We assess your business obligations and develop practical customer checks, escalation procedures and recordkeeping arrangements suited to the operating model.
ARG coordinated a client’s ownership arrangements, governance, internal procedures and correspondence with the regulator so that AML, KYC and compliance work matched the way the business operated from the outset. The completed work left the client with a better organised compliance file and a process that could be maintained within the business.
That is the practical distinction between collecting identity documents and running a defensible compliance system in Bulgaria. The right approach depends on the exact activity, the ownership and representation structure, the risk profile and the controls needed after onboarding. It may include beneficial owner checks, source of funds evidence, sanctions screening, escalation routes, reporting procedures and updates when the business changes.
ARG can help when you need to
Map the actual business to Article 4 of the Bulgarian AML Act. A bank asking you for KYC does not by itself make every commercial activity an obliged entity.
Trace ownership to natural persons, verify representatives and explain the business purpose and funds. Use documents that connect the ownership chain and the actual payment.
Prepare a business risk assessment, management-approved procedures and staff training. Assign decisions on acceptance, higher risk, monitoring and confidential escalation.
Refresh files when risk or facts change. Escalate suspicion promptly to the competent function and DANS where required, preserve records and respect the prohibition on tipping off.
AML and KYC compliance in Bulgaria is not just a customer intake check. It is a full control framework built around the Bulgarian Measures Against Money Laundering Act (ЗМИП), which is the main statute governing prevention, customer identification, beneficial ownership checks, representation authority checks, record keeping, suspicious activity reporting, risk assessment and control measures. The Ministry of Finance confirms that this framework is still being updated, so a compliant business has to treat AML as an ongoing operating system, not as a one-time file opening exercise. See the official AML overview from the Ministry of Finance and the State Gazette summary of the statutory framework here and here.
In practical terms, the service is relevant when you need a documented process that can withstand review, not just a form that collects a name and a passport copy. ZМИП requires the person in scope to collect and retain information, assess money-laundering risk, disclose suspicious operations and apply control measures. That means the compliance function has to connect onboarding, verification, screening, escalation and reporting into one traceable process. A sanctions-related check belongs in that process because it is part of proportionate risk control, even where the statute does not reduce the service to a simple sanctions list review.
This distinction matters commercially. A business that only collects onboarding data may still fail its statutory duty if it does not know who ultimately owns the client, who can bind it, whether the risk is higher than ordinary, and when escalation is required. For example, a company can have clean customer identity documents and still need additional review if its ownership chain is opaque or if the transaction pattern does not fit the profile that was declared at onboarding.
The useful test is simple. If your process cannot explain why a client was accepted, how risk was assessed and what was done when something looked unusual, it is not yet a compliance system.
ARG helps turn the legal requirements into the decisions your team needs to make: what to collect, who reviews ownership and funding, who may approve a higher-risk customer and when a payment must be escalated. The documents and training should reflect your actual clients, countries, products and payment channels. A workable process also records the reason for each decision so that a colleague can continue the review when the original case handler is unavailable.
Whether a business is within the Bulgarian AML regime depends on the exact activity, not on a generic label such as “regulated” or “international.” The correct starting point is the current consolidated text of ZМИП and the relevant implementing rules, because the law and the subordinate regulations must be read together. The Ministry of Finance expressly confirms that the framework continues to evolve, so scope has to be checked against the client’s actual business model before any compliance conclusion is given. The current statute is the Bulgarian Measures Against Money Laundering Act (ЗМИП), and the verified official text should be checked here together with the latest amendment published in the State Gazette here.
AML means preventing money laundering; CFT addresses terrorist financing. KYC, or “know your customer”, is the identification part of the wider customer due diligence process. Article 10 also requires ownership checks, an understanding of the relationship and funding, and ongoing monitoring. Foreign entrepreneurs may encounter both sides: their bank checks them as customers, while their own Bulgarian activity may separately make them an obliged entity. A bank’s acceptance of your company does not discharge your business’s own duties.
The key distinction is between a statutory duty and a voluntary commercial onboarding practice. A business may choose to verify identity or screen counterparties for its own commercial reasons, but that does not automatically mean the same step is a legal AML obligation under ZМИП. The legal duty arises only when the person or activity falls within the statute’s scope. That is why a proper scope review has to ask what the business actually does, how it contracts, whether it handles customer funds or value transfer, and whether a specific threshold or trigger applies to that activity.
Article 4 of the Measures Against Money Laundering Act identifies the obliged activities. They include payment services, investment services, accounting and tax advice, specified company-service and legal work, real-estate intermediation and licensed gambling, with conditions particular to each category. The current cryptoasset provision covers authorised cryptoasset service providers with the specified exclusion for cryptoasset advice. A business buying cryptoassets for its own investment is not automatically a service provider. Map the actual service to the current statutory category before deciding which controls and registration duties apply.
This also explains why a normal client-onboarding check is not the same thing as statutory AML compliance. Onboarding is a business process. AML scope is a legal status. A bank or service provider can choose to ask for more information than the law strictly requires, but a business cannot assume that optional due diligence answers all statutory questions. If the activity is in scope, the client has to build the required compliance controls around it. If it is not in scope, it may still be sensible to use screening and identity checks, but those remain commercial safeguards rather than statutory AML duties.
The beneficial owner is a natural person who ultimately owns or controls the customer. Bulgarian supplementary §2 includes ownership of 25% or more and control through other means; stopping at a foreign holding company does not answer the question. Build the chain to individuals, examine voting and appointment rights, and record the evidence. Where the statutory senior-management fallback is used after the required enquiries, preserve the reasons; it is not a shortcut for an incomplete ownership file.
Tell us where you live, how your business works and what you want to change. We will help you identify the questions to resolve and the next steps to consider.
A Bulgarian compliance file should prove three things at the same time. Who the client is, who ultimately controls it, and who is allowed to act for it. In ZМИП terms, that means customer identification, beneficial ownership identification and representation authority checks are separate tasks, not one combined form. The 2023 amendment also made clear that for a natural-person client, representatives and authorised attorneys must be evidenced as well. The legal point is simple. If the file does not show who can bind the client, the onboarding record is incomplete even if the identity documents are clean. See the amended statute on the official State Gazette page here.
The ownership part is broader than a standard KYC pack. The law requires suitable, accurate and up-to-date information about beneficial owners and extends the same logic to trust-like arrangements and related contact persons in Bulgaria. In practice, this means ARG would not treat a company file as complete until the ownership chain is understandable and the documentary trail supports the conclusion. If the structure is layered, foreign or otherwise opaque, the question is not whether the client has provided something, but whether what was provided actually lets the business assess control and risk.
Source of wealth explains how a person accumulated their overall assets; source of funds explains the money used for the particular relationship or transaction. A share-sale contract may explain wealth, while the completion statement and bank credits connect that event to the money being invested. Use evidence proportionate to the risk, amount and explanation: accounts, dividend decisions, employment income, inheritance documents or loan terms may be relevant. Check dates, counterparties and transfers across the chain. An unsupported declaration should not conceal a gap that the transaction itself makes material.
ARG’s role in this part of the service is to shape the file around the actual risk. That means deciding what is legally necessary, what is merely prudent, and what would only create clutter. A useful compliance file is not the largest file. It is the file that shows the legal basis for the decision, the evidence relied on, and the reason no further escalation was needed.
If the file cannot explain the ownership chain and the authority to act, it is not yet ready for a regulator, a bank or an internal audit.
When the business operates cross-border, the file also has to remain usable after onboarding. That means the evidence should be ordered in a way that supports later screening, periodic review and reporting, not just the first acceptance decision. The commercial value of this service is that the business can defend its choice later, instead of reconstructing it under pressure.
After onboarding, the compliance function has to work as a live process, not as a static folder. ZМИП requires a risk-based approach, collection and retention of information, disclosure of suspicious operations, and control measures. In practice, that means screening, escalation and reporting have to be connected. A name check alone is not enough if the surrounding facts create a higher risk profile or if the transaction pattern no longer fits the original file. The Ministry of Finance confirms that the framework is still being updated, so the operating procedure has to be checked together with the current statute and implementing rules before it is used in production. See the official AML page here and the statute as published by the Ministry here.
A sensible operating model starts with screening, but it does not end there. Sanctions-related screening belongs in the broader compliance workflow because it helps the business see whether a customer, counterparty or transaction needs a higher level of review. If the result is a match, a near match or a pattern that does not fit the declared risk profile, the question becomes whether to escalate, request clarification, suspend action or report internally according to the business’s procedure. The law is aimed at prevention, so the point is not to collect information for its own sake, but to be able to act when something is unusual.
An internal alert is only one step. Article 72 requires prompt reporting of suspicion to the Financial Intelligence Directorate of DANS, normally before execution with the operation delayed as the law requires; it also addresses cases where prior delay is impossible. Article 80 restricts disclosure to the customer. Set a confidential route that reaches the authorised decision-maker promptly and preserves the facts. Where the required due diligence cannot be completed, apply Article 17 and assess reporting; sales staff must not override that decision merely to meet a closing date.
Group-wide controls under Article 107 apply where the Bulgarian obliged entity belongs to a group; the issue is not limited to Bulgarian parents with foreign subsidiaries. Coordinate information-sharing, data protection, risk assessment and escalation across the relevant entities, branches and majority-owned subsidiaries. For third-country operations, assess local restrictions and the additional measures required where group standards cannot be applied fully. Identify the Bulgarian decision-maker and reporting route: a group compliance department can support the work but does not erase the Bulgarian entity’s duties.
For ARG, the commercial value is in turning abstract compliance rules into an operating route the business can actually use. That usually means a written policy, a screening and escalation map, a reporting trigger, and an audit trail that shows what happened and why. Where the business is part of a wider group, the procedure also has to show how the Bulgarian file sits within the group control structure. Without that, the business may have a policy on paper but no defensible process in practice. 🔎
Article 16 requires periodic and event-driven updates to customer information. A new beneficial owner, unusual incoming payment, changed business activity or new country exposure may require fresh evidence before the next transaction. The review schedule must reflect the statutory requirements and customer risk, with responsibility assigned to a named role. Record both the material collected and the conclusion, including any decision to escalate or end the relationship. Do not postpone a known change simply because the next routine review has not yet arrived.
Certain company-service providers under Article 4(16) must also maintain the separate public registration under Article 9 b. Article 9 d imposes eligibility and notification obligations on its specified persons, including a 14-day period for the relevant changes in circumstances. These are category-specific duties, not a universal 14-day deadline for every customer-file update. Check which register and notifications apply to the business itself, then distinguish them from beneficial-ownership filings for the customer and ordinary KYC refreshes. Keep responsibility and proof of submission for each obligation in the compliance calendar.
Internal rules under Articles 101–102 are formally adopted by management. The general adoption period is four months from the relevant registration, licence or authorisation, with specific rules for the listed nonprofit cases. That period is not permission to transact without customer due diligence. Staff need initial and continuing training, a usable escalation route and access to the current procedures. Retain the approval, training record, risk assessment and review history so the framework can be demonstrated in practice.
For a client, the decision point is whether the business needs a one-off compliance file or a maintenance system. ARG would usually steer the matter toward the second. That means mapping the trigger events, identifying who is responsible for updates, and separating legal notifications from internal checks so the team does not confuse one with the other. The immediate implication is that the file should be built for change, not just for opening day, because a compliant AML setup in Bulgaria has to survive the next ownership change, the next screening result and the next regulatory update.
Compare the related procedures in this category, including their requirements and the stage at which you need them.
.svg)
.svg)
