Crypto guide

Bulgaria Crypto Licence Requirements in 2026

Full Bulgaria crypto (CASP) licence requirements for 2026 — a Bulgarian company with substance, capital by class, FSC fit-and-proper vetting, an MLRO.

Contents

A Bulgaria crypto (CASP) licence requires a Bulgarian company with genuine local substance and the class-based MiCA capital of €50,000, €125,000 or €150,000 by service class. Bulgaria is the EU’s value option for a full crypto licence, with FSC licence fees of €5,113 to €30,678 by class and a flat 10% corporate tax, but the requirements file behind a CASP authorisation is the same full MiCA file every member state demands. The low state fee does not lower the standard the file is held to. The Financial Supervision Commission (FSC) still asks for a real Bulgarian business: a company with substance, funded capital, vetted people and a working AML and ICT-resilience programme.

We work from this same checklist when we build a file. It covers exactly what the 2026 Bulgaria CASP regime demands, from a Bulgarian company with genuine presence and initial capital by service class to fit-and-proper management, an MLRO and a DORA-compliant ICT framework, so you can price the licence on what it actually takes rather than on the headline fee. This is a full EU financial-services regime, and we scope it as one.

Key takeaways
  • The applicant is a Bulgarian company with genuine local substance — a registered office, real operating presence and management anchored in Bulgaria.
  • Initial capital is set by service class: €50,000 (Class 1), €125,000 (Class 2, adds custody/exchange), or €150,000 (Class 3, trading platform), or a quarter of last year’s fixed overheads if higher.
  • The FSC runs fit-and-proper vetting on management, plus suitability and source-of-funds checks on shareholders and UBOs; a dedicated MLRO and governance structure are mandatory.
  • The document pack includes a programme of operations, AML/CFT policies to the EU directives plus the Travel Rule, and a DORA-compliant ICT framework. Once granted, the licence passports across all 27 EU states.

The company and local substance Bulgaria requires

Everything starts with a Bulgarian company. The FSC licenses a Bulgarian legal entity with genuine substance behind it; there is no remote-only route. The applicant is incorporated in Bulgaria, keeps a registered office there, and runs a real operating presence rather than a virtual mailbox. This is the first hard requirement operators pricing Bulgaria on the €5,113 Class 1 fee tend to skip past, and a file without it will be rejected.

Substance is assessed in the round. The regulator wants to see that the business is directed and administered from Bulgaria, with the right people performing the core functions locally. A company that exists only on paper, with management and operations sitting elsewhere, does not clear the substance test. Bulgaria’s low cost base makes that substance cheaper to maintain, but the FSC still expects it. For the full picture of what a CASP authorisation buys and how it sits within MiCA, our flagship Bulgaria crypto licence overview maps the regime end to end.

Capital by service class in Bulgaria

This is the requirement that catches operators reading Bulgaria as “the cheap one.” MiCA sets a minimum capital floor by the service class you run, and Bulgaria applies it directly; the low state fee does not reduce it. The application has to prove the safeguards are in place, and from then on you keep them at the higher of the class minimum or a quarter of the previous year’s fixed overheads (projected overheads until you have a year of accounts). They can be own funds, an insurance policy or a mix, and none of it goes to the regulator as a fee.

Class Services covered Minimum capital
Class 1 Reception/transmission, advice, execution, placing €50,000
Class 2 Class 1 plus custody and exchange €125,000
Class 3 Operating a trading platform €150,000

These figures are identical in every EU member state because they come from MiCA rather than Bulgarian law, so the capital tier is not something you optimise by choosing Bulgaria over another jurisdiction. What Bulgaria offers is a published FSC fee schedule and a flat 10% corporate tax sitting behind the same capital requirement. Costs sit outside scope here; for the full year-one build, the state fee and running costs, see the Bulgaria crypto licence cost guide, and for the capital rules across all three classes our CASP capital requirements primer breaks each one down.

People, governance and fit-and-proper vetting in Bulgaria

Under MiCA, the people behind the company are assessed as rigorously as the business itself, and the FSC runs the vetting. An unresolved file on any one person holds up the whole application.

Fit-and-proper management. The people running the CASP are assessed for competence, integrity and relevant experience. The FSC expects a board and senior management with genuine financial-services or crypto backgrounds, rather than a founder team with no regulated-industry track record. Directors must demonstrate they can actually run a licensed EU financial-services business, and that expectation does not soften because Bulgaria is the cheaper base.

A dedicated MLRO and governance structure. A money-laundering reporting officer is a condition of the licence, backed by a clear governance structure with defined responsibilities and board-level compliance oversight. The MLRO is accountable for the AML programme, transaction monitoring and reporting, so the role has to be filled by a real person who does the work.

Suitability and source-of-funds on shareholders and UBOs. Every ultimate beneficial owner and significant shareholder faces suitability checks and a source-of-funds assessment. The FSC asks where the company’s money came from and how its beneficial owners built their wealth, applying roughly the scrutiny of a tier-1 bank. Gaps in that evidence are among the most common reasons a file stalls.

Because these checks take the longest to assemble, especially source-of-funds evidence and documents from multiple jurisdictions, start them on day one rather than treating them as a closing step.

DORA and a real MLRO are where low-cost applicants get caught.

Since 17 January 2025 every CASP must run a DORA-compliant ICT risk-management and incident-reporting framework, and the MLRO must be a genuinely operable function rather than a document on file. These are the two requirements that a bargain-hunting file underestimates, and the two the FSC scrutinises hardest. Our team builds both end to end; see the Bulgaria crypto licence service for how we run it.

The documents and programme Bulgaria asks for

Alongside people and capital, the FSC reviews a defined set of documents and policies. Filing with any of these missing, or written for a different business model, is what stops the statutory 40-working-day clock and turns a two-month approval into a longer one. The core pack is:

Document What it proves Notes
Business plan & financial projections A viable, credible operation Must match your service classes and capital
Programme of operations How each service is actually run Per CASP class applied for
AML/CFT policies A working compliance programme EU directives plus the Travel Rule
DORA ICT framework Operational and cyber resilience Risk management plus incident reporting
Custody, safeguarding & complaints Client-asset protection and conduct Asset segregation for custody classes
MiCA white paper Compliant token disclosure Where you also issue or admit tokens

Three elements deserve emphasis. The AML/CFT policies must be operable documents aligned to the EU’s anti-money-laundering directives and the Travel Rule (the EU Transfer of Funds Regulation obligation to attach originator and beneficiary data to crypto transfers), because the MLRO is expected to actually run them. The DORA ICT framework covers ICT risk management, incident reporting, resilience testing and third-party ICT oversight, and it applies to every CASP. And where you issue or admit tokens to trading, a MiCA white paper meeting the regulation’s disclosure standard is required on top of the service authorisation. Custody, safeguarding and complaints-handling policies round out the pack, with strict client-asset segregation for any class that touches custody.

Transition, passporting and the statutory clock

Two dates frame the requirements. First, the VASP-to-CASP transition: Bulgaria adopted the full grandfathering window to 1 July 2026 and issued its first MiCA licence in April 2026, so the regime is operational and the legacy window has now closed. New entrants apply directly to the FSC for a CASP authorisation; there is no VASP registration shortcut left. Bulgaria’s low tax base is a natural home for teams weighing where profits land; our Bulgaria crypto tax guide covers the flat 10% corporate rate and how crypto activity is treated alongside it.

Second, the reward for meeting the full requirements: passporting. Once the FSC grants the CASP licence, it lets you offer crypto services across all 27 EU member states on a notification basis under MiCA Article 65. One licence gives you the whole single market without applying jurisdiction by jurisdiction. That EU-wide reach is exactly what the substance, capital and DORA requirements are the price of. And unlike heavier EU regulators, the FSC runs a defined 40-working-day statutory assessment of a complete file, which keeps a well-prepared timeline predictable.

Assembling the Bulgaria file in the right order

Start by fixing your CASP service classes and the matching capital tier, then incorporate the Bulgarian company, put the own funds or insurance cover in place and stand up the local office and roles. Assemble every UBO and management fit-and-proper file (source of funds, suitability, experience evidence) in parallel, because they take the longest. Draft the programme of operations, AML/CFT and DORA policies against your actual operating model rather than off a template. Only then does the FSC application go in, because the statutory clock only rewards a complete file.

The low cost does not make this a light-touch registration. The Bulgarian CASP regime asks for a real company, real capital, vetted people and operable AML and ICT programmes, and in exchange gives you a full EU financial-services credential that passports across 27 markets and carries weight with banks, PSPs and institutional partners, all on one of the lowest tax rates in the union. A complete, internally consistent file keeps the 40-working-day window running in your favour, while any gap stops the clock.

Ready to assemble your CASP requirements pack, or want a second opinion on a file you have already started? Our team handles the full Bulgarian substance, fit-and-proper, AML and DORA build end to end and will review any application against the FSC’s expectations before you submit. Book a free consultation and we will tell you exactly what is missing.

Frequently asked questions

Do I need a Bulgarian company for a CASP licence?

Yes. The applicant must be a Bulgarian company with genuine local substance — a registered office, real operating presence and management anchored in Bulgaria. This is a full EU financial-services authorisation under MiCA rather than an offshore registration you can hold from anywhere. The Financial Supervision Commission (FSC) will not license a nameplate entity with no local operations behind it, regardless of how low the state fees are.

How much capital do the Bulgaria crypto licence requirements set?

Initial capital is fixed by service class under MiCA: €50,000 (Class 1, covering reception/transmission, advice, execution and placing), €125,000 (Class 2, adding custody and exchange), or €150,000 (Class 3, operating a trading platform). These figures come from MiCA and are identical in every EU state. What you actually hold is the higher of that figure or a quarter of the previous year's fixed overheads, as own funds, an insurance policy or a combination, and none of it is a fee.

Who does the FSC assess as fit-and-proper?

Management, board members and key function holders are assessed for competence, integrity and relevant financial-services or crypto experience, and shareholders and ultimate beneficial owners face suitability and source-of-funds checks. Every person behind the company clears the same bar. An unexplained ownership chain or an undocumented source of wealth will stall the whole file, however clean the rest of it is.

Is an MLRO and a DORA framework mandatory?

Yes to both. A dedicated money-laundering reporting officer (MLRO) and a clear governance structure are conditions of the licence, and since 17 January 2025 a DORA-compliant ICT risk-management and incident-reporting framework is required of every CASP. These are operable programmes the business must actually run, rather than template documents assembled for the application and then shelved.

Is Bulgaria's regime actually operational?

Yes. Bulgaria adopted the full grandfathering window to 1 July 2026 and issued its first MiCA licence in April 2026, so the FSC is already granting authorisations. The transitional window for legacy VASPs has now closed, so new entrants apply directly to the FSC for CASP authorisation with no registration shortcut left.

How long does the Bulgarian crypto licence take?

The FSC has a statutory 40 working days to assess a complete application, with the clock pausing if it identifies deficiencies and a reasoned decision issued shortly after. With incorporation, capital and the document build in front of it, plan realistically for roughly two to four months from start to authorisation.

Sources

Christina S.
Crypto Licensing at Vantegris

Christina S. is part of the Vantegris team, which prepares and files licence applications across 40+ jurisdictions. This article was reviewed by Vladyslav S. (Compliance & Legal).

Related service Bulgaria crypto licence →

This article is for general informational purposes only and is not legal, tax or financial advice. Consult a qualified professional before acting.

Share
TG share on Telegram X In share on LinkedIn WA share on WhatsApp Reddit Mail share by email
Talk to a specialist.

We'll map the fastest route to a licensed, banked, live operation.

Book a free consultation →

Stay ahead of the rules.

Licence fees, rules and deadlines change through the year. Subscribe and we'll email you Vantegris licensing updates.

We use your email to send these updates and note where you signed up. Unsubscribe any time from any email. Privacy policy.

Licence, done right.

300+ operators licensed across 40+ jurisdictions. Book a free consultation.

Book a free consultation