Crypto License in Bulgaria 2026

You must first determine whether your model is a CASP under MiCA, a token issuer, a payment institution, an e-money institution, an investment firm, or a combination. This is the single most important threshold issue.

• CASP-relevant services may include custody, exchange, transfer, execution, order reception/transmission, advice, portfolio management, placing, and operation of a trading platform;
• EMT projects may trigger e-money analysis and involvement of the Bulgarian National Bank (BNB);
• Security-like tokens can fall into MiFID II territory rather than MiCA;
• Fiat payment flows may require analysis under the Payment Services and Payment Systems Act.

A frequent founder mistake is to call everything a “crypto exchange license”. The regulator will not. The application must map each product feature to a legal service category.

You generally need a Bulgarian legal entity, most commonly an OOD or in some cases a joint-stock structure depending on governance and investor preferences. A Bulgarian OOD can often be incorporated with 2 BGN statutory capital, but that figure is only a company law minimum and not a regulatory own-funds benchmark for MiCA activity.

In practice, founders should expect to provide:

• registered office and contact infrastructure in Bulgaria;
• clear management and decision-making structure;
• documented beneficial ownership chain;
• operational substance proportionate to the business model;
• service agreements for outsourced functions, where used.

Letterbox structures are increasingly weak in regulator and banking reviews. Even when remote setup is possible, effective management, recordkeeping, and local corporate maintenance must be demonstrable.

Founders, directors, UBOs, and key control persons must be defensible from a fit-and-proper standpoint. The regulator and counterparties typically assess:

• identity and beneficial ownership transparency;
• criminal record and sanctions exposure;
• source of wealth and source of funds;
• relevant financial services, fintech, cybersecurity, or crypto experience;
• conflicts of interest and governance independence;
• whether management can actually supervise outsourced vendors.

One nuance many applicants miss: experience is not judged only by titles on a CV. Regulators increasingly look for evidence that management understands wallet architecture, outsourcing risk, transaction monitoring, complaints handling, and incident escalation in operational terms.

You must distinguish between corporate capital under Bulgarian company law and regulatory own funds / prudential safeguards under MiCA. They are different concepts and should never be merged in founder planning.

• OOD statutory capital: often as low as 2 BGN;
• MiCA prudential requirements: depend on the service class and actual activity mix;
• Operational runway: regulators and banking partners also care whether you can finance at least the first 12 months of compliant operations;
• Capital composition: founders should expect fiat funding evidence, not vague references to token treasury value.

In real projects, the under-budgeted item is often not the formal threshold but the total compliance stack: legal drafting, security controls, AML tooling, accounting, audit support, local administration, and banking onboarding.

A Bulgarian crypto business must operate a risk-based AML/CFT framework aligned with the Measures Against Money Laundering Act, suspicious reporting expectations, and the EU Travel Rule framework. This goes far beyond collecting a passport image.

• business-wide AML/TF risk assessment;
• CDD and EDD logic by customer type, geography, channel, and product;
• sanctions and PEP screening;
• source-of-funds and source-of-wealth review for higher-risk cases;
• blockchain analytics and wallet risk scoring;
• ongoing transaction monitoring and alert handling;
• suspicious activity escalation to the competent AML authority;
• record retention and audit trails.

For crypto businesses, blockchain forensics is now a practical expectation. If you cannot explain how you detect mixers, darknet exposure, sanctions-linked wallets, or high-risk counterparties, your AML framework is incomplete.

In 2026, crypto authorization is also an ICT governance exercise. Even where DORA applicability must be assessed case by case, regulators and banking partners expect a DORA-style control environment.

• role-based access control and MFA for privileged users;
• encryption in transit and at rest;
• segregation of hot, warm, and cold wallets;
• HSM or MPC-based key management for custody models;
• logging, monitoring, and tamper-evident audit trails;
• incident response playbooks and severity classification;
• business continuity and disaster recovery testing;
• vendor due diligence and outsourcing register.

A useful technical nuance: regulators increasingly ask not only where keys are stored, but who can reconstruct them, under what quorum, and how emergency key rotation works after compromise.

Your application must show that the business is commercially coherent and operationally controllable. A regulator-facing business plan should usually cover:

• exact services and target markets;
• client onboarding channels and restrictions;
• revenue model and fee schedule;
• 3-year financial projections with assumptions;
• custody and safeguarding model;
• complaints handling and client disclosures;
• outsourcing map and vendor dependencies;
• market abuse and conflicts controls where relevant.

Generic plans copied from another jurisdiction are easy to detect. The strongest Bulgarian applications align the narrative across the business plan, AML manual, ICT policy set, corporate documents, and banking pack.

You should prepare banking and payment strategy in parallel with licensing, not after it. Crypto businesses often need a mix of:

• Bulgarian or EU corporate banking for operating expenses;
• EMI accounts for faster onboarding and SEPA access;
• merchant or payment processing arrangements for fiat on-ramp/off-ramp;
• documented transaction flows between wallets, treasury, and payment providers.

Banking counterparties usually request more than the regulator: website flows, source-of-funds logic, target geographies, sanctions controls, proof of licensing status, and sample compliance reports. RUE supports both the licensing track and the parallel banking preparation through our bank account in Bulgaria and crypto business bank account services.