Digital asset regulation and tokenization in Bulgaria

In Bulgaria, a business designing digital asset services must combine European MiCA rules with national supervision. The Financial Supervision Commission, FSC, and Bulgarian National Bank have responsibilities depending on the activity and entity. Historical anti-money laundering registration and present authorisation are legally different stages.

The practical question goes beyond incorporation: who runs the business, which resources are available in Bulgaria and how client assets are protected must be demonstrated. A project issuing a tokenized security also needs assessment under financial instrument rules and of the rights represented.

Which rules distinguish crypto-assets and securities

MiCA governs crypto-assets within its scope, with separate regimes for services, asset-referenced tokens and electronic money tokens. Bulgaria's Markets in Crypto-Assets Act establishes domestic supervision. Technology does not determine classification: tokenized financial instruments remain outside MiCA's material scope and require assessment under securities legislation.

The FSC confirmed transition ended on 1 July 2026. Historical anti-money laundering registration does not permit continued services without required entitlement. Unauthorised operators must arrange orderly cessation and return or transfer of assets. This process does not authorise acquisition of new business or indefinite continuation of ordinary services.

What the FSC and central bank supervise

The domestic statute assigns responsibilities to the Financial Supervision Commission, FSC, with exceptions and coordination involving the Bulgarian National Bank, BNB. The BNB has responsibilities concerning electronic money and certain financial institutions. Competence depends on product and provider rather than a single supervisor for every crypto-asset activity.

FSC guidance distinguishes ordinary CASPs from financial institutions eligible for MiCA Article 60. Notification depends on equivalent services and specified conditions. Banking, investment or electronic money authorisation does not indiscriminately permit custody, exchange, advice and trading platform operation. The institution must establish the route applicable to each service.

How to demonstrate readiness for authorisation

The supervisory FAQ requires effective presence and operational capacity, including executive management and part of activities and staff in Bulgaria. Outsourcing receives specific scrutiny. A formal address and statements of intention are insufficient. Staffing adequacy depends on functions and risks; indicative staffing guidance is not a universal minimum guaranteeing approval.

The January 2026 first-licence announcement confirms an operational access route. It describes assessment of governance, risks, controls and technology resilience. It does not establish approval of every applicant or guaranteed processing times. Cross-border services require verification of the authorised entity, permitted activities and corresponding MiCA notification.

Which rights tokenized issuance must document

ESMA distinguishes digital representation and tokenized issuance when interpreting the DLT pilot. Issuance design should identify economic or corporate rights, holder entitlement and transfer rules. Control of a private key does not independently establish ownership of real estate, a corporate interest or a claim against another party.

The DLT Regulation requires specific permissions for trading and settlement infrastructure handling eligible instruments. CASP authorisation does not replace these permissions. Securities requirements, infrastructure conditions and actual exemptions must be checked. The EU framework does not establish authorisation of a particular Bulgarian platform or remove issuance formalities.

Which controls must operate after authorisation

MiCA safeguards include organisation, asset protection, conflict management and continuing prudential requirements. Applications and daily operations should describe the same business. Outsourcing technology or controls does not automatically transfer the authorised provider's responsibility, particularly where essential decisions or resources depend on another group entity.

DORA adds technology risk management, continuity and third-party oversight for entities within its scope. The Transfer of Funds Regulation requires originator and beneficiary information for affected transfers. These requirements must integrate with due diligence and custody: a technically functioning platform can still lack adequate compliance processes.

How to prepare Bulgarian operations

Preparation should begin with an inventory of services, assets and entities, followed by an operating plan assigning functions and responsibilities. FSC FAQs help assess local presence, management and outsourcing. Each policy should be backed by the people, systems, contracts and procedures needed to implement it, rather than statements of intention alone.

Tokenized issuance requires documented holder rights and a reasoned classification under MiCA or securities rules. The English translation of Bulgarian law flags amendments awaiting incorporation; points dependent on that text should be checked against the current Bulgarian publication. Before selecting custodians or infrastructure, verify their specific permissions instead of inferring them from other firms’ authorisations.

To understand how this framework applies to your project, discuss your case with our team.