Bosnia and Herzegovina

**No specific "crypto custody license" exists.** Unlike some EU countries with dedicated VASP (Virtual Asset Service Provider) licensing regimes that explicitly cover custody, BiH has not yet introduced such a license.

**AML Registration for VASPs:** The primary regulatory requirement for entities providing services related to virtual assets, including those that might engage in custody (e.g., exchanges holding client funds), stems from the AML/CFT framework. BiH has aligned its AML legislation with FATF recommendations, which includes treating Virtual Asset Service Providers (VASPs) as obliged entities.

The **Law on Prevention of Money Laundering and Terrorist Financing (Zakon o sprečavanju pranja novca i finansiranja terorističkih aktivnosti)** mandates that VASPs, which would typically include entities offering custodial services for virtual assets, must register with the relevant authority (likely the Financial Intelligence Unit - FIU BiH) and implement robust AML/CFT procedures, including Know Your Customer (KYC) checks.

**Law on Prevention of Money Laundering and Terrorist Financing of Bosnia and Herzegovina (Official Gazette of BiH, No. 100/17, 36/18, 55/19, 32/22, 12/23, 12/24)**. While an official English translation with a direct government URL for the latest consolidated version can be hard to pinpoint, the law is accessible via official legislative databases. The Ministry of Security often publishes updates or related information.

**Ministry of Security of BiH (responsible for AML policy):** http://www.msb.gov.ba/?lang=en (You may need to navigate to legislative sections to find the specific law).

The Financial Intelligence Department (FID) within the State Investigation and Protection Agency (SIPA), not an independent FIU BiH, is the key AML/CFT enforcement body and likely first point of contact for VASP registration in Bosnia and Herzegovina.

**No specific rules for digital assets.** Given the absence of a dedicated custody framework, there are no specific legal mandates requiring the segregation of client digital assets from the custodian's proprietary assets.

**General Fiduciary Principles (by analogy):** While not legally binding for crypto, general principles of good corporate governance and financial trust would suggest that responsible custodians *should* segregate assets. However, this is currently a best practice rather than a regulatory requirement in BiH for digital assets.

**No specific requirements.** There are no explicit regulatory requirements for digital asset custodians in BiH to hold specific insurance or bonding to cover potential losses from hacks, operational failures, or other risks.

**No specific mandates.** BiH law does not currently mandate the use of cold storage (offline storage) for digital assets under custody. Responsible custodians would typically employ a combination of cold and hot storage for security reasons, but this is an operational choice rather than a regulatory obligation.

**No specific definition.** BiH law does not currently define what constitutes a "qualified custodian" for digital assets. Without a dedicated custody framework, such definitions are absent.

**EU Alignment and MiCA:** This is the most significant pending development. Bosnia and Herzegovina is an **EU candidate country**. As such, it is expected to gradually align its legislation with the EU acquis communautaire. The European Union's **Markets in Crypto-Assets (MiCA) Regulation** (Regulation (EU) 2023/1114) entered into force in June 2023, with most provisions becoming applicable from December 2024 and June 2025.

MiCA includes comprehensive provisions for **custody services for crypto-assets**, requiring authorization for crypto-asset service providers (CASPs) offering such services, robust organizational and prudential requirements, rules on segregation of client assets, liability for loss of crypto-assets, and more.

**Future Impact:** While MiCA does not directly apply to BiH, it is highly probable that BiH will eventually seek to transpose or align its national legislation with MiCA's standards as part of its EU accession process. This will involve introducing a dedicated licensing regime for CASPs, including specific rules for custody, which will address all the points raised in your question.

**Timeline:** The process of drafting, adopting, and implementing such comprehensive legislation would likely take several years after a formal commitment to MiCA alignment is made.

**Reference for MiCA (for understanding future direction):**

**Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA):** https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114

**Central Bank of Bosnia and Herzegovina (CBBH):** http://www.cbbh.ba/?lang=en (Primarily regulates traditional financial institutions, but may be involved in broader financial stability discussions regarding crypto).

**Ministry of Security of Bosnia and Herzegovina:** http://www.msb.gov.ba/?lang=en (Oversees AML/CFT policy and the FIU).

**Financial Intelligence Unit of BiH (FIU BiH):** A key player in AML/CFT enforcement, likely the first point of contact for VASP registration under current law.

**Securities Commission of the Federation of Bosnia and Herzegovina:** https://www.komvp.gov.ba/

**Securities Commission of Republika Srpska:** https://www.komvp.gov.rs/

Bosnia and Herzegovina now has a state-level AML/CFT framework that expressly covers virtual asset/virtual currency service providers, and Republika Srpska has a dedicated registration/notification regime for virtual currency service providers administered by the RS Securities Commission. While there is still no MiCA-style, fully harmonized crypto-asset licensing law at the state level, RS does operate a specific regulatory and registration regime for crypto businesses, so it is no longer correct to say that BiH operates under ‘no specific licensing regime’ or lacks any mandated authority for crypto businesses.

For virtual asset service providers, AML/CTF registration is no longer best described as an informal or merely ‘implied’ reporting registration. In line with FATF standards and recent reforms (including Australia’s Tranche 2 and comparable EU/Ireland approaches), VASPs are explicitly required to register with the competent AML/CTF authority (e.g., AUSTRAC or the Central Bank) before providing designated services, and must comply with a comprehensive set of ongoing AML/CTF obligations. While this registration is technically for AML/CTF purposes rather than a full prudential or conduct-of-business licence, it is a formal, mandatory regime with significant, licence-like compliance and enforcement requirements—not simply an implied reporting status.

**Custody Providers:** There is no specific license for virtual asset custody providers. General commercial law applies to business registration, but not for the specific service of crypto custody.

Crypto Payment Processors: If processing pure crypto-to-crypto payments without fiat involvement, no specific license is typically required. However, accepting fiat payments or converting between fiat and crypto requires licenses such as PSP under PSD2/MiCA CASP in the EU, or money transmitter/state licenses in the US.

In many jurisdictions, including BA, regulators have increasingly moved away from forcing VASPs to fit into existing payment‑ or e‑money‑institution categories and instead are introducing dedicated VASP licensing regimes, with their own prudential and capital requirements tailored to virtual‑asset risks; as these specific VASP frameworks take hold, traditional payment/e‑money capital requirements no longer generally apply by default to VASPs, though they can still apply in cases where a VASP also performs regulated payment or e‑money services.

AML and KYC obligations remain core and widely applicable elements of financial regulation, but they form one part of a broader, risk‑based compliance program that also includes sanctions screening, transaction monitoring, beneficial ownership transparency, reporting, and other controls; regulators no longer single out AML/KYC as the uniquely ‘most critical’ or universally dominant area across all financial activities.

Implement **Customer Due Diligence (CDD)** measures (Know Your Customer - KYC) for clients, including identity verification, beneficial ownership identification, and understanding the purpose of the business relationship.

**Monitor transactions** for suspicious activities.

Report suspicious transactions to the Financial Intelligence Agency (FIA), Botswana’s financial intelligence unit (FIU).

Maintain required records for the periods specified in applicable laws, regulations, and retention schedules; these periods vary by record type and jurisdiction (often 3–7 years for many business and financial records, around 5 years for many BSA/AML and similar regulatory records, and longer or permanent only for certain categories such as some medical, corporate, or ownership records), rather than a uniform 10‑year default.

Obligated entities in Bosnia & Herzegovina must appoint an AML officer and conduct internal AML/CFT training as part of a broader set of detailed compliance obligations introduced by the 2026 AML Rulebook implementing the Law on the Prevention of Money Laundering and Terrorist Financing.

The FIA/SIPPA is the primary authority for overseeing AML/CTF compliance.

Bosnia and Herzegovina has no single dedicated crypto licensing law, but fragmented regulations apply, and some sources indicate that obtaining a crypto license is necessary for legal operation, which may imply local presence requirements.

To conduct ongoing commercial operations in Bosnia and Herzegovina, a foreign business must register a presence in the country (typically a local company such as a d.o.o. or a registered branch), which entails registration with the competent court and subsequent registrations with tax and other authorities; a branch is not a separate legal entity but can also be used to operate a business with a registered office and local representative, so it is not strictly required to establish a separate Bosnian legal entity in all cases.

The process now primarily involves registering through the unified e-Registration platform (eRegistracija) run by the Indirect Taxation Authority, which has streamlined and digitized the steps including legal entity creation, tax identification, and permits.

**AML Registration/Compliance:** Any entity dealing with virtual assets is expected to implement an internal AML program and be prepared to register as a reporting entity with the FIA/SIPPA if they meet the criteria for "reporting entities" under the AML Law. There isn't an "application" for this, but rather an obligation to comply and report.

The main anti–money laundering (AML) authority in Bosnia & Herzegovina is the Financial Intelligence Department (FID) within the State Investigation and Protection Agency (SIPA), not a separate Financial Intelligence Agency (FIA).

Website: https://www.fipa.gov.ba/ (This official site, now hosted under the fipa.gov.ba domain with language options including English and local languages, contains information on the agency’s mandate and services.)

Banking agencies are primary supervisors of traditional insured depository institutions (such as banks and savings associations) but their regulatory and supervisory activities increasingly extend to certain nonbank financial firms and broader financial stability concerns, so their remit is no longer confined exclusively to traditional institutions.

Banking Agency of the Federation of Bosnia and Herzegovina: https://www.fba.ba/

Banking Agency of Republika Srpska: https://www.abrs.ba/

These agencies would be relevant if a crypto service attempts to integrate with traditional banking services and seeks licenses like those for payment institutions.

**Note:** Finding an official, up-to-date consolidated English translation with direct links to the *latest* official gazette entries online can be challenging for BiH legislation. However, the law is public.

**Zakon o sprečavanju pranja novca i finansiranja terorističkih aktivnosti (Law on Prevention of Money Laundering and Financing of Terrorist Activities)** – *Official Gazette of BiH, No. 13/2024.*

**Crucial Amendment:** The latest significant amendments, particularly those published in **Official Gazette of BiH, No. 13/20** (Law on Amendments to the Law on Prevention of Money Laundering and Financing of Terrorism), explicitly brought Virtual Asset Service Providers (VASPs) under the scope of obliged entities. This amendment defined virtual assets and established obligations for entities dealing with them.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.

Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.

**Identification and Verification of the Customer:**

Identifying the customer (and any person acting on behalf of the customer) and verifying their identity using reliable, independent source documents, data, or information.

For natural persons: full name, address, date and place of birth, unique identification number (e.g., ID card, passport number).

For legal entities: name, legal form, address of registered office, registration number, names of directors/authorized persons, and proof of incorporation.

**Identification of the Beneficial Owner:**

Identifying the beneficial owner(s) and taking reasonable measures to verify their identity.

Understanding the ownership and control structure of the customer (for legal entities or arrangements).

**Purpose and Intended Nature of the Business Relationship:**

Understanding the purpose and intended nature of the business relationship or occasional transaction.

Conducting ongoing monitoring of the business relationship and transactions undertaken throughout the course of the relationship to ensure that transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Keeping documents, data, or information up-to-date.

**Standard CDD:** Applied to regular customer relationships.

**Simplified CDD (SCDD):** Applicable only in cases of demonstrably lower risk, specified by law or regulation.

**Enhanced CDD (EDD):** Required for higher-risk situations, including:

Transactions or business relationships with Politically Exposed Persons (PEPs).

Cross-border correspondent relationships involving virtual assets.

Transactions or relationships involving high-risk geographic areas.

Complex, unusually large transactions, and all unusual patterns of transactions that have no apparent economic or lawful purpose.

Situations where the customer is not physically present for identification purposes.

**Obligation to Report:** If a VASP knows, suspects, or has reasonable grounds to suspect that funds or other assets are derived from criminal activity, or are related to terrorist financing, they must immediately report such suspicions.

**No Tipping-Off:** VASPs and their employees are prohibited from disclosing to the customer or to third parties that a suspicious transaction report is being, or has been, submitted, or that an investigation is being conducted.

Records of identity documents obtained during CDD.

Account files, business correspondence, and transaction records.

Records of analysis performed, supporting the determination of whether a transaction is suspicious.

**Retention Period:** All relevant records must be retained for a period of **five (5) years** after the termination of a business relationship or after the date of an occasional transaction.

**State Investigation and Protection Agency (SIPA) - Financial Intelligence Department (FID)**

While there isn't always a direct sub-page specifically for "Financial Intelligence Department" with a unique URL, its functions are integral to SIPA's overall mission.

**Risk Assessment:** Obligated entities must conduct a comprehensive risk assessment to identify and evaluate ML/FT risks, including those related to crypto assets, specific customers, products, services, and geographic areas. This must inform their internal controls.

**Customer Due Diligence (CDD) and Know Your Customer (KYC):**

**Identification and Verification:** VASPs must identify and verify the identity of their customers (natural and legal persons) and, crucially, their beneficial owners.

**Purpose and Nature of Business:** Understand the purpose and intended nature of the business relationship.

**Ongoing Monitoring:** Continuously monitor customer transactions and activities to ensure consistency with their business profile.

**Enhanced Due Diligence (EDD):** Apply EDD for high-risk situations, such as dealings with Politically Exposed Persons (PEPs), customers from high-risk jurisdictions, or transactions involving anonymity-enhancing technologies.

**Sanctioned Entity Screening:** Obligated entities must screen their customers, beneficial owners, and transaction counterparties against relevant sanctions lists.

**UN Sanctions Lists:** Consolidated list of individuals and entities subject to UN sanctions.

**EU Sanctions Lists:** Consolidated list of persons, groups, and entities subject to EU financial sanctions.

**OFAC Sanctions Lists:** Specially Designated Nationals (SDN) and Blocked Persons List, Sectoral Sanctions Identifications (SSI) List, etc.

**Domestic Lists:** Any specific lists published by BiH authorities (e.g., related to domestic terrorism or specific high-risk individuals, though these often reflect international lists).

**Transaction Monitoring:** Implement systems to monitor transactions for unusual patterns, amounts, or origins that could indicate illicit activity, including attempts to circumvent sanctions.

**Suspicious Transaction Reports (STRs) / Suspicious Activity Reports (SARs):** Report any suspicious transactions (including those involving crypto) or activities to the Financial Intelligence Unit (FIU) of BiH, which is part of the State Investigation and Protection Agency (SIPA).

**Blocking Reports:** Immediately block funds/assets of sanctioned individuals or entities and report the hit to the relevant authorities (FIU, Central Bank of BiH).

**Record-keeping:** Maintain records of customer identification, transactions, and risk assessments for a specified period (typically 5-10 years).

**Internal Controls and Training:** Implement robust internal policies, procedures, and controls, and provide regular training to employees on AML/CFT and sanctions compliance.

**FATF Travel Rule:** While not a sanction per se, the FATF's Recommendation 16 (the "Travel Rule") requires VASPs to obtain, hold, and transmit required originator and beneficiary information for crypto transfers above a certain threshold. Compliance with the Travel Rule helps enhance the transparency necessary for sanctions screening in the crypto space.

Law on Anti-Money Laundering and Counter-Terrorism Financing of Bosnia and Herzegovina (adopted February 2024)

Official Gazette of BiH, No. 104/09, 107/09, 21/17, 102/23 (superseded by new Law on Personal Data Protection, Official Gazette of BiH, March 2025)

While specific online access to the latest consolidated version might require a subscription, the legislation is publicly available through official channels. The BiH FIU (SIPA) often provides summaries or guidance: SIPA - Financial Intelligence Unit (Information usually in Bosnian/Serbian/Croatian).

**Western Balkans Sanctions Program (E.O. 13304, E.O. 14033):** This program targets individuals and entities undermining democratic processes, contributing to instability, engaging in corruption, or obstructing peace agreements in the Western Balkans, including BiH.

**Specific Example:** Milorad Dodik (President of Republika Srpska) and other officials have been sanctioned by OFAC for corruption and undermining BiH's sovereignty and territorial integrity.

**Reference:** OFAC's Western Balkans Designations and OFAC Recent Actions (search for BiH-related press releases).

**Federal Police Administration (FUP)** (Federalna uprava policije) - law enforcement agency of the Federation of BiH.

**Prosecutor's Office of BiH** (Tužilaštvo Bosne i Hercegovine) - leads the criminal prosecution.

Support from international agencies (e.g., Europol, foreign law enforcement).

**Entity Targeted:** An organized international criminal group.

**Violation Type:** International drug trafficking, organized crime, and **money laundering through cryptocurrencies.** The use of encrypted applications (Sky ECC and Anom) and cryptocurrencies was central to their operations for communication and financial transactions.

As this is an ongoing criminal investigation and prosecution, specific final "penalty amounts" (fines, sentences) are pending court decisions.

Reports indicate seizures in the hundreds of kilograms of drugs and significant amounts of cash.

**Date:** Operations and arrests occurred primarily in **April and May 2023**, with follow-up actions and indictments in subsequent months. The investigation had been ongoing prior to these public operations.

**Multiple arrests** were made across BiH (and internationally in coordinated actions).

**Indictments** were subsequently filed by the Prosecutor's Office of BiH against numerous individuals for organized crime, international drug trafficking, and money laundering.

The operations aimed to dismantle a major international drug cartel with strong links to criminal groups in the region and beyond, relying heavily on modern communication and payment methods (crypto).

The case highlights the growing use of cryptocurrencies by organized crime groups in BiH and the region for illicit financial flows, prompting law enforcement to adapt.

**SIPA Official Statement (May 2023):** "U BiH i inostranstvu realizovana međunarodna akcija „Black Diamond“ (In BiH and abroad, the international operation "Black Diamond" was realized)"

**Klix.ba News Report (April 2023):** "Akcija "Crni dijamant": Uhapšene tri osobe u Sarajevu, zaplijenjena droga i oružje (Operation "Black Diamond": Three people arrested in Sarajevo, drugs and weapons seized)"

**Radio Slobodna Evropa (RFE/RL) Report (April 2023):** "Deseci uhapšenih u BiH i inostranstvu u borbi protiv organizovanog kriminala (Dozens arrested in BiH and abroad in the fight against organized crime)" - Mentions use of Sky ECC and financial transactions.