BULGARIA KYC, KYB AND AML

Scale Identity Verification and KYC Operations in Bulgaria

Q: Is the Bulgarian identity card accepted for identity verification under MAMLA?

It is the primary identity document for citizens, compulsory from age 14. Shufti reads the chip on the 2024 biometric card and pairs it with a biometric check for high-assurance onboarding.

Q: Can EU nationals onboard with their national ID card?

Yes. EU and EEA national identity cards are recognised for Bulgarian onboarding under the EU AML framework, and AMLR keeps them valid from July 2027. Shufti verifies them with document, biometric and chip-based checks in one flow.

Q: Does Bulgaria use goAML?

Yes. Bulgaria's Financial Intelligence Directorate receives suspicious transaction reports through the goAML system. Shufti structures verification and screening evidence so those reports can be filed without a manual scramble.

Q: What documents are required for KYB in Bulgaria?

Typically a Commercial Register extract from the Registry Agency, the 9-digit Unified Identification Code, the BG VAT number, and beneficial ownership details from the Commercial Register. Shufti verifies these in real time and screens the UBOs behind them against sanctions and PEP lists.

Q: How are Bulgarian name variants handled in screening?

Matching applies the 2009 Bulgarian transliteration standard, so Cyrillic and Latin versions of a name resolve to the same person and false positives stay low.

Q: How long must AML records be retained in Bulgaria?

Under MAMLA Article 67, records are kept at least five years after the relationship or occasional transaction ends. The FID can add up to two years. From 10 July 2027 AMLR Article 77 sets five years, extendable case by case. Shufti logs evidence to support retention.

Q: Is EU-region data hosting available?

Yes. Shufti offers EU-based cloud regions, so Bulgarian customer data stays in-region in line with GDPR. On-premise deployment is available where residency requirements are stricter.

Q: What changes for Bulgaria under AMLR from July 2027?

AMLR applies directly, so no Bulgarian transposition law is needed. It sets out two permitted routes, document-based and eIDAS-based, so notified eIDs, the EUDI Wallet and qualified trust services sit beside document and biometric checks, and it sets the ownership test at 25% or more, or control.

Q: Will QES alone satisfy identity verification under AMLR?

A qualified electronic signature is a qualified trust service AMLR recognises for remote verification. Shufti runs QES flows that work under Bulgarian law today and carry over when AMLR applies, with the signing identity check running through the Evrotrust eID.

Q: How does Shufti support businesses supervised by the FID and the BNB?

Shufti connects identity verification, KYB, AML screening, QES, account verification and decision evidence in one configurable workflow. This helps obliged entities within the FID's and the BNB's supervisory remit reduce manual hand-offs, standardise compliance records and prepare clearer evidence for internal audit and applicable supervisory review.

Verify Bulgarian customers and businesses through the Evrotrust eID, NFC, QES, identity documents, biometrics and KYB. Bulgaria is under FATF increased monitoring (statement of 19 June 2026), so audit evidence matters. One workflow supports MAMLA today and AMLR from 10 July 2027.

Trusted by 2000+ businesses that make identity decisions at scale

Operational Performance for Bulgaria KYC

Our Numbers Speak Volumes

98.68%

First-Pass
Verification Rate

< 10 sec

Median
Verification Time

Verification Routes
Live Today

THE BULGARIA VERIFICATION GAP

Bulgaria IDV/KYC Challenges

Two Scripts, One Identity

Bulgarian identity documents carry both Cyrillic and Latin under the 2009 transliteration standard. When international databases strip the Cyrillic or mismatch the two scripts, names fail matching and clean customers get declined.

A New eID That Is Still Ramping

Bulgaria's notified Evrotrust eID and the chip in the 2024 biometric ID card are still growing in everyday use. Flows that assume every customer has an active eID fall back to manual uploads that are slower and easier to spoof.

Ownership Has Been Hard to See Through

Bulgaria holds beneficial-ownership data in the Commercial Register, but public access narrowed after the 2022 CJEU ruling. Layered holdings behind an OOD or AD still slow UBO identification.

Registry Data Is Not Verification

The Commercial Register confirms a company exists and carries its UIC, not who controls it or whether they are sanctioned. KYB needs screening layered on top of registry lookups.

Regulatory Update

What AMLR Changes for Identity Verification in Bulgaria

The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in Bulgaria from 10 July 2027, with no transposition period. MAMLA must be adapted to sit alongside it, and AMLA in Frankfurt begins direct supervision of selected cross-border entities from 2028.

Timeline

End of 2026 Member State wallet issuance deadline (eIDAS 2.0)
10 July 2027 AMLR applies directly
Late 2027 In-scope relying parties accept wallets (Art 5f)
2028 AMLA direct supervision begins

eIDAS Is Expressly Recognised

Article 22(6) gives two routes, an identity document backed by reliable, independent sources, or eIDAS eID at level substantial or high with qualified trust services. Both are valid. Evrotrust eID and QES sit in the eIDAS route. Record which route you use and why.

The Ownership Test Tightens

AMLR sets the ownership test at 25% or more, assessed with control. The Commission may lower it, floored at 15%, for higher-risk categories.

Existing Customers Get Re-Checked

AMLR expects existing customer records to be brought up to standard on a risk basis, not just new onboarding. Continuous monitoring keeps back-book files current between reviews.

Accountability Stays With You

Article 18 keeps customer due diligence accountable with the obliged entity even when verification is outsourced, so vendor evidence and clean audit trails matter more under AMLR.

Book an AMLR Readiness Demo

FOR BUSINESSES SUPERVISED BY THE FID AND THE BNB

Streamline FID- and BNB-Supervised Onboarding in Bulgaria

Connect identity verification, qualified signing and account confirmation in one flow anchored in MAMLA Article 55 and the BNB's 2023 remote onboarding guidelines.

Verify the Customer

Confirm identity through the Evrotrust eID, NFC chip reading of the 2024 biometric identity card, or document-plus-biometric checks with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness.

Complete Qualified Signing

Apply and validate the QES within the same journey, keeping the signed document, verification result and supporting evidence together. Bulgaria is a notified-eID country, so the signing identity check runs through the Evrotrust eID.

Confirm the Payment Account

Penny Drop Verification supports account-ownership checks alongside the own-account first-payment measure in MAMLA Article 55 and BNB guidance.

Book a Bulgaria Compliance Demo

Shufti's IDV/KYC Solutions for Bulgaria

KYC Solutions

Built to support the KYC obligations in the markets you operate in. Shufti verifies age and address in the same flow as identity checks.

Explore More

Face Verification

Face verification binds the live person to the document with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness, stopping spoofs, masks and deepfakes.

Age Verification

Selfie-based age estimation, with document verification where needed, supporting age checks in age-restricted sectors such as online gambling and e-commerce.

Bank Account Verification

Confirms a Bulgarian bank account (BG IBAN) belongs to the customer, returning the registered account holder name for matching against the verified identity.

Address Verification

Shufti verifies Bulgarian address-bearing documents, including utility invoices, telecom bills and bank statements from major Bulgarian issuers. Proof-of-address checks remain common in regulated onboarding.

Document Verification

Shufti verifies Bulgarian identity documents including the biometric identity card and passport, with dual-script Cyrillic and Latin OCR built in. NFC chip reading captures the data on the 2024 card. Remains a permitted route under AMLR.

Identity Verification

Shufti confirms every customer is real and present, not a spoofed or synthetic identity. Biometric face matching and liveness detection run against 10,000+ actively processed document types.

KYB Solutions

Every business you onboard is obligated to undergo the same scrutiny as the people behind it. Shufti checks registry records, beneficial ownership, and VAT details in real time, then screens UBOs against 4,000+ global watchlists for sanctions and adverse media exposure.

Explore More

Business Verification

Automated validation of Commercial Register data, the 9-digit Unified Identification Code, the BG VAT number, and appointed directors. Reduces manual registry lookups and onboarding delays.

Enhanced Due Diligence (EDD)

Structured risk profiling for complex ownership chains, cross-border entities and high-risk sectors, supporting Bulgaria's risk-based AML obligations under MAMLA.

AML Screening

Shufti screens customers and transactions in 240+ countries and territories, flagging sanctions, PEP, and adverse media matches as they happen. Ongoing monitoring surfaces suspicious activity in time to meet local reporting obligations.

Explore More

AI Compliance Copilot

Helps compliance teams review verification and AML data, investigate alerts, and understand the reasoning behind risk signals. It brings relevant case information together to support faster, more consistent compliance decisions.

Transaction Monitoring

Ongoing transaction monitoring calibrated to Bulgarian financial flows flags anomalies against AML rules, supporting the risk-based controls the BNB and the FID expect.

Supported Verification Methods for Bulgaria

Every Verification Route Bulgaria Uses, in One Platform

Shufti supports the full range of remote verification routes used in Bulgaria, from the EUDI Wallet and the notified Evrotrust eID to document and biometric checks. Each method below shows what is live today and what is ready for the 2027 rollout.

EUDI Wallet

Wallet-ready · from 2027

AMLR Article 22(6) recognises eIDAS eID, including the EUDI Wallet, for verification. Bulgaria is preparing its wallet under eIDAS 2.0. Shufti is built to accept wallet-based verification as the Bulgarian wallet goes live.

Notified eID

LiveeIDAS Substantial/High

Evrotrust is Bulgaria's notified eID scheme under eIDAS, used through the Evrotrust app. B-Trust from BORICA is a widely used qualified trust service for identity and signing, not a notified eID. Shufti verifies these today.

Learn more

Docless Database (eIDV)

Live

Database-driven verification confirms identity in seconds for low-risk onboarding with no document upload, using permitted reference data sources. Shufti escalates to stronger checks as risk rises.

Learn more

NFC Chip Verification

Live

Shufti reads the secure chip in the Bulgarian biometric identity card, the residence permit and the Bulgarian ePassport. This is the high-assurance capture route where eID activation is still ramping.

Learn more

Document and Face Biometric

Live

Permitted by AMLR Article 22(6)(a). Document authentication of the Bulgarian identity card, residence permit and ePassport, paired with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness to confirm a real, present person.

Learn more

Qualified Electronic Signature

Live

A qualified electronic signature is a qualified trust service recognised under AMLR. Shufti runs eIDAS-qualified signing powered by Evrotrust, producing PAdES-LTV signatures. Evrotrust is also the notified eID scheme and performs the signing identity check, so one CRC-supervised provider underpins eID, QES and identity proofing.

Learn more

Book a Bulgaria KYC Demo

Independent Validation

Shufti's Recognition Across Independent Evaluations

Ranked Exceptional in the Liminal Index 2026 for age estimation

View Report arrow-icon

Differentiated by Gartner on document diversity and country coverage

Certified at iBeta Level 3 PAD with 0% APCER

Read Blog

Broadest global reach in the 2025 KuppingerCole Extended IDV report

Download Report arrow-icon

Ranked Top 5 in the DHS RIVR 2025 for identity validation

Read Blog

Top Vendor for Product Execution in the Liminal Index for KYC 2026

View Report arrow-icon

Ranked Exceptional for age verification by Liminal Index 2026

View Report arrow-icon

Recognised as a Leader in G2 Fall 2026 reports

Trust signal graphic for Shufti age verification performance ranking

Gartner recognition graphic for Shufti document diversity and country coverage

Analyst recognition graphic for Shufti verification accuracy

Sample Shufti verification report showing trust-signal check results

Shufti trust-signals report graph illustrating identity risk scoring

Liminal Index for KYC 2026 chart placing Shufti as a top vendor for product execution

Shufti trust-signals verification report overview panel

G2 Grid® for Identity Verification Software

Evidence-Ready Checks Across People & Businesses

Verifications with robust evidentiary support

Individual Documents We Verify

Highlights from 10+ Bulgarian documents:

View All Supported Documents

Bulgarian Identity Card (Lichna Karta)

Primary identity document for Bulgarian citizens, compulsory from age 14. Dual-script Cyrillic and Latin, with a chip on the biometric model issued from June 2024 by the Ministry of Interior.

Bulgarian ePassport (Zagranichen Pasport)

Machine-readable Bulgarian passport. Biometric and ICAO-compliant, with an NFC chip that supports chip-based checks for cross-border onboarding.

Residence Permit

Electronic residence permit for non-EU nationals in Bulgaria. Carries a biometric chip for remote, high-assurance identity verification.

Evrotrust eID

Bulgaria's notified eID scheme under eIDAS, used through the Evrotrust mobile app. Recognised for verification under AMLR Article 22(6)(b).

B-Trust (BORICA)

A widely used Bulgarian qualified identity and signing app from BORICA. Verified as a qualified trust service for high-assurance onboarding and signing.

Bulgarian Driving Licence (Svidetelstvo za Upravlenie)

Bulgarian driving licence, an identity document for citizens under Article 13 of the Bulgarian Personal Documents Act. Verified through document checks. It carries no eID function.

EU/EEA National ID Cards & Passports

National identity cards from EU and EEA states, accepted for Bulgarian onboarding. Verified against ICAO standards with document, biometric and chip-based checks.

Entity Identity

Commercial Register Extract (Targovski Registar)

Official extract from the Commercial Register and Register of Non-Profit Legal Entities held by the Registry Agency. Confirms a company's legal existence, registered office, legal form and directors for KYB.

Certificate of the Unified Identification Code (UIC/EIK)

Registry Agency record confirming the 9-digit Unified Identification Code, the primary entity identifier assigned on commercial registration.

Articles of Association (Uchreditelen Akt)

Founding deed and articles evidencing legal form, share structure and governance during KYB onboarding.

Tax Identity

VAT Registration Certificate

National Revenue Agency certificate confirming a valid VAT number in the form BG plus nine digits. Evidences that the entity is registered and trading legitimately during KYB.

Unified Identification Code (UIC/EIK)

Nine-digit code that also serves as the tax identifier for Bulgarian entities. Confirms a business is registered for tax and supports identity and KYB checks for onboarding.

Ownership & Control (UBO)

Commercial Register UBO Entry

Beneficial ownership record held in the Commercial Register under the Registry Agency. Shufti checks control data against it, applying AMLR's test of 25% or more, or control by other means.

UBO Declaration Form

Statutory declaration identifying the natural persons who own 25% or more of an entity or control it by other means. Shufti maps them to the people behind a Bulgarian company for UBO checks.

Directors and Legal Representatives

Listing of directors and legal representatives as a company's legal signatories. Screened against sanctions, PEP and adverse media lists during KYB.

Languages We Cover

Bulgarian and Cyrillic Parsing

Native Bulgarian-language parsing reads names, addresses and document fields in Cyrillic and Latin, so onboarding stays accurate for Bulgarian customers.

Name Matching and Transliteration

Name and address matching applies the 2009 Bulgarian transliteration standard, so Cyrillic and Latin variants resolve correctly and false mismatches stay low.

Cross-Document Consistency Checks

Cross-document consistency checks reconcile names and identifiers across the identity card, residence permit, Commercial Register extract and UBO records to catch mismatches.

Governance & Controls

Audit-Ready Decisions, Lower Operational Drag

Fewer Avoidable Re-submissions

Optimised capture for Bulgarian ID formats and the chip-enabled 2024 identity card cuts avoidable re-submissions and manual review.

Cleaner Audit Trails

Structured logs aligned to MAMLA record retention and FID reporting obligations keep every onboarding decision audit-ready.

Better Name Matching Outcomes

Matching applies the 2009 Cyrillic-to-Latin transliteration standard, reducing false declines and manual review on Bulgarian names.

One Workflow, One Back Office

KYC, KYB and AML screening are consolidated in one operational case view, so one back office team works on every customer file.

National ID-First Flow Design

Start onboarding with the Bulgarian identity card or passport as the primary route, with residence permits or driving licences accepted as supplementary evidence.

Continuous Compliance

Compliance that does not stop at onboarding

AMLR treats customer due diligence as a continuing obligation. Perpetual monitoring keeps the customer picture current between reviews, so risk is caught when it appears, not at the next annual check.

Surface Changes as it happens

Detect

Perpetual monitoring flags risk when it appears, not at the next annual review. Behavioural biometrics, background fraud signals, and ongoing sanctions and PEP screening watch every active relationship.

Step up when the signal fires

Verify

When a signal fires, re-verification confirms the person or the ownership change using the same live methods above, so a flag turns into a resolved decision.

Keep the file audit-ready

Comply

Every check and decision is logged to MAMLA record-keeping standards, so the file is organised and retrievable for internal audit and supervisory review.

Perpetual KYC

pKYC

Keeps individual customer risk current with behavioural biometrics, background fraud signals and ongoing AML screening, so back-book records stay standard-ready.

Perpetual KYB

pKYB

Monitors the Commercial Register for shareholding and control changes, catching a move past 25% or a new control position between reviews.

REGULATORY ALIGNMENT

Built To Fit Bulgaria's Compliance Landscape

Bulgarian National Bank (BNB)

Central bank that supervises banks and payment institutions for AML/CFT and issues customer due diligence rules. Shufti supports these rules with structured identity evidence, risk classification logs and ongoing monitoring controls.

Financial Supervision Commission (FSC)

Supervises capital markets, insurers, pension funds and crypto-asset service providers for AML obligations. Shufti supplies verification and screening evidence that supports FSC onboarding and record-keeping expectations.

Financial Intelligence Directorate (FID)

Bulgaria's Financial Intelligence Unit, within the State Agency for National Security, receives suspicious transaction reports under MAMLA Article 72 through goAML. Shufti's audit trails, structured risk indicators and escalation logs support that reporting.

National Revenue Agency (NRA)

Tax authority and the AML supervisor for the gambling sector. Shufti verifies entity and tax identifiers and screens customers to support NRA due diligence expectations.

Registry Agency (Commercial Register)

Holds company records and beneficial ownership information in the Commercial Register. Shufti captures UBO data and screens controlling persons, and where your findings diverge from the register Shufti flags the gap so you can report the discrepancy.

AMLA (EU Anti-Money Laundering Authority)

The new EU-level supervisor has been established in Frankfurt since July 2025. Begins direct supervision of selected high-risk cross-border entities from 2028 and shapes technical standards under AMLR.

Deployment Choice

Cloud in EU regions, or on-premise, keeps Bulgarian customer data in-region and supports GDPR accountability.

Roles and Duties

Shufti is a data processor supplying verification technology, not legal advice. Due diligence and the choice of verification method stay with the obliged entity.

Retention Controls

Under MAMLA Article 67, records are kept five years after the relationship or occasional transaction ends. The FID can add up to two years. From 10 July 2027 AMLR Article 77 sets five years, extendable case by case.

Encryption & Security

Encryption in transit and at rest, with access controls and audit logging, supports Article 32 GDPR obligations, under our ISO 27001 certification.

Data and Privacy Controls in Bulgaria

BUILT FOR COMPLIANCE TEAMS

Bulgaria AML Sources That Strengthen Decisions

We screen against 215+ sanction regimes, 4,000+ watchlists, 100,000+ adverse-media sources, and 6M+ PEPs across Bulgaria and globally. A few of them are:

Financial Intelligence Directorate (FID-SANS)

Financial Supervision Commission (FSC)

Bulgarian National Bank (BNB)

National Revenue Agency (NRA)

Registry Agency (Commercial Register and BULSTAT)

Ministry of Interior (GDBOP)

Supreme Bar Council (Vissh Advokatski Savet)

EU Consolidated Financial Sanctions List

UN Security Council Consolidated List

FATF

MONEYVAL (Council of Europe)

Egmont Group of FIUs

EU AMLA (Anti-Money Laundering Authority)

SEE SHUFTI IN YOUR BULGARIA WORKFLOW

Turn Bulgarian Verification Requirements into a Smoother Customer Journey

Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB, QES, Penny Drop and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.

Book a Bulgaria Compliance Demo Explore AMLR Solutions

INDEPENDENTLY AUDITED. GLOBALLY CERTIFIED.

Certified to Global Standards

Frequently Asked Questions

Is the Bulgarian identity card accepted for identity verification under MAMLA?

It is the primary identity document for citizens, compulsory from age 14. Shufti reads the chip on the 2024 biometric card and pairs it with a biometric check for high-assurance onboarding.

Can EU nationals onboard with their national ID card?

Yes. EU and EEA national identity cards are recognised for Bulgarian onboarding under the EU AML framework, and AMLR keeps them valid from July 2027. Shufti verifies them with document, biometric and chip-based checks in one flow.

Does Bulgaria use goAML?

Yes. Bulgaria's Financial Intelligence Directorate receives suspicious transaction reports through the goAML system. Shufti structures verification and screening evidence so those reports can be filed without a manual scramble.

What documents are required for KYB in Bulgaria?

Typically a Commercial Register extract from the Registry Agency, the 9-digit Unified Identification Code, the BG VAT number, and beneficial ownership details from the Commercial Register. Shufti verifies these in real time and screens the UBOs behind them against sanctions and PEP lists.

How are Bulgarian name variants handled in screening?

Matching applies the 2009 Bulgarian transliteration standard, so Cyrillic and Latin versions of a name resolve to the same person and false positives stay low.

How long must AML records be retained in Bulgaria?

Under MAMLA Article 67, records are kept at least five years after the relationship or occasional transaction ends. The FID can add up to two years. From 10 July 2027 AMLR Article 77 sets five years, extendable case by case. Shufti logs evidence to support retention.

Is EU-region data hosting available?

Yes. Shufti offers EU-based cloud regions, so Bulgarian customer data stays in-region in line with GDPR. On-premise deployment is available where residency requirements are stricter.

What changes for Bulgaria under AMLR from July 2027?

AMLR applies directly, so no Bulgarian transposition law is needed. It sets out two permitted routes, document-based and eIDAS-based, so notified eIDs, the EUDI Wallet and qualified trust services sit beside document and biometric checks, and it sets the ownership test at 25% or more, or control.

Will QES alone satisfy identity verification under AMLR?

A qualified electronic signature is a qualified trust service AMLR recognises for remote verification. Shufti runs QES flows that work under Bulgarian law today and carry over when AMLR applies, with the signing identity check running through the Evrotrust eID.

How does Shufti support businesses supervised by the FID and the BNB?

Shufti connects identity verification, KYB, AML screening, QES, account verification and decision evidence in one configurable workflow. This helps obliged entities within the FID's and the BNB's supervisory remit reduce manual hand-offs, standardise compliance records and prepare clearer evidence for internal audit and applicable supervisory review.

Let’s Build Trust Into Your Business

1B⁺Verifications Processed

240⁺Regions Actively Processed

99.7^%Accuracy Rate

Samer Al Tamimi

CEO of Safwa Bank

“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”

Trusted. Compliant. Certified

Explore Shufti For Your Business

Get a personalised demo from our experts.

Which products would you like to check out?

VideoIdent

Address Verification

eIDV (Docless)

KYB

AML Screening

Fraud Prevention

Face and ID Verification

Age Verification

Others

What is your expected yearly verification volume?

1 to 1,000

1,001 to 5,000

5,001 to 20,000

20,001 to 50,000

50,001 to 100,000

100,001 to 1,000,000

1,000,000+

Valid Invalid number

I agree that Shufti may use my email for marketing purposes, including to share updates about Shufti products & services, newsletters, invites to special events and free giveaways. You can unsubscribe at any time using the link from Shufti emails.

By clicking Submit, you accept our Privacy Policy and consent to marketing communications.

PROVEN PLAYBOOKS

Explore Practical KYC & AML Resources

Explore Content library

10 July, 2026

Identity Verification in Europe: eIDAS 2.0 & EUDI Wallet

A practitioner's guide to verifying identity in Europe, covering eIDAS 2.0, the EUDI Wallet, docless eIDV and how to choose an eID provider for onboarding in the EU.

Product Guide

4 August, 2026

EU AMLR Guide 2027: Requirements, Scope, Deadlines

Regulation (EU) 2024/1624 applies from 10 July 2027. Covers which firms fall in scope, what CDD and ownership checks demand, and how AMLR differs from AMLD6 today.

Product Guide

9 September, 2026

How to Remediate Existing Clients' Files Under EU AMLR

AMLR applies from 10 July 2027 to the files you already hold. Find CDD gaps in existing customers, rank them by risk, and record decisions auditors can follow later.

Product Guide

Explore Content library