Blockchain and Crypto-Assets 2026

BULGARIA Law and Practice Contributed by: George Chisuse, Ivelin Vassilev, Stephany Valcheva and Daniel Kolev, VC Law

4.2 White Labelling White-label arrangements are possible in Bulgaria, but they must be structured carefully. An external firm cannot “borrow” the licence of an authorised CASP in order to provide regulated crypto-asset ser- vices to Bulgarian clients. The licensed CASP must remain the actual provider of the regulated service and must retain responsibility for MiCA compliance, client onboarding, AML controls, disclosures, custody, complaints handling and client protection. The analysis depends on the real division of functions. If the external firm only provides technology, branding, marketing support or client introductions, the model may be viable. If it controls the client relationship, gives advice, receives orders, handles execution, provides custody, or presents itself as the regulated provider, it may need its own authorisation. The arrangement should also be clear to clients. The client should understand which entity is licensed, which entity provides the service, who holds the assets and who is responsible for regulatory compli- ance. White-label models are therefore possible, but they should not be used to disguise unauthorised activity or to bypass MiCA licensing and passporting requirements. DeFi is not prohibited in Bulgaria. However, there’s no special Bulgarian safe harbour for DeFi. The question depends on whether the activity is genuinely decen- tralised or whether an identifiable person or entity is providing regulated services to users. If a project has an operator, promoter, front-end provider, fee recipi- ent or other party exercising control or influence, the activity may need to be assessed under MiCA, and AML rules. CeFi firms may use DeFi infrastructure in connection with their products or services, but doing so does not remove their regulatory responsibilities. A licensed CASP or other regulated firm remains responsible for the service it offers to clients, even if part of the execu- 5. Decentralised Finance 5.1 Ability to Use DeFi

tion, liquidity provision or yield generation takes place through a decentralised protocol. The main issues are client disclosure, custody and control of assets, smart contract risk, liquidity risk, governance of the protocol, conflicts of interest, AML screening and operational resilience. In practice, a CeFi firm using DeFi should be able to show that it has carried out due diligence on the protocol, understands the technical and legal risks, can monitor exposures, and has clearly disclosed to clients that the product involves DeFi-specific risks such as smart contract failure, oracle manipulation, liquidity loss, hacks or protocol governance changes. Therefore, DeFi is permitted, but it is not treated as a regulatory blind spot. Where DeFi is used as part of a client-facing product, Bulgarian and EU regulators are likely to focus on the regulated entity that packages, promotes or controls the access to that product. 5.2 DeFi Structures Bulgaria does not currently recognise DAOs as a sep- arate legal form. DeFi projects that want a legal pres- ence need to use ordinary legal structures, such as a limited liability company, a joint-stock company, or in some cases a foundation or association-style entity for community or ecosystem functions. A DAO may exist at the governance or smart contract level, but it does not by itself provide legal personality, limited liability, tax registration or regulatory accountability under Bulgarian law. The structure will depend on the services performed by the DeFi project, as for example software develop- ment, IP ownership or regulated services. There are no DeFi-specific capital requirements in Bulgaria. The ordinary capital rules for the chosen legal form apply unless the activity is regulated. If the DeFi structure involves CASP services or other regu- lated functions, then the relevant licensing, prudential, governance and substance requirements will apply. In that case, the capital requirement is driven by the regulated activity, not by the fact that the project uses DeFi technology.

138 CHAMBERS.COM

Powered by