Ordinance No. 47 of 11.07.2012 on the Requirements for the Information Systems of Pension Insurance Companies

ORDINANCE No. 47 of 11.07.2012 on the Requirements for the Information Systems of Pension Insurance Companies Publ. - State Gazette, No. 57 of 27.07.2012, in force from 28.07.2013; amended, No. 94 of 13.11.2018, in force from 19.11.2018; amended and supplemented, No. 55 of 02.07.2021; amended and supplemented, No. 70 of 20.08.2024; amended and supplemented, No. 73 of 14.08.2026, in force from 01.01.2027. Adopted with Decision No. 135-N of 11.07.2012 of the Commission for Financial Supervision

Section I
General Provisions

Art. 1. This Ordinance regulates:

1. the requirements for the information security management system of the pension insurance company;
2. the requirements for the exchange of information and provision of electronic services;
3. the registers maintained by the pension insurance company.

Art. 2. (Amended - State Gazette, No. 73 of 2026, in force from 01.01.2027) The pension insurance company shall establish and maintain an information system in accordance with the requirements of this Ordinance, other applicable normative acts and standards, and the adopted internal documents of the company, taking into account the specifics and volume of the activity in supplementary pension insurance and its organizational structure.

Section II
Information Security Management System

Art. 3. (Amended - State Gazette, No. 70 of 2024.) (1) (Amended - State Gazette, No. 70 of 2024.)
The pension insurance company is obliged to establish an information security management system based on the requirements of the international standard ISO/IEC 27001.
(2) The information security management system must cover the following main aspects of security: risk assessment and management, personnel management, physical security, access control, security in the selection, purchase and use of software and hardware, plans and actions in emergencies and crises. (3) (Amended - State Gazette, No. 70 of 2024.) The pension insurance company shall align its activities with the good practices laid down in the international standards ISO/IEC 27002 and ISO/IEC 27004.

Art. 4. (Amended - State Gazette, No. 73 of 2026, in force from 01.01.2027.) Compliance with the requirements of the standard under Art. 3, para. 1 is demonstrated by certification from an accredited conformity assessment body.

Art. 5. (Amended and supplemented - State Gazette, No. 73 of 2026, in force from 01.01.2027.) (1) (Amended and supplemented - State Gazette, No. 73 of 2026, in force from 01.01.2027.) The governing body of the pension insurance company adopts its information security policy and other necessary internal rules and documents and ensures their implementation, and if necessary - their update. (2) The application of the principles and requirements laid down in the company's security policy must:

1. guarantee a general level of security in the development, operation and maintenance of the information system;
2. ensure the development and maintenance of a common architecture for the security of the information system;
3. ensure the identification and analysis of risks related to the information system and the determination of necessary countermeasures;
4. ensure the protection of information by ensuring the confidentiality, integrity and availability of information assets in the company, including in emergency circumstances.
   (3) (Supplemented - State Gazette, No. 73 of 2026, in force from 01.01.2027.) The company's information security policy must comply with the requirements in applicable normative acts and standards and contain at least:
5. the main principles on which it is based;
6. the obligations and responsibilities of the units and employees of the company for its application, for the establishment and operation of the information system and for the implementation of the envisaged security measures;
7. the rules for managing risks related to the information system, including the identification of risk factors, their assessment and the taking of necessary countermeasures against them;
8. the procedure for adoption, updating and publication thereof.

Art. 6. (Amended - State Gazette, No. 73 of 2026, in force from 01.01.2027.) (1) To certify compliance with the standard under Art. 3, para. 1, the pension insurance company submits to the Deputy Chairman of the Commission, heading the "Insurance Supervision" Management, hereinafter referred to as "the Deputy Chairman of the Commission", a certified copy of the document certifying the certification, within 7 days from its completion. (2) Within 7 days from the suspension of the validity of the certification, the company notifies the Deputy Chairman of the Commission about this circumstance and about the envisaged actions and deadlines for bringing into compliance with the standard and conducting certification.

Section III
Requirements for Information Exchange and Provision of Electronic Services

Art. 7. (Supplemented - State Gazette, No. 73 of 2026, in force from 01.01.2027.) (1) (Supplemented - State Gazette, No. 73 of 2026, in force from 01.01.2027.) The pension insurance company uses the information system for secure electronic delivery or an official e-mail address for receiving official correspondence from the Commission and other institutions with which the company exchanges information. The company notifies the Deputy Chairman of the Commission of a change in the official e-mail address at least three working days before the change. (2) Employees in the company use only their personal official e-mail for receiving and sending official correspondence electronically. Electronic messages sent by employees of the pension insurance company in connection with the performance of their duties must necessarily contain identifying contact information for the respective employee. At the end of every outgoing electronic message, instructions to the addressee for actions in case of incorrect receipt are automatically attached.

Art. 8. (Amended - State Gazette, No. 94 of 2018, in force from 19.11.2018; amended and supplemented, No. 55 of 2021; amended, No. 70 of 2024; amended, No. 73 of 2026, in force from 01.01.2027.) (1) (Amended - State Gazette, No. 55 of 2021; amended, No. 70 of 2024.) The information system of the pension insurance company must provide the possibility to create and maintain a unified electronic file for each insured person, PEPP-insured person, pensioner or PEPP beneficiary in a fund managed by the company. The file must contain all available data on the person and allow them to make inquiries and track their insurance history. (2) (Amended - State Gazette, No. 70 of 2024.) Applications and petitions on paper submitted by the persons under para. 1 and their heirs, as well as the company's acts in connection with them, are included in the electronic file of the respective person by taking an electronic image of them and of the documents attached to them using a scanning device in a form and manner allowing them to be read. The full and exact correspondence of the taken electronic image with the scanned document is certified by an electronic signature of the person who performed the scanning. (3) (Amended - State Gazette, No. 94 of 2018, in force from 19.11.2018.) The documents under para. 2 are stored by the pension insurance company. The pension insurance company may entrust by written contract the activity of scanning documents to a specialized external contractor. In this case, the company:

1. is responsible for the actions of the external contractor as for its own actions;
2. provides in the contract with the external contractor:
   a) obligations for the protection of the confidentiality of the provided documents and information and for providing assistance from its side to the bodies and employees of the Commission for Financial Supervision in the exercise of their powers; b) prohibition on entrusting the activities subject to the contract to subcontractors;
3. (amended - State Gazette, No. 73 of 2026, in force from 01.01.2027.) monitors and assesses the risks related to the outsourcing of the activities, as well as their implementation by the external contractor.
   (4) (Amended - State Gazette, No. 70 of 2024.) The pension insurance company is obliged to issue to each insured person, PEPP-insured person, pensioner or PEPP beneficiary, upon request from their side, a unique identifier for the use of the electronic services offered by the company.
   (5) (Amended - State Gazette, No. 70 of 2024.) Insured persons, PEPP-insured persons, pensioners, PEPP beneficiaries and their heirs have the right to obtain a copy of the electronic documents in the electronic file on paper or electronic media after presenting the necessary verification documents. (6) (Amended - State Gazette, No. 73 of 2026, in force from 01.01.2027.) The permission for access and the refusal of access to the electronic file and for the use of electronic documents from it under the procedure of para. 5 are issued in written form by the managing and representing persons of the pension insurance company or by an employee authorized by them. The refusal of access is necessarily motivated. (7) (Supplemented - State Gazette, No. 55 of 2021.) The refusal under para. 6 may be appealed by the applicant under the procedure and within the deadlines provided in the regulations on the organization and activities of the respective pension fund, respectively in the rules of the payment fund.

Art. 9. (Supplemented - State Gazette, No. 55 of 2021; amended, No. 73 of 2026, in force from 01.01.2027.) The information system must provide the possibility for:

1. accounting and verification of the time of the occurrence of facts with legal significance with accuracy up to year, date, hour, minute and second;
2. (supplemented - State Gazette, No. 55 of 2021; amended, No. 73 of 2026, in force from 01.01.2027.) preparation of an extract from the individual account and from the analytical account under Art. 123c, para. 3, item 1 of the Social Insurance Code at any moment, for the creation and printing of the necessary primary documents and for the provision of the copies under Art. 8, para. 5 in all offices of the company;
3. connection with all offices and insurance intermediaries of the company for the registration of documents submitted at them;
4. receiving and sending documents signed with an electronic signature;
5. preparation and exchange in electronic format, determined by the supervisory authority, of the required daily, periodic and prepared upon request reports and inquiries;
6. operational exchange of information with the institutions with which the pension insurance company exchanges data, in accordance with the standards, formats and forms provided for this purpose.

Art. 10. (1) Documents submitted to the company electronically are registered by persons determined by the governing body. After the registration of an incoming electronic document received by the company, a confirmation of its receipt is generated and sent to the applicant.
(2) The persons under para. 1 perform checks for the regularity, completeness and accuracy of the provided data. Upon establishment of irregularities by the sender, an electronic message with instructions and a deadline for their removal is sent.

Art. 11. When providing an electronic service, the pension insurance company informs its user in advance in a clear and understandable manner regarding:

1. the technical steps for providing the service, their legal significance and the deadline for its provision;
2. the possibility for the issued act to be stored in electronic form by the company and the method of access to it;
3. the technical means for establishing and correcting errors in the entry of information, before the statements in connection with the service are made.

Art. 12. (Supplemented - State Gazette, No. 55 of 2021; amended, No. 70 of 2024.) The electronic page of the pension insurance company must provide convenient access:

1. to the information published on it;
2. (supplemented - State Gazette, No. 55 of 2021; amended, No. 70 of 2024.) to each insured person, PEPP-insured person, pensioner or PEPP beneficiary to the data on their individual account, their analytical account and their electronic file after entering the identifier.

Section IV
Registers

Art. 13. (Amended and supplemented - State Gazette, No. 55 of 2021; amended and supplemented, No. 70 of 2024; amended and supplemented, No. 73 of 2026, in force from 01.01.2027.) The information system of the pension insurance company must maintain in an up-to-date state the following main components, respectively applicable to the funds managed by the company:

1. registers of:
   a) insurance contracts - including by types for the voluntary fund (contract with personal contributions, contract with employer or with a person under Art. 230, para. 3, item 3 of the Social Insurance Code and contract with another insured person); b) officially assigned persons with the number and date of the protocol for official assignment; c) pension contracts; d) contracts for the installment payment of the accumulated funds in the individual accounts; e) (new - State Gazette, No. 55 of 2021; amended, No. 73 of 2026, in force from 01.01.2027.) contracts for the installment payment of the funds in the individual accounts in the cases under Art. 167, para. 1 of the Social Insurance Code and under Art. 248, para. 2 of the Social Insurance Code in insurance in a fund for supplementary voluntary pension insurance; f) (new - State Gazette, No. 70 of 2024.) PEPP contracts.
2. (amended - State Gazette, No. 55 of 2021; amended, No. 70 of 2024; amended, No. 73 of 2026, in force from 01.01.2027.) a register of individual accounts of insured persons and pensioners and of PEPP accounts, which must contain the data according to Art. 24 - Art. 25a of Ordinance No. 9 of 19.11.2003 on the assessment of assets and liabilities of the pension insurance company and of the funds and subfunds managed by it, for the calculation of the value of net assets, of one share and for the maintenance of individual accounts, Pan-European Pension Product (PEPP) accounts and analytical accounts in a payment fund (State Gazette, No. 109 of 2003), hereinafter referred to as "Ordinance No. 9";
3. (new - State Gazette, No. 55 of 2021; amended, No. 73 of 2026, in force from 01.01.2027.) a register of analytical accounts of persons receiving payments from the payment funds, which must contain the data according to Art. 27a of Ordinance No. 9;
4. (previous item 3 - State Gazette, No. 55 of 2021; amended, No. 73 of 2026, in force from 01.01.2027.) a register of received petitions for withdrawal or payment of funds separately for each managed fund, respectively subfund;
5. (previous item 4 - State Gazette, No. 55 of 2021; supplemented, No. 73 of 2026, in force from 01.01.2027.) registers of applications for participation under Art. 9 of Ordinance No. 33 of 16 July 2026 on individual applications for participation in a fund for supplementary mandatory pension insurance and for renewal of insurance in a universal pension fund (State Gazette, No. 67 of 2026) - for funds for supplementary mandatory pension insurance;
6. (previous item 5 - State Gazette, No. 55 of 2021; supplemented, No. 70 of 2024; amended, No. 73 of 2026, in force from 01.01.2027.) registers of applications for change of participation or transfer of funds under Art. 19 of Ordinance No. 3 of 16 July 2026 on change of participation and transfer of funds of an insured person in a fund for supplementary pension insurance (State Gazette, No. 68 of 2026);
7. (previous item 6 - State Gazette, No. 55 of 2021.) a register of received petitions for transfer of funds from one insurance account to another of the same pension fund of a spouse or relatives in a direct line up to the second degree - for a fund for supplementary voluntary pension insurance;
8. (previous item 7, amended - State Gazette, No. 55 of 2021; supplemented, No. 70 of 2024; amended, No. 73 of 2026, in force from 01.01.2027.) a register of owned assets separately for each fund for supplementary pension insurance, respectively for subfund and for each payment fund, analogous to the register under Art. 123a, para. 4, item 4 of the Social Insurance Code, with records for the daily, respectively monthly, assessment of each asset;
9. (previous item 8 - State Gazette, No. 55 of 2021.) a register of professional schemes - for a fund for supplementary voluntary pension insurance by professional schemes;
10. (previous item 9 - State Gazette, No. 55 of 2021.) a register of the business correspondence of the pension insurance company, including a register of complaints;
11. (previous item 10 - State Gazette, No. 55 of 2021.) other registers that the pension insurance company maintains in accordance with the normative regulation or its internal rules.

Section V
(Repealed - State Gazette, No. 73 of 2026, in force from 01.01.2027.)
Administrative Penalty Liability

Art. 14. (Repealed - State Gazette, No. 73 of 2026, in force from 01.01.2027.)

Transitional and Final Provisions

§ 1. (1) Within 7 days from the entry into force of the Ordinance, the pension insurance company submits to the Deputy Chairman of the Commission a certified copy of the document certifying certification for compliance with the standard under Art. 3, para. 1, respectively - the documents under Art. 4, para. 2. (2) The Deputy Chairman of the Commission may require supplementation or correction of the documents submitted under Art. 4, para. 2, as well as other data and information in connection with them, and may set a deadline for their submission. When the submitted documents do not meet the requirements of this Ordinance, the Deputy Chairman of the Commission may apply the measure under Art. 344, para. 1, item 1 of the Social Insurance Code.

§ 2. In Art. 6, para. 4 of Ordinance No. 33 of 2006 on individual applications for participation in a fund for supplementary mandatory pension insurance (State Gazette, No. 83 of 2006), the words "the requirements for the creation and maintenance of an information system of a pension insurance company, approved by the Deputy Chairman of the Commission for Financial Supervision, heading the "Insurance Supervision" Management" are replaced with "the Ordinance under Art. 123j, para. 1 of the Social Insurance Code".

§ 3. The Ordinance is issued on the basis of Art. 123j, para. 1 of the Social Insurance Code and is adopted with Decision No. 135-N of 11.07.2012 of the Commission for Financial Supervision.

§ 4. The Ordinance enters into force one year after its publication in the "State Gazette".

Chairman: Stoyan Mavrodiev

Final Provisions to ORDINANCE No. 62 of 30.10.2018 on the Procedure for Storage, Use and Destruction by Pension Insurance Companies of Documents and Data Related to the Activity in Supplementary Pension Insurance (State Gazette, No. 94 of 13.11.2018, in force from 19.11.2018)

§ 3. In Ordinance No. 47 of 2012 on the Requirements for the Information Systems of Pension Insurance Companies (State Gazette, No. 57 of 2012), in Art. 8, para. 3, the words "activities of scanning and/or storage" are replaced with "the activity of scanning".

Final Provisions to Ordinance on Amendment and Supplement of Ordinance No. 61 of 27.09.2018 on the Requirements for Advertising and Written Informational Materials and Internet Pages of Pension Insurance Companies (State Gazette, No. 55 of 02.07.2021)

§ 22. In Ordinance No. 47 of 11.07.2012 on the Requirements for the Information Systems of Pension Insurance Companies (Publ., State Gazette, No. 57 of 2012; amended, No. 94 of 2018), the following amendments and supplements are made:

1. In Art. 8:
   a) in para. 1, the word "pension" is deleted; b) at the end of para. 7, a comma is placed and "respectively in the rules of the payment fund" is added.
2. In Art. 9, item 2, after the words "individual account", "and from the analytical account under Art. 192b, para. 3, item 1 of the Social Insurance Code" is added.
3. In Art. 12, item 2, after the words "their individual account", a comma is placed and "for their analytical account" is added.
4. In Art. 13:
   a) in the main text, the word "pension" is deleted; b) in item 1, letter "d" is created:
   "d) contracts for the installment payment of the funds in the individual accounts in the cases under Art. 167a of the Social Insurance Code;" c) item 2 is amended as follows:
   "2. a register of individual accounts of insured persons and pensioners, which must contain the data according to Art. 24 and 25 of Ordinance No. 9 of 2003 on the manner and procedure for the assessment of assets and liabilities of the pension insurance company and of the funds managed by it, of the value of the net assets of the fund, for the calculation and announcement of the value of one share, for the calculation and comparison of the yield from investment real estate and for the requirements for the maintenance of individual accounts and analytical accounts in a fund for installment payments (State Gazette, No. 109 of 2003) (Ordinance No. 9), as well as the account of the reserve for guaranteeing minimum yield under Art. 193, para. 7 of the Social Insurance Code;" d) a new item 3 is created:
   "3. a register of analytical accounts of persons receiving payments from the installment payment funds, which must contain the data according to Art. 27a of Ordinance No. 9;" e) previous items 3 - 6 become respectively items 4 - 7; f) previous item 7 becomes item 8 and is amended as follows:
   "8. a register of owned assets separately for each fund for supplementary pension insurance and for each payment fund, analogous to the register under Art. 123a, para. 4, item 4 of the Social Insurance Code, with records for the daily, respectively monthly, assessment of each asset;" g) previous items 8 - 10 become respectively items 9 - 11.

Transitional and Final Provisions to Ordinance on Amendment and Supplement of Ordinance No. 63 of 8.11.2018 on the Requirements for the Content, Periodicity of Preparation and Deadlines for Submission of Reports for Supervisory Purposes of Pension Insurance Companies and Funds Managed by Them (State Gazette, No. 70 of 20.08.2024)

§ 18. In Ordinance No. 47 of 11.07.2012 on the Requirements for the Information Systems of Pension Insurance Companies (Publ., State Gazette, No. 57 of 2012; amended, No. 94 of 2018; amended and supplemented, No. 55 of 2021), the following amendments and supplements are made:

1. In Art. 3:
   a) in para. 1, the words "ISO/IEC 27001:2005" are replaced with "ISO/IEC 27001"; b) in para. 3, the words "international standard ISO/IEC 27002:2005 (ISO/IEC 17799:2005)" are replaced with "international standards ISO/IEC 27002 and ISO/IEC 27004".
2. In Art. 8:
   a) in para. 1, the words "insured person or pensioner" are replaced with "insured person, PEPP-insured person, pensioner or PEPP beneficiary"; b) in para. 2, the words "insured persons, pensioners" are replaced with "persons under para. 1"; c) in para. 4, the words "insured person or pensioner" are replaced with "insured person, PEPP-insured person, pensioner or PEPP beneficiary"; d) in para. 5, the words "Insured persons, pensioners" are replaced with "Insured persons, PEPP-insured persons, pensioners, PEPP beneficiaries".
3. In Art. 12, item 2, the words "insured person or pensioner" are replaced with "insured person, PEPP-insured person, pensioner or PEPP beneficiary".
4. In Art. 13:
   a) in item 1, letter "e" is created:
   "e) PEPP contracts."; b) item 2 is amended as follows:
   "2. a register of individual accounts of insured persons and pensioners and of PEPP accounts, which must contain the data according to Art. 24 and 25 of Ordinance No. 9 of 19.11.2003 on the assessment of assets and liabilities of the pension insurance company and of the funds managed by it, for the calculation of the value of net assets, of one share and of the yield from investment real estate and for the maintenance of individual accounts"

parties, the accounts for the Pan-European Pension Product (PEPP) and the analytical accounts in the deferred payment fund (State Gazette, No. 109 of 2003) (Ordinance No. 9), as well as the account for the reserve for guaranteeing minimum income under Art. 193, para. 7 of the Social Insurance Code;" b) in item 6, at the end, add "and for applications for changing the PEPP provider"; c) in item 8, after the word "insurance", add a comma and add "respectively for the sub-fund under Art. 214a of the Social Insurance Code".
5. Everywhere in the ordinance, the word "the Commission" is replaced with "the Commission".

Transitional and Final Provisions to the Ordinance for Amendment and Supplement of Ordinance No. 17 of 7.07.2004 on the Documents Required for Issuing a Permit for the Transformation of a Pension Insurance Company and a Supplementary Pension Insurance Fund and on the Requirements for the Plans under Art. 327, para. 1, item 3 and Art. 336, para. 1 of the Social Insurance Code (State Gazette, No. 73 of 14.08.2026, effective from 01.01.2027)

§ 20. In Ordinance No. 47 of 11.07.2012 on the Requirements for the Information Systems of Pension Insurance Companies (published, State Gazette, No. 57 of 2012; amended, No. 94 of 2018, No. 55 of 2021 and No. 70 of 2024), the following amendments and supplements are made:

1. In Art. 2, the word "the activity" is replaced with "the carried out activity".
2. Article 4 is amended as follows:
   "Art. 4. Compliance with the requirements of the standard under Art. 3, para. 1 is demonstrated through certification by an accredited conformity assessment body."
3. In Art. 5:
   a) in para. 1, after the words "policy for", add "information", and delete the words "under Art. 4, para. 2"; b) in para. 3, in the text before item 1, after the words "the policy for", add "information".
4. Article 6 is amended as follows:
   "Art. 6. (1) To certify compliance with the standard under Art. 3, para. 1, the pension insurance company submits to the Deputy Chairman of the Commission, heading the "Insurance Supervision" Management, hereinafter referred to as "the Deputy Chairman of the Commission", a certified copy of the document certifying the certification within 7 days from its completion. (2) Within 7 days from the suspension of the certification, the company notifies the Deputy Chairman of the Commission of this circumstance and of the planned actions and deadlines for bringing into compliance with the standard and conducting certification."
5. In Art. 7, para. 1, after the word "uses", add "the information system for secure electronic service or".
6. In Art. 8:
   a) in para. 3, item 3, the word "exporting" is replaced with "entrusting"; b) in para. 6, the words "managing and representing" are replaced with "managing and representing", and the word "him" is replaced with "them".
7. In Art. 9, item 2, the words "Art. 192b" are replaced with "Art. 123c".
8. In Art. 13:
   a) in item 1, letter "d", the words "Art. 167a of the SIC" are replaced with "Art. 167, para. 1 of the SIC and under Art. 248, para. 2 of the SIC in insurance in a supplementary voluntary pension insurance fund"; b) item 2 is amended as follows:
   "2. a register of individual accounts of insured persons and pensioners and of PEPP accounts, which must contain the data according to Art. 24 - Art. 25a of Ordinance No. 9 of 19.11.2003 on the Assessment of Assets and Liabilities of the Pension Insurance Company and of the Funds and Sub-funds Managed by It, for Calculating the Value of Net Assets, of One Share and for Maintaining Individual Accounts, Accounts for the Pan-European Pension Product (PEPP) and Analytical Accounts in the Deferred Payment Fund (State Gazette, No. 109 of 2003), hereinafter referred to as "Ordinance No. 9";" c) in item 3, the word "deferred" is replaced with "term"; d) in item 4, at the end, add a comma and add "respectively sub-fund"; e) item 5 is amended as follows:
   "5. registers of applications for participation under Art. 9 of Ordinance No. 33 of 16 July 2026 on Individual Applications for Participation in a Supplementary Mandatory Pension Insurance Fund and for Renewal of Insurance in a Universal Pension Fund (State Gazette, No. 67 of 2026) - for supplementary mandatory pension insurance funds;" f) item 6 is amended as follows:
   "6. registers of applications for change of participation or transfer of funds under Art. 19 of Ordinance No. 3 of 16 July 2026 on Change of Participation and Transfer of Funds of an Insured Person in a Supplementary Pension Insurance Fund (State Gazette, No. 68 of 2026);" g) in item 8, the words "for the sub-fund under Art. 214a of the Social Insurance Code" are replaced with "sub-fund".
9. Section V with Art. 14 is repealed.