It exists because the Credit Institutions Act (ZKI), Art. 3(2) counts both as financial institutions.

For crypto firms, item 19 has replaced the pre-MiCA categories: virtual-currency exchange and custodian-wallet providers (Art. 4 items 38 and 39) and their registration regime (Art. 9a) were repealed by the Crypto-Asset Markets Act, the two items with effect from 1 July 2026. The licences themselves are described in EMI and payment institution licences in Bulgaria, the Bulgarian CASP licence and the Bulgarian investment firm licence.

Two channels: an intelligence unit and a sector supervisor

The model has two channels. Control over the application of the ZMIP belongs to the Chair of DANS, who exercises it through the Financial Intelligence Directorate (FID) (Art. 108(1)–(5)). Every suspicious-transaction report goes to the FID. At the same time, Art. 108(6) gives the BNB and the FSC risk-based supervision of the same firms' customer due diligence (CDD), record-keeping, risk assessment and internal organisation, and of their compliance with the Art. 72 reporting duty. A licensed firm therefore answers to two inspectorates under one rulebook.

Three instruments, one perimeter

The ZMIP is the general statute. It transposes the EU Anti-Money Laundering Directive (EU) 2015/849 and its 2018 amending Directive (EU) 2018/843 (Additional Provisions, § 3). It was promulgated in State Gazette No. 27 of 27 March 2018, and its consolidated text runs to the amendments of State Gazette No. 51 of 5 June 2026. It sets out who is bound, how customers are identified and checked, what is reported, who supervises and what a breach costs.

Two instruments sit beside it. The Measures Against the Financing of Terrorism and the Proliferation of Weapons of Mass Destruction Act (ZMFT), renamed in 2025, governs asset freezing and terrorist-financing reports. The implementing regulation (PPZMIP), adopted by Council of Ministers Decree No. 357 of 31 December 2018 and last amended in State Gazette No. 61 of 29 July 2025, supplies procedures, forms and deadlines. The FSC keeps all three on its AML legislation page.

What shapes the regime in practice

Four features give the Bulgarian regime its practical shape:

• Dual supervision. The financial intelligence unit sits inside the national security agency and can inspect on its own or jointly with the BNB or FSC.
• Pre-execution reporting. A suspicious operation is reported before it is carried out, and the FID can suspend it for up to five working days.
• Statutory clocks. Internal rules and a specialised AML service must exist within four months of the licence; the FID learns the service head's name within seven days.
• Personal exposure. Managers and the person responsible for AML control are fined personally, up to BGN 15 million (about €7.67 million), and can be barred from senior posts for a year.

The regime as it stands in September 2026:

Who supervises: the FID, the BNB and the FSC

The two channels divide the work by function rather than by firm. Both reach every licensed firm, but they do different things.

Under Art. 108(6) the BNB covers credit institutions and the payment service providers it has licensed, with their agents. It also covers the Bulgarian branches and agents of payment institutions and EMIs licensed in other member states. The FSC covers insurers, investment firms, collective investment undertakings and their managers, pension companies and CASPs. Banks that act as investment firms, and CASPs that are credit institutions, stay with the BNB.

The two channels also exchange data. DANS and the FSC concluded Instruction No. I-1 of 8 January 2025, published in State Gazette No. 6 of 21 January 2025, to implement ZMIP Art. 115(4) on the exchange of supervisory information.

Building the AML function after licensing

The ZMIP treats a new licensee's first months as a build phase: the firm assesses its own risk, writes internal rules on that basis and puts a named senior person in charge.

Risk assessment and internal rules

Bulgaria prepares a national assessment of money-laundering and terrorist-financing risk, updated every three years (Art. 95(1)) by a permanent interagency working group (Art. 96(1)). Each obliged entity then prepares its own assessment covering clients, countries and geographic areas, products and services, transactions and delivery channels, proportionate to its type and size (Art. 98(1)–(2)).

The internal rules for control and prevention turn that assessment into procedure (Art. 101). Among other things, they set criteria for recognising suspicious clients and transactions, an internal control system, a PEP-identification system and client risk profiling. They also cover source-of-funds and source-of-wealth procedures and the collection, storage and disclosure of information. A licensed entity adopts them within four months of the licence, by a written act of its management (Art. 102(2)–(3)).

The specialised AML service

ZMIP Art. 106 requires the entities in Art. 4 items 1, 3, 5, 8–11 and 19 to set up a specialised AML service. That list includes banks, financial institutions, investment firms and CASPs. The service is headed by an employee in a senior management position and must exist within four months of the licence. The FID is told the head's name and contact details within seven days of the appointment or of any change.

Art. 107 offers a lighter route to payment service providers under item 2. They may run internal AML control through their managers or through a senior employee designated in writing, whose duties begin only once the FID has been notified.

Agents and providers from other member states

Agents of a payment service provider apply that provider's internal rules (Art. 101(8)). Payment service providers from another member state operating in Bulgaria under the right of establishment apply policies meeting at least the Art. 101(2) standard and notify the FID (Art. 101(9)).

ZMIP Art. 9 also provides for central contact points for EMIs, payment service providers and CASPs from other member states that operate in Bulgaria under the right of establishment in a form other than a branch. The PPZMIP currently sets the conditions for EMIs and payment service providers only. A contact point is required in any of five cases:

• ten or more agents in Bulgaria (Art. 10(1) item 1);
• e-money distributed and redeemed, or payment transactions executed, through agents above €3 million in the previous financial year (item 2);
• the same volume expected to exceed €3 million in a financial year (item 3);
• failure to supply the BNB or the FID on time with the information needed to check these conditions (Art. 10(2));
• a binding instruction of the FID Director where a high risk is established (Art. 11).

No conditions are yet set for CASPs.

Programme design and the role of the money-laundering reporting officer belong to the compliance stack of a licensed firm; handing AML tasks to service providers belongs to outsourcing by licensed firms.

Due diligence and politically exposed persons

What CDD consists of

Under ZMIP Art. 10, customer due diligence (CDD) has five elements. The firm identifies and verifies the client, and identifies and verifies the beneficial owner, including the ownership and control structure. It then assesses the purpose and nature of the relationship, clarifies the source of funds and monitors the relationship and its transactions on an ongoing basis. A firm that cannot complete the first four elements must refuse the transaction or relationship, including opening an account, and must end an existing relationship where CDD cannot be completed (Art. 17).

Identification can be remote. PPZMIP Art. 42 accepts a notified electronic identification scheme under the eIDAS Regulation (EU) No 910/2014 or another means of electronic identification recognised by a legal act.

The source of funds is established by at least two of five methods listed in Art. 66: a client questionnaire, official independent sources, information gathered under other laws, group information and tracing of cash flows. A written client declaration in the form of Annex 4 to the PPZMIP (Art. 47) is used only when those methods are exhausted or contradict each other. The methods are compared across jurisdictions in source of funds, and corporate onboarding in corporate KYC.

When CDD is triggered

Art. 11(1) sets the occasions for CDD. The thresholds are low for transfers and crypto-assets and disappear altogether on suspicion.

Since 1 January 2026 the statute states these amounts directly in euro; before, it used the lev equivalent of the same euro figures, so the thresholds did not change. The information that must travel with a transfer is set out in the travel rule. A CASP must also assess the risk of crypto-asset transfers to or from self-hosted addresses and, according to that risk, verify the originator or beneficiary, request information on the origin and destination of the assets, or monitor such transfers more closely (Art. 20a), applying the EBA guidelines that the FSC has adopted.

Enhanced due diligence and politically exposed persons

Enhanced due diligence (EDD) is required in the eight situations listed in Art. 35. Politically exposed persons (PEPs) are the first of them. Art. 36 covers PEPs in Bulgaria, in another member state, in a third country and in international organisations, and persons related to them. The Bulgarian list of prominent public functions reaches down to mayors and deputy mayors of municipalities and chairs of municipal councils (Art. 36(2) item 9).

For a PEP the firm needs senior-management approval of the relationship (Art. 38). It must take appropriate steps to establish the source of wealth (Art. 39(2)) and apply enhanced ongoing monitoring (Art. 40). After the person leaves office, the risk is taken into account for at least one year (Art. 37(1)).

High-risk third countries

For relationships and transactions with persons from high-risk third countries, Art. 46(1) requires the following measures according to risk:

• additional information on the client, the beneficial owner and the intended nature of the relationship;
• information on the source of wealth and on the reasons for transactions;
• senior-management approval to establish or continue the relationship;
• enhanced ongoing monitoring.

Those countries are the ones the European Commission designates (Art. 46(3)); Art. 46(5) extends the measures to countries the FATF designates as high-risk.

Where a higher risk is established, Art. 46a adds more. Where applicable, the first payment must go through an account in the client's name at a credit institution that applies equivalent CDD. The firm must also apply at least one further measure: additional EDD elements, enhanced reporting, or restricting business relationships, transactions or operations with persons from those countries. It applies these only after notifying its supervisor and the FID and being told that the European Commission has been informed.

Because the Bulgarian definition follows the Commission's list in Delegated Regulation (EU) 2016/1675, the list's changes flow straight into the ZMIP. The two latest changes took effect on the same day:

From 29 January 2026 a Bulgarian obliged entity therefore applies EDD under Arts 35 and 46 to persons established in Russia. Other links to a listed country are weighed by risk and lead to EDD where the risk is higher (Art. 35 item 8), and the FID Director may extend EDD to persons from countries outside the Commission's list (Art. 46(6)).

Beneficial owners and the register

A beneficial owner of a legal person is the natural person who directly or indirectly holds 25% or more of its shares, stakes or voting rights, or otherwise exercises control (ZMIP Additional Provisions, § 2(1)). Nominee directors, secretaries and shareholders are not beneficial owners where another beneficial owner is established (§ 2(2)).

The data are entered in the Commercial Register, the register of non-profit legal entities and the BULSTAT register (Art. 63(1)); for the licensee itself, filing them is part of running a company in Bulgaria.

Several bodies have direct access to them without the data subject being informed (Art. 63(9)): the FID, the BNB, the FSC, other competent authorities, and obliged entities carrying out CDD. Since 16 July 2024, an obliged entity that finds a discrepancy between the beneficial-ownership data it has collected and the data in the register must notify the Registry Agency within 14 days, attaching the relevant documents (Art. 63a(1)). An entity that fails to file its beneficial-ownership data on time faces a property sanction of BGN 5,000, or a fine of the same amount where the person liable is an individual (Art. 118(4)).

Who else may see the register after the Court of Justice's ruling on public access is explained in beneficial ownership registers. The vetting of a licensed firm's own owners is a licensing question, covered in qualifying holdings and fit-and-proper tests.

Reporting to the Financial Intelligence Directorate

Suspicious-transaction and cash reports go to the FID, never to the BNB or the FSC, whatever the firm's licence. The report types differ in trigger and timing:

The table shows that the core report comes before the money moves. Under Art. 72(1) the firm notifies the FID immediately and delays the operation within the time the rules governing its activity allow, stating the maximum period of delay. Where the firm knows, rather than suspects, of laundering or of funds of criminal origin, it also notifies the competent authorities under the Criminal Procedure Code, the Ministry of Interior Act and the DANS Act. Anyone who knows that operations are aimed at financing terrorism must likewise notify the Minister of Interior and the Chair of DANS immediately (ZMFT Art. 9(1)).

The firm reports immediately after execution, giving reasons, only where a delay is objectively impossible or would be likely to frustrate the pursuit of the beneficiaries of the suspicious operation (Art. 72(2)). The Director of the FID may then suspend a specific operation by written order for up to five working days (Art. 73(1)). The cash report under PPZMIP Art. 54(1) is due regardless of suspicion.

The firm, its managers and employees may not tell the client or third parties that information has gone to the FID (Art. 80(1)). The ban does not apply towards the competent supervisor, and Art. 80(3) permits disclosure within the same group. All documents, data and information collected under the ZMIP are kept for five years; for a business relationship the period runs from the date it ends (Art. 67(1)–(2)).

Penalties and what is at stake

ZMIP penalties reach three levels: the firm, the individuals who run it and the licence. Arts 116 and 117 apply to breaches of the core duties listed in Art. 116(1); for obliged entities under Art. 4 items 1–6, 8–11 and 19 the amounts are:

The amounts are still stated in leva. Under § 5(1) of the transitional provisions of the Euro Introduction Act, in force from 1 January 2026, fines stated in leva continue to apply under that Act's conversion rules: the lev amount is divided by the full conversion rate of 1.95583 levs per euro, set by Council Regulation (EU) 2025/1409, and rounded to the cent (Arts 12–13). The basic band for a firm, BGN 5,000–50,000, thus corresponds to about €2,556–25,565.

The licence is the third level. After repeated or serious or systematic breaches, the authority that licensed the firm may restrict, suspend or revoke its licence (Art. 125). It acts on a proposal of the Chair of DANS or the Minister of Interior, or on its own initiative. DANS, the BNB, the FSC and the other supervisors publish final coercive measures and penalty decrees on their websites, naming the offender, the breach and the penalty (Art. 122(1)). Anonymised publication is used where naming would be disproportionate (Art. 122(2)).

Grey list, MONEYVAL and the 2027 switch to the AMLR

Bulgaria's international assessments

As of September 2026, Bulgaria is on the FATF list of jurisdictions under increased monitoring, where it was placed in October 2023. In June 2026 the FATF made the initial determination that it has substantially completed its action plan and warrants an on-site assessment. The FATF does not call for enhanced due diligence on jurisdictions under increased monitoring.

How correspondent banks assess a licensed firm's AML programme against this background is explained in Wolfsberg questionnaires and banking for licensed operators; which Bulgarian banks work with such firms is the subject of banks in Bulgaria.

The Council of Europe's evaluation has already ended. MONEYVAL adopted Bulgaria's fifth-round mutual evaluation report in May 2022, after an on-site visit of 6–17 September 2021. With the follow-up report published on 17 June 2026 it closed the fifth round: all 40 FATF Recommendations are now rated compliant (13) or largely compliant (27) for technical compliance.

The switch to EU rules in 2027

The next change is European. The Anti-Money Laundering Regulation (EU) 2024/1624 applies from 10 July 2027 (from 10 July 2029 for football agents and professional football clubs) and will then apply directly in Bulgaria alongside national law. It does not apply yet.

Member states must transpose the Sixth AML Directive (EU) 2024/1640 by 10 July 2027. Earlier deadlines applied to Art. 74 (10 July 2025) and to Arts 11, 12, 13 and 15 on access to beneficial-ownership registers (10 July 2026), and a later one applies to Art. 18 (10 July 2029). What the package changes at EU level is the subject of the EU AML package.