Blockchain activity in Bulgaria is driven mainly by the private sector, supported by a strong information technology, software-development and financial technology base. The most visible use remains in financial services, particularly crypto-asset trading, custody, payments and related technology services. Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) has also given this part of the market a much clearer regulatory footing, with the Financial Supervision Commission (FSC) acting as the principal competent authority for crypto-asset service providers (CASPs).

Beyond financial services, Bulgarian technology companies are active in smart-contract development, tokenisation, Web3 infrastructure and blockchain-based software solutions. Distributed ledger technology (DLT) is also being explored for areas such as digital identity, document verification, certification and supply-chain traceability, although adoption there is still more limited.

Public-sector use remains modest. Most activity has come through participation in European Union initiatives, including the European Blockchain Partnership and the European Blockchain Services Infrastructure, with use cases around digital identity, notarisation and educational credentials.

Overall, blockchain in Bulgaria is still much more visible as a commercial technology and financial-services tool than as part of day-to-day public administration.

The legal framework is primarily activity- and asset-based rather than technology-based. There is no general Bulgarian statute regulating blockchain or distributed ledger technology (DLT) as such.

For crypto-assets, the principal framework is the MiCA Regulation, supplemented domestically by the Markets in Crypto-Assets Act. The Financial Supervision Commission is the main competent authority for the authorisation and supervision of crypto-asset service providers and issuers within its remit, while the Bulgarian National Bank has competence in relation to e-money tokens and certain supervised entities.

Since 1 July 2026, following the end of the Bulgarian transitional regime, regulated crypto-asset services may generally be provided only by duly authorised providers.

Where a token qualifies as a financial instrument, MiCA does not apply. The project instead falls within the securities and investment-services framework. Regulation (EU) 2022/858, establishing the DLT Pilot Regime, is particularly relevant for tokenised financial instruments and permits certain DLT-based trading and settlement infrastructures to operate under specific permissions and exemptions.

Other rules may become relevant depending on the business model, including those on anti-money laundering, payments, electronic money, data protection, consumer protection and digital operational resilience under Regulation (EU) 2022/2554 (DORA).

The regulatory path therefore depends less on the use of blockchain itself and more on what the token represents and what service is being provided. Further development is likely to come mainly through supervisory practice under MiCA and the DLT Pilot Regime rather than through a separate Bulgarian blockchain code.

The attitude of the Bulgarian authorities towards blockchain technology is generally supportive, with increasing emphasis on regulatory compliance, market integrity and consumer protection.

In the financial sector, the FSC has shown a willingness to engage with fintech and crypto businesses. Its Innovation Hub provides a single point of contact for companies developing innovative financial products or business models. Applicants can enter into an informal dialogue with the FSC and receive non-binding guidance on the regulatory framework applicable to their project, including whether an authorisation may be required. The Hub expressly covers areas such as crypto-assets, DLT-based financial instruments and smart contracts. The FSC is also working towards a regulatory sandbox framework.

The implementation of MiCA reflects the same approach. Bulgaria has introduced a full authorisation and supervisory regime for crypto-asset service providers, while the FSC has published licensing guidance and FAQs intended to make the process more transparent for market participants.

Public-sector use remains limited, while most practical adoption continues to come from private technology and fintech businesses.

The overall approach is therefore best characterised as innovation-friendly, but regulation-led rather than technology-led.

Bulgaria does not have a separate national CBDC project. Since joining the euro area on 1 January 2026, Bulgaria participates in the Eurosystem and is therefore part of the digital euro project led by the ECB.

The digital euro is intended to be a digital form of central bank money for retail payments, complementing rather than replacing cash. The project has moved beyond its initial investigation and preparation phases and is currently focused on technical readiness, market engagement and the EU legislative process. The ECB has stated that it aims to be ready for a potential first issuance during 2029, provided the necessary EU legislation is adopted.

A practical pilot is also under preparation. In July 2026 the ECB selected 36 payment service providers to participate, with testing expected to begin in the second half of 2027 and continue for 12 months. The pilot will be run by the ECB and 19 of the 21 euro area national central banks. The Bulgarian National Bank is not among the participating central banks, although as a Eurosystem member it is involved in the wider digital euro project. The legal basis for the digital euro is still being negotiated at EU level following the European Parliament’s approval of its position in July 2026.

Accordingly, the relevant CBDC development for Bulgaria is now European rather than national, with Bulgaria participating through its membership of the Eurosystem.

Crypto-assets are regulated in Bulgaria primarily under MiCA and the Markets in Crypto-Assets Act. Since 1 July 2026, services falling within MiCA generally require authorisation as a CASP in Bulgaria or passporting from another EU Member State.

For DeFi, the key question is whether the activity is genuinely decentralised. MiCA does not apply where services are provided in a fully decentralised manner without an intermediary. In practice, however, the use of smart contracts or a DAO structure is not enough on its own. If an identifiable person or entity controls the protocol, sets key parameters, operates the interface or otherwise provides the service, MiCA may still apply.

Accordingly, DeFi projects in Bulgaria should be assessed by looking at the actual functions performed and who exercises control, rather than relying on the technology or label used.

Crypto-asset activities in Bulgaria are subject to the general AML/CFT and sanctions framework. CASPs are required to apply customer due diligence, identify beneficial owners, monitor transactions, report suspicious activity and screen customers and transactions against applicable sanctions.

In addition, the EU “Travel Rule” applies to crypto-asset transfers involving a CASP, requiring information on the originator and beneficiary to accompany the transfer. This brings crypto transfers considerably closer to the AML controls applicable to traditional payment transfers.

DeFi presents a more fact-specific issue. A genuinely decentralised protocol operating without an intermediary may fall outside obligations directed at regulated service providers. However, where a business operates an interface, controls access to a protocol, facilitates transactions or otherwise acts as an intermediary, its AML and sanctions obligations must be assessed based on its actual role rather than the “DeFi” label.

In practice, Bulgarian crypto businesses should expect AML and sanctions compliance to form part of the product design itself, particularly customer onboarding, wallet screening, transaction monitoring and transfers to or from self-hosted wallets.

Bulgaria does not apply a separate tax regime to crypto-assets or DeFi. Existing personal income tax and corporate income tax rules apply according to the nature of the transaction.

For individuals, gains from the sale or exchange of crypto-assets are generally taxable and must be reported in the annual tax return, while for companies, profits from crypto-related activities form part of the ordinary corporate tax base. Both personal income and corporate profits are generally taxed at a flat rate of 10%. DeFi activities, including staking, lending and liquidity provision, are assessed according to the economic nature of the particular transaction.

VAT treatment is more nuanced. A person carrying on crypto-related activities as an independent economic activity must consider VAT registration once the applicable annual turnover exceeds EUR 51,130. Registration, however, does not necessarily mean that VAT is charged on the crypto transaction itself. Following the CJEU’s Hedqvist judgment, the exchange of traditional currency for Bitcoin and vice versa is treated as an exempt financial transaction. Fees for brokerage, custody, platform access, advisory, software and other related services require a separate assessment.

The exemption can also have a less obvious consequence: businesses making exempt crypto-related supplies may have a restricted right to deduct input VAT on their own costs, potentially requiring proportional deduction where both taxable and exempt activities are carried on.

The main challenge is usually the correct identification and proper recording of the taxable event and its value in euro, particularly where transactions involve token-to-token exchanges, DeFi protocols or multiple wallets.

The regulatory treatment of a tokenisation project turns first on what is being tokenised and what rights the token gives to its holder.

A retail project involving a token that falls within MiCA will generally follow the crypto-asset framework. If, however, the token represents a share, bond or another financial instrument, the project moves into the securities and investment-services regime instead. That distinction affects not only issuance, but also how the token may be marketed, traded and held.

For wholesale projects, the EU DLT Pilot Regime is particularly relevant because it allows certain market infrastructures for tokenised financial instruments to operate on distributed ledger technology under a specific permissions framework. Bulgarian legislation gives the FSC competence to grant the relevant permissions for DLT trading and settlement infrastructures.

There is no prohibition on holding or trading crypto-assets. This aplies also and to proprietary trading, where a company buys and sells crypto-assets for its own account and with its own funds. Such activity does not, by itself, constitute a crypto-asset service requiring CASP authorisation under MiCA.

The position changes where the business provides services to clients. Operating a crypto-asset trading platform, executing client orders, providing custody, crypto exchange, and other services listed in MiCA are regulated activities and require prior CASP authorisation by the FSC. The distinction can become particularly important where a firm trades as principal while interacting directly with clients, as the activity may constitute the regulated service of exchange of crypto-assets under MiCA.

Certain conduct is expressly prohibited, including insider dealing, unlawful disclosure of inside information and market manipulation. Providing regulated crypto-asset services without the required authorisation is also prohibited.

Bulgaria saw a number of ICO projects during the earlier growth of the crypto market, particularly around 2017–2018, but there was no dedicated national ICO regime. The authorities approached such offerings through existing financial, AML and consumer-protection rules and even warned potential investors of their significant risks.

MiCA has substantially changed the position. An ICO involving a public offer of crypto-assets in Bulgaria must now be assessed under the relevant MiCA issuance regime. For crypto-assets other than asset-referenced tokens (ARTs) and e-money tokens (EMTs), the issuer has to be a legal person and, unless an exemption applies, prepare, notify and publish a crypto-asset white paper, together with the required marketing communications.

Stricter requirements apply to ARTs and EMTs, including specific authorisation requirements for their issuers. Conversely, MiCA provides exemptions for certain offers, including offers to fewer than 150 persons per Member State or offers with a total consideration not exceeding EUR 1 million over 12 months, subject to the conditions in MiCA.

If the token qualifies as a financial instrument, the ICO falls outside MiCA and the securities framework applies instead, potentially including prospectus requirements.

For a prospective issuer, token classification should therefore come before drafting the white paper or structuring the sale: it determines whether the offering follows MiCA, the securities regime, or benefits from an exemption.

There is currently no dedicated property-law regime for crypto-assets, so the legal effect of a transfer or security arrangement remains tested against general civil and commercial law.

For straightforward transfers, the blockchain record will usually evidence that the asset has moved from one wallet to another. The harder questions arise when that transfer has to be recognised against third parties, challenged in insolvency, or used as collateral. In those cases, control over the wallet and private keys becomes legally significant, but it does not by itself resolve questions of ownership or perfection of security.

Where a CASP holds crypto-assets for clients, MiCA adds a further layer by requiring those assets to be safeguarded and kept protected from use for the provider’s own account.

The real issue is whether the on-chain arrangement is matched by a legally effective off-chain structure, particularly where collateral or insolvency risk is involved. If there is no effective off-chain legal structure, the parties may have technical control of the crypto-assets without having a security interest or ownership position that is enforceable against third parties. In a default or insolvency scenario, that can mean the creditor is treated as unsecured, or that the asset becomes subject to competing claims despite the on-chain arrangement.

Smart contracts are not recognised as a separate category of contract under Bulgarian law. Their enforceability therefore depends on the ordinary rules of contract law – there must be valid consent, sufficiently certain terms and a lawful purpose, together with any mandatory form required for the particular transaction.

A smart contract may serve different legal functions. The code itself may embody the parties’ agreement, or it may simply automate performance of a separate legal contract. The distinction matters because blockchain execution is not necessarily the same as legal performance. Code may execute a transaction even where the underlying agreement is invalid, has been terminated, or the execution results from an error or incorrect external data.

This creates a practical enforcement issue that is less common with traditional contracts: the law may recognise a right to reverse a transaction, while the blockchain cannot technically reverse it. The remedy may then be an off-chain claim for restitution or damages against an identifiable counterparty rather than reversal of the on-chain transaction.

For material transactions, it is therefore advisable to document how the legal agreement and the code interact, including which prevails if they produce different results and how errors or failed external data inputs are handled.

A Decentralised Autonomous Organisations (DAO) can operate technically in Bulgaria, but the law will still look for the persons or entities standing behind it when legal rights and obligations arise.

This means that a DAO which needs to contract with service providers, employ staff, hold bank accounts or assets, or obtain regulatory permissions will usually require a conventional legal entity alongside the on-chain governance structure. The same applies where the project provides regulated crypto-asset services – decentralised governance does not prevent MiCA from applying if identifiable persons or entities are in fact operating or controlling the service.

The most important consequence is liability. Without a legal wrapper, it may be unclear who is the contractual counterparty, who owns project assets and who is responsible for losses or regulatory breaches. This can expose founders, developers or other active participants to claims that would otherwise sit with an incorporated entity.

There have been regulatory interventions concerning crypto-asset activities, although enforcement practice under the MiCA regime is still developing.

The FSC has taken action against providers that were no longer entitled to offer crypto-asset services and has increased its focus on unauthorised activity, customer complaints and compliance with licensing requirements. Following the end of the transitional regime on 1 July 2026, firms providing regulated crypto-asset services without the required authorisation are expected to cease those activities.

The FSC also publishes warnings concerning entities that are not authorised to provide regulated financial or crypto-related services.

For now, the enforcement focus is moving towards licensing status, client-facing conduct and compliance with MiCA requirements. Operating without the correct authorisation is therefore now a clear supervisory and enforcement risk that resulst in forced cessation of the relevant activity.

Several areas of Bulgarian law require particular attention when blockchain technology is used, even where no sector-specific blockchain rule applies.

Data protection is one of the clearest examples. The GDPR applies together with the Bulgarian Personal Data Protection Act. This can sit uneasily with blockchain immutability, especially where personal data is written directly on-chain and later becomes subject to rights of rectification or erasure. The EDPB’s 2026 blockchain guidance therefore favours architectures that avoid storing identifiable personal data directly on-chain where possible. It also indicates that blockchain solutions should be designed so that relevant information can be erased or effectively rendered anonymous.

Insolvency and enforcement are governed mainly by the Commerce Act, the Obligations and Contracts Act and, where security is involved, the Special Pledges Act. The difficulty is practical as much as legal: if crypto-assets are held in a self-hosted wallet, an insolvency administrator or creditor may have a valid claim but still be unable to realise the asset without control of the private keys. Bulgarian insolvency law also allows certain transactions and security interests created shortly before insolvency to be challenged, so transferring crypto-assets on-chain does not make them immune from clawback rules.

Consumer-facing projects must also consider the Consumer Protection Act, particularly where standard terms govern access to a wallet, exchange or blockchain-based service. Provisions that heavily limit liability, allow unilateral changes or place excessive risk on the user may be vulnerable under the rules on unfair contractual terms.

Bulgarian courts have already applied ordinary contract law to crypto-related arrangements. The Supreme Court of Cassation has dealt with a dispute arising from a Bitcoin mining-services contract and ordered repayment of amounts due under the agreement, illustrating that crypto-related contracts remain subject to conventional contractual remedies.

One point increasingly relevant in practice is that blockchain projects rarely fit neatly within one jurisdiction. A Bulgarian company may have developers locally, token holders across the EU, a foundation or operating company abroad and infrastructure that is decentralised geographically. Establishing which entity performs each regulated function, and from where, can therefore be as important as analysing the technology itself.

MiCA passporting has made the EU dimension particularly significant. Bulgaria can serve as the home Member State for an authorised CASP operating across the EU, while Bulgarian users can equally be served by CASPs authorised elsewhere following the relevant passporting notification.

The position is more restrictive for providers established outside the EU. A third-country CASP that actively targets or solicits customers in Bulgaria cannot generally rely on the fact that it has no establishment in the EU. Providing MiCA-regulated services to EU clients requires the appropriate authorisation. The exception for reverse solicitation is deliberately narrow and applies only where the client approaches the third-country provider at the client’s own exclusive initiative. MiCA expressly prevents firms from manufacturing that result through disclaimers or contractual wording.

This makes marketing strategy particularly important. EU-facing advertising, local-language campaigns, affiliates, influencers or other forms of solicitation can undermine a reverse-solicitation argument. Even where a Bulgarian client first approaches the provider independently, that does not give the provider a general right to market additional types of crypto-assets or services to that client.

Another consideration is the interaction with banks and other traditional service providers. Regulatory permissibility does not guarantee access to banking, payment or professional services on the same terms as an ordinary technology company. The ability to explain the source and flow of funds, ownership structure and compliance model can therefore have a direct impact on whether a blockchain business can operate effectively.

Finally, legal practitioners should expect the framework to continue developing through supervisory practice. MiCA is now in force, but many questions will be shaped by the FSC, European supervisory authorities and ultimately the courts as real business models are tested against the new rules. For new projects, this makes regulatory strategy an ongoing part of the business model rather than a one-off licensing exercise.