Crypto regulation in Bulgaria: MiCA, licenses and taxes for startups

Crypto is no longer a grey zone. Since 30 December 2024 the EU's MiCA regulation has applied in full, and Bulgaria's Crypto-Assets Act (ZPKA, promulgated in State Gazette No. 54 of 4 July 2025) came into force on 8 July 2025 and named who supervises what. The result: issuing a token, running an exchange, custody, and even the "decentralized" protocol now have a clear regulatory address - and a deadline.

That deadline is 1 July 2026. Until then, grandfathered crypto firms may operate under the old rules. After it - you either hold an FSC license or you stop. In parallel, since 1 January 2026, under DAC8 the tax agency has started receiving your transaction data directly from exchanges. The transparency is already here; the question is whether your structure is ready for it.

Here's the map - ordered by the decisions that actually determine whether your startup is legal.

What changed and who supervises what

MiCA is a regulation, not a directive - it applies directly, without waiting for a Bulgarian law. It rolled out in two phases: the stablecoin rules from 30 June 2024, and the licensing of crypto-asset service providers (CASPs) plus the Travel Rule from 30 December 2024. The ZPKA is the national "adapter": it sets the competent authorities, the fees, and the transition deadlines.

Three bodies split the supervision:

• FSC (Financial Supervision Commission, КФН) - licenses and supervises crypto-asset service providers (CASPs) and receives white papers.
• BNB (the central bank) - handles e-money tokens (EMTs), because they are de facto electronic money.
• SANS, Financial Intelligence Directorate - receives suspicious-transaction reports and imposes AML penalties.

The dates a founder should keep in view:

Date	What happens
30 Dec 2024	MiCA fully applies to CASPs + Travel Rule (TFR)
8 Jul 2025	ZPKA comes into force; pending tax-agency filings are terminated
1 Jan 2026	DAC8 data collection begins
1 Jul 2026	End of the transition period - no license, you stop
30 Sep 2027	First reporting of 2026 data to the tax agency under DAC8

The first decision: how your token is classified

Everything else flows from this question. A wrong classification isn't a technical slip - it means carrying on unlicensed activity, which the FSC punishes with suspension and a fine.

ESMA's guiding principle (guidelines in force from 18 May 2025) is substance over form: what matters is what the token does economically, not what you called it in the white paper. Here are the decisive questions, in the order the regulator asks them:

1. Does the token grant voting rights, a share of profit, a dividend, or is it a debt obligation? If yes - it's a transferable security under Article 4(1)(44) of MiFID II. You leave MiCA's lighter regime entirely and fall under Bulgaria's securities laws.
2. Is it unique and indivisible, and not part of a coordinated series? If yes - it's an NFT, which under certain conditions stays outside MiCA.
3. Does it hold a stable value referencing external assets or a currency? If yes - it's a stablecoin (EMT or ART).
4. If none of the above - it remains a utility token or "other" crypto-asset under Title II of MiCA.

Translated into obligations:

Token type	Regime	What you need
Security token	MiFID II / ZPFI	Investment-firm license + prospectus approved by the FSC
E-money token (EMT)	MiCA Title IV	E-money-institution or bank license from the BNB; redemption at par
Asset-referenced (ART)	MiCA Title III	FSC approval + a segregated asset reserve
Utility token	MiCA Title II	White-paper notification to the FSC (20 working days)
Genuinely unique NFT	Outside MiCA (Art. 2(3))	Nothing - if it isn't a series and isn't fractionalized

Three quick examples to feel the line:

• Tokenized rent. A startup sells tokens each carrying a percentage of the rent from an office building in Sofia. That's a security - it's a financial claim on income. It needs an investment-firm license.
• Game token. A Web3 game issues a token you use to buy swords in-game. That's a utility token - a white-paper notification is enough.
• Lev stablecoin. A fintech issues a token backed 1:1 by deposits in Bulgarian leva. That's an EMT - it needs an e-money-institution license from the BNB.

The "utility" trap

The most common mistake crypto startups make: the token is marketed as a plain utility for accessing a platform, but the white paper promises guaranteed staking income or a share of the protocol's fees. That automatically makes it a financial instrument under MiFID II - regardless of what's written on the box. The result is suspension by the FSC and a fine for operating without a license.

The same trap lurks for "decentralized" projects. If the founders hold admin keys, can pause the protocol or control the front-end interface, or if a small set of addresses holds over 50% of the votes in a DAO, the regulator sees an identifiable issuer - and applies MiCA's full regime, with personal liability for the founders.

The CASP license: classes, capital, and fees

If you provide services to third parties - exchange, conversion, custody, brokerage, advice - you need a crypto-asset service provider (CASP) license from the FSC. The services are split into three classes by risk, with each higher class also covering the lower ones:

Class	Services covered	Required capital	State fee
Class 1	Reception/transmission of orders; advice; portfolio management; transfers	€50,000	€2,500
Class 2	Crypto/fiat exchange; crypto/crypto exchange; order execution; placing	€125,000	€5,000
Class 3	Custody; operating a trading platform	€150,000	€15,000

For Class 1 and Class 2, capital is often combined with professional indemnity insurance (PII). For Class 3, though, the FSC usually requires fully paid-in cash capital - the systemic risk in custody and exchanges is too high.

The FSC timelines are up to 25 working days to check the file is complete and up to 40 working days to decide on the merits - up to 65 working days in total. The application is filed electronically through the FSC's unified system, signed with a qualified electronic signature.

Passporting is the reward. Once licensed by the FSC, you can offer your services across the entire EU/EEA with a simple written notification; the FSC must forward it to the host authorities and ESMA within 10 days. One license, the whole single market.

The white paper: when you need it and when you don't

Issuing a standard crypto-asset (other than ART and EMT) needs no prior approval - but you must send the white paper to the FSC at least 20 working days before publication. It has to be in a machine-readable format (XHTML with Inline XBRL) and cover the issuer, the project, the token's rights, the technology used, the mandatory carbon-footprint disclosure, and an explicit risk warning.

The obligation falls away if the offer targets fewer than 150 people per member state, doesn't exceed €1,000,000 over 12 months, or is a genuinely free airdrop. Watch out: the token isn't "free" if the user has to hand over personal data beyond what's technically necessary, or if the issuer collects any fee at all.

And most importantly: the members of the management body bear joint personal liability for damage caused by false or incomplete information in the white paper. Clauses that try to exclude that liability are void.

Money, KYC, and the Travel Rule

Every licensed CASP is an obliged entity under the anti-money-laundering act (Art. 4(19)) - the only exception is firms whose sole service is providing advice. In practice that means three non-negotiable duties:

• Customer due diligence (CDD). Every client is identified before the first transaction - for individuals via an ID document and, increasingly, liveness-detection software; for companies, current registration status and ownership structure.
• Ultimate beneficial owner (UBO). Mandatory identification of any individual holding, directly or indirectly, over 25% of the client company.
• PEP and sanctions. Automated real-time screening against politically-exposed-person lists and the UN, EU, and OFAC sanctions lists. A match means blocking the transaction and reporting to SANS.

On top of this comes the Travel Rule (Regulation (EU) 2023/1113), applicable from 30 December 2024. On every transfer between providers you must pass on the sender's full name, address, and official document number. Unlike bank transfers, there's no minimum threshold here - the rule applies to a €5 transfer too. For a transfer over €1,000 to a self-hosted wallet, you must also technically verify that the client controls that wallet - via a cryptographic signature or a micro-transaction.

Here a real conflict with GDPR appears. The AML act (Art. 110) requires you to keep the KYC file for 5 years after the client relationship ends, while GDPR insists on deletion once the purpose is achieved. The reconciliation: process on the "legal obligation" basis (Article 6(1)(c) of GDPR), split the databases - marketing data is deleted immediately, while the KYC file is archived encrypted and accessible only to compliance - and after the 5-year period, delete it irreversibly.

Tax: what the agency takes

MiCA didn't change the tax rates, but together with DAC8 it changed the visibility. Here's the real math:

Individuals. Under Article 33(3) of the Personal Income Tax Act, the taxable base is the year's gains minus losses. A 10% statutory expense deduction applies to it, and the tax is 10% - so effectively 9% of the net gain (10% tax on 90% of the profit). Swapping one crypto-asset for another is a taxable event - the gain is the market value of the new asset minus the acquisition cost of the old one. Mining and staking, however, are treated as business activity (Art. 26(7)) - taxed at 15%, with social and health contributions due on top.

Companies. Profit enters the overall financial result and is taxed at 10% corporate tax, and on distribution as a dividend - a further 5%. Unrealized gains from year-end revaluation aren't recognized for tax (Art. 34 of the Corporate Income Tax Act) - they're taxed only on the actual sale.

DAC8 is what makes all of the above unavoidable. From 1 January 2026 exchanges collect your data, and by 30 September 2027 they report your full transaction history to the tax agency - buys, sells, swaps, transfers. The agency automatically cross-checks what you declared against your real activity across the whole EU. Not declaring is no longer "risky" - it's visible.

Marketing and penalties

Every marketing message aimed at Bulgarian consumers - a social post, a banner, a Telegram message - must be clearly identifiable as marketing, must not be misleading, must match the white paper, must link to it, and must be in Bulgarian or English. For ART and high-risk tokens aimed at retail investors, promises of quick returns and gamified interfaces are banned; before purchase, a suitability test is mandatory.

The penalties aren't symbolic. Operating without a license after 1 July 2026 is punishable by a fine up to the greater of roughly €7.7 million and 12.5% of annual turnover. For market abuse the ceiling is €15,000,000 or 15% of turnover, and for individuals fines reach €5,000,000. On top of that, the FSC can suspend activity for 30 working days and order internet providers to block domains, apps, and Telegram channels used to advertise unlicensed activity.

Checklist: what to do now

• I accept crypto payments: if you receive directly into your own wallet for your own goods, you're not a CASP and need no license. If you use an intermediary (e.g. BitPay), check it's listed in ESMA's register. After 1 July 2026, using an EU-unlicensed intermediary is prohibited.
• I'm issuing a token / doing an IDO: run a legal audit of the tokenomics to be sure the token grants no dividend, interest, or vote. Prepare a white paper (XHTML + Inline XBRL) and notify it to the FSC at least 20 working days before launch.
• I'm building a CASP platform: pick a license class, secure the capital (€50,000-150,000) in an EU bank account, and deploy Travel Rule and AML monitoring software. If you had an old tax-agency registration, file the FSC application immediately - review takes up to 65 working days.
• I'm doing an NFT project: avoid large series (over 10,000 items) with an investment purpose, and remove any fractionalization function - otherwise you risk the FSC treating the collection as a standard crypto-asset under MiCA.
• I'm building a DeFi protocol: assess the real degree of decentralization. If you control the front-end interface, collect fees, or hold the admin keys, restructure or apply for a CASP license before personal liability catches up with you.

Crypto regulation in Bulgaria is no longer a question of "whether," but of "when and how." The token's classification determines the regime, the regime determines the license and capital, and 1 July 2026 determines the clock. Founders who line up those three things now will have a working structure - while the rest explain to the FSC why they're still operating.