Introduction to MiCA, TFR, and DORA in Bulgaria, Vyara Savova, EUCI | ETHSofia 2025

Transcript

[Music] So the intention of this uh presentation is to set the tone for the wonderful workshop that will follow right after so that we don't have to basically explain the basics of what is going to be applicable in Bulgaria and what is already applicable in Bulgaria through the newly adopted uh legal go framework. So that's the intention. Um I would leave therefore the Q&A for after the presentations from the representatives of our financial authority. But of course if you have some pressing questions you can already ask them. I will provide you with a QR code at the

end. Um but first of all what do I do? I'm part of the European Crypto Initiative. It's a it's an adoxy organization. Basically, we represent the crypto industry in front of EU institutions so that we ensure as much as possible that favorable legal frameworks are created in the EU so that we have a thriving crypto and blockchain ecosystem. Um, so this means that I communicate quite a lot of EU institutions. I communicate of course also with the industry explaining how a specific proposal would affect uh the day-to-day operations as what is being built. It's a dynamic job.

Currently, I'm really happy to be focusing quite a lot on privacy and blockchain, but that's a topic for a different day. But if you want, you can always ask me about privacy. I might not chat up for the next uh four hours. Um but let's go into the more um dry part of this overall workshop which is what are we even talking about where when we talk about legal regulation currently and particularly the applicable legal framework around licensing crypto asset service providers crypto asset services stable coins crypto assets um crypto assets other than stable coins and all of that. So it's actually a mixture

between three main regulations. It's not just Mika, it's not just the marketing crypto assets regulation. Um it's also two more in this specific law. But of course if you are running a crypto business, you need to also keep in mind a lot of other uh frameworks and country specific frameworks. So speak to lawyers who are handling cases like that. But just so we have this general understanding of even the licensing regime and what would be covered afterwards by um the members of the financial um conduct authority. There are three main legal frameworks currently in this law that is already applicable in Bulgaria. We have Mika

that is basically it covers the whole crypto market. um how assets are issued, how assets are circulated and then what happens with those assets more or less we it's already applicable and in Bulgaria you already have a law then it's the transfer of funds regulation it's the socalled travel rule in car like in shaped up in a in a legal framework within the EU we actually went a bit overboard because the travel rule is less harsh than what we then adopted as the transfer funds regulation overachievers in the EU. What can I say?

Uh but what's important is that there without any minimum threshold because there usually is a threshold for fiat. So, so like normal money uh transfers um without a minimum threshold, there needs to be some data exchanged between um uh when whenever between the originator and beneficiary uh whenever a transfer occurs, which is specifically important when it comes to uh unhosted wallets, self-hosted wallets or just wallets as the as we call them in the industry because there also needs to be some information provided whenever such a wallet is interacting with a crypto. to asset service provider, but it only applies whenever whenever there is a

centralized crypto asset service provider. So, no peer-to-peer transfers. So, that's number two. And then the most I think underlooked one which is Dorat digital operation resilience act um which talks about the infrastructure basically what are we even allowed to use whenever we are interacting with the quote unquote financial uh system financial sector. Uh so it's all about ICT risk management, incident reporting, testing, all of those very technical parts of the job, but also third-party risk, which which basically means that you need to be very careful about the third party service providers you are choosing to use. And this is also part

of the broader okay, how and when and if I'll get a license under Mika broadly speaking question. But we have this beautiful law now in Bulgaria. So something interesting about this discussion is going to be um the presentations would follow in Bulgarian and I will serve as a sort of a nexus uh a interpreter if you have any questions that are in English. Um so don't worry you would also be able to ask questions um and then we will see how the discussion will go. But intentionally this presentation is in English so that we set the tone kind of in a unified manner and then we'll

continue in Bulgarian because this also affects mostly Bulgarian companies. Um but we have now this uh law the cons of pazarit and the crypto activity as I said um in Bulgaria it also covers it's not just in Bulgaria but it also covers not just mika but the but other frameworks most importantly the transfer funds regulation and DORA. So this is to say that whenever we are talking about a license, we are not just talking about a MA license even though that's the official kind of regulation legal framework, but we're talking about also the need of compliance with other uh very important and often even more complicated requirements. So keep that in mind. Um but now the really important

part and we are slowly moving towards the workshop. But who are the supervisors? So a bit of context uh the European Union by adopting Mika it's a regulation so it's directly applicable sorry for the lawyers here I know you know that but just so that we are at the same level um directly applicable however even though it's a regulation and it's quote unquote directly applicable and it should be applied as it is no changes major changes to the text um there is still some um opportunity for the member states to make it specific, more specific, more tailored towards their system which in this case means in the case of Mika it means various things but probably the

most important the most critical is that the member state still has the capacity to choose which would be the national competent authorities dealing with Mika. So we have two of them which is not um necessarily the case across Europe where they're predominantly one single national competent authority where all the supervisory and regulatory powers are concentrated but here we have two of them because of the system of the system which was in operation even before Mika. So it has to it had to basically be reopened and Mika and all the crypto asset related um rules needed to be included in our already applicable uh system. So we have the financial supervision commission which is the main

supervisory body but we also have the Bulgarian national bank which uh focuses on uh the e-money uh side of it and the e-oney tokens and also all the payment uh specifics which is a very big question currently under Mika and I guess if you're operating a CASP uh you already have have this at least this burning question okay what is happening now that for example if I'm dealing with an e- money token say an USDC and I'm also a crypto asset service provider but is that enough do I also need to be a payment institution in order for uh for this to happen which is the big question currently there isn't one specific answer hopefully that will

be soon currently the EU is working on that EU level um but apart from that it's basically where you can draw the line e- money so therefore e- money token tokens and payments with them with um funds and then we have the crypto assets aspect which is with the financial supervision commission. So this makes it even more important that we actually have representatives from this um NCA here with us which is absolutely unique and I cannot stop saying this because I truly am very very impressed um that you're here. Thank you once again. Um and with this also um now I'm going to even um go into the details that again if

you're a CASP which had already operate which is which has been operating in Bulgaria for quite some time you probably know and this has affected you uh the fact that uh there wasn't a system equivalent to what Mika now introduces in Bulgaria which isn't necessarily the case everywhere. where for example in France there was this really really complicated system uh on which basically is at least partially uh based um but here in Bulgaria we didn't have anything about crypto assets crypto asset services the only thing was this registration with the national revenue agency and however what Mika said says in its text is that okay if there we if

we had any uh applicable frameworks in the member state that were ahead of the date of Mikas adoption then those um can basically serve as a basis of some um extended period of service provision within that member state uh under the so-called grandfathering clause. So I have to admit that I wasn't entirely convinced initially that this registration or regist not this one in particular but registrations such as this one which were basically just this AML uh Excel sheet u uh were um sufficient to prove this sort of a um possibility to continue providing

services even after Mika has been uh adopted. But what the commission, the European Commission did was um because there were quite a lot of questions like that. Okay, which systems because there was quite a lot of um quite a big difference between say what was in France, what was in Austria and what was in uh other countries such as Bulgaria for example. But so the commission was receiving questions, okay, would this registration be enough for a company to uh still be able to provide services under the grandfathering exemption? And the commission published a Q&A saying yes whatever the system was it is still would allow for this entity to continue providing services but only within the same country and only until this um

period of time um that the local law provides and it does not in any way provide for this grand uh for the um passportization of the license which is perhaps the most important part of um of Mika currently. because with one single license you can provide services across the EU. So uh with that being said basically now the grandfathering clause in our lovely country is um the following. The entities registered before the end of last year may continue operating only in Bulgaria again until the 1st of July 2026 or until a make a license decision whichever earlier as you can imagine. So

this is important because that's literally the last possible deadline and we are in a sense only able to use that because we also had this uh a bit bit of a delay with the adoption of our local law and here I know people often ask what are what are the financial side what's the financial side of non-compliance so um here together with my AI assistant um we we created this table which is obviously based on the uh regulation but you can have a sort of a feel of the different breaches and the um different uh seriousness and the amounts uh it's in Euro already preparing for um next year um but yeah you can also see

basically what is being considered a breach an offense uh uh to Mika which is also market abuse with crypto assets um supervision um issues but with the market abuse there is another discussion that is ongoing at least from my perspective is one of the most interesting which is around me and how um that is currently uh scoped in in within this term um but that's again topic for for our discussions at some other point we also have TFR obviously per um particularly when the there is this failure for uh provision of information.

Um, which again would be particularly interesting when we're talking about unhosted, self-hosted wallets. Um, but that's already something that there are some technical solutions around. And last but not least, Dora and here for me personally that's the most interesting part um perhaps because it's the most technical um but how do you handle the governance issues? How do you handle all those topics about uh related to outsourcing risk management? Don't forget about Dora. That's what I'm saying. If you take one thing out of this uh presentation, don't forget about Dora. um when you are also seeking um a ma license and now so that we slowly go towards the

uh discussion that you you have gathered here for please use this QR code for asking questions to uh the representatives from the financial um from our NCA um Mr. uh because what we will ask you to do is to actually um save them for after the presentations have ended and then I will uh be um reading them, translating them. But if you can also ask them in in Bulgarian if you are a Bulgarian that would make it easier. If you are not a Bulgarian, go on and ask them in English. I will kind of make the make um

the conversation flow. But please, I'm spending some let's spend a minute on this slide. You scan this code. This would be the way for you to ask questions during the workshop. Um and with that, I thank you and I think we can now all move towards the um the discussion. with uh the uh NCA and yeah we'll I'll be around I'll be around uh until the end of the day. So if you want to discuss privacy please let me know. I'm dying to do that and thank you once again.

[Applause] [Music] [Music] Heat.