We define the intended crypto-asset services and coordinate the authorisation documents, operational arrangements and regulatory application file.
A crypto business approached ARG because it was unsure how its operating model fitted the CASP authorisation requirements under MiCA. ARG first examined the classification of its activities, then organised the governance, compliance and supporting evidence work needed for a coherent application approach.
A shared checklist helped the client follow the preparation and kept instructions consistent between the different parts of the process. The same discipline matters for any business deciding whether it is merely providing information or performing regulated services such as custody, exchange, order handling or trading platform operation in Bulgaria.
ARG can help when you need to
Map the actual client services before choosing the application scope. Exchange, custody, advice, order handling, transfers and platform operation have distinct definitions and requirements, even when combined in one product.
Prepare management, staff and operating arrangements that support a Bulgarian application. Explain who makes decisions locally, how the company controls outsourced work and which resources are available at launch.
For the ordinary CASP route, safeguards must meet the higher of the relevant €50,000, €125,000 or €150,000 class minimum and one quarter of fixed overheads. Budget separately for the people, systems and ongoing controls.
Confirm the authorisation or applicable notification route before serving clients. The former Bulgarian registration and a pending application do not permit normal operations after the transition ended on 1 July 2026.
MiCA is the European Union's regulatory framework for markets in crypto-assets. Its full legal name is Regulation (EU) 2023/1114. It establishes rules for particular token offerings and for businesses that provide crypto-asset services to clients. For a founder entering Bulgaria, the first decision is therefore what the proposed business will actually do: issue a token, safeguard customers' assets, exchange assets, operate a trading venue, advise investors, or perform another regulated function. These activities lead to different obligations, even when they appear together in the same application or website. MiCA, Articles 1–3.
Bulgarian company incorporation gives your business a legal entity. It does not give that entity permission to provide regulated crypto services. An ordinary applicant needs authorisation as a crypto-asset service provider, commonly called a CASP, before starting the regulated activities. Bulgaria's Financial Supervision Commission, known in Bulgarian as Комисия за финансов надзор or КФН, handles the ordinary CASP authorisation route. Specified existing financial institutions have a different notification route, and banking or electronic-money activities require attention to the Bulgarian National Bank's competence. ARG coordinates the corporate and application preparation around the route that matches your business.
Article 3(1)(5) of MiCA defines a crypto-asset by its substance: a digital representation of value or rights that can be transferred and stored electronically using distributed-ledger technology or similar technology. A distributed ledger is a shared, synchronised record of transactions; blockchain is one form of that technology. The definition extends beyond coins used as payment. A token can represent access to a service or another right, and its legal treatment depends on what the holder receives and how the product operates. Bulgarian law incorporates this EU definition through § 1, point 6 of the Additional Provisions of the Markets in Crypto-Assets Act. Bulgarian Act, Additional Provisions.
Before selecting a licence, describe the asset's rights, transfer restrictions, redemption arrangements and any reference used to maintain its value. An electronic-money token seeks a stable value by reference to one official currency. An asset-referenced token uses another reference, or a combination, and is not an electronic-money token. Other crypto-assets form a separate category. An asset that qualifies as a financial instrument is assessed under the financial-instrument regime instead. A token's name, its ticker or a statement that it is an NFT does not settle this assessment. Bring the token terms and actual transaction flow into the classification exercise.
A client may be an individual or a legal entity receiving crypto-asset services from a provider. The Bulgarian reference is § 1, point 5 of the Additional Provisions, which leads to Article 3(1)(39) of MiCA. This matters for businesses serving companies, professional traders or other providers: a customer does not stop being a client because it is incorporated or commercially experienced. The separate term “retail holder” concerns a natural person acting outside their trade or profession. It appears in Bulgarian § 1, point 7 and MiCA Article 3(1)(37). MiCA definitions.
In practical terms, identify the party contracting with your company and receiving each service. If a corporate treasury instructs you to exchange its crypto-assets, the company is your client. If a customer gives you a mandate to manage a portfolio, the mandate and the discretion you exercise are central to the assessment. Your customer categories, contracts and onboarding process should all use the same understanding of the relationship.
Article 3(1)(16) lists ten crypto-asset services. The following points explain what to look for in your business model:
The detailed definitions are in Article 3(1)(17)–(26). They should be applied to the transaction steps and contractual responsibilities, rather than to the product's commercial description alone.
Consider an OTC business that quotes its own price and becomes the customer's counterparty. That is different from an intermediary that simply receives an order and sends it to another provider for execution. A platform on which several customers trade with each other raises a further question about operating a trading venue. The software may look similar to the customer, but the legal roles are different. Record who determines the price, who enters the transaction, whose capital is used and who receives the customer instruction. These details determine the services that must be covered.
The same care is needed with wallets and advisory products. Custody is concerned with control over assets or access to them, not merely the name given to a wallet. General educational content differs from a personalised recommendation based on a particular customer's position. A portfolio-management mandate differs again because the provider makes investment decisions within the agreed authority. A business can combine these functions, but each relevant service needs to be reflected in its permission and controls. Buying assets solely for your own investment does not, by itself, establish that you provide a professional service to clients.
The authorisation should cover the services that support your launch model. MiCA's Annex IV groups services into three classes for minimum prudential requirements. Class 1 includes order execution, placing, order reception and transmission, advice, portfolio management and transfers. Class 2 adds custody and exchange. Class 3 includes operation of a trading platform. The class does not replace the individual service list: a permission covering one activity cannot be treated as unrestricted approval for every activity within that class. MiCA, Article 59 and Annex IV.
This distinction is useful when setting the product roadmap. If launch revenue depends on exchange and custody, a plan describing only advice will not support the product you intend to offer. Equally, requesting every available service brings preparation obligations for functions you may not be ready to operate. Define the initial services, the assets involved, the customer groups and the countries targeted. Keep future features in a separate development plan so that any necessary extension of authorisation can be addressed before those features are introduced.
MiCA requires the registered office to be in a Member State where at least part of the crypto-asset services are carried out, effective management in the EU and at least one EU-resident director. For a Bulgarian application, the FSC's published supervisory expectations address local executive management, staff and activity. Your arrangements should explain which decisions are taken in Bulgaria, which people perform the work and how the Bulgarian company oversees functions supplied elsewhere. A registered address is one element of that structure; it is not evidence that the whole operating model is ready. FSC application guidance.
For an international group, map the Bulgarian company separately from its parent. Identify the assets, contracts, personnel and systems it can actually access; establish its authority to direct suppliers and obtain records; and show who remains responsible when a group service is interrupted. Outsourcing can support a viable model, but the authorised entity needs enough knowledge and control to manage the resulting risks. Decisions about management residence, staffing and supplier contracts should therefore be made alongside the corporate setup, not left until the application is being signed.
To begin, assemble a concise product description, a customer journey, the proposed ownership and management structure, draft terms, the token list and the payment and wallet flows. Include the website and application screens that show what customers will be offered. ARG can coordinate the classification and authorisation work with the company's establishment and relocation arrangements, so that the business described to the regulator matches the business you are preparing to launch. The result should be a defined application scope, a clear allocation of responsibilities and a practical list of documents and operational decisions needed to complete the file.
Tell us where you live, how your business works and what you want to change. We will help you identify the questions to resolve and the next steps to consider.
The application should make it possible to follow your business from ownership and financing to an individual customer transaction. MiCA Article 62 sets the central information requirements. Delegated Regulation (EU) 2025/305 adds the detailed evidence, while Implementing Regulation (EU) 2025/306 provides the application form. Together, they require a coherent account of the company, intended services, financial safeguards, management, shareholders, governance and operating arrangements. ARG can coordinate the preparation so that legal documents, financial forecasts and technical descriptions use consistent facts and reflect the service scope you have selected. Application requirements.
The programme covers the first three years following authorisation. It should explain the services, assets, customer groups and geographical markets, together with the resources that will deliver them. Include the websites and applications, the languages used, planned marketing, group relationships and outsourced functions. Financial projections should follow the same assumptions as the operational description. If the business plan anticipates corporate exchange customers but the onboarding policy addresses only individual retail customers, the documents need to be reconciled before filing. Delegated Regulation 2025/305, Article 2.
Work through a complete customer journey: application, identification, acceptance, funding, instruction, execution, settlement, reporting and withdrawal. For each stage, identify the contracting entity, the person responsible and the records created. Where another provider performs a step, explain the contractual arrangement and how you monitor its performance. This exercise is particularly useful for businesses adapting an existing overseas product to an EU entity, because it exposes functions that currently belong to the parent but must be available to the Bulgarian applicant.
Prepare the ownership chain through to the relevant individuals and identify direct and indirect qualifying holdings. MiCA's definition includes holdings of at least 10% of capital or voting rights and holdings that allow significant influence. Management and shareholder information serves different assessments: directors need the knowledge, skills, experience and time to run the provider, while the ownership assessment considers the persons able to influence it. A company chart alone does not explain indirect control, shareholder arrangements or the sources of funding. MiCA, Articles 3(1)(36), 62 and 68.
For each proposed director, collect a detailed professional history and the supporting education, experience and reputation documents. Assign responsibilities for compliance, risk, finance, technology, customer operations and supplier oversight. Explain reporting lines and how the governing body receives information and makes decisions. An individual may have several responsibilities where the arrangement remains effective, but a list of titles should not conceal an unfilled function or conflicting duties. The management assessment must also consider the governing body's collective capacity to understand the business it will oversee.
Foreign founders should plan document collection across the relevant jurisdictions. Registry records, criminal-record evidence, qualifications and experience documents can have different issuing procedures. The FSC requires Bulgarian application documents and bilingual declarations signed by foreign nationals, and its guidance addresses recognition of overseas diplomas. Establish who will obtain each document, what translation is needed and whether the document remains current when the application is filed. Resolve names, transliterations and company identifiers consistently across the ownership chart and supporting evidence. FSC FAQ, application and suitability requirements.
For the ordinary CASP route, Annex IV sets minimum amounts of €50,000 for Class 1, €125,000 for Class 2 and €150,000 for Class 3. Article 67 requires prudential safeguards at least equal to the higher of the applicable class amount and one quarter of fixed overheads. For a provider without a full first year of activity, the overhead calculation uses the projected first twelve months of service provision. This is an ongoing requirement and must be considered together with the cost of employees, systems, premises, advisers and outsourced services. MiCA, Article 67 and Annex IV.
The available forms include qualifying own funds, compliant insurance or a comparable guarantee, or a combination. Insurance must satisfy MiCA's conditions, including the relevant territorial coverage, an initial term of at least one year, at least ninety days' cancellation notice and coverage of the specified risks. The suitability of an arrangement depends on its actual terms. A quotation for ordinary professional liability cover is not sufficient evidence that every requirement has been met. Prudential safeguard conditions.
Prepare a calculation that can be checked against the financial plan, identify the form used to meet it and keep the supporting evidence with the application. Forecast how the requirement changes if staffing, transaction volumes or the service scope expand. The working budget should distinguish money needed for the safeguard from ordinary operating expenditure and application costs. This gives founders a realistic funding plan and prevents the statutory minimum from being mistaken for the entire amount needed to establish and operate the business.
Where you hold clients' crypto-assets, access credentials or money, explain how ownership is protected and how your own assets are kept separate. Describe the wallet structure, access approvals, key recovery, reconciliation and return of assets. For exchange and order services, set out how prices or execution arrangements are communicated and recorded. For advice and portfolio management, address the relevant customer assessment and suitability obligations. A generic policy that omits the steps used by your own product leaves the operating question unanswered. MiCA, Articles 70 and 75–82.
Customer-facing documents should explain the service, charges, material risks and how the customer can complain. Internally, assign responsibility for receiving, investigating and answering complaints, keeping records and correcting recurring problems. Identify conflicts arising from the company's own trading, related parties, remuneration and different customer groups. The policy should explain what staff must do when a conflict arises and when disclosure is required. These arrangements should connect to the contracts and customer support process, so that the promised route for a complaint is the route the company can actually deliver.
DORA, the Digital Operational Resilience Act, applies to authorised CASPs. Its requirements address ICT risk management, incidents, testing and third-party technology arrangements. Document the systems that support critical functions, the people who administer them, the suppliers involved and the recovery arrangements if access or service fails. A service hosted by an overseas group company remains a dependency that the Bulgarian business must understand and oversee. Contracts, access rights, incident escalation and exit planning should support that responsibility. DORA, Articles 2, 5–16 and 28–30.
Anti-money-laundering controls should follow the risks of your actual customers, services and countries. Establish how the company identifies and verifies clients and beneficial owners, evaluates risk, monitors activity, escalates suspicious circumstances and retains the required information. Crypto transfers also fall under the separate information requirements in Regulation (EU) 2023/1113. A transfer involving a self-hosted wallet is not automatically exempt; the specific ownership or control assessment for transfers exceeding €1,000 must be built into the relevant flow. Transfer requirements, Articles 14 and 16.
The application goes to the competent home-state authority. For the Bulgarian ordinary CASP route, FSC accepts the filing through its information system, electronically or at its offices; electronic documents require a qualified electronic signature. MiCA provides for acknowledgement within five working days and a completeness assessment within twenty-five working days. If information is missing, the authority sets a response deadline and may refuse to review a file that remains incomplete. Once the application is complete, the substantive assessment period is forty working days, with the regulation allowing further information requests and a defined suspension of that assessment period. MiCA, Article 63.
These stages help you organise the work, but they do not turn the initial preparation into a fixed approval timetable. Maintain a single version of the submitted documents and a record of subsequent changes. When the regulator asks a question, identify which policies, forecasts or contracts its answer affects. A revised service flow can require updates in several places, and the response should keep the entire file consistent. Directors and relevant operational staff should be able to explain the documents and the decisions behind them.
Bulgarian law requires a filing with the Registry Agency to enter the crypto-asset activity within seven days after receipt of the licence or relevant FSC confirmation. Article 16a also requires the provider to maintain a profile in the secure electronic-delivery system and notify FSC within seven days of registering that profile. These are specific implementation tasks to include in the launch checklist. Review the permission's service scope, complete the necessary company-record updates and activate the operating controls before accepting regulated business. Bulgarian Act, Articles 15(3)–(4) and 16a.
If you intend to serve other EU countries, use MiCA's Article 65 cross-border notification process, identifying the countries, services and intended commencement date. Keep the authorised services aligned with marketing and the customer contract. A proposed addition to the service scope needs the appropriate extension under Article 59(8) before it is offered. Company formation, authorisation, cross-border notification and ongoing supervision are connected steps with different purposes; completing one does not remove the obligations attached to the others.
The MiCA transitional period ended on 1 July 2026. A historical entry in Bulgaria's former registration system is not current CASP authorisation, and a pending application does not permit normal regulated operations to continue. ESMA's June 2026 statement requires unauthorised providers to stop new EU customer onboarding and marketing and limit services to what is necessary for an orderly exit. Custody may continue only for the period strictly needed to complete that process. ESMA statement of 23 June 2026.
For an existing operator, first establish the present legal basis for each service and identify the affected customers and assets. Where an exit is required, prepare clear communications, transfer or closure arrangements and an operational schedule. Keep financial-crime controls functioning throughout and record the customer's instructions. If the business will seek authorisation, develop the application alongside this work without presenting the pending procedure as permission to resume. ARG can coordinate the corporate, documentation and operational preparation so that any future launch follows the applicable permission and a service model the company is ready to deliver.
Compare the related procedures in this category, including their requirements and the stage at which you need them.
.svg)
.svg)
