Bulgaria Crypto License 2026

Before MiCA, Bulgaria regulated crypto businesses through a simple registration with the National Revenue Agency (NRA). That regime imposed minimal prudential requirements and offered no EU-wide passporting. Under the BG MiCA Act, all new CASPs must obtain a full licence from the FSC. Existing NRA-registered CASPs benefit from a grandfathering period until 1 July 2026.

Bulgaria adopted the euro on 1 January 2026, so all fees, capital thresholds, and fines are now denominated in EUR. DORA (Regulation EU 2022/2554) has applied directly to CASPs EU-wide since 17 January 2025. Bulgaria enacted complementary amendments transposing DORA Directive (EU 2022/2556) into national financial-sector legislation on 8 July 2025, alongside the BG MiCA Act.

MiCA groups crypto-asset services into three licence classes, each carrying different prudential safeguards (own funds or an equivalent insurance policy) and FSC application fees set by Ordinance No. 76. The table below maps the classes to their requirements:

A CASP holding a lower-class licence can upgrade: extending from Class 1 to Class 2 costs ~€6,136, and from Class 2 to Class 3 ~€18,538. A single entity may hold only one licence at a time, covering all authorised service categories.

Under MiCA, MiCA Article 3(1)(16) defines ten categories of crypto-asset services, each requiring authorisation within the appropriate licence class:

• Custody and administration of crypto-assets
• Operation of a trading platform
• Exchange of crypto-assets for funds (fiat on/off-ramp)
• Exchange of crypto-assets for other crypto-assets
• Execution of orders on behalf of clients
• Placing of crypto-assets
• Receiving and transmitting orders
• Providing advice on crypto-assets
• Providing portfolio management
• Providing transfer services

Every licensed CASP must appoint a dedicated AML/compliance officer and undergo ongoing FSC supervision, with AML enforcement handled by FID/SANS. Once authorised, you can passport services across all 27 EU member states without separate national approvals.

MiCA groups crypto-asset services into three classes of increasing scope. The FSC charges a single upfront fee per class at the time of authorisation:

CASPs that start with a lower class and later expand their activities pay an extension fee rather than re-applying from scratch:

Under MiCA Article 67, every authorised CASP must maintain prudential safeguards (own funds, an insurance policy, or a comparable guarantee) at all times. The minimum amounts, set by MiCA Annex IV, apply uniformly across the EU:

This capital must remain on the CASP’s balance sheet (or covered by insurance) for the entire duration of the licence. Under MiCA Article 67, the actual requirement is the higher of the Annex IV class minimum or one quarter of prior-year fixed overheads.

Beyond the one-time licence fee, the FSC charges annual supervisory fees with a fixed component per activity type. A variable component of 0.03% of total annual income also applies. Ordinance No. 76 lists nine fee lines (consolidating MiCA’s two exchange services into a single line):

If you hold multiple activity authorisations, you pay the fixed fee for each one. The 0.03% variable component applies to your combined total.

The table below combines the FSC licence fee, the minimum prudential safeguard, and a representative annual supervisory fee to show the total first-year financial commitment per class. Company formation costs (EUR 1 minimum share capital, notary/registration fees) and legal advisory fees are additional.

The prudential safeguard dominates every scenario, accounting for roughly 80–91% of first-year regulatory spend. Company formation, legal advisory, office lease, AML infrastructure, and staffing costs sit on top of these figures.

The standard vehicle for a Bulgarian CASP is an OOD (Druzhestvo s Ogranichena Otgovornost), the local equivalent of a limited liability company. An OOD can be formed by one or more founders, whether natural persons or legal entities, with no nationality restrictions under Bulgarian commercial law.

The statutory minimum share capital for an OOD is just €1 since Bulgaria adopted the euro on 1 January 2026. However, this bare minimum has no bearing on your licence application. MiCA Article 67 imposes separate prudential safeguards that every CASP must maintain:

• Class 1 services (receiving/transmitting orders, advisory, portfolio management, order execution, placement, transfer services) — €50,000 in own funds or equivalent insurance policy
• Class 2 services (Class 1 + custody, exchange for funds, exchange for other crypto) — €125,000
• Class 3 services (Class 2 + operating a trading platform) — €150,000

When CASPs choose the own-funds path, the capital must be CET1-quality under MiCA Article 67(3). But CET1 capital is not the only option — MiCA also accepts an insurance policy or comparable guarantee covering the relevant amount. Company formation itself takes 3–7 business days for in-person registration with ready documents, or 2–3 weeks when handled remotely via power of attorney.

MiCA Article 68(1) requires that all members of the management body of a CASP possess sufficient knowledge, skills, and experience to perform their duties, and that they are of good repute. The FSC conducts fit-and-proper assessments during the application review.

Board members must demonstrate they can collectively devote sufficient time to governance, have no disqualifying criminal convictions, and have not been associated with a previously revoked financial licence.

Your CASP must have its registered office in Bulgaria and carry out at least part of its crypto-asset services from that location.

The FSC may conduct on-site visits to verify that staff, systems, and records are accessible at your declared address.

CASPs are obliged entities under EU anti-money laundering law. The FSC and the Financial Intelligence Directorate (FID) under SANS jointly oversee AML compliance for crypto-asset service providers in Bulgaria.

Your application must include a detailed AML/CFT programme covering:

• Customer due diligence (CDD) — identity verification for all clients, with enhanced due diligence for higher-risk relationships. Under the EU Transfer of Funds Regulation (TFR/Reg. 2023/1113), CASPs must collect originator and beneficiary data for every crypto-asset transfer regardless of amount. From July 2027, AMLR Article 19 sets the CASP-specific occasional transaction CDD threshold at €1,000
• Transaction monitoring — automated systems to detect and flag suspicious activity, with reporting obligations to the FID
• Risk assessment — a documented firm-wide risk assessment covering customer types, geographic exposure, product lines, and delivery channels
• Record-keeping — retention of CDD data, transaction records, and internal reports for the legally mandated period

The Digital Operational Resilience Act (DORA, Regulation EU 2022/2554) has applied directly to CASPs EU-wide since 17 January 2025. Bulgaria enacted complementary amendments transposing DORA Directive (EU 2022/2556) into national financial-sector legislation on 8 July 2025, the same date the national MiCA Act entered into force.

DORA imposes five pillars of digital resilience that every CASP must implement:

• ICT risk management framework — documented policies and procedures for identifying, protecting against, detecting, responding to, and recovering from ICT-related incidents
• Incident reporting — classification and notification of major ICT incidents to the FSC within the prescribed timeframes
• Digital operational resilience testing — regular testing of ICT systems, including threat-led penetration testing for significant entities
• Third-party risk management — oversight of ICT service providers (cloud, infrastructure, software), with contractual provisions meeting DORA standards
• Information sharing — arrangements for exchanging cyber-threat intelligence with other financial entities and authorities

The FSC expects CASP applicants to demonstrate DORA readiness as part of the licence application. This includes evidence of an ICT risk management framework, business continuity plans, and incident response procedures already in place or under active implementation.

You pay a flat 10% corporate income tax on worldwide profits, a rate Bulgaria has held steady since 2007. No progressive brackets, no surcharges. If your group’s consolidated revenue exceeds €750 million, the Pillar Two Qualified Domestic Minimum Top-Up Tax (QDMTT) brings the effective rate to 15%, in line with the OECD global minimum. For the vast majority of crypto startups, the 10% rate applies without qualification.

When you distribute profits to a parent company in the EU or EEA, you owe 0% withholding tax on dividends under the EU Parent-Subsidiary Directive. For shareholders outside the EU/EEA, the baseline withholding rate is 5%. A proposed increase to 10% appeared in the November 2025 budget draft but was dropped from the revised budget in December 2025 after coalition negotiations. Double-tax treaties may reduce the 5% rate further depending on the shareholder’s jurisdiction.

Bulgaria applies a standard 20% VAT to most goods and services. However, pure crypto-to-fiat exchange services are VAT-exempt under the European Court of Justice’s Hedqvist ruling (Case C-264/14), which treats cryptocurrency exchange as a supply of services exempt from VAT in the same way as transactions in currency, banknotes, and coins. This exemption covers the core exchange activity only. Ancillary services such as consulting, technical integrations, or platform subscriptions may still attract the full 20% VAT. Structure your service agreements carefully to separate exempt exchange activity from taxable ancillary offerings.

If you hire staff in Bulgaria, expect total social and health contributions of approximately 32.7%–33.4% of gross salary, split between employer and employee. This breaks down into two components:

• Social security — 24.7%–25.4% of gross salary (the exact rate depends on the occupational risk category). The employer covers roughly 60% of this amount, the employee the remaining 40%.
• Health insurance — 8% of gross salary (employer 4.8%, employee 3.2%).

Despite these contributions, Bulgaria’s overall labour costs remain among the lowest in the EU. Bulgaria adopted the euro on 1 January 2026, so all salaries, contributions, and reporting are now denominated in EUR at the fixed conversion rate of 1 EUR = 1.95583 BGN.

CASPs registered with Bulgaria’s NRA as of 30 December 2024 can continue offering crypto-asset services while their MiCA licence application is under FSC review, provided they submit before the transitional period expires. This allows them to meet MiCA’s full requirements (prudential safeguards starting at €50,000, governance standards, dedicated AML/compliance officer) without interrupting their business.

CASPs that registered with the NRA after 30 December 2024 faced a shorter window. Under Bulgaria’s MiCA Act (entered into force 8 July 2025), these late registrants had until 8 October 2025 (three months from the Act’s entry into force) to submit their licence applications to the FSC. Any late registrant that missed that deadline lost its right to operate under the transitional regime.

The grandfathering period ends on 1 July 2026 with no extensions or grace periods. After that date, every CASP operating in Bulgaria must hold a full MiCA licence issued by the FSC. Providers that fail to obtain authorisation must cease all crypto-asset services immediately.

Given the FSC’s review timeline (detailed in the info box above), firms that have not yet filed face a real risk of missing the cutoff. As of 6 May 2026, only 56 days remain. If your firm is still operating under the transitional regime, submit your application to the FSC now.

Bulgaria’s 10% flat corporate income tax, in effect since 2007, is the second-lowest flat rate among all 27 EU member states (only Hungary’s 9% is lower). For a CASP generating €1 million in taxable profit, that means €100,000 in corporate tax versus €250,000 in France (25%) or roughly €300,000 in Germany (~30% effective). Dividends to qualifying EU/EEA parent companies (holding ≥10% for at least 12 months per the Parent-Subsidiary Directive) are taxed at 0%, and crypto-to-fiat exchanges are VAT-exempt. See the full tax breakdown below.

A CASP licence issued by Bulgaria’s Financial Supervision Commission (FSC) grants passporting rights across all 27 EU member states plus the EEA. You apply once in Sofia and serve clients from Lisbon to Helsinki without additional national authorisations. Bulgaria’s MiCA Act entered into force on 8 July 2025, and the FSC is already accepting licence applications under Ordinance No. 76. Licensing fees start at approximately €5,113 for a Class 1 CASP licence, materially below comparable application fees in France (AMF) and Germany (BaFin), which according to industry sources fall in the €10,000–€20,000 range depending on services and supervisory complexity.

Bulgaria’s entry into the eurozone on 1 January 2026 removed the last currency barrier for crypto firms operating in EUR-denominated markets. Several Bulgarian banks accept CASP applicants, though not all — expect 4–8 weeks for KYC and account onboarding. The Financial Intelligence Directorate (FID) under SANS handles AML supervision, providing a clear regulatory chain alongside the FSC.

Operational expenses in Bulgaria run 40–60% below Western EU benchmarks. Company formation takes 3–7 business days for in-person registration, and the preferred entity type, an OOD (Bulgarian LLC), requires a minimum share capital of just €1. Total combined social contributions (employer + employee) run approximately 32.7%–33.4% (including health insurance), with the employer's share at roughly 18.9%–19.6%, higher than some competitors on paper but offset by base salaries that are 2.5–5 times lower than in Luxembourg, Ireland, or the Netherlands (with the highest multiplier applying to Luxembourg). See the full cost breakdown for licensing fees, prudential safeguards, and annual supervisory charges by CASP class.