Bulgaria BG

Bulgaria's D1 profile this cycle is dominated by a single architecture undergoing legal metamorphosis rather than dismantlement. The Lukoil Neftohim Burgas refinery, operating under a December 2022 EU mass-balance export exemption, raised Russian-crude intake from roughly 70 percent to roughly 93 percent of throughput while exporting refined product under the same accounting rule, generating over EUR1 billion in annual Kremlin tax revenue at peak. Following OFAC's October 2025 SDN designation of Rosneft and Lukoil under the Russian Harmful Foreign Activities Sanctions programme, Bulgaria's Council of Ministers moved within weeks to install the head of its tax agency as external administrator over the refinery and over Lukoil's retail, aviation and bunker subsidiaries, converting a sanctions-driven fuel-supply threat into a state-administration model that preserves operational continuity. OFAC's response has been to build a parallel licensing architecture rather than force a clean break: General Licence 130, issued November 2025, and its amendment GL130A in April 2026, authorise continued transactions with the named Lukoil entities in Bulgaria through a window now extended to 29 October 2026.

Read as architecture rather than incident, this sequence illustrates a structural continuity mechanism: the mass-balance exemption that inflated Russian-crude throughput has been replaced by a state-administration model keeping the same physical refining and export activity running under a different legal wrapper, pending resolution of Litasco SA's formal legal challenge to the seizure, unresolved as of the most recent reporting. That dispute will likely determine whether the refinery's longer-term ownership status is settled by negotiated divestment, continued state administration, or a contested legal outcome.

The picture is complicated by two divergence signals. Bulgaria's 2026 government has indicated it will oppose the inclusion of Patriarch Kirill in a new EU restrictive-measures package, breaking from the emerging EU consensus, a political-commitment risk factor bearing directly on the FATF requirement that grey-listed jurisdictions sustain the political will underlying their action plans. Separately, a structural regulatory divergence exists between the EU and the UK: HM Treasury's February 2026 Advisory Notice lists Bulgaria as a UK High-Risk Third Country under Regulation 33, an outcome definitionally impossible under EU law for an EU member state. The UK's post-Brexit HRTC mechanism, tied to live FATF lists rather than EU membership, produces an outcome EU instruments structurally cannot replicate.

A residual channel deserves note under the three-pillar balance this monitor applies: FATF follow-up statements from February through June 2025 flagged gaps in Bulgaria's proliferation-financing targeted-financial-sanctions framework under Recommendation 7, and while the June 2026 statement suggests substantial remediation is pending, this has not yet been verified on-site. Until verification occurs, a residual channel exists through which DPRK- or Iran-linked proliferation financing could transit EU and eurozone banking rails via Bulgaria, a CPF-pillar finding structurally under-weighted relative to the AML-pillar volume the refinery story generates.

The broader pattern is instructive for how enabler-adjacent EU member states manage extraterritorial US sanctions pressure: rather than abandoning the underlying asset, the state absorbs administrative control, and the sanctioning authority accommodates that absorption through jurisdiction-specific licensing carve-outs. This is neither classic evasion nor straightforward enforcement; it is a third category, sanctioned-asset continuity management, that the F2 filter is designed to surface at the architecture level rather than as a single enforcement headline.

Outlook

The near-term sequencing is clear: GL130A's authorisation runs to 29 October 2026, close to the window in which FATF's on-site assessment and Plenary decision are also expected. Whether Bulgaria's stated dissent on the Kirill designation persists through that window, and whether the Litasco dispute resolves before or after the GL130A expiry, are the two structural uncertainties most likely to determine whether the sanctions-architecture trajectory stabilises or continues deteriorating.

As an EU member state, Bulgaria's D2 profile is properly read against the structural backdrop of the EU AML Package, which comprises three distinct instruments: the directly-applicable AML Regulation (AMLR, Regulation (EU) 2024/1624), the sixth AML Directive (6AMLD) requiring per-member-state transposition, and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority. All three converge on a 10 July 2027 application date, at which point AMLA's supervisory perimeter begins shifting from a purely national to a hybrid EU-level regime; AMLA's first risk-based selection round, covering roughly 40 cross-border obliged entities EU-wide and expected in 2027, will determine whether a Bulgaria-active institution moves to AMLA direct supervision from 2028. Bulgaria's own 6AMLD transposition vehicle, which will reshape FID-SANS's institutional mandate over FIU powers, registers and supervisory architecture, has not yet been identified in the public record this cycle and is recorded as not established rather than assumed complete.

Against that backdrop, this cycle's most consequential Bulgaria-specific development is the FATF/MONEYVAL determination at the June 2026 Plenary that Bulgaria has substantially completed its grey-list action plan, triggering an on-site assessment as the precursor to a possible delisting decision at the October 2026 or February 2027 Plenary. That improving technical-compliance trajectory sits alongside a persistent effectiveness deficiency: the FATF/MONEYVAL follow-up cycle running from February 2025 to June 2026 has repeatedly flagged insufficient investigation and prosecution of money laundering tied to high-scale corruption and organised crime. Effectiveness deficiencies are structurally harder to remediate than technical re-ratings, and this gap is the primary residual risk to full delisting.

An enforcement episode this cycle illustrates the corporate-transparency vulnerability directly: EPPO and the Bulgarian GDCOC detained eight suspects and executed eight search warrants over a shell-company network that used fabricated employment contracts to fraudulently draw down funds under Bulgaria's Human Resources Development Programme, exposing weak beneficial-ownership scrutiny at the company-formation stage even as EU-level enforcement caught the scheme.

Against these gaps, Bulgaria retains a genuine positive structural outlier: it is one of only five EU member states, alongside Denmark, Latvia, Luxembourg and Slovenia, operating a free, publicly accessible, green-graded beneficial-ownership register, interconnected through the EU's BORIS system. A separate, narrower transparency-adjacent development closes in August: the mandatory lev/euro dual price-display transition window, running one year from Bulgaria's 1 January 2026 euro adoption, ends on 8 August 2026, removing a residual cash-conversion valuation-opacity channel tied to the currency changeover.

Outlook

Bulgaria's D2 trajectory over the next twelve months will be defined by the interaction of two timelines: the FATF on-site verification process culminating in a delisting decision by early 2027, and the 10 July 2027 AMLR/6AMLD application date that will re-base Bulgaria's national AML framework regardless of the FATF outcome. Whether the persistent effectiveness deficiency in ML prosecutions is resolved before the on-site assessment, and whether Bulgaria identifies and enacts a 6AMLD transposition vehicle well ahead of the 2027 deadline, are the two clearest indicators to watch.

Bulgaria's D3 signal this cycle centres on its role as a staffing and back-office hub within a transnational, cross-border investment-fraud network rather than on any single enforcement action. Bulgaria-based compliance, marketing and IT staff were identified within a network anchored in Israel, Cyprus and Ukraine that extracted over US$240 million from more than 26,000 victims between 2021 and 2024, combining social-engineering techniques and fake trading platforms with crypto cold-wallet payment demands. The professional-facilitator dimension here is not a licensed intermediary sector of the kind typically associated with enabler-jurisdiction analysis, but a weakly-supervised call-centre and payment-processing labour market that plugs directly into a globally distributed laundering chain, with proceeds routed through international bank and crypto-wallet chains before reaching end-beneficiaries.

The EU subsidy-fraud enforcement episode this cycle, in which EPPO and the Bulgarian GDCOC detained eight suspects over a shell-company network exploiting fabricated employment contracts, is relevant to this domain as well: it illustrates a second, distinct enabler pathway in Bulgaria, corporate-formation infrastructure used to fabricate legitimate-seeming employment and procurement documentation in support of fraud, operating independently of the crypto-scam staffing pathway but drawing on the same underlying weakness in company-formation-stage scrutiny.

Applying the F3 enabler-jurisdiction filter requires distinguishing capacity from choice: nothing in the available record this cycle indicates that Bulgarian authorities have deliberately chosen a permissive posture toward this staffing infrastructure, and the absence of a confirmed Bulgaria-specific enforcement action against the identified crypto-scam network's local operations should be read as an evidentiary gap rather than as evidence of tolerance. The systemic significance nonetheless lies in the ease with which ordinary, weakly-supervised service-sector employment, compliance, marketing, IT roles, becomes infrastructure for a fraud network whose ultimate victims and beneficiaries are located entirely outside Bulgaria.

Outlook

The absence of visible enforcement against the local staffing dimension of the crypto-scam network, distinct from the separate and more visible EPPO/GDCOC subsidy-fraud action, remains the key variable to track. Whether targeted primary-source investigation confirms or narrows this evidentiary gap will materially affect whether Bulgaria's D3 status moves from watch toward active engagement.

Read through the conflict-finance lens, the Neftohim Burgas refinery is the source-channel-deployment architecture that this domain exists to trace. The source is Russian crude, whose share of refinery throughput rose from roughly 70 percent to roughly 93 percent under a December 2022 EU mass-balance export exemption. The channel is the refining and export process itself, structured so that refined product could be exported under mass-balance accounting even as the underlying crude input became overwhelmingly Russian in origin. The deployment is Kremlin tax revenue, generated at over EUR1 billion annually at peak, a direct financial contribution to the state conducting the war in Ukraine, extracted through EU-territory refining infrastructure operating under an EU-granted exemption.

The October 2025 OFAC SDN designation of Rosneft and Lukoil disrupted the ownership and control layer of this architecture but did not eliminate the underlying revenue mechanism: Bulgaria's state administration of the refinery, installed within weeks of the designation, has kept the same physical refining and export activity operating, now under Bulgarian state control rather than the mass-balance exemption model, pending resolution of Litasco SA's legal challenge to the seizure. From a conflict-finance perspective, this is best characterised as a change in the legal form of the revenue channel rather than its interruption; the war-economy financing function the refinery has performed persists in altered form.

This domain's severity assessment reflects the scale of the revenue involved and the direct nexus to an active armed conflict, distinguishing it from the sanctions-compliance and jurisdictional-divergence questions that dominate the D1 reading of the same underlying facts. The extractive-industry integrity dimension here is specifically about refining and export accounting rather than upstream extraction, but the core F4 filter concern, financial flows sustaining armed conflict, applies with full force to the mass-balance architecture regardless of which entity currently administers it.

Outlook

The question this domain will track going forward is whether Bulgarian state administration of the refinery represents a genuinely transitional arrangement pending divestment, or a durable new form through which the underlying revenue architecture persists indefinitely. The unresolved Litasco dispute is the key determinant of which outcome materialises.

Bulgaria's D5 exposure this cycle is anchored to its own EU-member regulatory perimeter under MiCA rather than to any Bulgaria-specific crypto-market development. As an EU member state, Bulgaria falls under MiCA's crypto-asset service provider authorisation regime, and the transitional authorisation window available to previously-operating firms closed EU-wide on 1 July 2026, applying to Bulgaria-active operators without a confirmed Bulgaria-specific enforcement action against unauthorised CASPs identified in the record this cycle. That absence of confirmed enforcement is itself worth surfacing explicitly rather than passing over: it may reflect genuine compliance ahead of the deadline, or it may reflect a supervisory visibility gap, and the record does not yet distinguish between the two.

A second and more concrete D5 signal concerns supervisory tailoring rather than market structure. FID-SANS, Bulgaria's financial intelligence unit, has not been confirmed to have issued virtual-asset-service-provider-specific suspicious-transaction-report guidance distinct from its general AML and CFT guidance; Bulgaria's 2022 Mutual Evaluation Report rated Recommendation 15, covering new technologies including virtual assets, as Partially Compliant. General FID-SANS guidance on terrorist-financing measures, customer risk and politically exposed persons applies formally to VASPs, but the absence of tailored detection guidance is a persistent gap distinguishing market-entry (registration) controls, which are established, from ongoing suspicious-activity detection capability, which remains unconfirmed.

The crypto-enabled investment-scam network in which Bulgaria-based staff were identified, extracting over US$240 million from more than 26,000 victims through fake trading platforms demanding crypto cold-wallet payments, is directly relevant here as well, cross-referencing the D3 enabler-jurisdiction reading of the same facts: from the D5 perspective, the notable feature is the laundering of proceeds through crypto-wallet chains layered against international banking rails, a hybrid traditional-finance and digital-asset laundering architecture rather than a purely on-chain scheme.

Outlook

The most consequential near-term D5 question for Bulgaria is whether MiCA's post-transitional enforcement phase, now underway EU-wide, produces any Bulgaria-specific action against unauthorised or non-compliant CASPs, and whether FID-SANS closes the VASP-specific STR-guidance gap that the 2022 Mutual Evaluation Report identified. Both would materially change Bulgaria's supervisory-tailoring profile in this domain.

Bulgaria's D6 record this cycle consists entirely of an evidentiary absence rather than a documented development: no Bulgaria-specific public-domain evidence of AI-driven transaction-monitoring or supervisory-technology roadmaps at FID-SANS has been identified. Consistent with this monitor's principle that non-enforcement, and by extension non-investment, in a jurisdiction is itself analytically significant, this absence is treated as a data point on supervisory capacity rather than as neutral silence, particularly given the effectiveness deficiencies in prosecuting high-scale corruption-linked money laundering documented under Bulgaria's D2 profile. A jurisdiction with a repeatedly flagged effectiveness gap in ML enforcement and no visible RegTech or SupTech investment presents a compounding, rather than independent, risk signal.

This finding carries lower confidence than most other findings in Bulgaria's profile this cycle, reflecting genuine limits in publicly available sourcing on a supervisory authority's internal technology posture rather than a considered assessment that no such investment exists. Targeted primary-source verification, potentially including direct engagement with FID-SANS or the Bulgarian National Bank, would be required to distinguish a genuine capability gap from an investment that simply has not been publicised.

Outlook

This domain remains a standing evidentiary gap rather than an active tracking item. Any future cycle identifying concrete RegTech or SupTech developments at FID-SANS, or confirming their continued absence through direct primary sourcing, would represent a material change to Bulgaria's D6 status.