🇪🇺Bulgaria's Financial Licences: BNB, FSC and the EU Passport

A Bulgarian licence is an EU licence

A financial licence issued in Sofia is a European Union licence. The Bulgarian supervisor assesses an applicant under the same directives and regulations as its counterparts in Vilnius or Luxembourg, and the resulting authorisation is valid across the European Economic Area (EEA) through the passport. Since 1 January 2026 Bulgaria has also been in the euro area: the conversion rate of 1.95583 lev per euro was fixed by Council Regulation (EU) 2025/1409, the Bulgarian National Bank (BNB) joined the Eurosystem, and a local bank or payment company now works in the same currency and on the same settlement systems as its clients in Germany or France.

The market chooses Bulgaria for a combination of three features. Labour is the cheapest in the EU: according to Eurostat, an hour of work cost employers €12.0 in 2025 against a euro-area average of €38.2. Corporate income tax is 10% under Article 20 of the Corporate Income Tax Act. The EEA passport and the euro turn a small national market into an entry point to the single market.

Supervision is split between two authorities. The BNB covers banking and payments: banks (together with the ECB), payment institutions (PIs), electronic money institutions (EMIs) and issuers of e-money tokens (EMTs). The Financial Supervision Commission (FSC) covers the non-bank sector: investment firms, management companies, alternative investment fund managers (AIFMs), insurers and, since July 2025, crypto-asset service providers (CASPs) and issuers of asset-referenced tokens (ARTs). Choosing a licence starts with the product: the product determines the regulator, and the regulator determines capital, timing and the scope of scrutiny.

The defining feature of the Bulgarian market is its size. In September 2026 the registers list 13 BNB-licensed EMIs and four FSC-licensed CASPs, so there are few precedents for any given business model and each application is handled as an individual case.

Two regulators, with the ECB over the banks

The division of powers follows the logic of EU law: money and payments sit with the central bank, capital markets and insurance with a separate commission. The diagram shows who grants which licence.

In the euro area banking licences are granted by the ECB: as the ECB describes it, the national supervisor receives the application and prepares the assessment, while the ECB decides on the licence and on acquisitions of qualifying holdings in banks. For Bulgaria this is not new in 2026: from October 2020 the BNB worked with the ECB under close cooperation, and with euro adoption it became a full participant in the Single Supervisory Mechanism. According to the ECB, on 1 January 2026 it directly supervised four significant institutions in Bulgaria and oversaw 17 less significant ones; this is a count by supervisory group, not the BNB's list of licensed banks.

Payment licences are the BNB's domain under the Payment Services and Payment Systems Act, which transposes PSD2 and the E-Money Directive (EMD2) into Bulgarian law.

In the crypto market the FSC is the competent authority under Article 93 of MiCA. Under Article 3 of Bulgaria's Markets in Crypto-Assets Act, as amended in August 2026, it grants CASP licences and receives every MiCA notification, including those filed by banks and EMIs under Article 60. The BNB keeps specific MiCA powers over banks that act as CASPs or ART issuers, and it supervises e-money-token issuers under Article 182a of the Payment Services and Payment Systems Act. Since 2003 the FSC has supervised the capital market, insurance, and pension and health insurance — the whole non-bank sector.

Map of regimes

The regimes differ in the parameters that drive a project's budget and timeline: who grants the authorisation, how much capital is needed at the outset and how long the regulator may take. Capital in the table is the EU-law minimum at authorisation; the real level is higher and depends on the business plan, own-funds methods and the supervisor's stance.

The order of magnitude matters more than the exact figures: payment, crypto and investment regimes start at tens or hundreds of thousands of euros, a bank at millions. The EMI and PI rows may merge: PSD3 and the Payment Services Regulation, politically agreed in November 2025 but not adopted as of September 2026, would bring e-money into the payment-institution regime (see PSD3 and PSR).

What the registers show

Registers answer a question the statute does not: how much experience the regulator has with a given type of applicant. According to the EBA central register, which the BNB feeds, Bulgaria had 13 EMIs on 24 September 2026 and 5 active PIs on 23 September 2026; four of the EMIs were licensed from December 2024 onwards, the latest in August 2026. For comparison, on 24 September 2026 the same register showed about 70 active EMIs in Lithuania; the two markets are compared in EMI licence: Lithuania or Bulgaria.

The bank list is kept by the BNB, the non-bank lists by the FSC. The conclusion: in payment and crypto licensing Bulgaria is a market of individual decisions, where the regulator has few precedents for any given model.

What the switch to the euro changed

For a licensee the euro changed the infrastructure more than the currency position. According to the ECB, for more than 25 years a currency board kept the lev fixed to the euro, and the 1.95583 conversion rate had been the lev's ERM II central rate. Exchange-rate risk between the lev and the euro was therefore mainly the risk of abandoning the peg; since 2026 it has disappeared along with the lev.

The infrastructure side is set out in an ECB notice of 2 January 2026: the BNB became a euro-area central bank in the three TARGET services, which the Bulgarian market had already been using in euro.

Since 2026 the euro is the domestic currency, and a Bulgarian bank settles in it like any other euro-area bank.

For EMIs and PIs the practical effect runs through the banks. Funds received by an EMI in exchange for electronic money are not deposits under EU law (EMD2, Art. 6) and are protected through safeguarding (EMD2, Art. 7), including in segregated accounts at credit institutions. Since 2026 these accounts, client payments and the licensee's own capital are all denominated in one currency.

Deposit protection in Bulgaria is €100,000 per depositor per bank; it protects bank depositors, and the two mechanisms are compared in the client asset protection map. An EMI's access to bank accounts is a separate operational question for any payment licence, and the euro does not resolve it; the mechanics are covered in banking for a licensed operator.

How to choose a regime

The choice starts with the product; three basic set-ups cover most projects.

Regimes can be combined within one group. A bank or an investment firm may provide crypto-asset services on a notification to the FSC filed at least 40 working days before starting (MiCA, Art. 60), without a separate CASP licence; an EMI may do so only for custody and transfer of the e-money tokens it issues.

The first entry in the FSC crypto-asset register, in December 2025, was the investment firm Alaric Securities on such a notification (FSC decision 783-ДУКА); the first MiCA licence under Article 63 went to Belayer on 28 April 2026 (decision 276-ДУКА). The legal entity for any licence is a Bulgarian company, entered in the Commercial Register before the application goes in.

A Bulgarian licence suits a project that needs the EEA market, staff costs at the bottom of the EU range and a 10% tax rate. It is weaker for a model with no analogue in the Bulgarian register. Comparisons with other EU and non-EU jurisdictions are in the financial licence map and the crypto licence map.

Shortcuts: shelf licences, legacy registrations and agency

Buying a ready-made "empty" licence

Buying a company that already holds a licence looks like a way to save on the procedure. EU law makes such a purchase costly and unreliable for two reasons: an unused authorisation can be withdrawn, and the buyer is assessed in any case. Acquiring a qualifying holding (10% or more), raising it to 20%, 30% or 50%, or making the institution a subsidiary requires the regulator's prior approval.

The assessment of the buyer essentially repeats the assessment of a founder applying for a new licence — see change of control and buying a licensed company.

Old crypto registrations

Before MiCA, crypto businesses in Bulgaria went through a national VASP registration for anti-money-laundering purposes. Bulgaria's Markets in Crypto-Assets Act entered into force on 8 July 2025 and let registered persons continue until 1 July 2026 or until the FSC decided on their licence application, whichever came first; those entered in the register from 30 December 2024 had to apply for a licence by 8 October 2025 (ESMA list). The FSC warned that an entry in the transitional register is not a MiCA licence and that, once the transitional period ended, operating without a licence would be an administrative offence. Since 1 July 2026 such companies must wind down their activity under an exit plan.

Working under someone else's licence

The lawful way in without an authorisation of one's own is to become an agent or distributor of a Bulgarian EMI or PI. The EBA register lists more than 3,000 active agents of Bulgarian licensees (as of 24 September 2026). An agent acts on behalf of the licensee and receives no authorisation of its own, and the principal remains fully liable for its acts (PSD2, Art. 20). The model is explained in payment agents and licence for rent.

EU sanctions perimeter (Regulation 833/2014)

Where an applicant's owners, or its intended clients, sit in a sanctioned jurisdiction, EU sanctions law narrows both who may hold the licensee and whom it may serve — on top of the ordinary authorisation tests. Regulation 833/2014 is the operative instrument: in the consolidated version of 24 July 2026, five groups of provisions bear directly on licensees.

The exemption in Article 5b(3) lifts the prohibitions of Article 5b(1)–(2a) for nationals of EU and EEA countries and Switzerland and for holders of a temporary or permanent residence permit there. For a project this produces three constraints:

• Since 25 August 2026 a Russian national or resident without such status may not own, control or sit on the board of any EU entity that provides crypto-asset services, not only a custodian.
• A Bulgarian EMI cannot issue e-money, and a CASP cannot provide crypto-asset services, to Russian nationals and residents without such status.
• A Russian parent company cannot obtain from European lawyers, accountants and auditors the services closed off by Article 5n(1).

Where a Bulgarian licence does not help

The EEA passport does not open the United Kingdom or Switzerland, which have their own regimes. A licence does not by itself provide a bank account for client money — a bank assesses the EMI's model and owners under its own rules. Eurostat's average hourly labour cost covers the whole economy, and the salary of an experienced compliance officer or MLRO cannot be derived from it. The 10% tax is paid by the Bulgarian company; the tax on distributing profit to the owner and substance for tax purposes are a separate question, covered in company in Bulgaria.