BULGARIA Trends and Developments Contributed by: George Chisuse, Ivelin Vassilev and Stephany Valcheva, VC Law
employees may be considered sufficient. This shows the practical direction of the review: the FSC is look- ing at whether the applicant has a real and workable structure. Substance in Bulgaria should be credible A Bulgarian CASP applicant should not be designed as a letterbox company. The exact substance needed will depend on the services and risk profile, but the applicant should be able to demonstrate real manage- ment, oversight and operational capacity. This does not mean that every developer, vendor and compliance function must be physically located in Bulgaria. Modern crypto businesses are often inter- national by design. Group support, outsourcing and remote functions can be legitimate. The point is that the Bulgarian applicant must remain in control of its regulated activity. If the company outsources wallet technology, KYC tools, transaction monitoring, cloud hosting, cyber- security, customer support or liquidity access, it still needs to understand and supervise those arrange- ments. It should be able to explain who the provider is, what service is outsourced, why the provider was selected, what due diligence was performed, what contractual protections exist, how performance is monitored and what happens if the provider fails. The same applies to group structures. A Bulgarian company cannot simply say that “the group handles compliance” or “the technical team is abroad”. It needs to explain what the Bulgarian entity controls, which decisions are made locally, who is accountable and how information flows between the group and the licensed entity. Substance can also become a banking and investor issue. Banks, payment institutions and counterparties are more likely to engage with a CASP that can clearly explain where the business is managed and how client assets are protected. Outsourcing should be decided before the application, not discovered during it Outsourcing is one of the areas where crypto busi- nesses often underestimate the amount of preparation
needed. A founder may know commercially that the company will use an external custodian, KYC tool, or customer support centre, but the licensing file needs more than the provider’s name. Before filing, the appli- cant should know which functions are outsourced, whether each function is critical or important, what data is shared, whether subcontracting is allowed, how the contract can be terminated, how business continuity is protected and how the company would migrate away from the provider if needed. This is especially important because DORA applies to CASPs and brings ICT risk, incident reporting, resil- ience testing and third-party ICT risk management into the centre of the operating model. DORA should not be treated as an IT appendix to the MiCA applica- tion. It affects the entire system – from governance to board-level responsibility. For a crypto exchange, outsourcing is rarely limited to back-office support. Some of the most important parts of the business may depend on third parties, like wallet infrastructure and transaction monitoring to cloud hosting and payment connectivity. If one of these providers fails, the exchange may be unable to process withdrawals, monitor suspicious activity, onboard clients or keep the platform running. This is why the outsourcing map should be prepared before the application is submitted. It should not be assembled after the regulator asks questions. Custody and client asset protection are central If the exchange will hold or control client crypto- assets, custody becomes one of the most important parts of the licensing analysis. The applicant needs to explain whether it will use omnibus wallets, segregated wallets, hot and cold storage, multi-signature arrangements, internal cus- tody or a hybrid model. It also needs to explain how client assets are reconciled, how withdrawals are approved, who has access rights, how keys are pro- tected, what happens if a key person leaves, and how clients are treated if the company becomes insolvent. A common weakness is that businesses describe cus- tody as “non-custodial” because they use a technical
145 CHAMBERS.COM
Powered by FlippingBook