Bulgaria Advances AML/CFT Defenses Through Expanded Use of Open-Source Intelligence

Financial crime remains an unrelenting global threat that constantly pushes authorities to adopt more advanced detection and prevention tools, and Bulgaria has moved decisively by intensifying its reliance on Open-Source Intelligence, OSINT, to reinforce its Anti-Money Laundering and Counter-Financing of Terrorism, AML/CFT, architecture. The strength of any AML/CFT regime hinges on the sophistication of its Financial Intelligence Units and law enforcement bodies, which must perpetually refine their analytical methods to keep pace with the evolving tactics of criminal organizations seeking to funnel illicit proceeds into the legitimate economy. OSINT—information collected from publicly accessible sources—has emerged as an essential asset in this struggle, providing real-time visibility into sprawling laundering operations and newly developing risk typologies.

With the support of the Council of Europe, Bulgarian authorities have substantially boosted their ability to employ advanced analytical methods for tackling financial crime. Building upon prior foundational initiatives, an advanced OSINT training program was delivered in Sofia in October 2025, specifically requested by national institutions. The two-day session brought together analysts, investigators, and prosecutors from the Financial Intelligence Unit, law enforcement agencies, and prosecution services with the explicit aim of sharpening practical OSINT proficiency and embedding these techniques seamlessly into institutional workflows. The first segment of the training zeroed in on developing operational-level OSINT competencies vital for immediate enforcement needs. Participants practiced the use of specialized OSINT tools to carry out core functions such as identifying red flags, detecting imminent threats, and mapping national or regional vulnerabilities. Through scenario-based exercises modeled on real analytical workflows, teams learned to pinpoint relevant indicators, define operational goals, and translate findings into actionable recommendations. In parallel, the program revisited the legal and operational parameters governing OSINT deployment within AML/CFT mandates, ensuring that practitioners understood both the legal safeguards and required conditions for applying OSINT appropriately in their daily functions. This transition toward systematic, operationalized OSINT use enhances the state’s capacity to monitor transactions and entities that may be exploiting gaps in the financial system.

The second portion of the program shifted from the tactical demands of immediate investigations to the broader realm of strategic analysis. Strategic OSINT work involves identifying systemic threats and recognizing risk patterns shaped by global and regional geopolitical forces, providing the long-term insight essential for crafting national AML/CFT priorities and allocating resources effectively. The training introduced advanced analytical tools such as thematic coding, a methodology that allows analysts to detect recurring themes and linkages within vast pools of open-source data. Practical sessions demonstrated how these techniques inform strategic policymaking. A significant emphasis was placed on frameworks for evaluating money laundering typologies, particularly those tied to cryptocurrency. The rise of virtual assets has introduced complex challenges that defy traditional investigative tools, and OSINT has proven invaluable in tracing on-chain behavior and linking pseudonymous activity to real-world actors. By equipping practitioners with the ability to grasp these typologies at a higher level, the program supports a shift from reactive, case-by-case investigations to proactive, risk-based supervision—precisely the model promoted by the Financial Action Task Force, FATF.

A defining feature of the Bulgarian initiative was its focus on improving inter-agency collaboration, long identified as a critical weakness in AML/CFT enforcement. The training intentionally gathered 25 experts from across financial intelligence, policing, and prosecutorial institutions to foster cross-sector dialogue and shared expertise. Money laundering cases typically require fluid, rapid information-sharing between those who detect suspicious patterns, those who build investigations, and those who pursue prosecutorial action. To simulate these real-world dynamics, the final integrated exercise assigned different groups interdependent analytical responsibilities, demonstrating how tactical OSINT discoveries fuel operational insights, which then shape strategic assessments of systemic vulnerabilities. This interconnected approach underscored the necessity of synchronizing analytical efforts across all levels to achieve comprehensive, effective outcomes. By encouraging this multi-layered collaboration, the initiative reinforced Bulgaria’s institutional resilience and its capacity to deploy OSINT cohesively across all facets of AML/CFT activity.

This advanced program, funded through the European Union and Council of Europe’s Technical Support Instrument, signifies a pivotal moment in the modernization of Bulgaria’s AML/CFT framework. It successfully guided participants from a narrow, case-oriented perspective toward a holistic understanding that integrates operational and strategic intelligence. With their upgraded OSINT capabilities, the Financial Intelligence Unit and law enforcement entities are better positioned to detect and dismantle sophisticated laundering schemes, from identifying early-warning indicators to mapping risk environments and generating targeted intelligence for investigators and prosecutors. This forward-looking posture strengthens Bulgaria’s defenses against the proceeds of serious crime and aligns national practice with international expectations. By embedding these skills within a structure that promotes inter-agency cooperation, Bulgaria enhances its ability to respond decisively to complex financial crime threats, ensuring that intelligence is not only generated but effectively transformed into impactful enforcement and informed policymaking.

By fLEXI tEAM