Custodial wallet / SaaS in Croatia

Office for Anti-Money Laundering (Ured za sprječavanje pranja novca – USPN): This is the primary authority responsible for supervising the implementation of AML/CFT measures by obliged entities, including VASPs. They maintain the register of VASPs.

Current Regime (Pre-MiCA): Croatia operates a registration regime for VASPs, primarily for AML/CFT supervision. This means entities providing virtual asset services must register with the USPN and comply with AML obligations. It is not a full financial services license in the traditional sense, but an AML registration.

Future Regime (Post-MiCA): From December 30, 2025, MiCA will introduce a harmonized licensing regime across the EU. Entities providing "crypto-asset services" (as defined by MiCA) will require a license from a competent national authority (likely HANFA in Croatia, in coordination with USPN for AML aspects) in one EU member state, which will then allow them to operate across the entire EU ("passporting"). This will replace the national AML registrations for the services covered by MiCA.

Services related to the safekeeping and administration of virtual assets or instruments enabling control over virtual assets (e.g., private keys).

Generally, a legal entity incorporated in Croatia is required to apply for registration.

A registered office in Croatia is necessary.

There is no specific "custody license" in Croatia dedicated solely to crypto assets.

However, entities providing services related to virtual assets, including the safeguarding/custody of virtual assets, are considered VASPs.

VASPs are required to register with the Ministry of Finance – Financial Intelligence Office (Ured za sprječavanje pranja novca) as part of their AML/CTF obligations.

This registration requires compliance with the Croatian Anti-Money Laundering and Terrorist Financing Act (Zakon o sprječavanju pranja novca i financiranja terorizma), which transposes EU AML Directives (specifically AMLD5).

Implementing robust KYC/CDD (Know Your Customer/Customer Due Diligence) procedures.

Reporting suspicious activities to the Financial Intelligence Office.

Appointing an AML Officer.

Establishing internal AML policies and procedures.

Segregation of Client Assets Rules (Current):

Explicit national rules for the segregation of client crypto assets from the firm's own assets are not specifically detailed within the current AML/CTF framework.

Insurance/Bonding Requirements (Current):

There are no specific national insurance or bonding requirements explicitly mandated for crypto custody providers under the current AML/CTF framework.

Cold Storage Mandates (Current):

There are no explicit national mandates for cold storage of crypto assets. Operational security measures, including the use of cold storage, are generally considered best practices for secure custody but are not yet regulatory requirements.

Qualified Custodian Definitions (Current):

There is no specific definition of a "qualified custodian" for crypto assets within current Croatian national law. The concept of "qualified" custodian is more comprehensively introduced with the advent of MiCA.

Custodial License Requirements (Under MiCA):

Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114 (Note: MiCA has a phased implementation, with most provisions for CASPs applying from 30 December 2025).

AML/KYC Framework: This is the most critical aspect:

AML/CFT Policies and Procedures: Comprehensive internal rules and procedures for customer due diligence (CDD), enhanced due diligence (EDD), ongoing monitoring, record-keeping, and reporting suspicious transactions.

Risk Assessment: A robust risk assessment methodology for identifying and mitigating money laundering and terrorist financing risks associated with the VASP's operations, customers, products, and geographies.