Self-custodial wallet / non-custodial software in Croatia
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Croatia without local incorporation, subject to AML obligations and none licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- None
- Last updated
- 2026-07-13
AML Obligations
- No AML obligations attach — the publisher never holds, controls, or accesses user private keys or funds, and therefore does not fall within the VASP definition under AMLD5/current Croatian AML Act.
- If the software includes any integrated on-ramp/off-ramp, swapping, or other services where the publisher exercises control over virtual assets (e.g., a hosted swap feature that routes through the publisher's infrastructure), AML obligations would apply. This verdict assumes purely non-custodial software without such intermediary services.
Key Restrictions
- The software publisher must not engage in any service that involves safekeeping, administration, or control of private keys or customer virtual assets — doing so would trigger VASP registration with USPN under the current regime.
- From December 30, 2025, MiCA harmonised licensing applies; non-custodial software publishers that do not provide 'crypto-asset services' (as defined by MiCA Art. 3(16)) are generally outside scope.
- No geofencing of Croatian residents is strictly required for a pure non-custodial software publisher, since no regulated service is being provided to them.
Key Risks
- Regulatory creep risk: If the software adds features like integrated swaps, staking-as-a-service, or fiat on-ramps, the publisher could be re-classified as a VASP requiring USPN registration.
- Ambiguity in MiCA: Some national competent authorities may interpret non-custodial wallet software as a 'transfer service' under certain circumstances — though this is uncommon.
- Consumer protection exposure: Under Croatian consumer protection laws (Zakon o zaštiti potrošača), software publishers may still face general liability for defects, misleading representations, or lack of disclosures about risks of self-custody (e.g., loss of seed phrase, no recovery).
- HANFA or HNB may issue guidance or opinions expanding the classification of certain software features as regulated activities.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Services related to the safekeeping and administration of virtual assets or instruments enabling control over virtual assets (e.g., private keys).
This is explicitly defined as a VASP service and requires USPN registration.
Current Regime (Pre-MiCA): Croatia operates a registration regime for VASPs, primarily for AML/CFT supervision. This means entities providing virtual asset services must register with the USPN and comply with AML obligations. It is not a full financial services license in the traditional sense, but an AML registration.
Office for Anti-Money Laundering (Ured za sprječavanje pranja novca – USPN): This is the primary authority responsible for supervising the implementation of AML/CFT measures by obliged entities, including VASPs. They maintain the register of VASPs.
VASPs are required to register with the Ministry of Finance – Financial Intelligence Office (Ured za sprječavanje pranja novca) as part of their AML/CTF obligations.
However, entities providing services related to virtual assets, including the safeguarding/custody of virtual assets, are considered VASPs.
Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32023R1114 (Note: MiCA has a phased implementation, with most provisions for CASPs applying from 30 December 2025).
Future Regime (Post-MiCA): From December 30, 2025, MiCA will introduce a harmonized licensing regime across the EU. Entities providing "crypto-asset services" (as defined by MiCA) will require a license from a competent national authority (likely HANFA in Croatia, in coordination with USPN for AML aspects) in one EU member state, which will then allow them to operate across the entire EU ("passporting"). This will replace the national AML registrations for the services covered by MiCA.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a pure non-custodial wallet software publisher (no control over private keys or customer funds) does not trigger VASP registration or AML obligations under current Croatian law or MiCA, but any integrated intermediary feature (swap, staking, on-ramp) would bring the provider into scope for USPN AML registration and, post-December 2025, MiCA CASP licensing.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?