Anti-money laundering

Who is an obliged entity under the AML Act

The Measures against Money Laundering Act (the AML Act) lists the obliged entities in Article 4: they include banks and payment institutions, life insurers, investment firms, leasing companies, accountants, auditors, notaries, real estate agents, crypto-asset service providers, gambling operators and lawyers when they assist in certain transactions.

Listing such an activity in the objects of the business in the register creates a presumption that it is carried on by way of business until the entity proves otherwise (§ 5 of the Supplementary Provisions of the AML Act).

Risk assessment and internal rules

An obliged entity prepares its own risk assessment, which is documented and updated at least every three years, every year by banks and other financial institutions, and whenever products or customers change significantly (Art. 98 of the AML Act and Art. 60 of the Regulations for its Implementation).

Internal rules are adopted by a written act of the management within four months of registration or, where the activity requires a licence, authorisation or registration, of the licence being issued or the entry being made (Art. 102 of the AML Act). The minimum content is set out in Article 101(2): criteria for suspicious customers and transactions, internal control, risk assessment, politically exposed persons, keeping and disclosing information, training and anonymous internal reports.

The Act does not require the rules to be sent to the Financial Intelligence Directorate for approval. The Directorate reviews them in on-site or desk inspections and may give binding instructions, which must be implemented within one month (Arts 103(8) and 108(8)).

Customer due diligence and reporting

Customer due diligence covers identifying the customer and its beneficial owner, establishing the purpose of the relationship and the source of funds, and ongoing monitoring (Art. 10). It applies when a business relationship is established, to an occasional transaction of EUR 15,000 or more, to a cash payment of EUR 5,000 or more, and whenever there is a suspicion (Art. 11). A suspicion of money laundering must be reported immediately to the Financial Intelligence Directorate of the State Agency for National Security, before the transaction is carried out (Art. 72), and the documents collected must be kept for 5 years (Art. 67).

In detail: AML obligations in Bulgaria: internal rules, due diligence and reporting for obliged entities

Beneficial owners

The beneficial ownership rules go beyond obliged entities: every legal entity established in Bulgaria, except sole traders, must hold accurate and up-to-date information on its beneficial owners and apply for them to be entered in the Commercial Register, the Register of Non-Profit Legal Entities or BULSTAT where they are not apparent from the register (Arts 61 and 63).

A beneficial owner is the individual who directly or indirectly holds 25 per cent or more of the shares, interests or voting rights or otherwise controls the company, or, where no such person can be identified, the senior managing official. Every change must be filed within 7 days, and failure is penalised with BGN 5,000 (EUR 2,556.46); if the details are still not filed one month after the penalty, a new penalty is imposed every month until they are (Arts 63 and 118(4) and (5) of the AML Act).

In detail: Beneficial owners in Bulgaria: which companies must declare them, how and by when

Inspections, penalties and the new EU framework

Inspections are carried out by the Financial Intelligence Directorate’s inspectors on a written order and, for their sectors, by the Bulgarian National Bank, the Financial Supervision Commission, the National Revenue Agency and the Communications Regulation Commission (Art. 108). Penalties can be imposed both on the obliged entity and personally on its managers and on the employee responsible for internal control (Arts 116 and 117).

Regulation (EU) 2024/1624 will apply directly from 10 July 2027 and will govern many of these obligations across the EU. Until then the core obligations derive from the AML Act and its Implementing Regulations, and internal rules will need to be revised once the Regulation applies.