We map the business model to the relevant payment permissions and coordinate the application, governance documents and post-authorisation requirements.
A business had begun preparing for a Bulgarian payment institution licence without a clear order of work. ARG compared its actual operations with what the regulator would expect, identified the gaps and addressed them in sequence. One team coordinated the process, including the links between the commercial arrangements and the supporting documents.
That experience reflects the practical question behind this service. A payment institution licence is not a general fintech approval or a simple register entry. The requested scope must match the services the company will actually perform, while its capital, management arrangements, application documents and future changes must fit the Bulgarian National Bank’s requirements. This guide explains the main decisions before and after filing.
ARG can help when you need to
Identify the actual Article 4 functions. Payment initiation, account information, money remittance and e-money are distinct regulatory models.
Use an eligible company with actual management and part of its activity in Bulgaria, suitable managers and transparent source of capital.
Initial capital is EUR 20,000 for remittance only, EUR 50,000 for payment initiation, or EUR 125,000 for relevant broader services.
Prepare safeguarding where funds are held, required insurance, AML, ICT resilience and a three-year plan consistent with the proposed operations.
A Bulgarian payment institution licence authorises a company to provide the payment services that are expressly covered by that licence under the Law on Payment Services and Payment Systems [LPSPS]. It is not a general permission to operate any kind of fintech business. The licence fixes the legal perimeter of the activity, so the company may perform only the services that the Bulgarian National Bank [BNB] has approved for that specific institution.
Article 4 of the Bulgarian payments law covers placing and withdrawing cash on payment accounts; executing direct debits, card payments and credit transfers, including where funded by credit; issuing payment instruments and acquiring transactions; money remittance; payment initiation; and account information. A payment institution licence concerns items 1–7. The last category has a distinct registration route. Identify your actual functions rather than selecting every category because it appears commercially useful.
For a prospective client, the legal question is not whether the business works in a payment context in the abstract. The question is whether the company will be carrying out a regulated payment service that falls within Article 4. If it will, the company should seek the payment institution licence rather than assume that a company registration or a general commercial setup is enough.
That distinction matters because the licence determines who can lawfully contract with payment users, how the service may be structured, and what compliance perimeter the business must maintain. A company that is only planning a narrow regulated activity should not ask for more than it needs, but it must not understate the service either. The licence should match the real operating model, not a simplified business description.
The regime also distinguishes payment initiation services under Article 4(7) from the other payment services. That distinction is important because payment initiation is a distinct regulated function and the law treats it separately from some other payment service categories. If a business plans to initiate payments from a user’s account, that should be analysed as its own licensing question, not assumed to be automatically covered by a general payment services description.
Payment initiation means initiating a payment order at the user’s request from an account held with another provider. An account information service instead supplies consolidated online information about one or more payment accounts. Both can be regulated even though the provider never takes possession of the transferred money. The technical-services exclusion in Article 2 expressly excludes these two functions, so describing the business as software or an API provider does not remove the licensing or registration trigger.
The safe rule is simple. The licence should be drafted around the exact regulated functions the company will actually perform, not around a broad commercial label.
So, the practical value of the service is to identify the proposed activities against Article 4, determine whether they are licensed payment services, and shape the application around the correct scope. That avoids a common mistake in this sector, where a business plans one operational model but applies on the basis of another. If the model changes later, the licensing file may have to be expanded rather than treated as already covering the new service.
Prepare one diagram for each user journey: who receives the instruction, whose name is on the payment contract, who controls the money, how it reaches the beneficiary and how refunds or rejected payments are handled. For a merchant platform, distinguish technical processing from acquiring and money remittance. For a wallet, test whether you issue a claim that meets the electronic-money definition. The same interface can conceal materially different legal roles, capital levels and customer protections.
A Bulgarian company needs a payment institution licence before it starts providing regulated payment services, unless it is operating under a different lawful route that actually fits its activity. A simple register entry is not enough if the company is going to perform services that the LPSPS regulates as payment institution activity. The BNB is the competent authority where the applicant’s registered office is in Bulgaria, so the licensing decision is tied to the Bulgarian establishment of the company, not just to the commercial idea behind it.
The legal trigger is the activity itself. If the company will provide payment services as a payment institution, it needs BNB authorisation before it starts. That requirement sits alongside a separate organisational reality. The applicant must be a limited liability company or a joint-stock company, either already registered or still in formation, its registered office and head office in the Commercial Register must correspond to the place of actual management, and it must carry out at least part of its payment activity in Bulgaria. Those conditions show that this is a genuine Bulgarian regulated presence, not a paper entity that only exists for filing purposes.
Registration is the correct route for a company providing only account information services under Article 18, subject to the required insurance or comparable guarantee and the other registration conditions. An agent of a licensed institution is another distinct arrangement and must be entered in the relevant register before acting. Neither position authorises the company to provide independently the full range of services reserved to a licensed payment institution.
That is why the first step is to map the planned operation against the statutory definition of the regulated service, then test whether the company’s structure and place of management fit the Bulgarian licensing model. A company with its formal seat in Bulgaria but management elsewhere, or with no real payment activity in Bulgaria, may face a mismatch that needs to be corrected before filing.
Clients often confuse three different positions. A Bulgarian payment institution licence covers a company established in Bulgaria that wants to perform licensed payment services from that Bulgarian base. Account information services sit in the same payment-services universe, but they are not the same as a full payment institution business and must be analysed on their own regulatory terms. Passporting is different again. It is the route for an institution already authorised in another EEA state to provide services across borders under that existing authorisation, rather than starting a Bulgarian authorisation process from scratch.
If you are establishing a Bulgarian regulated company, assess the BNB licensing route and the requirement for genuine Bulgarian management and activity. If the same legal entity already holds an EEA authorisation, examine the passport notification for the intended services, host state and operating method. The passport belongs to that institution: it cannot be borrowed by a new Bulgarian subsidiary. An authorisation from a non-EEA country does not create an EEA passport.
For a client, that means ARG would first test the structure. Is this a Bulgarian applicant that needs a BNB licence, a narrower regulated activity that should be framed correctly, or an EEA-authorised business that should rely on passporting? The answer decides the filing route, the corporate set-up, and whether the company can lawfully start trading in Bulgaria at all.
Tell us where you live, how your business works and what you want to change. We will help you identify the questions to resolve and the next steps to consider.
The financial test is not just whether the founders can fund the company. Under the Law on Payment Services and Payment Systems LPSPS, the applicant must meet an initial capital threshold before authorisation and then maintain ongoing own funds after the licence is granted. Those are different controls with different purposes. Initial capital is the entry condition. Own funds are the continuing prudential buffer that supports the business while it operates.
From 1 January 2026, the minimum initial capital depends on the planned service scope. The thresholds are EUR 20,000 for the services under Article 4(6), EUR 50,000 for Article 4(7), and EUR 125,000 for any of Article 4(1) to (5). The capital must be made up of one or more of the eligible own-funds items under Article 26(1)(a) to (e) of Regulation (EU) No 575/2013. In practical terms, this means ARG would check not only the amount, but also whether the source and form of the funds are acceptable for the licensing file.
If the intended scope is too broad for the capital you can credibly place in the company, the licence plan is misaligned from the start. A business that wants payment initiation services under Article 4(7) may face a lower initial-capital threshold than a business that wants a broader payment-services scope, but the capital question does not end there. The operating model must also be able to sustain the ongoing own-funds requirement once the company starts processing payment volume.
For ongoing prudential capital, the institution must at all times hold own funds calculated from its monthly payment volume, unless it provides only Article 4(7) services. The law uses a tiered formula in Article 9(1), with 4 percent up to EUR 5 million, 2.5 percent from EUR 5 million to EUR 10 million, 1 percent from EUR 10 million to EUR 100 million, 0.5 percent from EUR 100 million to EUR 250 million, and 0.25 percent above EUR 250 million, then multiplied by the scaling factor k. The payment volume is one twelfth of total payment transactions executed in the preceding year. That makes the funding requirement scale with actual business activity, not with the nominal size of the company.
Under Article 9(2), the scaling factor is 0.5 for an institution providing only money remittance under Article 4(6), and 1 for the relevant services under Article 4(1)–(5). An institution providing only payment initiation is excluded from the payment-volume formula, but must maintain its applicable minimum capital. The BNB may adjust the calculated requirement by up to 20% in either direction according to the statutory risk-management and control criteria. Model that potential adjustment and operating losses before deciding how much capital to contribute.
Professional indemnity insurance is not a substitute for capital. It becomes relevant where the applicant wants to provide payment initiation services under Article 4(7). In that case, the applicant must hold professional indemnity insurance or an equivalent guarantee that covers the territories where the service will be offered and covers the liability regime in Articles 79, 94 and 95. The function of that insurance is to address the liability risk of the service, not to satisfy the prudential capital requirement.
A useful way to think about the distinction is this. Capital tells the BNB whether the company is financially formed and prudentially credible. Insurance tells the BNB whether a specific service risk is covered in the way the statute requires. A company can need both at the same time. If the planned model includes Article 4(7) services, ARG would check the capital structure and the insurance wording together, because a gap in either one can block a clean application.
Safeguarding is a third, separate requirement. Article 23 prevents customer payment funds from being mixed with the institution’s own money. Where relevant funds have not been passed to the recipient or another provider by the end of the following working day, they must be held in the prescribed safeguarding account. Establish the account, reconciliation method, access controls and exception handling before accepting live funds. Capital protects the institution’s prudential position; safeguarding protects the specific money it holds for payment users.
The key decision is not only whether the company can reach the threshold, but whether it can keep the required financial profile once the licence is live.
For a prospective applicant, the practical next step is to match the service scope to the financial package. If the model is narrow, the lower threshold may be enough. If the model is broader, or if the projected payment volume will quickly trigger a higher own-funds requirement, the business case should be reworked before filing. That is where service design, treasury planning and compliance planning have to be read together rather than separately.
The BNB application is a formal licensing filing, not a simple notification. Under the LPSPS, the request must be in writing and accompanied by the documents required by BNB Ordinance No. 16. The applicant must also file a written declaration that the materials are current, complete and truthful. That declaration matters because the regulator is not just counting pages. It is testing whether the file can be relied on as an accurate description of the company, its owners, its management and its operating model.
The applicant must be a limited liability company or a joint-stock company, either already registered or still in formation, and its registered office and head office in the Commercial Register must match the place of actual management. The institution must also carry out at least part of its payment activity in Bulgaria. Those points are important because they tell the BNB that the applicant is a real Bulgarian regulated presence, not a shell set up to obtain a licence with no local operational substance.
In practical terms, the filing should prove four things.
Articles 2–6 of BNB Ordinance No. 16 turn those conditions into an evidence file: corporate documents, paid-capital proof, ownership and source-of-funds material, the programme of operations and three-year financial projections, fit-and-proper information, safeguarding arrangements and operational controls. The programme includes fund-flow and settlement diagrams where applicable, draft agreements, intended premises and agents, ancillary activities and proposed markets. Forecasts must explain volumes, pricing, customer numbers, costs, outsourcing and stress assumptions. Check that these figures agree with the service description and capital calculations.
The review timetable is also important for planning. The BNB’s main licensing period is three months from receipt of the application. If the file is incomplete, the BNB may request missing documents and information within up to two months, and then it has up to three months from receipt of the supplementary file to decide. In other words, the clock can move if the file is not complete at the outset. A weak submission can therefore stretch the process well beyond the headline three-month period.
For a client, the practical consequence is simple. The first filing should be treated as the real filing, not as a draft that can be corrected informally later. If the BNB asks for supplementary materials, the application remains alive, but the timetable changes and the burden shifts back to the applicant. That is why ARG would normally build the file in sequence, starting with the corporate structure, then the source of funds, then the service scope, and only then the final document set.
Foreign founders should collect current corporate extracts for every relevant entity in the ownership chain and identify the ultimate individuals, their source of financing and any regulated group relationships. Managers’ qualifications, professional history and reputation require evidence. Arrange Bulgarian translations and any applicable legalisation early, particularly where criminal-record or company documents have limited validity. A Bulgarian registered address must correspond to actual management, with at least part of the payment business conducted in Bulgaria.
The common blockers are easy to understand even before the checklist is opened. If the company form is wrong, if the capital source is not transparent, if the management location does not match the registered seat, or if the application does not clearly cover the intended services, the file is vulnerable. Missing or inconsistent information is not a minor defect in this regime. It can delay the review or force the applicant into a supplemental cycle that changes the project timeline.
The BNB reviews whether the business can actually deliver the proposed services with the resources described. Assign an owner to every application section and keep evidence of the supporting arrangements, including banking, audit, technology and key personnel. The application-review fee is EUR 4,000 under Article 70(3) of Ordinance No. 16, separately from capital, insurance and project preparation costs. An application to supplement a PI licence is subject to its separate EUR 2,500 review fee; this matters when planning phased product launches.
Once authorised, the institution must keep the licence alive by keeping the underlying conditions alive. The licence is granted for an indefinite period, but it is not transferable, and the institution must continue to satisfy the Article 8 to 10 requirements for the whole life of the licence. It must also notify the BNB without undue delay of changes in the licensing file. That means the post-licence stage is not passive. It is an ongoing compliance exercise tied to the company’s real operations, owners and control environment.
If the business wants to add payment services outside the original scope, it cannot simply start offering them because the company already holds a licence. It must apply for a licence supplement, and the Article 10 to 12 licensing rules apply again. This is the point where many businesses underestimate the regulatory impact of growth. A new product, a new payment flow or a new customer journey may look like a commercial extension, but legally it may be a new licensed activity that needs a fresh approval layer.
The ownership rules are equally important. Acquisitions that create or cross qualifying-holding thresholds, or that reach 20 percent, 30 percent or 50 percent of shares, voting rights or a subsidiary relationship, need prior BNB approval. For a client, this means cap table changes cannot be treated as an internal corporate matter once the company is licensed. Investor entries, reorganisations and control shifts should be checked against the licensing perimeter before they are signed.
Outsourcing is permitted, but it is not a way to push regulatory responsibility away from the institution. The institution must notify the BNB with the outsourcee’s identification details and a description of the outsourced services. If the outsourced function is an important operational function, the arrangement must not materially impair internal control or the BNB’s supervision. It also cannot delegate senior management, alter user rights or undermine the licence conditions.
That is commercially significant because payment businesses often outsource technology, operations or support functions. The question is not whether outsourcing is useful. The question is whether the outsourcing model leaves the licensed institution in genuine control of the regulated service. If it does not, the structure may have to be redesigned before implementation.
For a practical decision, ARG would usually separate the post-authorisation work into three tracks.
A small but important implication follows from the indefinite, non-transferable nature of the licence. If the founders plan to sell the business, bring in a strategic investor or move operations into a group structure, the licensing status does not simply travel with the deal. The regulatory question has to be solved alongside the corporate transaction. That is why the correct next step after authorisation is not just compliance monitoring. It is change-management planning, so the business can grow without accidentally stepping outside the conditions on which the licence rests.
Compare the related procedures in this category, including their requirements and the stage at which you need them.
.svg)
.svg)
