Bulgaria

Art. 12(1) requires an internal reporting channel from public-sector employers (municipalities aside, Art. 12(2)) and from private employers with 50 or more workers, or of any size in listed EU-regulated activities; employers with 50 to 249 workers may share a channel (Art. 12(3)). Art. 13(1) requires confidentiality and records on durable media, Art. 16(1) receipt confirmation within 7 days and Art. 16(4) feedback within three months of confirmation. Art. 41 fines non-compliance.

Art. 10 lists the measures: identification and verification, beneficial owner identification, purpose of the relationship, source of funds and ongoing monitoring. Art. 11 sets triggers, including occasional transactions of EUR 15,000 (EUR 5,000 for cash) and fund transfers of EUR 1,000 or more. Art. 15 requires most measures before the relationship begins, Art. 16 requires information to be updated at intervals set in the internal rules, and Art. 17 requires refusal or termination if CDD cannot be completed.

Art. 31(1) requires a payment institution that intends to outsource operational functions to notify the BNB, identifying the entity and describing the outsourced services. Under Art. 30(1) the institution stays liable for the acts of its employees and agents.

The BNB licenses payment institutions (Art. 6) and electronic money institutions (Art. 37(1)) whose registered office is in Bulgaria. User funds must not be commingled and must be accounted for in a safeguarding account (Art. 23). Art. 41 applies this to funds received for e-money; funds received through a payment instrument must be safeguarded no later than five business days after the e-money is issued (Art. 41(2)).