.svg)
A client brought ARG a regulated business model that needed to become a licence application. ARG first examined how to classify the activity, then organised the governance, capital, AML controls, operating procedures and evidence for the regulator. Developing those elements together helped the client produce a consistent file whose documents agreed on how the business would operate.
Licensing determines whether your business has permission to carry on a regulated activity. Compliance is the continuing work of operating within the rules: assigning responsibility, checking customers and transactions where required, keeping evidence and reporting changes. The first task is to describe what you actually do, not choose a licence from the product's marketing name. That assessment should happen before launch commitments, capital arrangements or a cross-border expansion are fixed.
ARG can help you:
Identify the legal service, product, client and contracting entity. Company registration does not replace a sector licence, registration, notification or premises approval.
Match capital, funding, qualified personnel, premises, systems, insurance and internal controls to the chosen activity. Different requirements need distinct evidence.
Check the actual provider’s home permission, service scope and notification route. An EU owner, foreign licence or local branch does not create universal market access.
Plan reporting, client protection, changes, renewals and closure. Permissions and controls must remain aligned with the business as it grows or reorganises.
Start with four different questions:
Registration and notification are not shorthand for 'no conditions', and one project may need several of these steps. The service provided and the way it operates determine the answer.
Start with the function that creates the legal requirement. Holding client cryptoassets, issuing a spendable electronic-money balance, arranging investment transactions, selling a package holiday and operating a medical centre are different activities even if each uses an online platform. A food business also needs the correct establishment registration or approval and working food-safety controls; a transport operator needs the relevant operator and vehicle permissions. The business name, registered corporate objects and website category do not settle which route applies.
Governance means who makes decisions, who checks them and who is responsible when something goes wrong. AML means anti-money laundering; KYC, or know-your-customer checks, is part of understanding and verifying customers where the applicable rules require it. In practical terms, a policy needs named owners, usable procedures and records showing what was done. Having a policy document does not replace any operating approval.
For payment institutions and electronic-money institutions, the Bulgarian National Bank is the licensing and supervisory authority under the Law on Payment Services and Payment Systems (ЗПУПС). Corporate structure, capital, management and the proposed service must be considered within that framework.
For cryptoassets, MiCA Article 3 defines the asset and each regulated service; the Bulgarian Act refers onward to those EU definitions. Professional custody, exchange, execution, advice and transfers can enter the CASP perimeter, while merely owning cryptoassets does not make every investor a provider. The Bulgarian transitional period ended on 1 July 2026. A former AML-register entry therefore does not replace the required MiCA authorisation or a qualifying Article 60 route. Identify the asset, service, customers and entity before choosing the application.
Other sectors need their own classification review. A restaurant, travel operator or recruitment business may require a different combination of registration, permissions and continuing procedures. Start with a description of the actual activity, premises, customers and transactions so the relevant regime can be identified.
ARG can then define the work required before launch and the obligations that continue afterwards. This gives the corporate, operational and compliance teams a common basis for preparing the application and supporting documents.
The regulator follows the legal nature of the service. What the business does, whom it serves, which assets or funds it handles, its place of establishment and its proposed markets all affect the analysis.
A classification review should establish:
The Bulgarian National Bank supervises payment and electronic-money institutions. The Financial Supervision Commission handles the relevant investment, insurance-intermediary and MiCA matters. KEVR licenses electricity and natural-gas trading; the NRA regulates gambling. Tourism, food, employment mediation, transport, private security and pharmacies have their own competent authorities. Outpatient medical-centre applications pass through the regional health inspectorate, but IAMN makes the final registration decision under Articles 40–41 of the Medical Establishments Act. Correct routing matters because a regional premises check and a final operating registration are different steps.
Where a Bulgarian authorisation is required, the application must reflect the applicant's corporate form, ownership, management and operating arrangements. An existing EU business needs its current permissions and planned Bulgarian activity assessed before choosing between a cross-border procedure and a new local application.
Prepare a one-page description of a typical customer transaction: who contracts with the customer, what the customer receives, who handles any money or assets, which companies or outsourced providers take part, and where the service is offered. Add existing permissions and a diagram or list of the ownership chain. The review should return a list of regulated activities, responsible authorities, pre-launch steps and continuing duties, with any unresolved classification questions identified.
Hypothetical example: a business calls its product a 'wallet'. That label alone does not say whether it issues electronic money, provides a payment service or supplies only technology to another operator. Following a customer payment from receipt to use or repayment exposes the facts needed for the legal classification before an application is chosen.
A useful initial brief contains one actual transaction flow: the customer’s instructions, money or assets received, who controls them, the contractual provider, the result delivered and each country involved. Add the intended launch date, ownership chart, proposed managers, premises and any existing approvals. For a physical business, include address, use of premises, equipment and qualifications. For a digital operation, include systems, outsourcing and data or asset custody. These facts let ARG turn a broad business idea into an activity-specific list of permissions, evidence and implementation tasks.
Tell us where you live, how your business works and what you want to change. We will help you identify the questions to resolve and the next steps to consider.
A payment institution is authorised to provide specified payment services. An electronic-money institution is authorised to issue electronic money: electronically stored monetary value representing a claim on its issuer, issued for funds and accepted for payments by others. These are different regulated statuses, so the word 'fintech' does not identify the application or capital requirement. The Bulgarian Law on Payment Services and Payment Systems ЗПУПС] governs BNB authorisation. [BNB definitions and licensing rules
The applicant must be, or be in the process of establishing, the required Bulgarian limited liability company or joint-stock company. The registered office and actual management must be in Bulgaria. The written application must also address lawful capital origin and the capital required for the institution.
An electronic-money institution must hold at least EUR 350,000 in initial capital when obtaining its licence under Article 38, as amended with effect from 1 January 2026. Prepare the funding evidence and ownership trail alongside the corporate documents. BNB consolidated law
Prepare these workstreams together:
Test the package against an ordinary transaction and a problem scenario. Can the business plan, customer terms and procedures explain who receives the funds, who approves a transaction, where it is recorded and who handles a complaint? Then check that the named people, companies and responsibilities agree with the corporate records. This turns 'a complete application' into evidence of an operating model the business can actually run.
The same evidence discipline applies beyond finance. An insurance broker must address registration, competent people, professional cover and customer-money safeguards. An energy trader needs the appropriate trading licence and financial, technical and personnel capacity, followed by the relevant market arrangements. A medical centre needs the prescribed specialist team and suitable premises. A tour operator’s package obligations and financial protection differ from an agent’s resale role. These differences determine what must be funded, hired, insured, tested or documented first.
For a fintech applicant, that means testing the product description against the proposed entity, funding, management and controls. If management arrangements or capital evidence remain unsettled, those issues need to be addressed as part of preparation.
ARG reviews the evidence against the proposed activities and identifies what must be completed before filing and before launch. For example, paid-up initial capital, ongoing own funds, professional insurance and safeguarding of client money serve different purposes. A capital bank statement does not prove that customer funds will be protected, and an insurance policy does not replace required management competence. Build the funding and control arrangements together with the customer contracts so each requirement has an identified owner and a document or working process that supports it.
'Passporting' means using a permission from one EU Member State to provide the authorised services in another through the applicable cross-border procedure. It is not a second licence automatically created by opening a Bulgarian office, nor a general permission for every product sold under the same brand. Check the licensed company, the services its permission covers and the proposed Bulgarian structure.
For payments, Article 33 of the Law on Payment Services and Payment Systems ЗПУПС] permits an institution licensed in another Member State to provide its authorised services in Bulgaria directly, through an agent or through a branch after the prescribed notification process. Article 43 provides the corresponding direct and branch route for electronic-money institutions. A Bulgarian branch therefore does not, by itself, mean that a new Bulgarian licence is required. [BNB rules on cross-border operation
The assessment should establish:
A separate Bulgarian regulated entity needs its own licensing position assessed. Likewise, services outside an existing authorisation cannot simply be assumed to fall within it. The review must connect the intended transactions and legal operator with the permissions actually held.
Cross-border access is activity-specific. MiCA Article 65 provides the CASP cross-border notification route after the appropriate authorisation; it is not a permission for unrelated investment or payment services. Tourism has its own EU/EEA/Swiss service framework under Articles 62 and 65 of the Tourism Act. Gambling has no general EU licence passport. The owner’s nationality and a foreign parent’s licence do not transfer the licensed status to a newly incorporated subsidiary. Identify the precise provider and permission before signing Bulgarian customer contracts.
Provide ARG with the existing licence, regulator correspondence and a description of the Bulgarian operating model. The resulting advice should identify the permissible structure, required filings and the corporate and compliance work needed to implement it.
Before launch, establish which approvals must already be in place and what activities they cover. Beginning regulated services without the required permission can create enforcement, contractual and reputational exposure. Later changes also need review against the conditions of the existing approval.
For a payment institution planning to stop providing payment services, Article 17 requires notice to the BNB at least two months before the intended decision and a coordinated termination plan protecting users and outstanding payment obligations. Build that step into the closure timetable. BNB requirements for termination
Changes in control, management, corporate form, customer arrangements or regulated services may require notification, approval or a further application. The relevant step depends on the sector and the proposed change.
Review:
Before implementing a change, give ARG the current approval, the proposed transaction or operating plan and the intended timetable. A review can then identify the responsible authority, required filings and adjustments to the compliance documents.
Plan changes before implementation. A new regulated service, acquisition of a qualifying holding, replacement of a responsible professional, new premises or software version may trigger different approval or notification procedures. Keep a current register of permissions, authorised services, responsible people and renewal/reporting dates. For outsourcing, identify the retained decision-making and monitoring responsibilities; a supplier contract does not remove the operator’s obligations. ARG can coordinate the legal, corporate and operational work so the submitted model and day-to-day business remain consistent.
Find the service that matches your decision or procedure. Each page sets out the relevant requirements, supporting documents and practical steps.
