Bosnia and Herzegovina -- Custody Regulations Regulatory Overview

As of early 2024, Bosnia and Herzegovina (BiH) does not have a comprehensive, dedicated regulatory framework specifically addressing cryptocurrency/digital asset custody as a standalone licensed activity with detailed rules on segregation, insurance, cold storage mandates, or qualified custodian definitions.

The regulatory landscape for digital assets in BiH is still in its nascent stages and primarily focuses on Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) obligations for entities dealing with virtual assets.

Here's a breakdown based on the current situation:

1. Custodial License Requirements

• No specific "crypto custody license" exists. Unlike some EU countries with dedicated VASP (Virtual Asset Service Provider) licensing regimes that explicitly cover custody, BiH has not yet introduced such a license.
• AML Registration for VASPs: The primary regulatory requirement for entities providing services related to virtual assets, including those that might engage in custody (e.g., exchanges holding client funds), stems from the AML/CFT framework. BiH has aligned its AML legislation with FATF recommendations, which includes treating Virtual Asset Service Providers (VASPs) as obliged entities.

  • The Law on Prevention of Money Laundering and Terrorist Financing (Zakon o sprečavanju pranja novca i finansiranja terorističkih aktivnosti) mandates that VASPs, which would typically include entities offering custodial services for virtual assets, must register with the relevant authority (likely the Financial Intelligence Unit - FIU BiH) and implement robust AML/CFT procedures, including Know Your Customer (KYC) checks.

  • Regulatory Reference:

    • Law on Prevention of Money Laundering and Terrorist Financing of Bosnia and Herzegovina (Official Gazette of BiH, No. 100/17, 36/18, 55/19, 32/22, 12/23). While an official English translation with a direct government URL for the latest consolidated version can be hard to pinpoint, the law is accessible via official legislative databases. The Ministry of Security often publishes updates or related information.
    • Ministry of Security of BiH (responsible for AML policy): http://www.msb.gov.ba/?lang=en (You may need to navigate to legislative sections to find the specific law).
    • Financial Intelligence Unit of BiH (part of the State Investigation and Protection Agency - SIPA): While SIPA has a general website, direct specific links to FIU crypto guidance are not readily available in English.

2. Segregation of Client Assets Rules

• No specific rules for digital assets. Given the absence of a dedicated custody framework, there are no specific legal mandates requiring the segregation of client digital assets from the custodian's proprietary assets.
• General Fiduciary Principles (by analogy): While not legally binding for crypto, general principles of good corporate governance and financial trust would suggest that responsible custodians should segregate assets. However, this is currently a best practice rather than a regulatory requirement in BiH for digital assets.

3. Insurance/Bonding Requirements

• No specific requirements. There are no explicit regulatory requirements for digital asset custodians in BiH to hold specific insurance or bonding to cover potential losses from hacks, operational failures, or other risks.

4. Cold Storage Mandates

• No specific mandates. BiH law does not currently mandate the use of cold storage (offline storage) for digital assets under custody. Responsible custodians would typically employ a combination of cold and hot storage for security reasons, but this is an operational choice rather than a regulatory obligation.

5. Qualified Custodian Definitions

• No specific definition. BiH law does not currently define what constitutes a "qualified custodian" for digital assets. Without a dedicated custody framework, such definitions are absent.

6. Any Pending Custody Legislation

• EU Alignment and MiCA: This is the most significant pending development. Bosnia and Herzegovina is an EU candidate country. As such, it is expected to gradually align its legislation with the EU acquis communautaire. The European Union's Markets in Crypto-Assets (MiCA) Regulation (Regulation (EU) 2023/1114) entered into force in June 2023, with most provisions becoming applicable from December 2024 and June 2025.
  • MiCA includes comprehensive provisions for custody services for crypto-assets, requiring authorization for crypto-asset service providers (CASPs) offering such services, robust organizational and prudential requirements, rules on segregation of client assets, liability for loss of crypto-assets, and more.
  • Future Impact: While MiCA does not directly apply to BiH, it is highly probable that BiH will eventually seek to transpose or align its national legislation with MiCA's standards as part of its EU accession process. This will involve introducing a dedicated licensing regime for CASPs, including specific rules for custody, which will address all the points raised in your question.
  • Timeline: The process of drafting, adopting, and implementing such comprehensive legislation would likely take several years after a formal commitment to MiCA alignment is made.
  • Reference for MiCA (for understanding future direction):
    • Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114

Relevant Regulatory Bodies in BiH:

• Central Bank of Bosnia and Herzegovina (CBBH): http://www.cbbh.ba/?lang=en (Primarily regulates traditional financial institutions, but may be involved in broader financial stability discussions regarding crypto).
• Ministry of Security of Bosnia and Herzegovina: http://www.msb.gov.ba/?lang=en (Oversees AML/CFT policy and the FIU).
• Financial Intelligence Unit of BiH (FIU BiH): A key player in AML/CFT enforcement, likely the first point of contact for VASP registration under current law.
• Securities Commission of the Federation of Bosnia and Herzegovina: https://www.komvp.gov.ba/
• Securities Commission of Republika Srpska: https://www.komvp.gov.rs/ (These bodies regulate securities markets in the respective entities and might have a role if certain crypto assets are classified as securities, though currently they have not issued specific crypto custody rules).

Conclusion:

Currently, entities offering digital asset custody services in Bosnia and Herzegovina primarily face obligations under the existing AML/CFT framework, requiring registration as VASPs and adherence to KYC/AML procedures. There are no specific regulations for the operational aspects of custody (segregation, insurance, cold storage, qualified custodians). However, due to BiH's EU candidate status, the future regulatory landscape is expected to evolve significantly towards aligning with the EU's MiCA Regulation, which will introduce comprehensive rules for crypto-asset custody.

Disclaimer: This information is for general informational purposes only and does not constitute legal advice. Given the dynamic nature of cryptocurrency regulation, it is essential to consult with legal professionals specializing in BiH law for specific guidance on compliance.