If you register a Bulgarian company, open a bank account, or deal with the tax authority for more than a few months, you will eventually need a QES — a Qualified Electronic Signature, known locally as a KEP (Квалифициран електронен подпис). It's one of the least glamorous parts of moving to Bulgaria, and one of the most useful once you actually have it. Here's what it is, what it costs, and exactly where it fits into the rest of the bureaucracy.
What QES Actually Is
QES stands for Qualified Electronic Signature — known locally as a KEP, short for Квалифициран електронен подпис, the Bulgarian term you'll actually see on bank websites, government portals, and provider paperwork. Under the EU's eIDAS regulation, it carries exactly the same legal weight as signing a piece of paper by hand. It isn't a niche banking tool — it's the everyday key to digital life as a resident or business owner in Bulgaria.
Once issued, your QES lets you file with the National Revenue Agency (NAP), submit and amend filings at the Trade Register, handle social security paperwork with NOI, sign contracts and official correspondence electronically, and — for a small but growing number of banks — complete parts of the account-opening process itself.
Whether you're registering a company or opening a bank account — see our Register a Company in Bulgaria and Banking in Bulgaria for Foreigners guides — you'll likely need a QES for one stage or another of both processes — this guide is written as the companion piece to those two.
Cloud QES vs. Token/Smart-Card QES
There are two physically different ways to hold a QES, and the difference matters more than most people expect.
- Cloud (mobile) QES — lives on the provider's secure server and is triggered through a mobile app. You confirm each signature with your phone; nothing to plug in or carry around. It's the only type that realistically supports fully remote registration from outside Bulgaria.
- Token / smart-card QES — physical hardware: a USB key, or a card plus reader, that you plug into a computer to sign. It's the traditional format many accountants and older institutional systems still expect, and some government portals and legacy banking systems are built around it specifically.
Rule of thumb: if you mainly need to sign documents from your phone, go cloud. If your accountant, employer, or a specific institution insists on a hardware certificate, you'll need the token or smart-card version instead — and possibly both, eventually.
The Three Providers
| Provider | What it's known for |
|---|---|
| Evrotrust | Fully mobile-app-based signature — the most remote-friendly option, the only one most foreigners can complete without visiting Bulgaria first |
| B-Trust (Borica) | Both cloud and smart-card signatures; widely accepted across government portals |
| InfoNotary | Smart-card signatures; the default choice for many companies and accountants |
As of 2026, a personal cloud QES through Evrotrust starts around €41 for a 2-year certificate; a smart-card QES through B-Trust or InfoNotary is typically cheaper for residents already in Bulgaria but adds the cost of a card reader, and requires an in-person step that the cloud option skips entirely.
How to Actually Get One
Decide cloud or token first
If you're not yet in Bulgaria, or want everything done from your phone, choose a cloud QES (Evrotrust). If your accountant or a specific institution needs a hardware certificate, choose token/smart-card (B-Trust or InfoNotary).
Identity verification
For Evrotrust's cloud QES, this happens inside the app — a selfie plus an ID document scan, reviewed remotely, typically resolved within minutes to a day. For a token/smart-card QES, this means a physical visit to a registration office with valid ID.
Certificate issued
Your qualified certificate is generated and linked to your identity — to your mobile app for cloud QES, or written to the smart card/token for the hardware version.
Start signing
From here, you can sign NAP filings, Trade Register submissions, NOI paperwork, contracts, and — at a handful of banks — parts of an account application, all with full legal effect.
Can Someone Collect It for You?
A physical token or smart-card QES has to be collected in person at one of the provider's own registration offices, with valid ID — but it doesn't necessarily have to be you who shows up. Both B-Trust and InfoNotary explicitly allow an authorised representative to collect it on your behalf, provided you give them a notarised power of attorney specifically for this purpose. Either way, someone still has to physically visit the office; there's no way to skip the in-person step entirely for a hardware certificate.
A cloud QES through Evrotrust is the exception worth knowing about: its app-based identity verification lets you register and receive a personal QES remotely, in minutes, without anyone visiting an office at all — the only realistic route if you're applying from outside Bulgaria.
If you do go the authorised-representative route, both providers publish the exact power of attorney wording they require: B-Trust's templates (separate versions for personal and professional/corporate signatures) and InfoNotary's templates. The form itself is the easy part — getting it notarised correctly, matching the right version to your situation, and making sure the provider accepts it on the first attempt is where most of the actual friction is. Ask us to make sure your power of attorney is filled out and notarised correctly the first time.
QES When Registering a Company
Most founders end up needing a QES at some point during or shortly after incorporation — for Trade Register filings, for NAP and NOI registration as a company director, and for day-to-day contract signing once the business is running. It's worth getting one early rather than scrambling for it later. See our full guide to registering a company in Bulgaria for the wider process this fits into.
QES and Bank Accounts
A small number of Bulgarian banks let QES carry part of the account-opening process itself. UniCredit Bulbank is the clearest example — its remote-onboarding service is built around a cloud QES issued by Evrotrust, used to sign the account contract digitally with no branch visit. The catch: this route currently only applies if the company's legal representative is a Bulgarian citizen, so it generally isn't available to a foreign director. Read the full breakdown in our bank account guide, including which banks accept QES for everyday banking once an account already exists, even where they don't accept it to open one.
Common Mistakes
Assuming any QES works everywhere. Some portals and institutions are built around token/smart-card certificates specifically and don't recognise a cloud signature, or vice versa. Confirm which type you need before you pay for one.
Leaving renewal too late. Most certificates run on a 1–2 year validity. An expired QES can't sign anything, including the renewal request itself in some cases — set a calendar reminder well before expiry.
Getting the power of attorney wording wrong. If someone else is collecting your hardware QES, the notarised power of attorney must match the provider's published template exactly — generic wording is often rejected on the first attempt.
None of this is complicated once you've done it once — it's just one more piece of Bulgarian bureaucracy that's easy to underestimate from abroad. Get the right type for what you actually need, budget for renewal, and a QES becomes one of the more useful tools in your day-to-day administrative life here rather than another hurdle.
