Regulation No. 77 of 12.03.2026 on the Conditions and Procedures for Licensing and Conduct of Activities by Asset-Backed Token Issuers and Crypto-Asset Service Providers

REGULATION No. 77 of 12.03.2026 on the Conditions and Procedures for Licensing and Conduct of Activities by Asset-Backed Token Issuers and Crypto-Asset Service Providers

Pub. - State Gazette, No. 30 of 27.03.2026 Adopted by Decision No. 276-N of 12.03.2026 of the Commission for Financial Supervision

Chapter One GENERAL PROVISIONS Scope

Art. 1. (1) This Regulation regulates:

1. the conditions and procedures for submitting an application for the issuance of a license for the issuer of asset-backed tokens of a person under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937 (OJ, L 150/40 of 9 June 2023), hereinafter referred to as "Regulation (EU) 2023/1114", and for submitting a notification by a person under Art. 16, paragraph 1, letter "b" of the same Regulation;
2. the conditions and procedures for submitting an application for the issuance of a license for carrying out activities as a crypto-asset service provider by a person under Art. 59, paragraph 1, letter "a" of Regulation (EU) 2023/1114 and for submitting a notification by a person under Art. 59, paragraph 1, letter "b" of the same Regulation;
3. the requirements for the internal organization of crypto-asset service providers and for the natural persons providing advice on crypto-assets;
4. requirements for information disclosure by crypto-asset service providers;
5. the conditions and procedures for issuing approval for the use of internal persons conducting penetration tests and for the certificate of confirmation of the testing performed or for determining re-testing regarding the issuer of asset-backed tokens and the crypto-asset service provider in accordance with Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011 (OJ, L 333/1 of 27 December 2022), hereinafter referred to as "Regulation (EU) 2022/2554".

(2) This Regulation shall not apply in cases that fall within the explicit competence of the Bulgarian National Bank.

Procedure for submitting applications and notifications

Art. 2. (1) Applications and notifications under this Regulation shall be submitted:

1. in person at the building of the Commission for Financial Supervision (the Commission);
2. through the Commission's Unified Information System;
3. by e-mail to the Commission, as published on its website;
4. through the information system for secure electronic delivery as a module of the E-Government Portal within the meaning of the Electronic Governance Act.

(2) Applications and notifications under this Regulation shall be signed by the legal representatives of the persons, respectively by persons authorized by them with a notarized power of attorney. In the cases under para. 1, items 2-4, a qualified electronic signature shall be used.

(3) Applications and notifications under this Regulation and the documents attached to them shall be submitted in Bulgarian, except for the cases under Art. 4 of the Crypto-Assets Market Act. Declarations from foreign citizens shall be bilingual, with one of the languages being Bulgarian.

Chapter Two ISSUERS OF ASSET-BACKED TOKENS Submission of application for the issuance of a license for the public offering of asset-backed tokens and for applying for their admission to trading

Art. 3. (1) A person under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114, which seeks to be issued a license for the public offering of asset-backed tokens and/or for applying for their admission to trading, shall submit an application in accordance with Art. 18, paragraph 1 of Regulation (EU) 2023/1114 in conjunction with Commission Delegated Regulation (EU) 2025/1125 of 5 June 2025 supplementing Regulation (EU) 2023/1114 of the European Parliament and of the Council as regards regulatory technical standards for determining the information in the application for the issuance of a license for the public offering of asset-backed tokens or for applying for their admission to trading (OJ, L 2025/1125 of 15 September 2025), hereinafter referred to as "Delegated Regulation (EU) 2025/1125".

(2) The application under para. 1 shall be submitted in the form according to Annexes I and II of Commission Implementing Regulation (EU) 2025/1126 of 5 June 2025 establishing implementing technical standards for the application of Regulation (EU) 2023/1114 of the European Parliament and of the Council as regards the establishment of standard forms, templates and procedures for the information to be included in the application for the issuance of a license for the public offering of asset-backed tokens and for applying for their admission to trading (OJ, L 2025/1126 of 15 September 2025), hereinafter referred to as "Implementing Regulation (EU) 2025/1126".

(3) The following shall be attached to the application under para. 1:

1. the documents and information in accordance with Art. 18, paragraph 2 of Regulation (EU) 2023/1114, as well as those in accordance with Delegated Regulation (EU) 2025/1125;
2. a declaration from the applicant, as well as from any legal entity with a qualified shareholding in the applicant, that it is not a company registered in jurisdictions with a preferential tax regime or controlled by such a company within the meaning of the Act on Economic and Financial Relations with Companies Registered in Jurisdictions with a Preferential Tax Regime, the persons controlled by them and their beneficial owners, or data and evidence that it falls under one of the exceptions under Art. 4 of the same Act;
3. a document confirming the deposit of the fee due for the issuance of a license for the public offering and/or admission to trading of asset-backed tokens in accordance with Regulation No. 76 of 12.06.2025 on the fees collected by the Commission for Financial Supervision (State Gazette, No. 54 of 2025), hereinafter referred to as "Regulation No. 76", unless the fee has been paid electronically.

(4) Regarding the content and form of the legal opinion under Art. 18, paragraph 2, letter "d" of Regulation (EU) 2023/1114, the requirements of the Guidelines on templates for explanations and opinions and the standardized test for crypto-assets under Art. 97, paragraph 1 of Regulation (EU) 2023/1114 (JC 2024 28), issued by the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority, for which the Commission has taken a decision on their application in accordance with Art. 13, para. 1, item 26 of the Act on the Commission for Financial Supervision, shall apply.

Data and documents for members of the management body of persons under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114 and persons managing their activities, shareholders or persons having direct or indirect qualified shareholdings in persons under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114

Art. 4. (1) For each of the members of the management body, persons managing the activities, shareholders or persons having direct or indirect qualified shareholdings in a person under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114, the following shall be attached to the application under Art. 3, para. 1:

1. documents regarding criminal proceedings: a) for Bulgarian citizens - a certificate of the presence or absence of data on instituted criminal proceedings and charges brought, issued by the Prosecutor's Office of the Republic of Bulgaria or the National Investigation Service; b) for foreign citizens - a document analogous to that under letter "a", as well as a document confirming that the person has not been convicted, and when the relevant jurisdiction does not issue such documents, the person declares the presence or absence of the relevant circumstances, as well as explicitly declares that such documents are not issued in the relevant jurisdiction; c) the documents under this item shall be provided by both Bulgarian and foreign citizens for every jurisdiction in which the person has had residence during the last 10 years, as well as from every jurisdiction in which the person holds citizenship;
2. data and documents confirming the qualification and professional experience of the persons: a) a curriculum vitae for each of the persons, indicating the respective education, qualification and professional experience; b) the obtained degree of education shall be confirmed by providing data on the series and number of the held secondary or higher education diploma; for a secondary or higher education diploma issued in the Republic of Bulgaria before 1 January 2012, a notarized copy thereof shall be presented; for a diploma not issued by a secondary or higher school in the Republic of Bulgaria, the number of the certificate of recognition of the obtained secondary or higher education, entered in the register for academic recognition kept by the National Centre for Information and Documentation, shall be indicated, or a certified copy of the certificate shall be attached;
3. a declaration of the presence of a previously conducted reputation assessment of the person in the capacity of a person acquiring or increasing their qualified shareholding or participating in the management of an investment intermediary, credit institution, insurer, reinsurer, management company, a person managing an alternative investment fund, a crowdfunding service provider, an issuer of asset-backed tokens or a crypto-asset service provider; data on the competent authority that conducted the assessment and the result thereof; in cases where the person has a reasoned written decision of the competent authority that conducted the assessment, a copy of the decision shall be attached;
4. a declaration on the presence or absence of sanctions, embargoes or measures related to terrorism, financing of terrorism or proliferation of weapons, determined by a Member State, the European Union or an international organization;
5. a declaration describing the other positions held, functions performed and professional activities with indication of the time devoted to them;
6. a declaration from the person containing: a) identification data of persons associated with him within the meaning of § 1, item 8 of the Additional Provisions of the Crypto-Assets Market Act; b) a description of the financial and non-financial relationships of the applicant with the persons under letter "a", including information on shareholdings and voting rights in legal entities, where applicable; c) information on whether, to the extent known to him, there are data on his associated persons within the meaning of § 1, item 8 of the Additional Provisions of the Crypto-Assets Market Act, which give grounds for doubt regarding his reliability and reputation; in the presence of such circumstances, additional information shall be presented, including indication of the associated persons and a description of their links with the person;
7. a declaration from the applicant company on whether, to the extent known, there are data on the person and his associated persons within the meaning of § 1, item 8 of the Additional Provisions of the Crypto-Assets Market Act, which give grounds for doubt regarding the reliability and suitability of the person; in the presence of such circumstances, additional information must be presented, including indication of the associated persons and a description of their links with the person.

(2) For the circumstances under Art. 18, paragraph 5, letter "a" of Regulation (EU) 2023/1114, declarations shall be presented from each member of the management body of the issuer of asset-backed tokens.

(3) At least half of the members of the management body of the issuer of asset-backed tokens under para. 1 shall present documents confirming qualification and professional experience in the field of crypto-assets, finance, economics, law, accounting, audit, management, financial regulation, information technology and quantitative methods.

(4) The requirements of the Joint Guidelines on the assessment of the suitability of members of the management body and shareholders, direct or indirect, with qualified shareholdings in issuers of ABTs and CASPs, jointly issued by the European Banking Authority and the European Securities and Markets Authority (EBA/GL/2024/09; ESMA75-453128700-10), hereinafter referred to as "Joint Guidelines", for which the Commission has taken a decision on their application in accordance with Art. 13, para. 1, item 26 of the Act on the Commission for Financial Supervision, shall apply to all persons under para. 1.

(5) When conducting the assessment of the individual suitability of a person under para. 1, as well as when conducting the assessment of the collective suitability of the management body of the issuer of asset-backed tokens under para. 1, the requirements of the Joint Guidelines shall apply. When assessing the skills of the members of the management body, the functions of the position shall be taken into account. A non-exhaustive list of skills subject to assessment is defined in the appendix to this Regulation.

(6) The requirements of the Joint Guidelines shall apply to shareholders or persons having direct or indirect qualified shareholdings in an issuer of asset-backed tokens under para. 1.

(7) The requirements of paras. 1-5 shall also apply to the natural persons who are appointed as representatives of legal entities - members of the management body of the issuer of asset-backed tokens under para. 1, as well as with respect to its procurator.

Requirements upon subsequent acquisition of a qualified shareholding in an issuer of asset-backed tokens, which is a person under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114

Art. 5. (1) Upon subsequent acquisition of a qualified shareholding in an issuer of asset-backed tokens, which is a person under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114, the data and documents under Art. 4, para. 1 and the information in accordance with Commission Delegated Regulation (EU) 2025/413 of 18 December 2024 supplementing Regulation (EU) 2023/1114 of the European Parliament and of the Council as regards regulatory technical standards determining the detailed content of the information necessary for carrying out the assessment of the proposal for acquisition of a qualified shareholding in an issuer of an asset-backed token (OJ, L 2025/413 of 31 March 2025) in accordance with Art. 41 of Regulation (EU) 2023/1114 shall be presented.

(2) Upon subsequent acquisition of a qualified shareholding in an issuer of asset-backed tokens under para. 1, a document confirming the deposit of the fee due under Art. 16 of Regulation No. 76 shall also be applied, if the fee has not been paid electronically.

Obligation to notify upon changes

Art. 6. (1) An issuer of asset-backed tokens, which is a person under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114, shall immediately notify the Commission of any change in the internal rules, policies and procedures on the basis of which the license was issued, to which the following shall be attached:

1. a certified copy of the decision of the competent body according to the articles of association of the issuer of asset-backed tokens to adopt the respective changes;
2. the full text of the respective amended document with indication of the date on which the change was adopted in each of the amended texts, including in change tracking mode.

(2) An issuer of asset-backed tokens, which is a person under Art. 16, paragraph 1, letter "a" of Regulation (EU) 2023/1114, shall notify the Commission of any change in the member of the management body before the exercise of activities by the person under Art. 33 of Regulation (EU) 2023/1114. The data and documents under Art. 4 shall be attached to the notification.

(3) The elected member of the management body may be applied for registration in the Commercial Register if, within 15 days from the notification under para. 2, the Vice-Chairman has not requested additional data and documents within a period determined by him, which cannot be shorter than 10 working days.

(4) When, within 15 days from the submission of the additional data and documents requested under para. 3, respectively from the expiration of the period for their submission, the Vice-Chairman has not notified the person under para. 2 about the opening of proceedings for the application of a compulsory administrative measure under Art. 27 and 28 of the Crypto-Assets Market Act, the registration may be applied for in the Commercial Register.

Submission of notifications by persons under Art. 16, paragraph 1, letter "b" of Regulation (EU) 2023/1114

Art. 7. (1) A person under Art. 16, paragraph 1, letter "b" of Regulation (EU) 2023/1114 shall submit a notification regarding the public offering and/or admission to trading of an asset-backed token, to which the following shall be attached:

1. the white paper for the asset-backed token, prepared in accordance with Art. 19 of Regulation (EU) 2023/1114;
2. all documents and information specified in Art. 17, paragraph 1, letter "b" of Regulation (EU) 2023/1114;
3. a document confirming the deposit of the fee due under Art. 16 of Regulation No. 76, if the fee has not been paid electronically.

(2) The notification under para. 1 with the attached documents and information shall be provided to the Commission at least 90 working days before the first issuance of the asset-backed token.

(3) Regarding the white paper for the asset-backed token, the requirements of Commission Implementing Regulation (EU) 2024/2984 of 29 November 2024 establishing implementing technical standards for the application of Regulation (EU) 2023/1114 of the European Parliament and of the Council as regards the forms, formats and templates of crypto-asset white papers (OJ, L 2024/2984 of 3 December 2024), hereinafter referred to as "Implementing Regulation (EU) 2024/2984", as well as Commission Delegated Regulation (EU) 2025/422 of 17 December 2024 supplementing Regulation (EU) 2023/1114 of the European Parliament and of the Council through regulatory technical standards for determining the content, methodologies and presentation of information regarding sustainability indicators in relation to adverse impacts on the climate and other adverse impacts related to the environment (OJ, L 2025/422 of 31 March 2025), hereinafter referred to as "Delegated Regulation (EU) 2025/422", shall apply.

(4) Regarding the content and form of the legal opinion under Art. 17, paragraph 1, letter "b", sub-letter "ii" of Regulation (EU) 2023/1114, the requirements of the Guidelines on templates for explanations and opinions and the standardized test for crypto-assets under Art. 97, paragraph 1 of Regulation (EU) 2023/1114 (JC 2024 28), issued by the European Banking Authority, the European Insurance and Occupational Pensions Authority and the European Securities and Markets Authority, for which the Commission has taken a decision on their application in accordance with Art. 13, para. 1, item 26 of the Act on the Commission for Financial Supervision, shall apply.

Chapter Three CRYPTO-ASSET SERVICE PROVIDERS Section I Licensing requirements and notifications Submission of application for the issuance of a license to a crypto-asset service provider

Art. 8. (1) A person under Art. 59, paragraph 1, letter "a" of Regulation (EU) 2023/1114, which seeks to be issued a license for the provision of crypto-asset services, shall submit an application under Art. 62 of Regulation (EU) 2023/1114 in the form which is an appendix to Commission Implementing Regulation (EU) 2025/306 of 31 October 2024 establishing implementing technical standards with a view to the application of Regulation (EU) 2023/1114 of the European Parliament and of the Council as regards the standard forms, templates and procedures in connection with the information to be included in the application for the issuance of a license for a crypto-asset service provider (OJ, L 2025/306 of 31 March 2025), hereinafter referred to as "Implementing Regulation (EU) 2025/306".

(2) The following shall be attached to the application under para. 1:

1. documents and information in accordance with Commission Delegated Regulation (EU) 2025/305 of 31 October 2024 supplementing Regulation (EU) 2023/1114 of the European Parliament and of the Council as regards regulatory technical standards for determining the information to be included in the application for the issuance of a license for a crypto-asset service provider (OJ, L 305 of 31 March 2025), hereinafter referred to as "Delegated Regulation (EU) 2025/305"; in the section "Required Information" of the application under para. 1, the corresponding information under each article of Delegated Regulation (EU) 2025/305 shall be provided and/or reference shall be made to documents attached to the application or parts thereof containing the required information;
2. a declaration from the applicant, as well as from any legal entity with a qualified shareholding in the applicant, that it is not a company registered in jurisdictions with a preferential tax regime or controlled by such a company within the meaning of the Act on Economic and Financial Relations with Companies Registered in Jurisdictions with a Preferential Tax Regime, the persons controlled by them and their beneficial owners, or data and evidence that it falls under one of the exceptions under Art. 4 of the same Act;
3. a draft memorandum and articles of association or partnership agreement, in which amendments related to the stated intention to carry out activities as a crypto-asset service provider are included;
4. a document confirming the deposit of the fee due according to the stated license class under Art. 16 of Regulation No. 76, if the fee has not been paid electronically.

Data and documents under Delegated Regulation (EU) 2025/305

Art. 9. (1) The information under Art. 2, paragraph 1, letter "l" of Delegated Regulation (EU) 2025/305 shall also include:

1. data identifying the subjects who are external service providers or activities;
2. information regarding the necessary permission for the performance of the respective services or activities in the country of origin of the subjects to whom the performance of services or activities is entrusted, if such are required in accordance with European legislation or their national legislation;
3. information on whether the crypto-asset service provider and the subject to whom the performance of services or activities is entrusted belong to the same group.

(2) The agreements concluded, respectively draft agreements for the outsourcing of services or activities to external service providers, which are described under Art. 2, paragraph 1, letter "k" of Delegated Regulation (EU) 2025/305, shall be attached to the program of activities.

(3) The information under Art. 4, paragraph 1, letter "a" of Delegated Regulation (EU) 2025/305 shall include:

1. rules for the internal organization of the company, including a description of all units, their functions and interaction;
2. data and documents for specific employees, distributed by functional units, with regard to the different crypto-asset services planned by the applicant's activities and services;
3. job description and scheme for the distribution of functions and powers between the members of the management body and other managerial positions.

(4) The information under Art. 2, paragraph 1, letter "k", Art. 3, letter "g", Art. 4, paragraph 1, letters "v" - "e" and letter "z", paragraph 2, letter "a", Art. 5, Art. 6, letter "e", Art. 9, letter "a", item "iii", Art. 10, Art. 11, Art. 12, letter "b", Art. 13 - 16 of Delegated Regulation (EU) 2025/305 shall be provided in the form of internal rules, policies and procedures, which the applicant will comply with in carrying out its activities, as well as a certified copy of the decision of the competent body according to the articles of association of the applicant for the adoption of these internal rules, policies and procedures.

Data and documents under Delegated Regulation (EU) 2025/303

Art. 10. (1) The description under Art. 1, paragraph 1, letter "j" of Delegated Regulation (EU) 2025/303 shall include:

1. data and documents for specific employees, distributed by departments with regard to the different crypto-asset services planned by the applicant;
2. job description and