Self-custodial wallet / non-custodial software in Bosnia and Herzegovina
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is permitted in Bosnia and Herzegovina with no licensing burden.
Verdict Details
- Permitted
- yes
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No AML obligations attach to a pure software publisher of a non-custodial/self-custodial wallet, because the publisher never holds, controls, or has access to user funds or private keys — the AML framework for VASPs (ba.aml.zakon-o-spreavanju-pranja-novca) applies to entities providing safekeeping/administration of virtual assets or instruments enabling control over virtual assets (ba.aml.safekeeping-andor-administration-of-virtual), which a non-custodial wallet publisher does not do.
- If the software were distributed by an entity that also provides hosted wallet/key management services, that entity would become a VASP and would need to register under the AML/CFT framework and apply CDD/EDD (ba.aml.identification-and-verification-of-the, ba.aml.identification-of-the-beneficial-owner, ba.aml.conducting-ongoing-monitoring-of-the).
Key Restrictions
- No dedicated crypto licensing regime applies to a pure software publisher — BiH has no specific 'crypto custody license' (ba.licensing.no-specific-crypto-custody-license) and the existing VASP AML registration covers only entities that provide safekeeping/administration of virtual assets (ba.aml.safekeeping-andor-administration-of-virtual).
- Republika Srpska has a dedicated registration regime for virtual currency service providers (ba.licensing.no-dedicated-licensing-regime-bih), but a non-custodial wallet publisher does not engage in exchange, custody, or transfer services and thus is not captured.
- Future alignment with EU MiCA (ba.licensing.eu-alignment-and-mica-this, ba.licensing.mica-includes-comprehensive-provisions-for) may bring software wallet publishers within scope — but this is several years out (ba.licensing.timeline-the-process-of-drafting).
Key Risks
- Regulatory ambiguity: BiH law does not clearly define whether publishing non-custodial wallet software constitutes a VASP activity — the current definition focuses on safekeeping/administration of virtual assets (ba.aml.safekeeping-andor-administration-of-virtual), which is arguably not triggered by pure software distribution.
- Enforcement precedent is limited to criminal use of crypto for money laundering (ba.enforcement.entity-targeted-an-organized-international) — no administrative enforcement against software publishers exists.
- If authorities interpret the FATF definition of VASP expansively to include software providers whose code enables control over private keys, AML registration could be required retroactively.
- No specific consumer-protection or disclosure rules exist for non-custodial wallet software in BiH (ba.licensing.no-specific-rules-for-digital), creating legal uncertainty about liability for software defects or security vulnerabilities.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
No specific "crypto custody license" exists. Unlike some EU countries with dedicated VASP (Virtual Asset Service Provider) licensing regimes that explicitly cover custody, BiH has not yet introduced such a license.
AML Registration for VASPs: The primary regulatory requirement for entities providing services related to virtual assets, including those that might engage in custody (e.g., exchanges holding client funds), stems from the AML/CFT framework. BiH has aligned its AML legislation with FATF recommendations, which includes treating Virtual Asset Service Providers (VASPs) as obliged entities.
Bosnia and Herzegovina now has a state-level AML/CFT framework that expressly covers virtual asset/virtual currency service providers, and Republika Srpska has a dedicated registration/notification regime for virtual currency service providers administered by the RS Securities Commission. While there is still no MiCA-style, fully harmonized crypto-asset licensing law at the state level, RS does operate a specific regulatory and registration regime for crypto businesses, so it is no longer correct to say that BiH operates under ‘no specific licensing regime’ or lacks any mandated authority for crypto businesses.
EU Alignment and MiCA: This is the most significant pending development. Bosnia and Herzegovina is an EU candidate country. As such, it is expected to gradually align its legislation with the EU acquis communautaire. The European Union's Markets in Crypto-Assets (MiCA) Regulation (Regulation (EU) 2023/1114) entered into force in June 2023, with most provisions becoming applicable from December 2024 and June 2025.
MiCA includes comprehensive provisions for custody services for crypto-assets, requiring authorization for crypto-asset service providers (CASPs) offering such services, robust organizational and prudential requirements, rules on segregation of client assets, liability for loss of crypto-assets, and more.
Timeline: The process of drafting, adopting, and implementing such comprehensive legislation would likely take several years after a formal commitment to MiCA alignment is made.
Zakon o sprečavanju pranja novca i finansiranja terorističkih aktivnosti (Law on Prevention of Money Laundering and Financing of Terrorist Activities) – Official Gazette of BiH, No. 13/2024.
Safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets.
Conducting ongoing monitoring of the business relationship and transactions undertaken throughout the course of the relationship to ensure that transactions are consistent with the VASP's knowledge of the customer, their business, and risk profile.
Entity Targeted: An organized international criminal group. Violation Type: International drug trafficking, organized crime, and money laundering through cryptocurrencies. The use of encrypted applications (Sky ECC and Anom) and cryptocurrencies was central to their operations for communication and financial transactions.
No specific rules for digital assets. Given the absence of a dedicated custody framework, there are no specific legal mandates requiring the segregation of client digital assets from the custodian's proprietary assets.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Yes — a pure non-custodial/self-custodial wallet software publisher can operate in Bosnia and Herzegovina without a license or AML registration, because the publisher never holds, controls, or accesses user funds/keys, and BiH's VASP AML framework (covering safekeeping/administration of virtual assets) does not reach mere software distribution; however, regulatory definitions are ambiguous and future alignment with EU MiCA may change this.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?