Success story· FinTech · 150+ Employees
How two compliance audits closed an estimated €18,300 in Bulgarian employment law risk for a FinTech company
Executive summary
- The situation: A FinTech company’s Bulgarian entity had been operating for four years with compliance gaps that no one had caught, including going without a legally required Health & Safety Contractor and missing basic employment legislation documentation.
- What we did: Ran a full compliance audit that closed the original gaps, then returned 2 years later for a targeted follow-up audit when Bulgaria’s Labor Code was amended to add new remote work requirements, catching the new gaps before they became liabilities.
- The result: An estimated €18,300 in compliance risk closed across both engagements, full documentation brought current, and an ongoing partnership the client still relies on.
- Why it matters: Compliance risk doesn’t stay still. A company can be fully compliant one year and out of compliance the next simply because the law changed underneath them, which is exactly what happened here.
Snapshot
The Client
Industry: FinTech
HQ: London, UK
Global Presence: Europe, Americas, Asia
Employees: 150-200 worldwide
Impacted location
Office: Sofia, Bulgaria
Employees: 30
The challenge
Compliance gaps that had gone undetected for years
When we were first engaged, the company’s Bulgarian entity had been operating since 2018 without anyone checking whether it was actually compliant with Bulgarian labor law, and it wasn’t.
The most serious finding: the company had never signed a contract with a Health & Safety Consultant/Agency, a legal requirement for any employer with at least one employee in Bulgaria. That gap had existed, undetected, since the very first employee was hired in April 2018, four years of exposure the company didn’t know it had.
That wasn’t the only issue. Across 30 active employee files, we found:
- No signed Bank Account Declarations, a legal requirement for any employer paying salaries by bank transfer
- No documentation at all for employees who had resigned or been terminated
- No Occupational Health & Safety documents – some examples are
- No certificates for Health & Safety induction training for new hires, only an instruction book, unsigned
- Five separate legally required registers completely missing: Health & Safety instruction registers (both induction and periodic/emergency), the Labor Book register, the Occupational Accidents register, and the Overtime register.
- No one formally appointed as responsible for Health & Safety, and no official representative designated for a Labor Inspection visit
Having opened a new office in Bulgaria and with plans to ramp up hiring, we were out of our depth regarding local labour laws and compliance. Without the knowledge in-house, we sought the specialist advice of the People Success Team to get our house in order and ensure full compliance
Sophie K., HRBP
The Second Challenge: The Law Changed
Two years later, we returned for a different reason. Bulgaria’s Labor Code was amended to include new requirements specifically for remote work, and a company that had been fully compliant the year before now had gaps it didn’t know about.
The follow-up audit found that the existing Remote Work Annex:
- Didn’t specify a place of work at all, now a legal requirement, with penalties for non-compliance
- Had no written rules for how remote work tasks were assigned or reported, a new requirement under the amended Labor Code
- Had no written policy on penalties for non-compliance with remote work rules
The audit also caught something with a real, dated consequence: the company’s overtime report for the previous year to the Labor Inspectorate had been missed entirely. Bulgarian law requires this report by January 31 each year; it hadn’t been filed, and without the audit, the deadline for the current year would likely have been missed too.
Language and legal complexity compounded both risks
- Most critical Bulgarian employment law resources are available only in Bulgarian and are unusable to an HQ-based leadership team without local support.
- Bulgarian labor law changes regularly, and there’s no reliable mechanism for a foreign-owned entity to be notified when a change affects them.
- Without local expertise, the company had no way to know it was out of compliance until an inspection or dispute forced the issue, by which point the fines and legal exposure would already be locked in.
Our strategic approach
Both engagements followed the same method. Rather than a general “compliance review,” each was a full document-by-document audit against the current Bulgarian legal requirements, with every finding scored Red (nothing in place), Amber (partially in place), or Green (fully compliant) and assigned a clear priority: High within 30–45 days, Medium within 45–60 days, Low within 90 days.
Every recommendation came with the specific legal basis behind it, including the article and code references, so leadership could see exactly why each fix mattered rather than taking it on faith.
The result, both times, was a status that leadership could actually act on, rather than a long list of legal jargon to decode.
How We Made It Happen
Full audit, twice, against a moving target: Ran a comprehensive compliance audit in two different years, specifically because the law had changed, catching new gaps within months of the legal amendment taking effect, not years later during an inspection.
Closed a four-year-old gap: Identified and resolved the missing Health & Safety Consultant/Agency contract, which had been outstanding since the company’s first Bulgarian hire in 2018.
Rebuilt missing documentation from zero: Brought the completely absent legal documents into existence, alongside signed declarations, induction certificates, and a full audit trail for departed employees.
Caught a real, dated compliance miss: Found that the previous year’s overtime report to the Labor Inspectorate had been missed, and flagged the current year’s deadline in time to act.
Closed the remote work gap created by law change: Rebuilt the Remote Work Annex to specify the place of work, added written task assignment and reporting rules, and added a penalties policy, all newly required under the Labor Code amendments.
The results
Estimated compliance risk closed: €18,300
During the 1st audit
During the 2nd audit
A lasting partnership
Maria’s guidance and diligence were vital and helped us immensely during this period. Not just during the initial project, but even two years later when we needed another review—Maria was right there with us. Her availability for ad-hoc questions has been invaluable support whenever needed.
Sophie K., HRBP
Why this matters beyond Bulgaria
For a FinTech company, compliance gaps aren’t just a legal risk. They’re a fundraising and exit risk. Employment law compliance is a standard line item in investor and acquirer due diligence, and undocumented gaps discovered mid-raise or mid-deal don’t just cost money to fix; they cost time, leverage, and sometimes the deal itself. A clean, current compliance file isn’t paperwork for its own sake; it’s part of what makes a company fundable and acquirable on schedule
Let us be part of your success story
We invite you to get in touch with us and let us be your partners in achieving your business goals. Your success story is waiting to be written, and we’re here to help you craft it.