Centralized exchange in Bosnia and Herzegovina

No specific "crypto custody license" exists. Unlike some EU countries with dedicated VASP (Virtual Asset Service Provider) licensing regimes that explicitly cover custody, BiH has not yet introduced such a license.

AML Registration for VASPs: The primary regulatory requirement for entities providing services related to virtual assets, including those that might engage in custody (e.g., exchanges holding client funds), stems from the AML/CFT framework. BiH has aligned its AML legislation with FATF recommendations, which includes treating Virtual Asset Service Providers (VASPs) as obliged entities.

The Law on Prevention of Money Laundering and Terrorist Financing (Zakon o sprečavanju pranja novca i finansiranja terorističkih aktivnosti) mandates that VASPs, which would typically include entities offering custodial services for virtual assets, must register with the relevant authority (likely the Financial Intelligence Unit - FIU BiH) and implement robust AML/CFT procedures, including Know Your Customer (KYC) checks.

Law on Prevention of Money Laundering and Terrorist Financing of Bosnia and Herzegovina (Official Gazette of BiH, No. 100/17, 36/18, 55/19, 32/22, 12/23, 12/24). While an official English translation with a direct government URL for the latest consolidated version can be hard to pinpoint, the law is accessible via official legislative databases. The Ministry of Security often publishes updates or related information.

Ministry of Security of BiH (responsible for AML policy): http://www.msb.gov.ba/?lang=en (You may need to navigate to legislative sections to find the specific law).

Under the newly adopted AML/CFT Law in Bosnia & Herzegovina, VASP registration and oversight is subject to a three-way regulatory split depending on the entity's incorporation location (FBiH, Republika Srpska, or Brčko District), with the FIU retaining a coordinating AML/CFT role but no longer being the sole first point of contact for VASP registration.

No specific rules for digital assets. Given the absence of a dedicated custody framework, there are no specific legal mandates requiring the segregation of client digital assets from the custodian's proprietary assets.

General Fiduciary Principles (by analogy): While not legally binding for crypto, general principles of good corporate governance and financial trust would suggest that responsible custodians should segregate assets. However, this is currently a best practice rather than a regulatory requirement in BiH for digital assets.

No specific requirements. There are no explicit regulatory requirements for digital asset custodians in BiH to hold specific insurance or bonding to cover potential losses from hacks, operational failures, or other risks.

No specific mandates. BiH law does not currently mandate the use of cold storage (offline storage) for digital assets under custody. Responsible custodians would typically employ a combination of cold and hot storage for security reasons, but this is an operational choice rather than a regulatory obligation.

No specific definition. BiH law does not currently define what constitutes a "qualified custodian" for digital assets. Without a dedicated custody framework, such definitions are absent.

EU Alignment and MiCA: This is the most significant pending development. Bosnia and Herzegovina is an EU candidate country. As such, it is expected to gradually align its legislation with the EU acquis communautaire. The European Union's Markets in Crypto-Assets (MiCA) Regulation (Regulation (EU) 2023/1114) entered into force in June 2023, with most provisions becoming applicable from December 2024 and June 2025.

MiCA includes comprehensive provisions for custody services for crypto-assets, requiring authorization for crypto-asset service providers (CASPs) offering such services, robust organizational and prudential requirements, rules on segregation of client assets, liability for loss of crypto-assets, and more.

Future Impact: While MiCA does not directly apply to BiH, it is highly probable that BiH will eventually seek to transpose or align its national legislation with MiCA's standards as part of its EU accession process. This will involve introducing a dedicated licensing regime for CASPs, including specific rules for custody, which will address all the points raised in your question.

Timeline: The process of drafting, adopting, and implementing such comprehensive legislation would likely take several years after a formal commitment to MiCA alignment is made.

Reference for MiCA (for understanding future direction):

Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114

Bosnia and Herzegovina now has a state-level AML/CFT framework that expressly covers virtual asset/virtual currency service providers, and Republika Srpska has a dedicated registration/notification regime for virtual currency service providers administered by the RS Securities Commission. While there is still no MiCA-style, fully harmonized crypto-asset licensing law at the state level, RS does operate a specific regulatory and registration regime for crypto businesses, so it is no longer correct to say that BiH operates under ‘no specific licensing regime’ or lacks any mandated authority for crypto businesses.

For virtual asset service providers, AML/CTF registration is no longer best described as an informal or merely ‘implied’ reporting registration. In line with FATF standards and recent reforms (including Australia’s Tranche 2 and comparable EU/Ireland approaches), VASPs are explicitly required to register with the competent AML/CTF authority (e.g., AUSTRAC or the Central Bank) before providing designated services, and must comply with a comprehensive set of ongoing AML/CTF obligations. While this registration is technically for AML/CTF purposes rather than a full prudential or conduct-of-business licence, it is a formal, mandatory regime with significant, licence-like compliance and enforcement requirements—not simply an implied reporting status.

Cryptocurrency exchanges in Bosnia and Herzegovina (BiH), particularly in Republika Srpska, require registration as a VASP with the Securities Commission and obtaining a specific crypto license or authorization, especially for exchange, custody, or related services. Pure crypto-to-crypto exchanges may still face ambiguity, but fiat-related activities trigger stricter oversight under AML laws and banking agencies.

Zakon o sprečavanju pranja novca i finansiranja terorističkih aktivnosti (Law on Prevention of Money Laundering and Financing of Terrorist Activities) – Official Gazette of BiH, No. 13/2024.

Crucial Amendment: The latest significant amendments, particularly those published in Official Gazette of BiH, No. 13/20 (Law on Amendments to the Law on Prevention of Money Laundering and Financing of Terrorism), explicitly brought Virtual Asset Service Providers (VASPs) under the scope of obliged entities. This amendment defined virtual assets and established obligations for entities dealing with them.

Exchange between virtual assets and fiat currencies.

Exchange between one or more forms of virtual assets.

Transfer of virtual assets.

Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.

Participation in and provision of financial services related to an issuer's offer and/or sale of a virtual asset.

Identification and Verification of the Customer:

Identifying the customer (and any person acting on behalf of the customer) and verifying their identity using reliable, independent source documents, data, or information.

For natural persons: full name, address, date and place of birth, unique identification number (e.g., ID card, passport number).

For legal entities: name, legal form, address of registered office, registration number, names of directors/authorized persons, and proof of incorporation.

Identification of the Beneficial Owner:

Identifying the beneficial owner(s) and taking reasonable measures to verify their identity.

Understanding the ownership and control structure of the customer (for legal entities or arrangements).

Purpose and Intended Nature of the Business Relationship:

Understanding the purpose and intended nature of the business relationship or occasional transaction.

Conducting ongoing monitoring of the business relationship and transactions undertaken throughout the course of the relationship to ensure that transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Keeping documents, data, or information up-to-date.

Standard CDD: Applied to regular customer relationships.

Simplified CDD (SCDD): Applicable only in cases of demonstrably lower risk, specified by law or regulation.

Enhanced CDD (EDD) is required only for specific high-risk activities in Bosnia & Herzegovina, not universally for all higher‑risk situations.

Transactions or business relationships with Politically Exposed Persons (PEPs).

Cross-border correspondent relationships involving virtual assets.

Transactions or relationships involving high-risk geographic areas.

Complex, unusually large transactions, and all unusual patterns of transactions that have no apparent economic or lawful purpose.

State Investigation and Protection Agency (SIPA) (Državna agencija za istrage i zaštitu) - primary law enforcement agency.

Entity Targeted: An organized international criminal group. Violation Type: International drug trafficking, organized crime, and money laundering through cryptocurrencies. The use of encrypted applications (Sky ECC and Anom) and cryptocurrencies was central to their operations for communication and financial transactions.

Reports indicate seizures in the hundreds of kilograms of drugs and significant amounts of cash.

Date: Operations and arrests occurred primarily in April and May 2023, with follow-up actions and indictments in subsequent months. The investigation had been ongoing prior to these public operations.

Multiple arrests were made across BiH (and internationally in coordinated actions).

Indictments were subsequently filed by the Prosecutor's Office of BiH against numerous individuals for organized crime, international drug trafficking, and money laundering.

The operations aimed to dismantle a major international drug cartel with strong links to criminal groups in the region and beyond, relying heavily on modern communication and payment methods (crypto).

The case highlights the growing use of cryptocurrencies by organized crime groups in BiH and the region for illicit financial flows, prompting law enforcement to adapt.

SIPA Official Statement (May 2023): "U BiH i inostranstvu realizovana međunarodna akcija „Black Diamond“ (In BiH and abroad, the international operation "Black Diamond" was realized)"

Klix.ba News Report (April 2023): "Akcija "Crni dijamant": Uhapšene tri osobe u Sarajevu, zaplijenjena droga i oružje (Operation "Black Diamond": Three people arrested in Sarajevo, drugs and weapons seized)"

Radio Slobodna Evropa (RFE/RL) Report (April 2023): "Deseci uhapšenih u BiH i inostranstvu u borbi protiv organizovanog kriminala (Dozens arrested in BiH and abroad in the fight against organized crime)" - Mentions use of Sky ECC and financial transactions.