MONEYVAL Bulgaria AML Follow-Up: The Correspondent Banking Read

On 17 June 2026, MONEYVAL published its third enhanced follow-up report on Bulgaria, and the headline is clear: Bulgaria is now rated compliant or largely compliant on all 40 FATF Recommendations, and no further reporting is required under MONEYVAL’s fifth-round evaluation. For anyone who runs country-risk models or approves correspondent relationships, the MONEYVAL Bulgaria AML follow-up is worth reading because it is easy to over-read. A technical-compliance re-rating assesses the extent to which a jurisdiction’s legal and institutional framework meets the FATF Recommendations; a largely compliant rating can still reflect minor shortcomings. It does not reassess effectiveness and does not itself alter an EU reporting obligation.

The report is most useful as a worked example of a distinction country-risk teams touch every week: a MONEYVAL follow-up, FATF increased monitoring and the EU list of high-risk third countries are separate mechanisms. Bulgaria was subject to the first two processes in June 2026. MONEYVAL closed its fifth-round follow-up, while FATF made an initial determination that Bulgaria had substantially completed its action plan and authorised an on-site assessment. Under FATF’s procedure, removal from increased monitoring requires a positive on-site assessment followed by a plenary decision. Bulgaria cannot be an EU high-risk third country because it is an EU Member State.

Related reading: CSSF guidance on de-risking and ML/FT risk management

Inside MONEYVAL’s Bulgaria AML re-rating

MONEYVAL is the Council of Europe’s FATF-style regional body. It assesses its own members, Bulgaria among them, against the same 40 FATF Recommendations the FATF applies to its direct members, and reports through the FATF Global Network. So this is a MONEYVAL assessment; the FATF plenary did not conduct it. The document is titled a third enhanced follow-up report and technical compliance re-rating, and it measures Bulgaria’s progress against the deficiencies flagged in its 2022 mutual evaluation.

The distinction that gets lost is between technical compliance and effectiveness. A mutual evaluation produces two scorecards. Technical compliance measures whether the laws and institutional powers exist and match the Recommendations. Effectiveness, scored against 11 immediate outcomes, measures whether the system actually stops, detects and prosecutes financial crime. This report re-rates technical compliance. It says nothing fresh about how well Bulgaria’s supervisors, financial intelligence unit and prosecutors perform.

On that scorecard, MONEYVAL recorded improvement on eight Recommendations since the previous monitoring report of June 2025, in areas including correspondent banking, the terrorist-financing offence, targeted financial sanctions on proliferation, non-profit organisations and mutual legal assistance. Correspondent banking maps to FATF Recommendation 13. Bulgaria now stands at compliant on 13 Recommendations and largely compliant on the other 27, which is why MONEYVAL closed the fifth-round process instead of keeping it open.

The dates that anchor the file

The timeline the re-rating sits on:

• 2022: Bulgaria’s fifth-round mutual evaluation report is adopted, setting the baseline of technical-compliance deficiencies.
• June 2025: the previous monitoring report is adopted, the benchmark this report measures against.
• 17 June 2026: MONEYVAL publishes the third enhanced follow-up report and re-rating; all 40 Recommendations are rated compliant or largely compliant, and no further fifth-round reporting is required.
• 10 July 2027: much of the EU Anti-Money Laundering Regulation begins to apply, alongside guideline mandates that reach into de-risking and correspondent-banking practice.

MONEYVAL follow-ups and the FATF grey list: two separate mechanisms

Mutual evaluations and their follow-ups run on a separate track from the FATF grey and black lists. The follow-up cycle is a peer-review process that produces technical-compliance ratings; it can span years and closes when the ratings reach a sufficient threshold. The grey and black lists come out of a different FATF mechanism, the International Co-operation Review Group, which produces the jurisdictions-under-increased-monitoring and call-for-action statements the FATF refreshed on 19 June 2026.

That separation has a direct consequence for scoring. A country can carry largely compliant technical ratings and still be under increased monitoring for unresolved strategic deficiencies, which may concern technical compliance, effectiveness or both. A country can also close a technical-compliance follow-up without ever appearing on a FATF public list. Bulgaria was subject to both processes. MONEYVAL’s closure of the technical-compliance follow-up did not remove Bulgaria from FATF increased monitoring. FATF’s June 2026 decision advanced Bulgaria to an on-site assessment, with removal still dependent on the outcome of that assessment and a subsequent FATF plenary decision. If your risk model treats “MONEYVAL follow-up status” and “FATF ICRG listing” as one field, this is the report that should prompt you to split them.

Where the correspondent-banking obligation actually bites

Until 10 July 2027, the EU-level correspondent-banking requirements are contained in Article 19 of Directive (EU) 2015/849, as transposed into national law, while Article 24 contains the shell-bank prohibition. From 10 July 2027, Articles 36 and 39 of Regulation (EU) 2024/1624 will replace those provisions. Article 36 will apply to specified cross-border correspondent relationships involving a third-country respondent institution and will require information gathering, assessment of the respondent’s AML/CFT controls, senior-management approval and documentation of the institutions’ respective responsibilities.

At EU level, an EU correspondent’s relationship with a Bulgarian respondent falls outside the third-country perimeter of current Article 19 of Directive (EU) 2015/849 and future Article 36 AMLR. However, the MONEYVAL report records a separate Bulgarian-law change: Bulgaria’s Law on Measures Against Money Laundering was amended in 2025 to require Bulgarian obliged entities acting as correspondents to apply FATF Recommendation 13 measures before establishing cross-border correspondent relationships with respondent institutions from any other country, including EU and EEA states. The report does not itself bring that rule into force, but it records a current Bulgarian domestic requirement. For an EU institution assessing a Bulgarian respondent, ordinary CDD and EDD remain governed by Directive (EU) 2015/849 as nationally transposed until 10 July 2027; Articles 20 and 34 AMLR will apply thereafter.

Country assessments as a risk input, not a switch

The EU high-risk third-country list is where a poor FATF or MONEYVAL result can produce hard obligations, so the wiring is worth stating precisely. Under the current framework, the Commission identifies high-risk third countries under Article 9 of Directive (EU) 2015/849, with resulting measures operating through the Directive and national law. From 10 July 2027, the AMLR separates three channels: Article 29 covers third countries with significant strategic deficiencies; Article 30 covers compliance weaknesses and uses information on jurisdictions under increased monitoring as a baseline for the Commission’s assessment; and Article 31 covers exceptional specific and serious threats to the Union financial system that cannot be addressed through Articles 29 or 30. Countermeasures listed in Article 35, including requiring credit and financial institutions to review and amend or, where necessary, terminate correspondent relationships with respondent institutions in the country concerned, are available for Article 29 identifications and for Article 31 cases where the threat amounts to a significant strategic deficiency.

Those mechanisms concern third countries, so Bulgaria remains outside them as an EU Member State. A MONEYVAL re-rating is not a Commission identification and does not itself trigger enhanced measures or countermeasures. For a third country, mutual evaluations and follow-up reports can inform the Commission’s assessment, but the applicable measures depend on the relevant Commission act under current Article 9 of Directive (EU) 2015/849 or, from 10 July 2027, Articles 29 to 31 AMLR. The correspondent-banking framework, including FATF Recommendation 13 and the transfer-information duties in FATF Recommendation 16, applies regardless of country-assessment outcomes.

De-risking: manage the risk, do not exit the client

The de-risking question is where a good-news report can quietly cause harm. The temptation after any country assessment is to translate a rating into a blanket accept-or-refuse rule for a category of counterparts. Supervisors have been explicit that this is the wrong reflex. In a communique published on 16 June 2026, the day before the MONEYVAL report, the CSSF restated that it expects firms to manage ML/FT risks, not avoid them, and that a higher level of risk exposure does not on its own justify refusing to establish or maintain a business relationship.

That position has a statutory tail. Article 21(4) of the AML Regulation mandates the EBA and AMLA to issue joint guidelines by July 2027 on measures for the business relationships most affected by de-risking, and the Regulation’s recitals warn that AML/CFT reasons should not be invoked to justify what are really commercial decisions, using non-profit banking access as the example. A firm that loosens controls on Bulgaria’s improved rating, or exits a client segment wholesale on a weaker country’s rating, misuses the assessment in opposite directions. AML/CFT decisions should be documented and risk-based. The CSSF rejects general exclusions based solely on higher ML/FT risk, while recognising that firms may separately redefine their business model and discontinue services for categories of customers for genuine commercial reasons; in both cases, AML/CFT reporting obligations require a documented, individual risk basis for each decision.

Frequently Asked Questions

Does the re-rating put Bulgaria on, or take it off, the EU list of high-risk third countries?

Neither. Bulgaria is an EU member state, so it cannot appear on that list, which by definition covers third countries identified by the Commission under Articles 29 and 31 of Regulation (EU) 2024/1624. The re-rating is relevant to country-risk scoring and has no bearing on the list.

Does the report change any reporting obligations for Bulgarian counterparties?

No. A technical-compliance re-rating does not create, remove or reschedule any EU reporting return or suspicious-transaction obligation. Until 10 July 2027, due diligence and reporting continue under Directive (EU) 2015/849 as transposed into national law; the AML Regulation applies from that date.

What is the difference between MONEYVAL and the FATF here?

MONEYVAL is a FATF-style regional body that assesses its own members against the FATF Recommendations and reports through the FATF Global Network. The FATF plenary did not itself re-rate Bulgaria. Attributing the report to the FATF instead of MONEYVAL is a common but material error.

MONEYVAL closed the fifth-round process. Does that mean no more monitoring?

Closing the technical-compliance follow-up means the ratings satisfy MONEYVAL’s threshold for ending further fifth-round reporting. It confirms that all 40 Recommendations are rated compliant or largely compliant at the technical-compliance level. Effectiveness remains a separate question, so the result is not a permanent all-clear.

How does this touch nested correspondent relationships?

Where a Bulgarian bank acts as correspondent, the MONEYVAL report records that Bulgaria’s amended national law applies correspondent-banking measures to cross-border relationships with respondent institutions from any other country, including EU and EEA states. Separately, current EU Article 19 of Directive (EU) 2015/849 and, from 10 July 2027, Article 36 AMLR use a third-country perimeter. An upstream EU bank’s relationship with the Bulgarian bank remains outside that specific EU third-country provision, but it remains subject to ordinary risk-based AML/CFT controls, including assessment of nested-relationship risks.

Related Articles

• CSSF De-Risking and ML/FT Risk Management: How the CSSF frames de-risking as risk management rather than blanket avoidance.
• The EU AML Regulation: What Changes: The single rulebook governing CDD, EDD and correspondent banking across the Union.
• FATF Travel Rule and Recommendation 16: How the FATF standard drives EU fund- and crypto-transfer information rules.
• AML Reporting in Luxembourg: The STR filing and AML/CFT obligations that sit on Luxembourg obliged entities.
• AUSTRAC 2026 Financial Crime Risk Snapshot: How a foreign regulator’s typologies feed EU teams’ country and sector risk.

Key Takeaways

• Attribute the report to MONEYVAL, the Council of Europe FATF-style body; the FATF plenary did not conduct it, and it grades technical compliance while leaving effectiveness untouched.
• As of 17 June 2026 Bulgaria is compliant on 13 and largely compliant on 27 of the 40 FATF Recommendations, and the fifth-round follow-up is closed.
• Split “MONEYVAL follow-up status” from “FATF ICRG listing” in your country-risk model; MONEYVAL’s closure did not remove Bulgaria from FATF increased monitoring, and FATF’s June 2026 decision authorised an on-site assessment pending a plenary removal decision.
• Current Article 19 of Directive (EU) 2015/849 and future Article 36 AMLR cover third-country respondents at EU level. Bulgaria is outside that EU perimeter, but the MONEYVAL report records that Bulgaria’s amended national law imposes correspondent-banking measures on Bulgarian obliged entities acting as correspondents to institutions in other countries, including EU and EEA states.
• From 10 July 2027, Article 35 correspondent-relationship countermeasures may be selected for Article 29 identifications and for Article 31 cases where the threat amounts to a significant strategic deficiency. Article 30 increased-monitoring identifications do not automatically carry Article 35 countermeasures, and Article 38 provides a separate AMLA-driven mechanism for measures against individual third-country respondent institutions.
• Treat the re-rating as one favourable input under the current national frameworks implementing Directive (EU) 2015/849. From 10 July 2027, Articles 20 and 34 AMLR will govern the corresponding Union-level CDD and EDD framework. It is not, by itself, a reason to re-tier every Bulgarian exposure.
• Do not convert any country rating into a blanket de-risking rule; the CSSF communique of 16 June 2026 and Article 21(4) of the AML Regulation both push the other way.

Sources and References

• MONEYVAL, Third Enhanced Follow-Up Report and Technical Compliance Re-Rating, Bulgaria, June 2026 (report page and PDF): fatf-gafi.org
• Council of Europe / MONEYVAL, press release on Bulgaria’s improved legal framework, 17 June 2026: coe.int/moneyval
• MONEYVAL within the FATF Global Network (mandate and role): fatf-gafi.org global network
• FATF, Jurisdictions under Increased Monitoring, 19 June 2026 (Bulgaria remains on increased monitoring; on-site assessment authorised): fatf-gafi.org increased monitoring June 2026
• Directive (EU) 2015/849 (EU Fourth Anti-Money Laundering Directive), Articles 9, 19 and 24 (current correspondent banking and shell-bank framework): EUR-Lex CELEX 32015L0849
• Regulation (EU) 2024/1624 (EU Anti-Money Laundering Regulation), Articles 20, 29, 30, 31, 34, 35, 36, 38, 39 and 21(4): EUR-Lex CELEX 32024R1624
• CSSF communique, De-risking Practices and ML/FT Risk Management, 16 June 2026: cssf.lu
• The Sofia Globe, report on the MONEYVAL Bulgaria findings, 17 June 2026: sofiaglobe.com

Reading the re-rating without over-reading it

The practitioner action here is small. Open your country-risk methodology, find the field that captures Bulgaria’s AML standing, and update it from the primary source while keeping technical-compliance ratings separate from any listing status. Leave the correspondent-banking and de-risking rules where they are, because none of them turned on this report. The next date that reshapes the analysis is 10 July 2027, when the AML Regulation and its guideline mandates begin to bind.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.