D1 Sanctions
Sanctions is not yet covered for this jurisdiction in this report.
Bulgaria operates the Law on Measures Against Money Laundering (LMML) and Law on Measures Against Financing of Terrorism (LMFT), supervised principally by FID-SANS (State Agency for National Security) and the Bulgarian National Bank.
Law made at European Economic Area level that applies in Bulgaria is covered once, on the European Economic Area page. This page covers Bulgaria’s own layer: implementation, national authorities, national options and local enforcement.
Sanctions is not yet covered for this jurisdiction in this report.
Globally, the EU AML Package sets the structural direction for beneficial-ownership and corporate-transparency supervision: three distinct instruments now govern the field across the European Economic Area — the AML Regulation (AMLR, Regulation (EU) 2024/1624), which applies directly and uniformly across Member States; the sixth AML Directive (6AMLD), which each Member State transposes into national law on its own timeline; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and begins shifting supervision of certain obliged entities from purely national authorities toward a hybrid EU-level regime combining direct AMLA supervision of the highest-risk cross-border entities with continued indirect national supervision of the rest. This is the durable architectural backdrop against which Bulgaria's own developments this cycle should be read.
In Bulgaria specifically, the directly relevant beneficial-ownership and corporate-transparency development this cycle is not a 6AMLD transposition milestone but a crypto-adjacent registration consolidation: the Bulgarian MiCA Act is understood to repeal the National Revenue Agency's Article 9a Anti-Money Laundering Act register of virtual-asset service providers, folding the AML-registration history of VASPs into the Financial Supervision Commission's MiCA CASP register. This is a single Tier-3-sourced, Probable-confidence finding, not yet corroborated against the MiCA Act's own statutory text, but it is properly read as an architecture-level change — the retirement of a national, AML-specific VASP register in favour of a supranationally-harmonised licensing register that itself carries AML-registration consequences — rather than as an isolated administrative footnote. Bulgaria's specific 6AMLD transposition status (whether not yet transposed, partially transposed, or fully transposed) has not been established this cycle, which limits how confidently the AMLR/6AMLD architecture described above can be tied to Bulgaria's domestic beneficial-ownership register practice specifically, as distinct from the crypto-registration consolidation, which is independently evidenced.
The practical consequence of the NRA register's repeal is that a compliance function checking a Bulgarian virtual-asset counterparty's AML-registration history can no longer rely on the legacy NRA Article 9a register as a current source; that history is now understood to sit within the FSC's MiCA CASP register instead. Because Bulgaria sits within the EEA legal bloc and is bound directly by the AMLR as an EU-27 member, the medium-term direction is toward greater harmonisation of this exact kind of registration architecture across Member States, even where the specific national implementing detail (such as which national register a given class of AML registration migrates into) is still resolving on a per-Member-State basis.
The register-consolidation finding rests on a single Tier-3 source and has not been corroborated against the MiCA Act's own text; a future cycle that locates a primary-source confirmation, or a contradiction, of the NRA register's repeal would materially change the confidence with which this development can be reported. Separately, Bulgaria's 6AMLD transposition status remains an open gap and would clarify how far the broader EU AML Package architecture has moved from directly-applicable-regulation (AMLR) to domestically-legislated-directive (6AMLD) within Bulgaria specifically.
Enabler Jurisdictions is not yet covered for this jurisdiction in this report.
Conflict Finance is not yet covered for this jurisdiction in this report.
In Bulgaria, the directly relevant digital-asset development this cycle is the expiry, on 1 July 2026, of MiCA CASP authorisation grandfathering for legacy National Revenue Agency-registered virtual-asset providers. Before that date, providers that had held NRA registration under Bulgaria's prior virtual-asset regime could continue operating on a transitional basis while migrating to authorisation from the Financial Supervision Commission (for asset-referenced tokens and crypto-asset service providers generally) or the Bulgarian National Bank (for electronic money tokens). After 1 July 2026, that transitional bridge closed, and continued operation without completed MiCA CASP authorisation now falls outside the lawful perimeter and constitutes a MiCA compliance breach.
Globally, the MiCA framework and FATF's virtual-asset standards set the structural direction for how crypto-asset activity is brought within AML/CFT-relevant supervision; in Bulgaria, the transitional grandfathering cliff-edge is the concrete mechanism through which that structural direction is being enforced against the specific population of legacy-registered providers. The grandfathering cliff-edge creates a residual population of potentially unauthorised legacy VASPs pending confirmation against the FSC register — a finding assessed at Probable confidence, given that it rests on legal-commentary sourcing (CMS, Eternity Law) rather than a primary FSC publication confirming which specific legacy providers did or did not complete the transition in time.
This residual-population question is the single most consequential open item in Bulgaria's crypto/digital-asset financial-integrity exposure this cycle. A compliance function assessing exposure to Bulgarian virtual-asset counterparties should treat legacy NRA registration, standing alone, as no longer sufficient evidence of current lawful operating status; only confirmed FSC CASP authorisation (or BNB authorisation for EMT issuers) now supports that assurance. Whether any specific legacy provider in fact failed to transition, and what enforcement or de-registration consequence followed if so, has not been confirmed against the FSC's own register this cycle.
The outlook for this domain turns entirely on primary-source confirmation from the Financial Supervision Commission's own register: a future cycle that surfaces the FSC's transitional-completion statistics, or any enforcement or removal action taken against a legacy provider that failed to transition, would resolve the current residual-population uncertainty. Absent that confirmation, the domain should continue to be tracked as a structural cliff-edge with an unconfirmed real-world application, rather than as a settled compliance picture.
Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.
Bulgaria's AML/CTF regime record strengthened materially this cycle with MONEYVAL's closure of the country's 5th-round mutual evaluation on 17 June 2026. All 40 FATF Recommendations are now rated compliant or largely compliant, following a re-rating exercise that specifically addressed confiscation, the terrorist-financing offence, proliferation-related targeted financial sanctions, non-profit-organisation oversight, correspondent banking, sanctions implementation, and mutual legal assistance. This closure ends an enhanced follow-up process that had run since the May 2022 mutual evaluation report identified technical-compliance deficiencies across several of these same areas.
The closure is assessed at Confirmed confidence, resting on Tier-1 sourcing directly from the Council of Europe / MONEYVAL and corroborated by FATF's own published follow-up materials. This is architecture-level good news: it reflects a multi-year remediation process across a broad range of FATF Recommendations reaching completion, rather than a single enforcement action or episodic event. Bulgaria is not on the FATF grey list, and the MONEYVAL closure removes what had been a standing item of supervisory and peer-review attention across multiple prior reporting cycles.
Set against this improving headline, two structural gaps remain in the evidence base. First, Bulgaria's specific 6AMLD transposition status — whether the directive has been fully transposed, partially transposed, or not yet transposed into national law — has not been established this cycle, notwithstanding that Bulgaria is bound directly by the AMLR as an EU-27 member state. Second, no BG-specific sanctions-evasion, enabler-jurisdiction, conflict-finance, or compliance-technology signal was located this cycle, reflecting that this dispatch was scoped exclusively to Bulgaria and did not run a standing multi-jurisdiction sweep across those adjacent domains; this is a scoping limitation on this cycle's coverage, not a finding that those risks are absent.
The crypto-adjacent AML registration consolidation — repeal of the NRA's Article 9a AML register in favour of the FSC's MiCA CASP register — sits alongside this cycle's core AML/CTF regime finding as a second, narrower architecture shift specific to the virtual-asset sector, distinct from the broader MONEYVAL-evaluated regime.
With the MONEYVAL 5th-round evaluation closed and all 40 Recommendations rated compliant or largely compliant, the near-term outlook on Bulgaria's core AML/CTF regime is stable-to-positive absent a new FATF or MONEYVAL finding. The 6AMLD transposition-status gap is the most likely source of a future material development, as is any confirmation of how the crypto-sector AML-registration consolidation interacts with the broader regime evaluated by MONEYVAL.
Commercial Activity is not yet covered for this jurisdiction in this report.
The closure removes a standing enhanced-follow-up obligation that had persisted since 2022; ongoing STR and reporting practices should remain aligned with the evaluated standards, and the crypto-sector AML-registration consolidation (NRA register repeal into the FSC MiCA CASP register) is a separate item warranting counterparty-due-diligence attention for any Bulgarian VASP relationship.
Compliance functions verifying a Bulgarian VASP counterparty's AML-registration status should no longer rely on the legacy NRA register and should instead check the FSC's MiCA CASP register directly; this finding is Probable-confidence and single-source, so independent confirmation is advisable before relying on it operationally.
Legal counsel advising on Bulgarian virtual-asset counterparty risk should treat legacy NRA registration as no longer sufficient evidence of current lawful status; whether any specific provider failed to transition and what followed has not been confirmed against the FSC's own register.
This is a positive structural development for the institution's Bulgaria-related regulatory risk profile, reflecting a multi-year remediation process reaching completion rather than a single event; it should be read alongside the narrower crypto-sector registration consolidation, which is a separate and still-developing item.
Any technical integration that had referenced the legacy NRA VASP register as a data source for counterparty AML status should be reviewed, since that register's function is understood to have been folded into the FSC's MiCA CASP register following the transitional expiry of 1 July 2026.
Risk functions should flag Bulgarian virtual-asset counterparties for enhanced verification pending confirmation of current FSC CASP authorisation status, given the unresolved gap in whether all legacy NRA-registered providers completed the MiCA transition.
No material change for this persona this cycle
Internal audit scoping exercises referencing Bulgaria's AML/CTF regime can now cite the closed 5th-round evaluation and its compliant/largely-compliant ratings across all 40 Recommendations as the current external benchmark, superseding the 2022 mutual evaluation report's deficiency findings.
MONEYVAL closed Bulgaria's 5th-round mutual evaluation with all 40 FATF Recommendations compliant or largely compliant.
The NRA's Article 9a AML register of VASPs is understood to have been repealed and consolidated into the FSC's MiCA CASP register.
MiCA CASP transitional grandfathering for legacy Bulgarian VASPs expired 1 July 2026, creating an unconfirmed residual-authorisation-status population.
Bulgaria's AML/CTF standing improved materially this cycle with the MONEYVAL 5th-round closure.
Bulgaria's VASP AML-registration architecture has been consolidated from a National Revenue Agency register into the FSC's MiCA CASP register.
A residual population of legacy Bulgarian VASPs with unconfirmed post-1-July-2026 authorisation status represents an open counterparty-risk exposure.
No material change this cycle.
The MONEYVAL 5th-round evaluation closure provides a fresh, favourable external audit benchmark for Bulgaria's AML/CTF control framework.
Illustrative scenario for analytical orientation only. As the AMLA Regulation (Reg (EU) 2024/1620) moves cross-border obliged entities from purely national AML supervision toward a hybrid EU-level regime combining AMLA direct supervision of the highest-risk entities with continued indirect national supervision of the rest, a Member State such as Bulgaria could see a subset of its largest cross-border obliged entities re-designated for AMLA direct supervision, while the crypto-sector AML-registration architecture (recently consolidated into the FSC's MiCA CASP register) could similarly become a candidate for future AMLA-level oversight if VASP AML risk is judged to warrant supranational rather than purely national supervision. This is an illustration of a structural possibility under the AMLA transition, not an observed development or a prediction of Bulgaria's specific designation outcome.
Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.
| Tracker | Status | Note |
|---|---|---|
| T1 · Russian Sanctions-Evasion Architecture | no_change | |
| T2 · EU AML Package / AMLA | watch | No BG-specific AMLR/6AMLD transposition delta located this cycle beyond the MiCA-driven repeal of the NRA Art. 9a AML register. |
| T3 · FATF Grey List | improving | BG is not on the FATF grey list; MONEYVAL closed BG's 5th round follow-up in June 2026 with all 40 Recommendations compliant/largely-compliant. |
| T4 · Beneficial-Ownership Register Status | no_change | |
| T5 · Crypto / VASP Regulatory Framework | material_change | MiCA CASP authorisation grandfathering for legacy NRA-registered VASPs expired 1 July 2026. |
| T6 · Sanctions Regime Divergence | no_change |