Anti-money laundering rules (ZMIP) for real estate agencies: what the agency has to do

When the agency is an obliged entity

Bulgaria’s Measures Against Money Laundering Act (ZMIP) lists in Art. 4 who has to apply the measures. Point 18 covers “persons who, by way of business, act as intermediaries in real estate transactions”. That is every agency and every agent working on their own, whatever their size.

For sales there is no threshold. For lettings the act applies when the monthly rent is €10,000 or more. That threshold has been in euro since 2019, so the switch to the euro did not change it. An agency that only lets flats at €800 a month is not covered for those deals. If it also brokers sales, it is covered for them.

Alongside ZMIP come its Implementing Regulations (PPZMIP) and the counter-terrorist financing act — since 2025 called the Measures Against the Financing of Terrorism and the Proliferation of Weapons of Mass Destruction Act. Supervision sits with the State Agency for National Security (SANS), through its Financial Intelligence Directorate. In 2026 the directorate updated its guidelines written specifically for real estate intermediaries.

This text reflects the law as of October 2026, including the amendments up to June 2026. It is not legal advice: for your own rules and for a specific case, talk to a lawyer.

Internal rules and who is responsible

Every agency adopts internal rules for the control and prevention of money laundering and terrorist financing (Art. 101 ZMIP). The deadline is 4 months from its registration (Art. 102(1)). The rules are adopted by a written act of the manager or of whoever represents the agency (Art. 102(3)).

The rules are not sent to SANS — that requirement was dropped in May 2019. They apply from the day they are adopted and are shown during an inspection.

SANS publishes no model rules for agencies, but its guidelines for intermediaries describe what else to include.

Internal control is run by a dedicated unit or personally by the manager. The manager may delegate it by written act to an employee in a senior management position (Art. 107(1)–(3)). The Financial Intelligence Directorate is then notified within 7 days — the form is on the SANS website — and the employee’s duties start from that notice (Art. 106(5) and Art. 107(4)–(5)).

Customer due diligence

The client’s identity and beneficial owner are checked before the business relationship starts (Art. 15(1)). At an agency that is usually the brokerage agreement — with the seller, the buyer or the landlord. The check is repeated whenever you doubt the data or it changes (Art. 15(2)).

Due diligence has five parts (Art. 10): who the client is, who the beneficial owner is, what the purpose is, where the money comes from, and monitoring for as long as the relationship lasts.

If everything happens remotely, the data is verified by at least two methods (Art. 55(2)). Every check is documented with the date and time and the name and position of whoever did it (Art. 55(3)).

If due diligence cannot be completed, the agency turns the deal down or ends the relationship already started (Art. 17), and considers whether to report to SANS. Documents about the property itself are a separate topic — which documents to ask the owner for.

PEPs, enhanced and simplified due diligence

A politically exposed person (PEP) holds a prominent public function in Bulgaria, abroad or in an international organisation: ministers and deputy ministers, members of parliament, senior judges, ambassadors, mayors and deputy mayors, members of the governing bodies of political parties and state-owned companies, and others (Art. 36(2)). The measures also cover their family members and known close business associates (Art. 36(5)).

A relationship with a PEP starts only with the approval of an employee in a senior management position (Art. 38). The agency also establishes the source of the person’s wealth, not just the money for the deal (Art. 39(2)), and monitors the relationship more closely (Art. 40) — for at least a year after the person has left office (Art. 37(1)). How you find out that a client is a PEP is set out in the internal rules; a declaration from the client is one of the sources (Art. 42; Annex 1 to PPZMIP).

Enhanced due diligence also applies to clients from high-risk third countries, to complex or unusually large deals, to deals with no apparent economic or lawful purpose, and whenever the risk assessment shows a higher risk (Art. 35). Simplified due diligence is possible only for low risk, with senior management approval and after the agency has notified SANS in advance (Art. 25–26). The SANS guidelines rule it out for medium and higher risk, and the National Risk Assessment rates real estate investment as high-risk.

Check clients against the sanctions lists as well — the EU, UN and Council of Ministers lists, linked from the SANS website. If a deal involves a listed person, it is not concluded, and SANS is notified immediately.

When to report to SANS

On suspicion of money laundering or of funds of criminal origin, the agency reports to the Financial Intelligence Directorate immediately and before the deal, delaying it as far as permitted. The report states the latest date to which the deal can be postponed (Art. 72(1)). If a delay is impossible, the report follows immediately after the deal, with the reasons (Art. 72(2)). The duty applies even when the deal is not completed (Art. 72(5)).

Reports go through the SANS goAML system (aml.dans.bg) after registration, or on the form from the SANS website. The director of the directorate can suspend the deal for up to 5 working days (Art. 73(1)). The client and third parties are not told that a report has been made (Art. 80(1)).

Examples of suspicion from the SANS guidelines: a third person comes with the client and makes the decisions; the price is well above or below market; the client shows no interest in the terms or the commission; the parties change at the last minute; the company’s beneficial owner is hard to establish; the property is resold within a short time for no apparent reason; large sums in cash.

Separately, the Cash Payments Restriction Act requires payments of BGN 10,000 or more — €5,112.92 at the official rate — to go by bank transfer only (Art. 3(1)). A large cash sum in a property deal raises questions by itself. For money coming into the agency’s own cash desk, see the commission: from the deal to the invoice.

Every report of suspicion from an employee is entered in a special log, together with the conclusion on whether to notify SANS. The log can be electronic if it meets the requirements of Art. 52 PPZMIP.

Records, training and penalties

Everything collected and prepared under ZMIP is kept for 5 years (Art. 67(1)). For a client relationship the period runs from its end; for an occasional transaction, from its date (Art. 67(2)–(3)). SANS can extend it by up to two years (Art. 67(6)). Records must be quick to retrieve and handed to SANS on request — as originals, certified copies or summaries (Art. 68(1); Art. 69).

Training is both introductory and ongoing (Art. 101(11)). Every year the agency draws up a training plan, and during an inspection it shows the plan and the report on how it was carried out (Art. 67 PPZMIP). SANS has published instructions on how to prepare the plan.

Penalties are in Chapter Ten of ZMIP. For breaching the core duties — due diligence, record keeping, reporting, training — a company pays BGN 2,000 to 20,000, and BGN 5,000 to 50,000 for a repeat breach (Art. 116(1)–(2)). For serious or systematic breaches the upper limit is BGN 2,000,000 or twice the benefit gained (Art. 116(3)). The manager and the person responsible for internal control are also personally liable, with a fine of BGN 1,000 to 15,000 (Art. 117(1)).

The amounts in the act are still in leva. Since 1 January 2026 they are converted at the rate of 1.95583 (Art. 11(2) of the Euro Introduction Act): BGN 2,000 is €1,022.58 and BGN 20,000 is €10,225.84.

What it looks like in practice

The law says what. The agency decides who, when and where. Here is a set-up that works in a small office too.

Copies sit in one place, with the deal — not in the agent’s email or Viber. When an agent leaves, they stay with the agency (how that is handled). The deadlines get written down too: 5 years from the end of the relationship, the 15th of the month for cash payments, the training plan every year, client file reviews at the interval set in the rules.

OptiEstate has no separate ZMIP module. The system does not screen sanctions lists or PEPs, does not assess risk and does not file reports with SANS — that stays the agency’s duty. But it can keep the routine around the checks in order:

• The party’s details — personal ID number or company ID, address, representative — live in the contact file, and the personal ID number is stored encrypted.
• Copies and declarations are uploaded to the Documents tab of the listing (for the seller) or of the buyer’s search. The tab is visible to the record’s agent, the manager above them and people with full access, and the files cannot be opened by direct link.
• A deal or deposit document stays locked as the history of the deal. Only someone with a separate permission or full access can unlock or delete it.
• Declarations and the questionnaire can become agency templates, filled in from the contact’s details — just like contracts.
• Deadlines become tasks with reminders, linked to the client, the listing or the search. The cash payment report can be a monthly recurring task.
• The internal rules are a page in the team handbook that everyone reads in the system. The handbook is in every plan.

Frequently asked questions

Is a real estate agency in Bulgaria an obliged entity under ZMIP?

Yes. Real estate intermediaries are obliged entities under Art. 4(18) of ZMIP — for every sale, and for lettings where the monthly rent is €10,000 or more.

Do the internal AML rules have to be sent to SANS?

No. Since May 2019 the rules are not sent to SANS. They are adopted by a written act of the manager within 4 months of the agency’s registration and shown during an inspection.

When does an agency report a cash payment to SANS?

For every cash payment over €15,000 made by or to its client. The information is filed monthly, by the 15th of the following month (Art. 76 ZMIP and Art. 54 PPZMIP).

How long are the due diligence records kept?

Five years. For a client relationship the period runs from its end; for an occasional transaction, from its date. SANS can extend it by up to two years.

Does OptiEstate have a ZMIP module?

No. Due diligence, the risk assessment and reports to SANS remain the agency’s duty. The system keeps the parties’ details, the copies and declarations with the listing or search, the locked deal document and the tasks with deadlines.