On-shore VASP in Serbia

Law on Digital Assets (Zakon o digitalnoj imovini):

This law defines digital assets, regulates their issuance and trading, and explicitly designates Virtual Asset Service Providers (VASPs) as obliged entities under the general AML/CFT law. It also sets out the licensing requirements for VASPs.

Law on the Prevention of Money Laundering and Terrorist Financing (Zakon o sprečavanju pranja novca i finansiranja terorizma)

Eligible Entities: Only legal entities registered in Serbia can apply for a VASP license. Foreign entities cannot directly provide services without establishing a Serbian legal entity.

The National Bank of Serbia (NBS) supervises banks and financial institutions, but the regulation of virtual assets as means of payment is governed by the Law on Digital Assets, which establishes a separate regulatory framework from the NBS’s traditional supervision of payment systems.

The Securities Commission (SC) supervises digital assets that qualify as financial instruments (e.g., security tokens, certain stablecoins).

A legal entity providing services related to digital assets must obtain a license from the relevant authority. If a VASP intends to provide services for both types of digital assets, it might require licenses from both regulators or a combined license if stipulated.

Minimum Capital: Specified in regulations issued by the NBS or SC (e.g., minimum share capital requirements).

Management & Ownership: Fit and proper test for management and significant shareholders, demonstrating professional competence, reputation, and absence of criminal records.

Internal Controls: Robust internal procedures, risk management systems, IT security, and business continuity plans.

Article 28(2) of the Law on Digital Assets states that a virtual asset service provider must "take all necessary measures for the safekeeping of digital assets of its clients, including the segregation of clients' digital assets from its own digital assets."

While the primary law doesn't explicitly mandate professional indemnity insurance or specific bonding requirements in detail, it empowers the NBS and SC to prescribe more specific conditions through secondary legislation.

Article 16 of the Law gives the regulators the power to prescribe "detailed conditions and method of obtaining and revoking licenses" which can include financial guarantees, insurance, or higher capital requirements depending on the nature and scale of the services.

Serbia has made strides in risk assessment and prosecution under its AML/CFT framework, but further steps are needed in supervision and effective use of financial intelligence, indicating partial rather than strict adherence to all AML/CFT regulations.

Identify and Verify the Identity of the Customer:

For natural persons: Obtain and verify identity based on official documents (e.g., passport, national ID card) including name, surname, address, date and place of birth, and unique identification number.

For legal entities: Obtain and verify identity based on official documents (e.g., excerpt from the company register) including name, registered address, registration number, legal form, details of statutory representatives, and information on the ownership and control structure.

Identify and Verify the Identity of the Customer:

Identify the natural person(s) who ultimately own or control the customer (typically 25% ownership threshold for legal entities) or on whose behalf a transaction is being conducted.

Verify their identity using reliable, independent sources, as per natural person requirements. Serbia also has a Central Register of Beneficial Owners that obliged entities can consult.

Obtain Information on the Purpose and Intended Nature of the Business Relationship: Understand why the customer wants to use the VASP's services.

Perform Ongoing Monitoring of the Business Relationship:

Scrutinize transactions throughout the course of the relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile, including, where necessary, the source of funds.

Regularly update customer information and risk assessments.

Politically Exposed Persons (PEPs): For customers who are PEPs, their family members, or close associates.

High-risk jurisdictions: Customers from countries identified by FATF or other credible sources as having weak AML/CFT regimes.

Whether Adopted: Yes, adopted. Serbia incorporated the FATF Travel Rule principles into its national legislation, primarily through the Law on Digital Assets (Zakon o digitalnoj imovini). This law specifically designates the National Bank of Serbia (NBS) as the supervisory authority for virtual asset service providers (VASPs) concerning AML/CFT compliance.

Threshold Amounts: Serbia generally follows the FATF Recommendation 16 for the Travel Rule. This means:

For cross-border transfers of digital assets: The Travel Rule applies to transactions with a value of EUR 1,000 or more.

For domestic transfers of digital assets: The Travel Rule also applies to transactions with a value of EUR 1,000 or more.

Collect and hold required information: This includes accurate and verifiable information about both the originator (sender) and the beneficiary (receiver) of a digital asset transfer.

Transmit this information: The originator VASP must transmit the required originator and beneficiary information to the beneficiary VASP during or before the transaction.

Screen transactions: Both originator and beneficiary VASPs are expected to screen transactions and involved parties against sanctions lists and for suspicious activity.

Secure Storage: VASPs must establish robust systems for the secure storage of collected data for a period of 5 years, as required by AML/CFT laws.

Penalties for Non-Compliance: Non-compliance with AML/CFT obligations, including the Travel Rule, can result in significant penalties, as outlined in the Law on Digital Assets and the general Law on Prevention of Money Laundering and Financing of Terrorism (Zakon o sprečavanju pranja novca i finansiranja terorizma). These penalties can include:

Revocation of licenses: The National Bank of Serbia has the authority to revoke licenses or permits for VASPs that fail to comply with regulatory requirements.

Individuals: 15% of the capital gain. This is applied under the Law on Personal Income Tax (Zakon o porezu na dohodak građana).

Legal Entities (Businesses): Capital gains from virtual assets are included in the corporate income tax base and are subject to the standard Corporate Income Tax rate of 15% (under the Law on Corporate Income Tax - Zakon o porezu na dobit pravnih lica).

Individuals are required to submit a tax return for capital gains (Form PP-OPO - Prijava poreza na kapitalne dobitke) to the Tax Administration within 30 days from the day of the disposal of the virtual asset. Payment is also due within this period.

Entity Targeted: Various domestic entities and individuals operating crypto asset exchange or custody services without the required licenses. While specific names are not always publicly disclosed with detailed penalties, the NBS has consistently emphasized its licensing requirements and taken steps against non-compliant entities. Violation Type: Operating a virtual asset service provider (VASP) without obtaining the necessary operating license from the NBS, as mandated by the Digital Assets Law. This includes facilitating the exchange of virtual assets for fiat currency or other virtual assets, or providing custody services. Penalty Amount: Administrative fines, cessation of operations. The Digital Assets Law (Article 109, Paragraph 1, Point 1 and 2) prescribes fines ranging from RSD 100,000 to RSD 5,000,000 for legal entities and RSD 10,000 to RSD 500,000 for responsible persons within the legal entity, along with potential protective measures like a ban on conducting business. Outcome: Several entities have either ceased operations, come into compliance, or faced administrative proceedings. The NBS continues to monitor the market for unlicensed activity.

Entity Targeted: Individuals and organized criminal groups involved in large-scale crypto Ponzi schemes, investment fraud, and money laundering using virtual assets. Examples include actions related to the "Infinity Economics" scheme and connections to other global crypto scams like "Finiko.". Violation Type: Fraud, money laundering, unauthorized organization of games of chance (depending on the nature of the scheme), cybercrime. These often fall under general criminal statutes rather than specific "crypto violations.". Penalty Amount: Arrests, pre-trial detention, asset freezes (including virtual assets), criminal charges leading to potential prison sentences if convicted. Specific final conviction penalties (amounts/sentences) are rarely publicly detailed for each individual case by Serbian authorities, especially if investigations are ongoing or multi-jurisdictional. Outcome: Numerous arrests have been made, leading to ongoing investigations, indictments, and trials. Assets, including cryptocurrencies, have been seized. These cases are often complex and lengthy.

Entity Targeted: Individuals and legal entities earning income from digital assets (e.g., capital gains from crypto trading, income from mining, staking, or providing crypto services). Violation Type: Tax evasion related to income or capital gains derived from digital assets. Penalty Amount: Varies significantly based on the amount of unpaid tax, plus interest and potential fines as per tax laws. Outcome: Increased tax compliance, with individuals and entities reporting and paying taxes on their crypto gains. Audits and enforcement actions against non-compliant taxpayers are conducted, though details are private unless criminal charges are filed.

Outcome: Several entities have either ceased operations, come into compliance, or faced administrative proceedings. The NBS continues to monitor the market for unlicensed activity.

Outcome: Numerous arrests have been made, leading to ongoing investigations, indictments, and trials. Assets, including cryptocurrencies, have been seized. These cases are often complex and lengthy.

Outcome: Increased tax compliance, with individuals and entities reporting and paying taxes on their crypto gains. Audits and enforcement actions against non-compliant taxpayers are conducted, though details are private unless criminal charges are filed.