An EMI license in Bulgaria lets a properly capitalized company issue electronic money, provide regulated payment services, and then passport those activities across the EEA, but the glamorous part ends there. The legal route is real. So is the scrutiny. If you want the short version, Bulgaria is attractive because of EU market access, a known supervisory framework, and relatively sensible operating costs. It is not attractive because the process is easy. It is not.
People often come in with the wrong mental picture. They hear “EMI license Bulgaria” and imagine a smart fintech setup, a local company formation, a polished application file, and then some neat approval from the Bulgarian National Bank a few months later. That is a child’s version of the story. The grown-up version involves capital thresholds, safeguarding architecture, AML controls, governance, IT resilience, shareholder vetting, source-of-funds checks, and a regulator that wants to see whether your proposed institution can survive contact with real users, real fraud risks, and real compliance deadlines.
That distinction matters because an Electronic Money Institution is not a decorative corporate vehicle. It is a supervised financial entity. Once authorized, it can issue electronic money, hold customer funds under the legal safeguarding rules, execute transfers, card-related transactions, direct debits, and other payment services allowed under the law. It still cannot take deposits like a credit institution. That line trips people up more than it should.
Bulgaria sits inside the European Union framework, so the national regime is not improvised. The licensing model is tied to PSD2-era rules, the Electronic Money Directive framework, local implementing law, and supervisory ordinances. The regulator is the Bulgarian National Bank, usually shortened to BNB, and that detail is not cosmetic. BNB is the gatekeeper, the prudential supervisor, the reviewer of the application pack, and later the institution watching whether your EMI compliance habits are real or just PowerPoint theater.
For international entrepreneurs, that combination is exactly why Bulgaria gets attention. You get an EU member state authorization, a route into EEA passport rules, and a jurisdiction that foreign founders already know from company formation, tax optimization, and cross-border structuring. Bulgaria’s 10% corporate tax gets all the headlines, naturally. Fine. But tax is not the heart of the EMI decision. Licensing credibility is. A badly structured applicant with weak governance does not become respectable because the corporate tax rate is low.
One more thing, because people blur categories all the time. An EMI is not the same as a payment institution, even though the overlap is substantial. A payment institution can provide certain payment services. An electronic money institution can do that too, but also issue electronic money. It is also not a bank, which means no deposit-taking and no use of customer balances as though they were ordinary bank funding. If your operating model quietly assumes bank economics, the application logic is already broken.
EMI Licensing in Bulgaria Is a Serious Regulatory Project
An EMI license in Bulgaria can open the door to regulated e-money issuance, payment services and EEA passporting. But it is not a shortcut. A credible application requires capital, governance, AML controls, safeguarding architecture, IT resilience and a regulator-ready business model.
What does this authorization allow?
The authorization allows a company to operate as a regulated payment service provider with the added right to issue electronic money. In practice, that means a Bulgarian EMI can build wallets, facilitate online transfers, support commerce platforms, run remittance services, manage payment accounts or payment instruments in a regulated sense, and structure centric payment solutions for Bulgarian customers or cross-border users across EU markets, subject to the exact scope approved by BNB and the passport notifications later made into other EEA member states.
This matters commercially because a lot of fintech founders do not actually need a full bank. They need controlled access to the payment hub. They need to store funds in exchange for e-money, execute payment transactions, support digital economy use cases, and plug into instant infrastructure without taking on the entire regulatory mass of a credit institution. That is the appeal. Also the trap, if I am honest, because some founders treat “lighter than a bank” as “light.” It isn’t.
A licensed EMI in Bulgaria usually has room to operate in several lanes at once:
- issuing electronic money tied to customer balances or wallet products
- providing payment services such as transfers, card-related payments, money remittance, and direct debits
- expanding into other EEA markets through passporting once the home-state authorization is in place
- serving as the regulated core for broader financial services or alternative banking solutions without becoming a deposit-taking bank
Issuing e-money
Issuing electronic money means receiving funds from a user and issuing electronically stored monetary value in return. That value represents a claim on the issuer and is accepted by persons other than the issuer. That last piece is important. If it is just a closed-loop store credit that never leaves your own narrow ecosystem, you may be in a different regulatory conversation. If it works as transferable stored value for broader use, you are in EMI territory fast.
A Bulgarian EMI can issue e-money through wallets, prepaid products, app balances, merchant settlement structures, and similar products. The customer gives funds. The institution issues electronic money. The institution then has to safeguard those funds correctly. It cannot behave as if those balances were ordinary revenue. They are not.
The best applicants understand the commercial model at a transaction-flow level. They can explain where the money comes in, who the payee is, how redemption works, when fees are taken, whether the product supports euro transactions, whether online transfers settle instantly or in batches, and which banks or safeguarding accounts sit underneath the model. If management cannot explain the product without hand-waving, BNB will notice. Quickly.
Providing payment services
The EMI licence can also cover a range of payment services. Under the Bulgarian legal framework implementing EU directives, that can include execution of payment transactions, issuing payment instruments, acquiring payment transactions, money remittance, operating payment accounts, and other regulated activities depending on the exact permissions requested.
That practical scope is why many applicants compare the EMI route against a payment institution license. If your model is purely transactional and does not require electronic money issuance, a payment institution route may be enough. If you want customer wallet balances, broader stored-value mechanics, or more flexible product architecture, the EMI route often makes more sense. It also brings more scrutiny, because stored value creates consumer risk and safeguarding obligations that the regulator will not take lightly.
And yes, clients always ask about alternative banking favors, banking services, and whether an EMI can function like a modern neobank. Commercially, many users will experience it that way. Legally, the framing must stay disciplined. An EMI can offer powerful digital remittance solutions, secure remittance options, payment accounts, cards, and electronic money transmissions. It still cannot market itself as a bank unless it actually is one. Words matter in regulated industries, often more than founders like.
Using EU passporting
This is one of the main reasons people look at Bulgaria in the first place. Once authorized in Bulgaria, an EMI may use the EU passporting regime to provide services in other EEA member states, either cross-border or through branches, subject to the notification mechanics. The home regulator is BNB. The host states are informed through the passporting procedure. The EBA Register on Payment and Electronic Money Institutions exists precisely because the single market needs a common visibility layer for these licenses.
That passporting value is real, though people over-romanticize it. A Bulgarian licence is not a magic key that makes every host market commercially easy. Local consumer law, AML expectations, outsourcing oversight, language realities, partner-bank onboarding, and scheme access can still be awkward. The legal right to operate and the practical ability to scale are cousins, not twins.
Which laws and regulators apply?
The framework is layered. European law sets the architecture. Bulgarian law implements and operationalizes it. BNB supervises the whole thing at the national level. If you are building an application strategy, you have to understand all three layers together, because that is the actual map.
Key Legal and Supervisory References
This guide is based on the Bulgarian and EU regulatory framework for payment services, electronic money institutions, prudential supervision and EEA passporting.
EU legal base
The big legal roots are the Electronic Money Directive and PSD2. Those establish the categories, authorization principles, prudential standards, safeguarding logic, passporting mechanics, and conduct rules that member states then implement through local legislation. More recently, operational resilience rules have become harder-edged as the EU moves deeper into digital finance supervision. Firms that still treat IT resilience as a side issue are living in the past.
The practical point is simple. Bulgaria did not invent a boutique EMI regime for itself. It operates inside a harmonized European Union structure. If you are coming from another EU member state, many concepts will feel familiar: initial capital, own funds, qualifying holdings, fit and proper review, outsourcing oversight, AML systems, complaints handling, governance, incident reporting, safeguarding of customer funds, and the right to passport services after authorization.
If you want to see how Bulgaria aligned its rules with PSD2, the CMS analysis of the PSD2 implementation in Bulgaria is a useful signal that this is not a legal backwater improvising from the sidelines.
Bulgarian legal base
The core national act is the Law on Payment Services and Payment Systems. For English readers, the translation of the Law on Payment Services and Payment Systems is one of the better starting points because it covers authorization, activities, capital, and supervision. Then you have secondary rules, including Ordinance No. 16, which digs into licensing procedure and governance details in a way founders ignore at their own peril.
That local legal base matters because the law is where broad rights become specific obligations. This is where you see how the application should be framed, which declarations and supporting materials are expected, how control functions must be presented, how managers are assessed, and how the institution has to behave after licensing.
Bulgaria also has the ordinary corporate law layer underneath all this. The applicant must be a Bulgarian legal entity, typically a limited liability company or joint-stock company depending on the intended structure and capitalization logic. Founders who obsess over fintech architecture but neglect the underlying business forms paperwork tend to discover, a bit late, that regulated licensing still sits on top of ordinary company law reality.
BNB supervision
The Bulgarian National Bank is the licensing authority and supervisor. That is the heart of it. It reviews the applicant’s file, asks for clarifications, assesses capital, governance, shareholder suitability, management competence, risk controls, outsourcing arrangements, AML systems, and operational readiness. If approved, the institution enters the relevant national register. You can inspect existing authorized entities through the Bulgarian National Bank Register.
BNB’s role is not ceremonial. The central bank framework is grounded in the Law on the Bulgarian National Bank, which defines its powers and supervisory authority. People sometimes assume that smaller EU jurisdictions are “softer” on financial licensing. That is lazy thinking. Smaller does not mean casual. It usually means the regulator expects a cleaner file, fewer theatrics, and a more coherent management explanation.
And frankly, that is healthy. A regulator approving institutions that hold customer funds should be difficult. If you want a participation trophy, regulated payments is the wrong industry.
Who can qualify?
Not everyone with a fintech deck and a decent logo should be running an electronic money institution. Qualification turns on the applicant’s legal form, capital, beneficial ownership transparency, fit and proper shareholders, competent management, governance infrastructure, and the credibility of the operating model. The regulator is not just licensing an idea. It is licensing the people behind it.
Before You Start: Ownership and Management Must Be Clean
Weak EMI applications often fail before the legal drafting begins. The biggest problems are unclear ownership, poor source-of-funds evidence, nominee structures, inexperienced management, weak local control and unrealistic fintech projections.
- Clear ultimate beneficial ownership structure
- Traceable capital and lawful source of funds
- Fit and proper shareholders and managers
- Real management capacity and regulatory understanding
- No artificial “mailbox jurisdiction” setup
Corporate form
The applicant has to be a Bulgarian company. In practice, most foreign founders first handle local incorporation and then prepare the licensing file through that entity. The exact business structure depends on strategy, ownership, governance, and capital-raising plans, but the central point is that the EMI permit attaches to a Bulgarian legal person, not to a roaming founder personally.
A limited liability company can work in some setups, though many serious regulated projects eventually lean toward a structure that is easier to govern, finance, and present to institutional partners. The wrong business structure at the start can create needless friction later, especially if investors enter, board composition changes, or future group reorganizations become necessary. Cheap structuring can become expensive very fast. That is one of the dull truths of regulated finance.
If you are still at the stage of forming the local vehicle, you should treat the company formation and licensing plan as one combined exercise, not two unrelated errands. Too many entrepreneurs build the shell first and discover later that the corporate architecture does not match the prudential story they need to tell BNB.
Shareholder fit and proper
Shareholders, especially anyone with a qualifying holding, must pass a fit and proper review. This is not just about criminal records. It reaches into reputation, financial standing, source of wealth, source of funds, transparency of ownership chain, group structure, and whether the regulator can supervise the applicant effectively once those owners are in place.
This part gets messy with layered offshore holdings, nominee arrangements, undocumented founder loans, vague crypto wealth narratives, and investors who think “commercial sensitivity” means they do not have to explain themselves. That may work in a pitch room. It does not work with a central bank.
You should expect scrutiny around at least these points:
- ultimate beneficial ownership and control over the applicant
- financial capacity of shareholders to support the institution
- lawful source of funds used for capital and setup
- absence of legal, regulatory, or reputational issues that would undermine prudent supervision
And yes, financial professionals can become irrationally suspicious of unfamiliar documentation formats. The same way some solicitors treat Revolut statements as though the paper itself were contagious, some licensing files run into extra friction because a source-of-funds trail is technically valid but presented in a format reviewers dislike. The lesson is not to argue with the universe. The lesson is to over-prepare the paper trail until nobody has to guess.
Management presence
Management is where a lot of flashy projects quietly fall apart. BNB will want to see real managers, with real competence, devoting real time to the institution. Not rented names. Not decorative directors with six other jobs and no operational grip on the proposed model.
The applicant needs a management body and senior function holders who understand payment systems, safeguarding, AML, internal controls, information security, outsourcing, complaints, incident handling, and the ordinary daily payment operations of the institution. Depending on the structure, there may also need to be a meaningful local presence in Bulgaria. Even where the law does not require every executive to sit permanently in Sofia, the regulator will still look at whether the institution can actually be directed and controlled in a coherent way from its licensed home state.
Remote process thinking has limits here. You can absolutely handle large parts of incorporation, drafting, and file preparation from abroad. But if your operating model implies that Bulgaria is just a stamp while the mind and muscle of the enterprise live somewhere else entirely, you are asking for a rude education.
Prepare the application
This stage is where optimism meets paperwork and usually loses a few teeth. A serious EMI licensing process is not just collecting forms. It is building a convincing regulatory narrative supported by documents, policies, controls, financial projections, and people who can defend the file under scrutiny.
Business plan
The business plan has to do much more than describe the product. It needs to explain the institution’s proposed activities, customer segments, geographic focus, revenue model, transaction assumptions, safeguarding setup, outsourcing model, IT infrastructure, staffing, governance, and financial projections. BNB is trying to judge viability and prudence at the same time.
A thin plan full of market adjectives is worse than useless. You need a document that shows the logic of the institution. Why this EMI. Why Bulgaria. Which payment services. Which channels. Which currencies. Which user journey. Which fraud controls. Which merchants. Which banks. Which partners. Which risks. Which mitigation. If your own team cannot read the plan and see the operating model with unpleasant clarity, it is not ready.
Founders often underestimate the degree to which the projections have to connect with operations. If you forecast aggressive customer acquisition, there had better be support staff, AML capacity, fraud monitoring, complaint handling, and enough capital to absorb a slower ramp. If you project instant euro payments at scale, your technical and banking infrastructure has to support that claim. Regulators are not obliged to believe your spreadsheet just because it is colorful.
Policy set
The policy stack is where the application starts to look like a regulated institution rather than a startup story. You typically need policies and procedures covering AML and counter-terrorist financing, safeguarding, risk management, internal control, governance, outsourcing, data protection interfaces, incident reporting, complaints handling, conflicts of interest, security, business continuity, and internal audit or equivalent oversight arrangements depending on the size and structure.
This is also where third-party risk enters the room and refuses to leave. A lot of fintech operators rely heavily on core software vendors, KYC providers, processors, card program managers, cloud services, and external compliance support. Fine. Common. Even sensible. But the contracts can be nasty. High minimums, punitive termination fees, weak service-level commitments, problematic data localization terms, and cheerful promises that vanish the moment something breaks. Industry warnings on this point are justified. A bad outsourcing stack can poison the licensing case and the post-approval life of the firm.
There is a practical test I like here. Read the outsourcing arrangements and ask a simple question: when something goes wrong at 2:00 a.m., who is responsible to BNB? The answer is always the licensed entity. Not the vendor. That should sober people up.
Document pack
The application file usually includes constitutional documents, corporate records, shareholder data, management CVs and declarations, criminal record extracts or equivalents, evidence of capital, source-of-funds material, financial forecasts, program of operations, policy manuals, IT and security descriptions, outsourcing contracts or drafts, safeguarding arrangements, organizational charts, and fit and proper questionnaires.
It is a lot. More importantly, it all has to agree with itself. The ugly failures are rarely dramatic. They are inconsistencies. One ownership percentage in the corporate chart, another in the shareholder declaration. One staffing model in the business plan, another in the financial forecast. A safeguarding description that does not match the draft bank correspondence. A policy referring to products the application does not actually seek approval for. Death by contradiction.
A compact way to think about the file is this:
| Application block | What BNB is really testing |
|---|---|
| ownership and management | whether trustworthy people control the applicant |
| financial model and capital | whether the institution can start and survive prudently |
| policies and controls | whether compliance exists outside the marketing deck |
| IT, outsourcing, safeguarding | whether customer funds and operations can be protected in the real world |
Typical EMI License Application Checklist
A strong EMI application is not only a legal formality. It is a complete regulatory file showing how the institution will operate, control risk and protect customer funds.
Meet capital and governance rules
This is where the romance really drains out of the project. EMI licensing is expensive enough to filter unserious applicants, and governance obligations continue long after the authorization lands.
Initial capital
An electronic money institution must hold the statutory initial capital required by law. Under the EU framework as implemented nationally, the figure commonly cited for a full EMI is EUR 350,000, though founders should always check the current legal text and any practical guidance because regulated thresholds are not a place for memory games. Capital must be real, traceable, and available. Not promised. Not vaguely “committed.” Not built out of accounting fog.
The capital story is also tied to source-of-funds evidence. If the shareholders are injecting the money, BNB will want a clean and credible trail. This is another area where people become irritated by bureaucracy, but honestly, some irritation is deserved. When an institution wants permission to handle other people’s money transactions, proving where its own setup money came from is not an outrageous ask.
Own funds
Initial capital gets you through the front door. Own funds requirements continue afterward. EMIs must maintain ongoing capital adequacy in line with the legal methods applicable to their activity levels and risk profile. That means your prudential life does not end on licensing day. It begins there.
The business model has to generate enough income, or at least enough support, to maintain the institution responsibly while meeting own funds requirements, compliance staffing, external audit costs, safeguarding mechanics, and technology obligations. Some applicants underestimate this badly. They focus on the permit and forget the organism that has to live afterward.
A simple table makes the point better than another sermon:
| Prudential concept | Why it matters after authorization |
|---|---|
| initial capital | proves the firm can launch with minimum substance |
| own funds | ensures ongoing financial resilience as activity grows |
| safeguarding | protects customer funds from the firm’s own insolvency risk |
| reporting | lets BNB monitor whether the institution remains sound |
Control framework
Governance is not there to decorate the file. The institution needs a defensible control framework with clear reporting lines, segregation of duties where proportionate, risk oversight, compliance capability, AML function, and some credible internal review mechanism. In larger or more ambitious firms, internal audit expectations become harder to dodge.
The regulator wants to see who approves products, who monitors suspicious activity, who reviews incidents, who oversees outsourcing, who signs off financial reports, who handles complaints, and who can stop a bad idea before it harms users or breaches the law. If all roads lead back to one founder with a laptop and a heroic self-image, the governance answer is no.
Capital Is Only the Entry Point
The statutory capital threshold is not the full cost of becoming an EMI. Founders must also budget for legal preparation, compliance design, AML systems, IT security, safeguarding banking arrangements, accounting, audit, reporting and operational staff.
Set up AML, IT, and safeguarding
This part is not side compliance. It is core licensing substance.
AML comes first because an EMI sits in the bloodstream of money movement. You need customer due diligence, risk scoring, transaction monitoring, sanctions screening, suspicious activity escalation, recordkeeping, staff training, and a clear governance chain around money laundering risk. The exact calibration depends on your product, channels, geography, and customer base. A simple domestic wallet for low-risk Bulgarian customers is one thing. Cross-border digital remittance solutions serving multiple jurisdictions with online onboarding and fast monetary transfers are another universe entirely.
IT and security have become equally central. You need system architecture that can support authentication, transaction integrity, user access control, logging, incident detection, vendor oversight, and business continuity. Resilience is no longer optional fluff for regulated firms. If your payment hub goes dark, users do not care that the root cause sits with a subcontracted provider in another time zone. BNB will not care either.
Safeguarding is the non-negotiable financial spine. Customer funds received in exchange for electronic money or for execution of payment transactions must be protected under the legal methods allowed, usually by segregation in dedicated accounts with credit institutions or through comparable mechanisms permitted by law. The institution cannot dip into those funds to solve its own working-capital headaches. This sounds obvious. Under stress, people still try clever shortcuts. Those shortcuts usually end in correspondence with the regulator that nobody enjoys.
There is also a practical banking angle here. Your safeguarding and operational account structure depends on banks willing to onboard the model, understand the flows, and support the institution’s categories of payments. Banking friction is one of the least glamorous and most consequential parts of the whole project. You can have immaculate legal memos and still lose months if the account setup and transaction explanation are weak.
What happens after approval?
Explore Related Regulated Business Licenses in Bulgaria
EMI licensing is part of a wider regulated business landscape. If your project involves digital assets, payment flows, online platforms, customer funds, KYC, AML controls or cross-border EU operations, these related Bulgarian licensing guides can help you compare the right route before committing to a full application.
Approval is not the end of the EMI licensing process. It is the moment the real burden starts charging rent.
Once licensed, the institution enters the relevant register and becomes subject to ongoing supervision, periodic reporting, prudential monitoring, AML obligations, audit expectations, incident notification rules, changes-in-control oversight, and approval or notification requirements for certain material changes. If it wants to passport into other EEA member states, it follows the notification route through BNB. If it changes managers, shareholders, outsourcing architecture, or business model materially, that can trigger fresh regulatory interaction.
The first months after approval are usually the most revealing. Policies that looked elegant on paper meet actual users, actual fraud attempts, actual reconciliation breaks, actual support tickets, and actual deadlines. This is where institutions learn whether they built compliance theater or an operating system.
You should expect ongoing obligations around at least these themes:
- safeguarding reconciliations and segregation discipline
- own funds monitoring and prudential calculations
- regular reports to the Bulgarian National Bank
- AML reviews, suspicious transaction handling, and staff controls
- audit, accounting, tax, and corporate compliance in Bulgaria
That last line is where some foreign founders get blindsided. The EMI does not float above ordinary legal compliance. It is still a Bulgarian company with bookkeeping, annual filings, tax exposure, employment issues if staff are hired locally, and every other adult obligation that comes with running a supervised enterprise. Regulated glamour still needs accounting.
If the institution plans to operate across borders, passporting adds another layer of housekeeping. You may need local disclosures, local consumer-facing documentation adjustments, language changes, and host-state conduct sensitivity even when the home authorization remains Bulgarian. A legal right to enter EU markets does not spare you from operational adaptation.
Banking and Safeguarding Can Delay the Project
In practice, many EMI projects are delayed not by the basic legal rule, but by banking, safeguarding account setup, AML workflows, vendor contracts and unclear transaction flows. These elements should be prepared before the formal application strategy is finalized.
FAQ
How long does an EMI license in Bulgaria take?
It depends on the quality of the file, the complexity of the model, and how quickly the applicant answers follow-up questions. Serious cases often take several months, sometimes longer. People who promise absurdly fast outcomes are usually selling optimism, not legal realism.
Can a foreigner own a Bulgarian EMI?
Yes, foreign shareholders can own the applicant, but they must pass fit and proper review, disclose beneficial ownership, and provide satisfactory source-of-funds and reputation evidence. Foreign ownership is normal. Opaque ownership is the problem.
Do you need to be physically present in Bulgaria?
Not for every single preparatory step. Much of the process can be handled remotely through local counsel and properly prepared corporate documents. Still, management presence, substance, banking, interviews, and practical supervision issues mean you should not treat Bulgaria as a mailbox jurisdiction.
Is an EMI the same as a bank?
No. An EMI can issue electronic money and provide payment services, but it cannot take deposits as a credit institution does. That legal distinction affects how customer funds are handled, how products are described, and how the institution is supervised.
Can a Bulgarian EMI serve clients across Europe?
Yes, through EU passporting into EEA member states after authorization and proper notifications. The EBA registers portal is useful for checking how these institutions are tracked across the European framework.
What is the biggest practical obstacle?
Usually not the headline law. Usually execution. Weak governance, messy ownership evidence, bad outsourcing contracts, thin AML systems, unrealistic projections, and banking friction kill more projects than the basic legal concept ever does.
Conclusion
Bulgaria offers a credible route to an EMI license for founders who want regulated access to the EU market and understand that this is a prudential exercise, not a branding exercise. The framework is legitimate, the authorization can support cross-border growth, and the jurisdiction remains commercially attractive for international entrepreneurs. All true.
The part people resist is the discipline. You need the right business structure, enough capital, clean shareholders, competent management, a persuasive application, serious AML controls, resilient IT, proper safeguarding, and the patience to deal with a regulator that is doing exactly what it should do. Which is to ask hard questions before giving anyone permission to touch customer money.
That is the real answer on EMI license Bulgaria. It is a strong option. It is not a shortcut. If your project can survive that truth, then Bulgaria is worth a hard look.
Comparing e-money with payments or investment permissions? Visit the Bulgarian business licensing hub.
Daniel Malbašić is a business expert with extensive experience in the field of business consulting, organization and business optimization. His expertise includes market analysis, strategic planning, and implementation of effective business solutions. Daniel is dedicated to helping companies grow and improve their operations, providing them with comprehensive support in making key business decisions.