Bulgarian Financial Instruments Broker Exam cheat sheet

In Bulgaria, the Markets in Financial Instruments Act (Zakon za pazarnite vav finansovi instrumenti, ZPFI) transposes MiFID II; the Financial Supervision Commission (Komisia za finansov nadzor, KFN) is the competent authority for investment firms, trading venues and market abuse.

KFN's three deputy-chair led sectors are investment supervision (including capital markets), insurance supervision, and banking/payments oversight; the Investment Supervision Department handles licensing, ongoing supervision and inspections of investment intermediaries.

An investment firm must be licensed by KFN before providing investment services in Bulgaria; passporting into Bulgaria by EEA firms occurs via the home-state regulator notification to KFN, and KFN may refuse only on defined grounds notified to the home authority.

Bulgarian law distinguishes 'investment intermediary' (the licensed firm) from tied agents, who act on behalf of one firm and must be registered with KFN; the firm remains fully liable for the tied agent's conduct.

Administrative penalties under ZPFI are imposed by KFN by reasoned decision; the sanctioned person may appeal to the Sofia Administrative Court (Administrativen sad Sofia-grad) within 14 days of notification.

KFN cooperates with ESMA, EBA and EIOPA and with other EEA regulators; memoranda of understanding and ESMA peer reviews shape supervisory expectations, and KFN sits on ESMA's Board of Supervisors.

The Bulgarian Stock Exchange (BSE) and its regulated market, plus the Central Depository AD, are licensed/recognised infrastructure supervised by KFN; the Central Depository maintains securities accounts and settles BSE trades.

Key national implementing acts: ZPFI (markets in financial instruments), the Market Abuse in Financial Instruments Act, the Measures against Money Laundering Act, and KFN ordinance-level rules on capital adequacy, client assets and reporting.

MiFID II instrument categories: transferable securities; money market instruments; units in collective investment undertakings; options, futures, swaps, forwards and other derivatives relating to securities, currencies, interest rates, commodities or credit; and emission allowances.

Equity valuation basics: price = expected dividends discounted at required return (Gordon: P0 = D1 / (r - g)); bond price = sum of coupon/(1+y)^t plus face/(1+y)^n, with price falling as yield rises and rising with longer duration for a given yield change.

Duration measures price sensitivity: modified duration approximates percentage price change = -modified duration x change in yield; convexity corrects the estimate for larger yield moves.

Derivative payoffs: long call payoff = max(S - K, 0); long put payoff = max(K - S, 0); forward payoff at maturity = S - K for the long. Option premium = intrinsic value + time value.

Money market instruments (T-bills, commercial paper, certificates of deposit) are short-term, discount-quoted; a discount rate quote understates the true yield, which is computed on the invested amount.

Collective investment scheme units: UCITS are retail, diversified and redeemable; AIFs may be closed-ended, leveraged or illiquid. NAV per unit = (assets - liabilities) / units outstanding.

Bond features to identify: issuer, seniority, coupon type (fixed, floating, zero), maturity, call/put options, covenants, and credit rating; subordinated debt ranks behind senior debt in insolvency.

Conversion/valuation conventions matter: clean vs dirty bond price (dirty = clean + accrued interest), ex-dividend adjustments for equities, and contract multipliers for futures and options.

MiFID II venue types: regulated market (RM), multilateral trading facility (MTF), organised trading facility (OTF), and systematic internaliser (SI); OTFs may not trade equities and are limited to non-equity instruments.

Best execution requires taking all sufficient steps to obtain the best result for the client considering price, costs, speed, likelihood of execution and settlement, size and nature of the order; the firm must publish and maintain an order execution policy.

Order types: market, limit, stop, stop-limit; time-in-force variants include day, GTC, GTD, IOC and FOK. A limit buy executes only at or below the limit price.

Order protection rules: client orders must be recorded and executed promptly on the terms most favourable to the client; aggregation of client orders is permitted only where consistent with the order execution policy and unlikely to disadvantage any client.

Pre-trade transparency: RM/MTF must publish current bid/ask and depth for equities; post-trade transparency requires publication of price, volume, time and venue, subject to permitted deferrals and waivers.

The tick size regime applies to equities and equity-like instruments traded on RM/MTF/SI; the tick size depends on the instrument's liquidity band and price range.

Settlement cycle for BSE equities is T+2 through the Central Depository; failed settlement triggers buy-in procedures under CSDR.

Market making and liquidity provision arrangements must be disclosed; a firm providing liquidity on an MTF or OTF must have a written agreement specifying obligations and any incentives.

Core MiFID II investment services: reception and transmission of orders, execution of orders on behalf of clients, dealing on own account, portfolio management, investment advice, underwriting/placing, and operation of an MTF/OTF.

Ancillary services include custody and administration of financial instruments, safekeeping, foreign exchange services connected to investment services, research, and investment credit.

Client categories: eligible counterparties (ECPs), professional clients (per se or elective), and retail clients. Retail clients receive the highest level of protection; ECP treatment removes many conduct protections.

Suitability (investment advice, portfolio management) requires gathering information on knowledge/experience, financial situation including loss-bearing capacity, and investment objectives including risk tolerance; the firm must issue a suitability statement.

Appropriateness assessment applies to non-advised services (execution, reception/transmission) for complex products; if the client lacks knowledge, the firm must warn and may proceed at the client's instruction.

Elective professional clients must meet two of three criteria: ten significant transactions per quarter over four quarters, portfolio exceeding EUR 500,000, or one year's relevant professional experience; a written opt-up procedure and warning are required.

Product governance: manufacturers define a target market and review the product; distributors must ensure the product fits the identified target market and report sales outside it to the manufacturer.

Inducements: fees paid to or by third parties must not impair the firm's duty to act honestly and professionally; investment advice and portfolio management must be inducement-free (with narrow, disclosed exceptions for minor non-monetary benefits).

The Market Abuse Regulation (MAR) prohibits insider dealing, unlawful disclosure of inside information, and market manipulation for financial instruments admitted to or traded on a regulated market, MTF or OTF.

Inside information: precise, non-public information relating to one or more issuers or instruments that, if made public, would likely significantly affect prices; for commodity derivatives, information expected to be disclosed under market rules also counts.

Insider dealing includes dealing on own account or for a third party using inside information, and recommending or inducing another person to deal (tipping); attempted dealing is also prohibited.

Market manipulation includes transactions giving false or misleading signals as to supply, demand, price or volume, price positioning at abnormal levels, and dissemination of false or misleading information.

Issuers must disclose inside information as soon as possible (with limited delay where legitimate interests exist, subject to KFN notification), maintain an insider list, and require managers' transaction notifications (PDMR dealings).

Suspicious transaction and order reports (STORs) must be submitted to KFN without delay where there are reasonable grounds to suspect market abuse; the firm must have a documented escalation process.

Market soundings require prior consent of the recipient, a written record, and a 'wall-crossing' script; recipients become insiders and must be reminded of their obligations.

KFN may impose administrative fines and sanctions for market abuse; MAR also provides for criminal penalties under national law, and firms must maintain records of communications for at least five years.

Core conduct duties: act honestly, fairly and professionally in the best interests of clients; provide information that is fair, clear and not misleading; and manage conflicts of interest.

Conflicts of interest policy must identify circumstances that may damage client interests, maintain a register of conflicts, and use organisational and Chinese-wall measures to prevent or manage them.

Client agreements must disclose the firm's execution policy, fees, the nature of the service, the applicable client category, and the firm's complaints-handling procedure.

Costs and charges must be disclosed in a standardised format (ex-ante and ex-post aggregate figures), including the firm's own fees and third-party payments; charges must not be misleadingly described as free.

Marketing communications must be identifiable as such and must not disguise the risks of the product; past performance must not be presented as a reliable indicator of future results.

Complaints must be handled promptly and fairly; clients must be informed of the right to escalate to KFN or to the relevant ombudsman/ADR body.

The firm must maintain adequate records of client orders, instructions, communications and agreements; recordings of telephone conversations relating to transactions must be retained for at least five years.

Ethical duties extend to fair treatment of clients when allocating orders, avoiding front-running and personal account dealing without prior approval under the firm's personal account dealing policy.

Bulgarian AML/CFT framework: the Measures against Money Laundering Act (Zakon za merkite sreshtu izpirane na pari) and the Measures against the Financing of Terrorism Act, supervised for investment firms by KFN and for some entities by the National Revenue Agency.

Customer due diligence (CDD) includes identifying the client and beneficial owner, verifying identity using reliable, independent sources, and understanding the purpose and intended nature of the relationship.

Enhanced due diligence applies to politically exposed persons (PEPs), their family members and close associates, high-risk jurisdictions, and complex or unusually large transactions; senior management approval is required for PEP relationships.

Simplified due diligence may be applied only to low-risk situations (e.g., listed companies, regulated financial institutions) and must still include identification and ongoing monitoring.

Reporting obligations: suspicious activity reports (SARs) go to the Financial Intelligence Directorate (FID) of the State Agency for National Security; tipping off the client is prohibited.

Record-keeping: CDD records and transaction documents must be retained for at least five years after the end of the business relationship or the transaction, extendable by the FID.

Risk-based approach: the firm must perform an enterprise-wide risk assessment, apply a customer risk classification, and calibrate monitoring and CDD intensity to the risk level.

Cash and threshold rules: for occasional transactions above EUR 15,000 (or the BGN equivalent) CDD must be applied; cash payments above the statutory threshold are restricted and must be reported where required.

Investment firms under the IFR/IFD framework must meet own funds requirements based on the higher of: permanent minimum capital (EUR 75,000 for reception/transmission and execution; EUR 150,000 for dealing on own account, underwriting, or operating an MTF; EUR 750,000 for dealing on own account as a market maker or operating an OTF), fixed overheads requirement (25% of fixed overheads), and the K-factor requirement.

K-factors capture risk to clients (AUM, client money held, assets safeguarded), risk to market (trading counterparty, daily trading flow), and risk to firm (concentration, position risk).

Client assets rules: client money must be held in segregated accounts with a credit institution or central bank, and client financial instruments must be segregated from firm assets and reconciled daily.

Title transfer collateral arrangements (TTCA) and securities financing transactions must be disclosed to clients and documented; the client must be informed of the risks of losing ownership of assets.

The client money calculation must be performed at least daily; any shortfall must be funded by the firm from its own funds and reported to KFN.

Risk management must include a documented risk appetite, limits on market, credit, liquidity and operational risk, stress testing, and independent oversight by a risk function reporting to senior management.

The firm must maintain a recovery plan and, where required, a resolution plan; outsourcing arrangements must not impair KFN's ability to supervise the firm.

Operational risk controls include business continuity planning, IT security and cyber resilience, and change management; material incidents must be reported to KFN.

Transaction reporting (MiFIR Article 26): investment firms must report complete and accurate details of transactions executed on any venue or OTC to KFN by end of the next working day, using a legal entity identifier (LEI) for the firm and, where relevant, the client.

Transaction reports must include the instrument identification (ISIN), buyer and seller identifiers, price, quantity, venue, and the trading capacity (matched principal, dealing on own account, or acting as agent).

Record-keeping: the firm must retain records of services, transactions and communications for at least five years, extendable by KFN to seven years in specified circumstances.

Post-trade transparency for shares requires publication of price, volume, time and venue as close to real time as possible, subject to permitted deferrals (e.g., large trades) and waivers.

The firm must submit periodic regulatory reports to KFN, including financial statements, capital adequacy returns and client asset returns, on the frequency and in the format prescribed by KFN ordinance.

Instrument reference data must be reported to ESMA via the FIRDS system; the firm must ensure the ISIN and trading venue codes used in reports are valid and current.

Best execution reporting: firms must publish annual RTS 27-style execution quality data and provide clients with an RTS 28-style summary of execution venues and the quality of execution achieved.

Internal audit and compliance monitoring must review the completeness and accuracy of transaction reports; errors must be corrected and reported to KFN without undue delay.

KFN supervisory tools include information requests, on-site inspections, appointment of a temporary administrator, suspension of activities, and withdrawal of a licence for serious or repeated breaches.

Administrative sanction decisions must be reasoned, published (subject to proportionality and confidentiality limits), and subject to appeal to the Administrative Court of Sofia within 14 days.

KFN cooperates with other EEA regulators through ESMA colleges and MoUs; for cross-border firms the home regulator supervises prudential matters and the host regulator supervises conduct of business.

Whistleblowing: firms must maintain internal reporting channels and protect whistleblowers; MAR requires confidential reporting of market abuse suspicions.

KFN publishes an annual report and supervisory priorities; it may issue guidance and Q&A documents that shape supervisory expectations for investment intermediaries.

Enforcement cooperation with the Prosecutor's Office applies to suspected criminal offences (market abuse, fraud, money laundering); KFN may refer cases and share information subject to confidentiality rules.

Supervisory convergence is driven by ESMA guidelines (e.g., on suitability, product governance, and market abuse) which KFN must apply or explain non-compliance.

Breach of record-keeping, reporting or client asset rules may lead to fines, public censure, suspension of individuals, and referral to the relevant professional body.

DORA (Regulation (EU) 2022/2554) applies to investment firms from 17 January 2025 and requires ICT risk management, incident reporting, resilience testing, and ICT third-party risk management.

Firms must maintain an ICT risk management framework, a register of ICT assets and dependencies, and a business continuity policy tested periodically.

Major ICT-related incidents must be reported to KFN in phases: initial notification, intermediate report and final report, within the timelines set by regulatory technical standards.

Digital operational resilience testing includes vulnerability assessments, scenario-based testing and, for significant firms, threat-led penetration testing (TLPT) at least every three years.

ICT third-party risk: contracts with critical ICT providers must include exit strategies, service level descriptions, audit rights and data protection clauses; KFN may designate critical providers.

Cyber resilience expectations include multi-factor authentication, encryption, network segmentation, and incident response playbooks.

Outsourcing to cloud providers does not transfer regulatory responsibility; the firm remains accountable to KFN for the outsourced function.

Firms must maintain a register of information on all contractual arrangements with ICT third-party providers and report it to KFN annually.

The Sustainable Finance Disclosure Regulation (SFDR) requires firms to disclose at entity and product level how sustainability risks are integrated and whether principal adverse impacts (PAIs) on sustainability factors are considered.

Products are classified as Article 6 (no sustainability objective), Article 8 (promotes environmental or social characteristics) or Article 9 (sustainable investment objective); classification drives disclosure obligations.

MiFID II suitability rules require advisers to ask about clients' sustainability preferences (as amended by the 2021 MiFID II delegated regulation) and to match products to those preferences.

The EU Taxonomy Regulation defines environmentally sustainable economic activities using technical screening criteria and 'do no significant harm' and minimum social safeguard tests.

Corporate Sustainability Reporting Directive (CSRD) obligations fall on the issuer, but distributors rely on issuer disclosures for product-level ESG data.

Greenwashing risk: marketing must be fair, clear and not misleading; ESG claims must be substantiated and consistent with the SFDR/Taxonomy disclosures.

Product governance must consider sustainability-related objectives in the target market definition and review.

Firms must maintain records of clients' sustainability preferences and of the suitability assessment that considered them.

Investment firms must have robust governance arrangements, including a clear organisational structure with well-defined, transparent and consistent lines of responsibility.

Senior management must be fit and proper: adequate knowledge, skills and experience, and good repute; KFN assesses fitness and propriety of directors and qualifying shareholders.

Remuneration policies must be consistent with effective risk management, include a balanced mix of fixed and variable pay, and provide for malus and clawback in specified circumstances.

The management body must approve and oversee the firm's risk strategy, compliance framework, and remuneration policy, and must meet with sufficient frequency.

Conflicts of interest at board level must be identified and managed; independent directors and a nomination/remuneration committee are expected for larger firms.

The compliance function must be independent, adequately resourced, and have direct access to the management body; the head of compliance must be fit and proper.

Outsourcing of critical functions requires prior notification to KFN and must not impair the quality of internal control.

Firms must maintain a conflicts of interest register, a gifts and entertainment register, and a personal account dealing register, reviewed by compliance.

Client complaints must be handled promptly, fairly and consistently; the firm must acknowledge receipt and provide a substantive response within the timeframe set by KFN rules.

Clients must be informed in writing of the firm's complaints procedure, the right to escalate to KFN, and any applicable out-of-court dispute resolution body.

The firm must maintain a complaints register recording the date, the client, the subject matter, the outcome and the remedial action taken.

Complaints data must be reported to KFN on request and analysed to identify recurring conduct issues and root causes.

Fair treatment of clients includes clear disclosure of fees, risks and product features before the transaction, and post-sale information on the service provided.

Vulnerable clients (e.g., due to age, health, or financial circumstances) require additional care in communications and suitability assessments.

Marketing must not create unrealistic expectations; projections must be based on reasonable assumptions and must disclose that they are not guarantees.

Redress: where a complaint is upheld, the firm must remedy the client promptly, including refunds of undue charges and correction of records.

The Central Depository AD maintains securities accounts, records book-entry transfers, and settles BSE trades on a delivery-versus-payment basis.

Custody duties: segregate client securities, reconcile holdings daily, and maintain records enabling clients' positions to be identified at any time.

Corporate actions (dividends, rights issues, splits, mergers) require timely notification to clients, instruction collection where elections are required, and accurate processing.

Settlement fails under CSDR trigger buy-in procedures and cash penalties; the firm must monitor and manage fails on its own and clients' trades.

Securities lending and repo transactions must be documented, disclosed to clients, and reflected in client asset reconciliations.

The firm must maintain a client asset reconciliation policy, perform internal reconciliations at least daily and external reconciliations at least monthly.

Registration of securities in the client's name or in a nominee name must be disclosed; nominee arrangements require clear records of beneficial ownership.

Loss of client securities triggers compensation obligations and reporting to KFN; the firm must maintain insurance or additional own funds where required.

Fiduciary-style duties: place the client's interests above the firm's own, avoid conflicts, and disclose all material information relevant to the client's decision.

Personal account dealing by employees requires prior written approval, must not conflict with client orders, and is subject to holding-period and reporting rules.

Gifts and entertainment must be recorded and must not exceed thresholds set in the firm's policy; excessive gifts are treated as inducements.

Confidentiality: client information must be protected and shared only on a need-to-know basis, subject to legal obligations and client consent.

Insider lists and information barriers must be maintained; employees with access to inside information must be wall-crossed and reminded of their obligations.

Employees must report suspected breaches through internal channels or to KFN; retaliation against whistleblowers is prohibited.

Outside business activities and directorships require prior approval to prevent conflicts with the firm's business.

Professional certification and continuing education requirements apply to registered representatives; KFN may suspend individuals for misconduct.

Manufacturers must identify a target market, define the product's risk profile and distribution strategy, and review the product at least annually or on material change.

Distributors must obtain sufficient information from the manufacturer, assess the target market, and ensure the product is distributed only to clients within it.

Where a product is sold outside the target market, the distributor must document the rationale, notify the manufacturer, and consider whether the sale was appropriate.

Product intervention: KFN and ESMA may prohibit or restrict the marketing, distribution or sale of certain products (e.g., binary options, contracts for difference) to protect investors.

Complex products (e.g., structured products, derivatives) require an appropriateness assessment for non-advised sales and clear risk warnings.

Costs and charges must be disclosed in a standardised format and must be proportionate to the service provided; performance fees must be clearly described.

The product approval process must involve the compliance and risk functions and be documented before launch.

Reviews must consider whether the product remains consistent with the needs of the target market and whether distribution channels remain appropriate.

Trading venues must publish post-trade data (price, volume, time, venue) for shares as close to real time as possible, subject to permitted deferrals for large trades.

The consolidated tape provider consolidates post-trade data across venues; MiFID II requires a consolidated tape for equities and, under the 2024 listing/transparency reforms, for bonds and derivatives.

Systematic internalisers must publish firm quotes for liquid shares and execute client orders at those quotes up to standard market size.

Trade repositories record derivatives transactions under EMIR; the firm must report the conclusion, modification and termination of derivative contracts to a registered trade repository.

Clearing obligations under EMIR require central clearing of standardised OTC derivatives for in-scope counterparties; the firm must have clearing arrangements in place.

Settlement discipline under CSDR includes cash penalties for fails and mandatory buy-ins for certain instruments after the extension period.

The Central Depository's rules govern the settlement cycle, account structure and corporate action processing for BSE-traded securities.

Venue operators must have transparent rulebooks, non-discriminatory access rules, and arrangements for orderly trading and circuit breakers.

Fraud risk controls include segregation of duties, dual authorisation for payments, reconciliation of client money, and monitoring of unusual transactions.

Market abuse surveillance must cover order and trade data, communications, and cross-product patterns; alerts must be investigated and documented.

Insider dealing detection includes monitoring of trades before announcements, unusual price movements, and employees' personal account trading.

Cyber fraud controls include verification of payment instructions, call-back procedures, and protection against business email compromise.

The firm must maintain a financial crime risk assessment covering money laundering, terrorist financing, fraud and market abuse, reviewed annually.

Suspicious activity reporting to the FID and STORs to KFN are separate channels; both must be documented and escalated to compliance.

Sanctions screening against EU and national sanctions lists must be performed at onboarding and on an ongoing basis.

Internal audit must independently test the effectiveness of financial crime controls and report findings to the management body.

Client money must be held in segregated accounts with a credit institution or central bank, separate from the firm's own money, and labelled as client money.

Client financial instruments must be held in segregated accounts and reconciled daily; the firm must be able to identify client assets at any time.

In insolvency, client assets are excluded from the firm's estate and returned to clients; the firm must maintain records enabling prompt identification and return.

Title transfer collateral arrangements must be documented and disclosed; the client must be warned that ownership of the assets transfers to the firm.

The firm must not use client assets for its own account or for other clients without explicit client consent and documented arrangements.

Client money calculations must be performed at least daily; any shortfall must be funded from the firm's own funds and reported to KFN.

The firm must maintain a client asset reconciliation policy, perform internal reconciliations at least daily and external reconciliations at least monthly.

Loss of client assets triggers compensation obligations and reporting to KFN; the firm must maintain insurance or additional own funds where required.

An EEA investment firm may provide services in Bulgaria under the MiFID II passport via notification from its home regulator to KFN; KFN supervises conduct of business in Bulgaria.

A Bulgarian firm passporting into another EEA state must notify KFN, which forwards the notification to the host regulator within one month.

Third-country firms may provide services to professional clients and eligible counterparties in Bulgaria only if registered with ESMA or authorised under a national regime.

KFN may require passporting firms to comply with Bulgarian conduct rules, including marketing and complaints handling, and may take measures against firms that breach them.

Cross-border firms must be aware of Bulgarian language requirements for client communications and the local rules on advertising financial products.

KFN cooperates with home regulators through MoUs and ESMA colleges; information sharing is subject to confidentiality safeguards.

Branch establishment in Bulgaria requires notification to KFN and compliance with local governance and reporting requirements.

Dispute resolution for cross-border clients may involve the home regulator's complaints scheme or the Bulgarian conciliation body, depending on the arrangements.

Bulgarian capital gains on securities are generally taxable at 10% for individuals, with exemptions for gains on shares traded on a regulated market in the EEA (subject to conditions).

Dividends paid by Bulgarian companies are subject to 5% withholding tax for individuals and certain foreign recipients; the rate may be reduced under double tax treaties.

Investment firms must report client income and transactions to the National Revenue Agency where required, and must apply withholding tax rules.

The EU savings and automatic exchange of information (DAC) framework requires reporting of financial account information for tax purposes.

Tax reporting obligations include the Common Reporting Standard (CRS) and, for reportable accounts, the FATCA regime with the United States.

Firms must maintain records of client tax residency and self-certification forms, and monitor for changes in circumstances.

Transaction taxes and stamp duties vary by jurisdiction; the firm must apply the rules of the market where the trade executes.

Tax treatment affects suitability: advisers must consider after-tax returns and the client's tax position when recommending products.

The Bulgarian National Bank (BNB) is the central bank and, until euro adoption, maintains the lev under a currency board pegged to the euro at BGN 1.95583 per EUR.

The currency board constrains monetary policy: BNB cannot set interest rates independently, and liquidity is managed through minimum reserve requirements and standing facilities.

Bulgaria's accession to the euro area (targeted for 1 January 2026) will replace the lev with the euro at the fixed conversion rate and shift monetary policy to the ECB.

Interest rate changes affect bond prices inversely and influence equity valuations through discount rates; the currency board limits Bulgarian rate divergence from euro area rates.

BNB supervises banks and payment institutions, while KFN supervises investment firms; the two cooperate on financial stability matters.

The Financial Stability Advisory Council coordinates macroprudential oversight among BNB, KFN and the Ministry of Finance.

Investors should consider currency risk for non-euro assets and the effect of the currency board on hedging costs.

Monetary policy expectations are reflected in yield curves; the firm must consider interest rate risk in suitability assessments for fixed income products.

The firm must maintain a business continuity plan (BCP) covering critical functions, with defined recovery time and recovery point objectives, tested at least annually.

Operational risk includes process failures, human error, system failures, fraud and external events; the firm must identify, assess, monitor and mitigate these risks.

Incident management requires logging, escalation, root cause analysis and remediation tracking, with material incidents reported to KFN.

Outsourcing arrangements must be documented, with service levels, exit plans and audit rights; the firm remains accountable to KFN.

Physical and logical security controls protect premises, data and systems; access rights must be reviewed periodically.

Staff training on operational risk and business continuity must be provided and recorded.

Scenario testing and stress testing must cover severe but plausible events, including cyber attacks and vendor failures.

Lessons learned from incidents must feed into the BCP and risk register, with management oversight of remediation.

Best execution monitoring must use venue data, execution quality statistics and client outcomes; the firm must review its execution policy annually and on material change.

Execution quality metrics include fill rate, slippage, speed of execution, and price improvement relative to the benchmark.

The firm must compare execution venues and disclose the top five venues by volume for each instrument class in its RTS 28 report.

Order routing decisions must be documented and consistent with the execution policy; payment for order flow is restricted under MiFID II.

Market data costs and latency affect execution quality; the firm must consider whether its data and technology are adequate for the services provided.

Client-specific instructions may override the execution policy; the firm must disclose that following instructions may prevent it from achieving the best result.

Monitoring must be independent of the front office and reported to senior management and the management body.

Records of execution quality reviews must be retained for at least five years.

Research is an ancillary service; inducements rules require that research is either paid for by the client (research payment account) or provided as a minor non-monetary benefit.

The research payment account (RPA) must be funded separately from the execution commission and governed by a written policy.

Minor non-monetary benefits must be reasonable, proportionate and unlikely to impair the firm's duty to act in the client's best interests; they must be disclosed.

Substantive research that could influence investment decisions must be distinguished from marketing material.

Conflicts of interest in research must be managed through information barriers and disclosure of the firm's relationships with issuers.

Research recommendations must be labelled as such, with disclosure of the analyst's holdings and the firm's conflicts.

The firm must maintain a record of research received and the charges paid, and review the research budget annually.

Inducements relating to distribution of products must be disclosed to clients and must not bias the advice given.

The Bulgarian Investor Compensation Fund covers claims of retail and professional clients up to BGN 40,000 (EUR 20,000) per client for losses due to a firm's inability to return client assets.

The fund does not cover losses from market movements, unsuitable advice, or losses at firms not covered by the scheme.

Claims must be submitted within five years of the date the compensation fund publishes the default; the fund must pay within three months of verifying the claim.

Investment firms must contribute to the fund and display information about the scheme to clients.

Bank deposits are covered by the Bulgarian Deposit Insurance Fund up to EUR 100,000 per depositor per bank, separate from the investor compensation scheme.

The compensation scheme does not apply to eligible counterparties or to firms' own assets.

Cross-border clients may claim under the home-state scheme where the firm is authorised in another EEA state.

The firm must maintain records enabling the fund to identify clients and their assets promptly in the event of default.

Client onboarding requires identity verification, suitability/appropriateness assessment, and execution of a client agreement before services are provided.

The client agreement must set out the services, fees, client category, execution policy, conflicts of interest policy and complaints procedure.

Terms of business must be fair, clear and not misleading; unfair terms may be unenforceable under consumer protection law.

The firm must provide a key information document (KID) for PRIIPs before the client is bound, and must record that the client received it.

Record-keeping: onboarding documents, suitability reports and communications must be retained for at least five years.

Periodic reviews of client information must be performed, particularly for retail clients and complex products.

The firm must obtain the client's consent for the use of personal data and comply with the GDPR.

Changes to the client agreement must be notified to the client in advance and documented.

Investment firms report own funds, capital requirements and large exposures to KFN at the frequency set by KFN ordinance (at least quarterly for most firms).

The fixed overheads requirement is 25% of the firm's fixed overheads from the previous year's audited accounts, adjusted for material changes.

The permanent minimum capital requirement depends on the services provided: EUR 75,000, EUR 150,000 or EUR 750,000.

K-factor requirements are calculated for client assets, client money, trading counterparty risk, daily trading flow and concentration risk.

The firm must maintain a capital planning process and stress test its capital adequacy against adverse scenarios.

Breaches of capital requirements must be reported to KFN immediately, with a remediation plan.

The firm must publish its Pillar 3 disclosures, including risk management and capital resources, on its website.

Internal audit and compliance must review the accuracy of prudential returns before submission.

Trade reporting must be complete, accurate and timely; errors must be corrected and reported to KFN without undue delay.

The firm must reconcile its trade reports against its internal records and venue data to detect missing or incorrect reports.

Common reporting errors include incorrect LEI, wrong trading capacity, missing client identifiers, and incorrect venue codes.

The firm must use approved reporting mechanisms (ARMs) or report directly to KFN, with controls over the ARM's performance.

Surveillance systems must generate alerts for potential market abuse, which must be investigated and documented.

STORs must be submitted without delay where there are reasonable grounds to suspect market abuse, and the firm must not tip off the client.

Records of trade reports and corrections must be retained for at least five years.

KFN may impose fines for persistent reporting failures and may require remediation plans.

Retail clients may opt up to professional status if they meet two of three criteria: ten significant transactions per quarter over four quarters, portfolio exceeding EUR 500,000, or one year's relevant professional experience.

The opt-up procedure requires a written warning about the loss of protections, a written client statement, and an assessment of the client's expertise.

Professional clients may opt down to retail status to obtain more protection; the firm must apply retail rules to them.

Eligible counterparties are a subset of professional clients (e.g., investment firms, credit institutions, insurance companies, pension funds) and receive the least protection.

The firm must record the client's category and review it when circumstances change.

Categorisation affects suitability, appropriateness, disclosure and complaints handling obligations.

The firm must not treat a client as professional if it has doubts about the client's ability to understand the risks.

KFN may require firms to re-categorise clients where the criteria are not met.

MiCA (Regulation (EU) 2023/1114) governs crypto-asset issuance and service provision; investment firms providing crypto services must obtain authorisation under MiCA.

Crypto-assets that qualify as financial instruments fall under MiFID II, not MiCA; the classification determines the applicable regime.

The firm must assess new products and business changes through a formal product approval process, including compliance and risk sign-off.

Distributed ledger technology raises custody, settlement and operational risk issues; the firm must ensure it can identify and control client assets.

Marketing of crypto-assets must be fair, clear and not misleading, with prominent risk warnings.

AML/CFT rules apply to crypto-asset service providers, including CDD, travel rule compliance and suspicious activity reporting.

The firm must monitor regulatory developments and update its policies for new products and services.

Investor protection rules (suitability, appropriateness, disclosure) apply to crypto-assets that are financial instruments, and the firm must consider the client's knowledge and experience.

Investment firms must file annual financial statements, capital adequacy returns and client asset returns with KFN within the deadlines set by ordinance.

Notifications to KFN include changes in qualifying holdings, changes in directors, material outsourcing, and breaches of capital or client asset rules.

KFN may request ad hoc information and conduct on-site inspections; firms must respond completely and on time.

The firm must maintain a regulatory calendar of filing deadlines and assign responsibility for each filing.

Filing errors must be corrected promptly, with a covering explanation where the error is material.

KFN publishes guidance and Q&A on filing requirements; firms must monitor updates.

Records of filings and correspondence with KFN must be retained for at least five years.

Failure to file or late filing may result in fines and supervisory measures.

Fair treatment includes transparent pricing, clear disclosure of risks, and prompt handling of complaints.

The firm must not impose undue pressure on clients or use aggressive sales techniques.

Product recommendations must be based on the client's objectives and circumstances, not on the firm's remuneration.

The firm must monitor the fair treatment of clients through management information, complaints data and customer surveys.

Vulnerable clients require additional care, including clear communications and, where appropriate, a slower sales process.

Marketing must be balanced and must not obscure risks with prominent return figures.

The firm must remedy client detriment promptly, including refunds and corrections.

Senior management must oversee conduct risk and ensure that incentives do not drive mis-selling.

Surveillance must cover orders, trades, communications and cross-product patterns, with alerts investigated and documented.

STORs must be submitted to KFN without delay where there are reasonable grounds to suspect market abuse.

Insider lists must be maintained by issuers and by firms with access to inside information.

Market soundings require prior consent, a written record and a wall-crossing script.

PDMR dealings must be notified to KFN and the issuer within the deadlines set by MAR.

The firm must maintain records of surveillance alerts, investigations and STORs for at least five years.

Training on market abuse must be provided to relevant staff and recorded.

KFN may impose fines and other sanctions for market abuse, including public censure and suspension.

Client money calculations must be performed at least daily; any shortfall must be funded from the firm's own funds and reported to KFN.

Client asset reconciliations must be performed internally at least daily and externally at least monthly.

Reconciliation differences must be investigated and resolved promptly, with escalation to senior management.

The firm must maintain a client asset reconciliation policy and records of reconciliations for at least five years.

Title transfer collateral arrangements must be documented and disclosed to clients.

The firm must not use client assets for its own account or for other clients without explicit consent.

Loss of client assets triggers compensation obligations and reporting to KFN.

The firm must maintain insurance or additional own funds where required to cover client asset risk.

The firm must maintain a regulatory change log and assess the impact of new rules on policies, systems and controls.

Compliance monitoring must be risk-based, documented and reported to senior management and the management body.

The compliance function must be independent, adequately resourced and have direct access to the management body.

Monitoring findings must be tracked to remediation, with owners and deadlines.

Internal audit must independently test the effectiveness of the compliance framework.

Training on regulatory changes must be provided to relevant staff and recorded.

The firm must maintain records of compliance monitoring and remediation for at least five years.

KFN may require remediation plans where compliance weaknesses are identified.

An investment firm must be licensed by KFN before providing investment services in Bulgaria.

Passporting into Bulgaria by EEA firms occurs via the home-state regulator notification to KFN.

A Bulgarian firm passporting into another EEA state must notify KFN, which forwards the notification to the host regulator within one month.

Third-country firms may provide services to professional clients and eligible counterparties in Bulgaria only if registered with ESMA or authorised under a national regime.

Branch establishment in Bulgaria requires notification to KFN and compliance with local governance and reporting requirements.

KFN may refuse a passport notification only on defined grounds notified to the home authority.

The firm must maintain records of its passport notifications and the services provided in each host state.

Changes to the services provided under a passport must be notified to KFN and the host regulator.

Pre-trade transparency requires RM/MTF to publish current bid/ask and depth for equities.

Waivers from pre-trade transparency are available for large-in-scale orders, reference price transactions and negotiated trades.

Systematic internalisers must publish firm quotes for liquid shares and execute client orders at those quotes up to standard market size.

Post-trade transparency requires publication of price, volume, time and venue, subject to permitted deferrals.

The tick size regime applies to equities and equity-like instruments traded on RM/MTF/SI.

The consolidated tape provider consolidates post-trade data across venues.

Trade repositories record derivatives transactions under EMIR.

Clearing obligations under EMIR require central clearing of standardised OTC derivatives for in-scope counterparties.

KFN and ESMA may prohibit or restrict the marketing, distribution or sale of certain products to protect investors.

Complex products require an appropriateness assessment for non-advised sales and clear risk warnings.

Costs and charges must be disclosed in a standardised format and must be proportionate to the service provided.

The product approval process must involve the compliance and risk functions and be documented before launch.

Reviews must consider whether the product remains consistent with the needs of the target market.

Distributors must obtain sufficient information from the manufacturer and assess the target market.

Where a product is sold outside the target market, the distributor must document the rationale and notify the manufacturer.

Product intervention measures may be temporary or permanent and may be adopted at national or EU level.

SFDR requires firms to disclose at entity and product level how sustainability risks are integrated.

Products are classified as Article 6, Article 8 or Article 9; classification drives disclosure obligations.

MiFID II suitability rules require advisers to ask about clients' sustainability preferences.

The EU Taxonomy Regulation defines environmentally sustainable economic activities using technical screening criteria.

CSRD obligations fall on the issuer, but distributors rely on issuer disclosures for product-level ESG data.

Greenwashing risk: marketing must be fair, clear and not misleading; ESG claims must be substantiated.

Product governance must consider sustainability-related objectives in the target market definition.

Firms must maintain records of clients' sustainability preferences and of the suitability assessment that considered them.

Investment firms must have robust governance arrangements with clear lines of responsibility.

Senior management must be fit and proper: adequate knowledge, skills and experience, and good repute.

Remuneration policies must be consistent with effective risk management and include malus and clawback.

The management body must approve and oversee the firm's risk strategy, compliance framework and remuneration policy.

Conflicts of interest at board level must be identified and managed.

The compliance function must be independent, adequately resourced and have direct access to the management body.

Outsourcing of critical functions requires prior notification to KFN.

Firms must maintain a conflicts of interest register, a gifts and entertainment register and a personal account dealing register.

Client complaints must be handled promptly, fairly and consistently.

Clients must be informed in writing of the firm's complaints procedure and the right to escalate to KFN.

The firm must maintain a complaints register recording the date, client, subject matter, outcome and remedial action.

Complaints data must be reported to KFN on request and analysed to identify recurring conduct issues.

Fair treatment of clients includes clear disclosure of fees, risks and product features before the transaction.

Vulnerable clients require additional care in communications and suitability assessments.

Marketing must not create unrealistic expectations; projections must disclose that they are not guarantees.

Where a complaint is upheld, the firm must remedy the client promptly.

The Central Depository AD maintains securities accounts and settles BSE trades on a delivery-versus-payment basis.

Custody duties: segregate client securities, reconcile holdings daily and maintain records enabling clients' positions to be identified at any time.

Corporate actions require timely notification to clients, instruction collection and accurate processing.

Settlement fails under CSDR trigger buy-in procedures and cash penalties.

Securities lending and repo transactions must be documented, disclosed to clients and reflected in reconciliations.

The firm must maintain a client asset reconciliation policy, perform internal reconciliations at least daily and external reconciliations at least monthly.

Registration of securities in the client's name or in a nominee name must be disclosed.

Loss of client securities triggers compensation obligations and reporting to KFN.

Fiduciary-style duties: place the client's interests above the firm's own, avoid conflicts and disclose all material information.

Personal account dealing by employees requires prior written approval and must not conflict with client orders.

Gifts and entertainment must be recorded and must not exceed thresholds set in the firm's policy.

Confidentiality: client information must be protected and shared only on a need-to-know basis.

Insider lists and information barriers must be maintained.

Employees must report suspected breaches through internal channels or to KFN.

Outside business activities and directorships require prior approval to prevent conflicts.

Professional certification and continuing education requirements apply to registered representatives.

Manufacturers must identify a target market, define the product's risk profile and distribution strategy, and review the product at least annually.

Distributors must obtain sufficient information from the manufacturer, assess the target market and ensure the product is distributed only to clients within it.

Where a product is sold outside the target market, the distributor must document the rationale and notify the manufacturer.

KFN and ESMA may prohibit or restrict the marketing, distribution or sale of certain products to protect investors.

Complex products require an appropriateness assessment for non-advised sales and clear risk warnings.

Costs and charges must be disclosed in a standardised format and must be proportionate to the service provided.

The product approval process must involve the compliance and risk functions and be documented before launch.

Reviews must consider whether the product remains consistent with the needs of the target market.

Trading venues must publish post-trade data (price, volume, time, venue) for shares as close to real time as possible.

The consolidated tape provider consolidates post-trade data across venues.

Systematic internalisers must publish firm quotes for liquid shares and execute client orders at those quotes up to standard market size.

Trade repositories record derivatives transactions under EMIR.

Clearing obligations under EMIR require central clearing of standardised OTC derivatives for in-scope counterparties.

Settlement discipline under CSDR includes cash penalties for fails and mandatory buy-ins for certain instruments.

The Central Depository's rules govern the settlement cycle, account structure and corporate action processing for BSE-traded securities.

Venue operators must have transparent rulebooks, non-discriminatory access rules and arrangements for orderly trading and circuit breakers.

Fraud risk controls include segregation of duties, dual authorisation for payments, reconciliation of client money and monitoring of unusual transactions.

Market abuse surveillance must cover order and trade data, communications and cross-product patterns.

Insider dealing detection includes monitoring of trades before announcements and unusual price movements.

Cyber fraud controls include verification of payment instructions, call-back procedures and protection against business email compromise.

The firm must maintain a financial crime risk assessment covering money laundering, terrorist financing, fraud and market abuse.

Suspicious activity reporting to the FID and STORs to KFN are separate channels.

Sanctions screening against EU and national sanctions lists must be performed at onboarding and on an ongoing basis.

Internal audit must independently test the effectiveness of financial crime controls.

Client money must be held in segregated accounts with a credit institution or central bank, separate from the firm's own money.

Client financial instruments must be held in segregated accounts and reconciled daily.

In insolvency, client assets are excluded from the firm's estate and returned to clients.

Title transfer collateral arrangements must be documented and disclosed to clients.

The firm must not use client assets for its own account or for other clients without explicit client consent.

Client money calculations must be performed at least daily; any shortfall must be funded from the firm's own funds and reported to KFN.

The firm must maintain a client asset reconciliation policy, perform internal reconciliations at least daily and external reconciliations at least monthly.

Loss of client assets triggers compensation obligations and reporting to KFN.

An EEA investment firm may provide services in Bulgaria under the MiFID II passport via notification from its home regulator to KFN.

A Bulgarian firm passporting into another EEA state must notify KFN, which forwards the notification to the host regulator within one month.

Third-country firms may provide services to professional clients and eligible counterparties in Bulgaria only if registered with ESMA or authorised under a national regime.

KFN may require passporting firms to comply with Bulgarian conduct rules, including marketing and complaints handling.

Cross-border firms must be aware of Bulgarian language requirements for client communications.

KFN cooperates with home regulators through MoUs and ESMA colleges.

Branch establishment in Bulgaria requires notification to KFN and compliance with local governance and reporting requirements.

Dispute resolution for cross-border clients may involve the home regulator's complaints scheme or the Bulgarian conciliation body.

Bulgarian capital gains on securities are generally taxable at 10% for individuals, with exemptions for gains on shares traded on a regulated market in the EEA.

Dividends paid by Bulgarian companies are subject to 5% withholding tax for individuals and certain foreign recipients.

Investment firms must report client income and transactions to the National Revenue Agency where required.

The EU savings and automatic exchange of information (DAC) framework requires reporting of financial account information for tax purposes.

Tax reporting obligations include the Common Reporting Standard (CRS) and the FATCA regime with the United States.

Firms must maintain records of client tax residency and self-certification forms.

Transaction taxes and stamp duties vary by jurisdiction; the firm must apply the rules of the market where the trade executes.

Tax treatment affects suitability: advisers must consider after-tax returns and the client's tax position.

The Bulgarian National Bank (BNB) is the central bank and maintains the lev under a currency board pegged to the euro at BGN 1.95583 per EUR.

The currency board constrains monetary policy: BNB cannot set interest rates independently.

Bulgaria's accession to the euro area will replace the lev with the euro at the fixed conversion rate and shift monetary policy to the ECB.

Interest rate changes affect bond prices inversely and influence equity valuations through discount rates.

BNB supervises banks and payment institutions, while KFN supervises investment firms.

The Financial Stability Advisory Council coordinates macroprudential oversight among BNB, KFN and the Ministry of Finance.

Investors should consider currency risk for non-euro assets and the effect of the currency board on hedging costs.

Monetary policy expectations are reflected in yield curves; the firm must consider interest rate risk in suitability assessments.

The firm must maintain a business continuity plan (BCP) covering critical functions, tested at least annually.

Operational risk includes process failures, human error, system failures, fraud and external events.

Incident management requires logging, escalation, root cause analysis and remediation tracking.

Outsourcing arrangements must be documented, with service levels, exit plans and audit rights.

Physical and logical security controls protect premises, data and systems.

Staff training on operational risk and business continuity must be provided and recorded.

Scenario testing and stress testing must cover severe but plausible events.

Lessons learned from incidents must feed into the BCP and risk register.

Best execution monitoring must use venue data, execution quality statistics and client outcomes.

Execution quality metrics include fill rate, slippage, speed of execution and price improvement.

The firm must compare execution venues and disclose the top five venues by volume in its RTS 28 report.

Order routing decisions must be documented and consistent with the execution policy.

Market data costs and latency affect execution quality.

Client-specific instructions may override the execution policy.

Monitoring must be independent of the front office and reported to senior management.

Records of execution quality reviews must be retained for at least five years.

Research is an ancillary service; inducements rules require that research is either paid for by the client or provided as a minor non-monetary benefit.

The research payment account (RPA) must be funded separately from the execution commission.

Minor non-monetary benefits must be reasonable, proportionate and disclosed.

Substantive research that could influence investment decisions must be distinguished from marketing material.

Conflicts of interest in research must be managed through information barriers and disclosure.

Research recommendations must be labelled as such, with disclosure of the analyst's holdings.

The firm must maintain a record of research received and the charges paid.

Inducements relating to distribution of products must be disclosed to clients.

The Bulgarian Investor Compensation Fund covers claims of retail and professional clients up to BGN 40,000 (EUR 20,000) per client.

The fund does not cover losses from market movements or unsuitable advice.

Claims must be submitted within five years of the date the compensation fund publishes the default.

Investment firms must contribute to the fund and display information about the scheme to clients.

Bank deposits are covered by the Bulgarian Deposit Insurance Fund up to EUR 100,000 per depositor per bank.

The compensation scheme does not apply to eligible counterparties or to firms' own assets.

Cross-border clients may claim under the home-state scheme where the firm is authorised in another EEA state.

The firm must maintain records enabling the fund to identify clients and their assets promptly.

Client onboarding requires identity verification, suitability/appropriateness assessment and execution of a client agreement.

The client agreement must set out the services, fees, client category, execution policy, conflicts of interest policy and complaints procedure.

Terms of business must be fair, clear and not misleading.

The firm must provide a key information document (KID) for PRIIPs before the client is bound.

Record-keeping: onboarding documents, suitability reports and communications must be retained for at least five years.

Periodic reviews of client information must be performed.

The firm must obtain the client's consent for the use of personal data and comply with the GDPR.

Changes to the client agreement must be notified to the client in advance and documented.

Investment firms report own funds, capital requirements and large exposures to KFN at the frequency set by KFN ordinance.

The fixed overheads requirement is 25% of the firm's fixed overheads from the previous year's audited accounts.

The permanent minimum capital requirement depends on the services provided: EUR 75,000, EUR 150,000 or EUR 750,000.

K-factor requirements are calculated for client assets, client money, trading counterparty risk, daily trading flow and concentration risk.

The firm must maintain a capital planning process and stress test its capital adequacy.

Breaches of capital requirements must be reported to KFN immediately, with a remediation plan.

The firm must publish its Pillar 3 disclosures on its website.

Internal audit and compliance must review the accuracy of prudential returns before submission.