Crypto License in Bulgaria

The application process is a rigorous stress test of the applicant’s internal controls and governance structure, requiring extensive documentation aligned with all relevant ESMA and EBA guidelines.

Corporate and Legal Foundation: Establishing Deep Local Substance

The FSC scrutinizes the concept of local substance to prevent ‘letterbox’ entities:

• Effective Management and Staffing: The CASP must prove that core decision-making authority resides in Bulgaria. This means key control functions (CCO, MLRO, Risk Manager) must have their primary office and employment in Bulgaria, with their roles and reporting lines clearly defined within the corporate structure.

• ICT Governance: The application must include an ICT Governance Framework detailing how the Management Body oversees the firm’s ICT strategy, approves key technology expenditures, and regularly reviews the effectiveness of the DORA policies.

Management and Governance: Rigour of the Fit and Proper Test

The Fit and Proper assessment is holistic, examining both individual character and collective capability:

• Management Body and Non-Executive Directors: The Management Body must include Non-Executive Directors (NEDs) who possess sufficient independence and expertise to challenge executive decisions, particularly regarding risk and compliance.

• Internal Audit Function: MiCA mandates an independent internal audit function that is fully separate from the management and operational functions. This function must report its findings on the adequacy and effectiveness of the firm’s internal controls and risk management processes directly to the Management Body and the FSC upon request. The audit plan must cover DORA, AML, and conduct of business compliance annually.

• Qualifying Holdings and Influence: The FSC performs a detailed assessment of the financial soundness, criminal record, and business reputation of all persons intending to hold a Qualifying Holding (10% or more), ensuring they do not undermine the prudent management of the firm.

• Independence of Key Control Functions: The CCO, MLRO, and Risk Manager must be allocated sufficient resources and authority to perform their duties effectively. Their reporting lines must be explicitly independent of the commercial lines of business, reporting directly to the highest internal authority (e.g., the Board or Audit/Risk Committee).

Comprehensive Compliance Documentation: Policy Suite Breakdown

The policy suite must reflect the firm’s technical, operational, and ethical commitments as an EU financial entity, covering both MiCA and underlying AML/DORA regulations.

AML/KYC and the Technical Travel Rule (TFR) Implementation

The Bulgarian AML regime (via MAMLA and FID) is inextricably linked with the MiCA/TFR requirements:

• TFR Implementation Protocol: The procedures must detail the secure cryptographic solution (e.g., specific Travel Rule protocol integration) used for collecting and transmitting the required originator/beneficiary data, ensuring compliance with both the TFR data standards and GDPR principles.

• AML/CTF Program Integration: The AML Manual must explicitly detail how the risk-based approach is applied, including the mandatory use of Enhanced Due Diligence (EDD) for all non-EEA clients, transactions involving high-risk jurisdictions, and all politically exposed persons (PEPs).

• Automated TM and Analytics: The firm must utilize Automated Transaction Monitoring (TM) systems integrated with On-Chain Analytics tools for continuous, automated monitoring. The compliance team must have a detailed protocol for investigating and resolving all alerts, ensuring a clear, time-stamped audit trail is maintained for all SAR Reporting to the Bulgarian Financial Intelligence Directorate (FID). This process must provide real-time risk scoring for transactions against known illicit activity (sanctioned addresses, darknet activity, mixing services).

DORA Compliance for CASPs: ICT Risk, Security Testing, and Threat Intelligence

DORA compliance is a prerequisite for authorization, requiring financial-grade operational stability and robust ICT controls:

• ICT Risk Management Policy and Cryptographic Controls: This policy must detail the strategy for the protection of key cryptographic material using advanced security solutions (HSMs or MPC). A dedicated section must outline the formal Key Ceremony procedures—the documented, multi-party process for the secure generation, storage, backup, and destruction of master keys, which must be auditable.

• Vulnerability Management and Remediation: A rigorous policy must outline the process for continuous vulnerability scanning, prioritization based on MiCA/DORA risk criteria, and defined, short Remediation Time Objectives (RTOs) for critical vulnerabilities.

• Threat and Vulnerability Management: The CASP must demonstrate procedures for actively sourcing, analyzing, and acting upon external Threat Intelligence (TI), particularly TI related to zero-day vulnerabilities in common blockchain protocols or custodial solutions. This includes subscribing to industry-specific information sharing and analysis centers (ISACs).

• Incident Reporting & Classification: The policy must contain the specific DORA criteria for classifying a major ICT-related incident (e.g., financial impact, regulatory impact, reputational damage). The CASP must be able to submit a preliminary report to the FSC within the strict regulatory deadline (often within hours of detection) and provide a final root cause analysis report within a defined period.

• Exit Strategy and Discontinuation of Services: MiCA and DORA require a documented plan for the orderly discontinuation of CAS activities. This plan must ensure that client assets are returned or securely transferred to another authorized CASP without disruption, minimizing harm to clients and market integrity. The CASP must provide the FSC with sufficient notice before discontinuing any service.

Client Protection and Conduct of Business Rules

MiCA imposes extensive obligations regarding fair dealing, transparency, and client suitability:

• Conflict of Interest Policy: This document must identify, manage, and disclose all conflicts, particularly those arising from proprietary trading vs. client execution, and conflicts related to the selection of execution venues. The policy must detail specific control measures like information barriers and restricted lists.

• Best Execution Policy: The CASP, offering execution services, must implement protocols that ensure the best possible result for the client, detailing the methodology used to rank execution factors (price, cost, speed, likelihood) and the process for periodic review (at least annually) of its execution quality and venues.

• Client Disclosure Requirements: The firm must provide extensive pre-contractual and ongoing disclosures, including:

  • Standardized Risk Warnings: Mandatory inclusion of the MiCA-prescribed risk warning regarding the lack of deposit guarantee and the volatility of crypto-assets.

  • Fee Structure Transparency: A clear, itemized breakdown of all fees, costs, and charges related to each service provided, including any hidden or implicit costs.

• MiCA Reverse Solicitation Policy: The policy must detail the strict protocol for verifying and documenting client-initiated service requests (Reverse Solicitation). Any active marketing or subsequent communication that encourages the client to engage in further services will void the exemption, subjecting the CASP to full MiCA authorization requirements in that host state.