Financial Institution Under Art. 3a CIA — BNB Registration, Ordinance 26 and Consumer Credit (2026)

What Is a Financial Institution Under Art. 3a CIA — and What It Is NOT

Under Art. 3a of the Credit Institutions Act, a financial institution is a legal entity, other than a credit institution (bank), that carries out as a business one or more of the activities listed in the law, using funds not raised through public deposit-taking or other repayable funds.

This is the key distinction: a financial institution under Art. 3a does not accept deposits from the public. It finances its activities through equity capital, bank loans, bonds, shareholder funding or other non-deposit sources.

What It Is NOT

• A bank (credit institution) — banks are licensed by BNB and the ECB (under the Single Supervisory Mechanism) with a minimum capital of EUR 5,000,000 and have the right to accept public deposits. A financial institution under Art. 3a has neither the right nor the obligation to meet these requirements.
• A payment institution (under the PSPSA) — payment institutions provide payment services (transfers, payment operations, issuance of payment instruments) and are subject to a licensing regime before BNB under the Payment Services and Payment Systems Act. For a detailed guide on payment institution licensing, see our article on FinTech Licensing in Bulgaria.
• An electronic money institution (EMI) — EMIs issue electronic money and are also subject to licensing under the PSPSA, not registration.

In other words, if you plan to grant loans, provide leasing or carry out factoring using funds not raised from deposits — your regime is registration under Art. 3a CIA. If you plan to provide payment services — you need a licence under the PSPSA.

Three Laws — CIA, Ordinance 26 and CCA

The registration and operations of a financial institution under Art. 3a are governed by three interconnected legal instruments, each covering a different aspect:

1. Credit Institutions Act (CIA) — the primary law that defines the concept of a “financial institution” (Art. 3a), specifies the permissible activities and establishes the obligation for registration with BNB. The CIA also governs BNB’s general supervisory powers over registered financial institutions.
2. BNB Ordinance No. 26 of 23 April 2009 — the secondary legislation that details the registration procedure, required documents, management and internal rules requirements, reporting obligations and grounds for deregistration. Ordinance 26 is the “operational handbook” for any company filing an application with BNB.
3. Consumer Credit Act (CCA) — applicable whenever the financial institution extends credit to consumers (natural persons acting outside their trade or professional capacity). The CCA introduces the APR ceiling, the obligation to provide pre-contractual information, the right of withdrawal and responsible lending requirements.

This triple legal framework means that the same company must comply simultaneously with three legal instruments — failure under any one of them may result in administrative sanctions, refusal of registration or removal from BNB’s register.

9 Types of Activities — Full List with Examples

Art. 3a of the CIA lists the following activities that a financial institution may carry out “as a business” using funds not raised through public deposits:

It is important to note that a company is not required to carry out all nine activities — it is sufficient to engage in even one of them to fall within the scope of Art. 3a CIA, provided it is carried out as a business.

When Is Registration Mandatory — the 30% Threshold

Not every company that incidentally carries out a financial transaction is subject to registration. The law sets two cumulative criteria:

1. “As a business” — the activity is carried out systematically, as a primary or ancillary commercial activity, not on a one-off or incidental basis. Regular provision of loans, even to a limited circle of persons, may qualify as “carried out as a business.”
2. “Substantial” activity — Ordinance 26 defines the activity as substantial when it represents 30% or more of the company’s total activity, determined on the basis of its financial statements. The threshold is calculated as the ratio between revenues from financial activities under Art. 3a and the company’s total revenues.

If both criteria are met, registration with BNB is mandatory. Carrying out these activities without registration constitutes an administrative offence and may result in sanctions, including court-ordered cessation of the activity.

In practice: if a single-member LLC regularly grants loans to several companies and interest income constitutes 35% of its total revenues — registration under Art. 3a is mandatory. If the same LLC grants a one-off loan to a related party and interest income represents 5% of turnover — registration is not required (but see tax risks in related-party loans).

BNB Registration Procedure

Registration of a financial institution under Art. 3a CIA is carried out by the Banking Supervision Department of the Bulgarian National Bank. The public register is accessible on BNB’s website (bnb.bg → Register of Financial Institutions under Art. 3a). The procedure involves the following steps:

Step 1: Incorporation of a commercial company

Before filing an application with BNB, the company must be entered in the Commercial Register at the Registry Agency. The scope of business must expressly include the financial activities the company intends to carry out. For more information on company registration in Bulgaria, see our guide.

Step 2: Preparation of documents

The application to BNB is filed in written form and includes:

• Completed registration form (as per BNB’s template)
• Current certificate of entry in the Commercial Register
• Articles of association / memorandum of association
• Detailed description of planned activities under Art. 3a
• Organisational structure and staffing chart
• Information on ultimate beneficial owners (UBO) under the AML Act
• Documents on qualifications and professional experience of the management bodies
• Criminal record certificates for managers and members of the management body
• Business plan and financial projections (typically for 3 years)
• Internal risk management rules
• Internal AML/CFT rules
• Internal control rules
• Evidence of adequate capital

Step 3: BNB review

BNB reviews the submitted documents and assesses whether the company meets the requirements of Ordinance 26. If the documentation is incomplete, BNB may request additional documents or clarifications.

Step 4: Entry in the register

Upon a positive decision, BNB enters the company in the Register of Financial Institutions under Art. 3a. The entry is published and accessible online. Only after the entry is made may the company begin carrying out the relevant financial activities.

Important: Registration under Art. 3a is not a licence. It is a lighter regime that does not require as extensive documentation or as high a level of capital as a banking licence or a payment institution licence. Nevertheless, BNB carries out a thorough review of the documents and may refuse entry if the requirements are not met.

Requirements — Capital, Management, Internal Rules

Capital adequacy

Unlike banks (minimum EUR 5,000,000) and payment institutions (EUR 20,000–125,000 depending on the type of services), there is no fixed statutory minimum capital for financial institutions under Art. 3a. However, BNB assesses the adequacy of equity capital relative to the scope and scale of the planned activities. In practice, for companies planning lending activities, a realistic minimum is approximately BGN 1,000,000 (~EUR 511,000), although this amount is not legally fixed and depends on the specific business model.

Fit and proper requirements for management

Members of the management body of a financial institution must meet fitness and propriety (fit and proper) requirements:

• Clean criminal record — no convictions for intentional criminal offences of a general nature, including offences against the financial system
• Professional experience — appropriate qualifications and experience in the financial sector, risk management or related fields
• No conflict of interest — BNB may refuse entry if it identifies circumstances that could jeopardise the sound management of the institution

Internal rules (mandatory)

Ordinance 26 requires the financial institution to adopt and implement:

• Risk management rules — credit risk, liquidity risk, operational risk
• AML/CFT rules — compliance with the requirements of the Measures Against Money Laundering Act (MAMLA), including customer identification, transaction monitoring and reporting (see AML training and internal rules)
• Internal control rules — segregation of duties, four-eyes principle, access control over information
• Consumer protection rules (for consumer lending) — transparency of terms, complaints handling procedure

Consumer Credit Act — Additional Obligations for Consumer Lending

When a financial institution under Art. 3a extends credit to consumers (natural persons for personal, non-business purposes), it falls fully within the scope of the Consumer Credit Act (CCA). This means compliance with the following obligations:

APR ceiling (Annual Percentage Rate of Charge)

The APR may not exceed 5 times the statutory interest rate on overdue obligations. The statutory interest rate is defined as BNB’s base interest rate + 10 percentage points. For 2026 (with EUR reference), the APR ceiling is approximately 50–55% APR, depending on changes to BNB’s base rate. Any clause exceeding this ceiling is null and void by operation of law.

Pre-contractual information — SECCI form

Before concluding the contract, the creditor must provide the consumer with a Standard European Consumer Credit Information form (SECCI) containing all essential terms — interest rate, APR, total amount payable, term, collateral and right of withdrawal.

Right of withdrawal — 14 days

The consumer has the right to withdraw from the consumer credit agreement within 14 days of its conclusion, without penalty or compensation. The consumer is obliged to return the principal and accrued interest for the period of use.

Creditworthiness assessment and responsible lending

The CCA requires the creditor to carry out a thorough assessment of the consumer’s creditworthiness before granting credit, based on sufficient information, including from BNB’s Central Credit Register (CCR). Granting credit without an adequate creditworthiness assessment constitutes an offence.

Total cost of credit

All costs associated with the credit (interest, fees, commissions, insurance, collateral valuation costs, etc.) must be clearly and unambiguously disclosed in the contract and in advertising materials.

Advertising rules

Advertising of consumer credit must contain specific information about the interest rate, APR, total amount payable and the conditions under which the advertised values are valid. Misleading advertising is prohibited.

New CCA 2026 — Directive 2023/2225

In 2026, the transposition of Directive (EU) 2023/2225 on consumer credit agreements is expected, replacing Directive 2008/48/EC. The new directive introduces stricter rules for digital lending, enhanced protection for online contracting, improved creditworthiness assessment requirements and an expanded scope of protection. Financial institutions granting consumer credit should closely monitor the transposition process.

AML Obligations Under the MAMLA

Financial institutions under Art. 3a CIA are obligated entities under the Measures Against Money Laundering Act (MAMLA) — Art. 4(2). This entails a full set of anti-money laundering and counter-terrorist financing (AML/CFT) obligations:

• Customer identification (KYC) — customer due diligence when establishing business relationships or carrying out occasional transactions above defined thresholds
• Ongoing monitoring — monitoring of customer transactions to identify unusual or suspicious transactions
• Reporting — where money laundering or terrorist financing is suspected — immediate notification to the Financial Intelligence Directorate at SANS (FID-SANS)
• Internal AML rules — mandatory adoption and implementation of internal rules approved by the management body (for the structure of such rules, see AML training and internal rules)
• Designation of an AML officer — a member of senior management responsible for the implementation of AML measures
• Staff training — periodic training for employees on recognising and reporting suspicious transactions
• Record keeping — minimum 5 years after termination of the business relationship

Enhanced due diligence (EDD)

When dealing with high-risk clients — politically exposed persons (PEPs), clients from high-risk jurisdictions, complex corporate structures — the financial institution must apply enhanced due diligence: additional identification, clarification of the origin of funds, intensified ongoing monitoring and approval from senior management.

Comparison Table — Financial Institution vs. PI vs. Bank

For clarity — the key differences between the three types of financial entities regulated by BNB:

As shown, the financial institution under Art. 3a occupies an intermediate position — more regulated than an ordinary commercial company, but significantly less regulated than a bank or payment institution. The main limitation is the absence of an EU passport — a financial institution under Art. 3a may operate only within the territory of Bulgaria.

BNB Supervision — What They Monitor

After entry in the register, the financial institution under Art. 3a is subject to ongoing supervision by BNB, albeit in a lighter form compared to banks:

• Annual reporting — the financial institution is required to submit annual financial statements to BNB, including information on the volume and nature of the activities carried out
• Compliance inspections — BNB may carry out on-site inspections or request the provision of additional information and documents
• Supervisory measures — where violations are identified, BNB may issue binding instructions, impose warnings or take more stringent measures
• Deregistration — in cases of gross or systematic breach of requirements, provision of false data or cessation of activities, BNB may remove the company from the register of financial institutions

Risks of deregistration

Deregistration means a prohibition on carrying out financial activities under Art. 3a. The main grounds for deregistration include:

• Failure to comply with reporting obligations for more than two consecutive years
• Systematic non-compliance with the requirements of Ordinance 26
• Provision of false or misleading data at the time of registration
• Dissolution of the company or opening of insolvency proceedings
• Carrying out activities for which the institution is not registered

The tax aspects of a financial institution’s operations — including corporate income tax — are governed by the Corporate Income Tax Act (see our overview of corporate tax).

Frequently Asked Questions