← Regulations / Serbia / Operating Models / Remote VASP

Remote VASP serving residents in Serbia

Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.

Conditional AI-Generated · Unreviewed

Remote VASP is conditionally permitted in Serbia with a local entity, subject to AML obligations and high licensing burden.

Verdict Details

Permitted
conditional
Local entity required
Yes
Licensing burden
High
Last updated
2026-07-13

AML Obligations

  • Customer due diligence (CDD) mandatory under the Law on Prevention of Money Laundering and Terrorist Financing — identify and verify identity of customers (natural persons: official ID documents; legal entities: company register excerpts).
  • Beneficial owner identification (25% ownership threshold) with consultation of the Central Register of Beneficial Owners.
  • Ongoing monitoring of business relationships, transaction scrutiny, and regular updates of customer information and risk assessments.
  • Enhanced due diligence required for Politically Exposed Persons (PEPs) and customers from high-risk/FATF-listed jurisdictions.
  • Travel Rule obligations apply: collect, transmit, and securely hold originator and beneficiary information for cross-border and domestic transfers of digital assets valued at EUR 1,000 or more.
  • Secure storage of collected data for a minimum of 5 years.
  • Screen transactions and parties against sanctions lists and for suspicious activity.
  • Suspicious transaction reporting (STR) to the relevant authorities under the AML/CFT law.
  • Supervised by the National Bank of Serbia (NBS) and/or the Securities Commission (SC) depending on the digital asset type.

Key Restrictions

  • Only legal entities registered in Serbia may apply for a VASP license — foreign entities cannot provide services directly from abroad without establishing a Serbian legal entity.
  • Cross-border remote service to Serbian residents without a local license constitutes unlicensed activity and is prohibited.
  • Client digital assets must be segregated from the VASP's proprietary assets under Article 28(2) of the Law on Digital Assets.
  • Minimum capital requirements apply as specified by NBS/SC regulations.
  • Management and significant shareholders must pass a fit-and-proper test.

Key Risks

  • Enforcement risk: NBS actively monitors and pursues unlicensed VASP activity; unlicensed foreign operators face administrative fines, license revocation risk for local entities, and potential criminal penalties.
  • AML/CFT compliance gaps: Serbia has been assessed as having only partial adherence to AML/CFT standards, creating ambiguity in supervisory expectations for foreign operators.
  • Tax exposure: Tax evasion enforcement related to crypto income is increasing, with audits and potential criminal charges for non-compliant operators.
  • Reputational risk: High-profile crypto fraud cases (e.g., Infinity Economics, Finiko) have heightened regulatory and public scrutiny on all crypto service providers.

Evidence

This verdict synthesizes the following facts. Each fact links to its primary source(s).

licensing 60% confidence

This law defines digital assets, regulates their issuance and trading, and explicitly designates Virtual Asset Service Providers (VASPs) as obliged entities under the general AML/CFT law. It also sets out the licensing requirements for VASPs.

licensing 60% confidence

Law on the Prevention of Money Laundering and Terrorist Financing (Zakon o sprečavanju pranja novca i finansiranja terorizma)

custody 60% confidence

Eligible Entities: Only legal entities registered in Serbia can apply for a VASP license. Foreign entities cannot directly provide services without establishing a Serbian legal entity.

custody 90% confidence

Serbia has made strides in risk assessment and prosecution under its AML/CFT framework, but further steps are needed in supervision and effective use of financial intelligence, indicating partial rather than strict adherence to all AML/CFT regulations.

custody 100% confidence

Article 28(2) of the Law on Digital Assets states that a virtual asset service provider must "take all necessary measures for the safekeeping of digital assets of its clients, including the segregation of clients' digital assets from its own digital assets."

travel-rule 60% confidence

Whether Adopted: Yes, adopted. Serbia incorporated the FATF Travel Rule principles into its national legislation, primarily through the Law on Digital Assets (Zakon o digitalnoj imovini). This law specifically designates the National Bank of Serbia (NBS) as the supervisory authority for virtual asset service providers (VASPs) concerning AML/CFT compliance.

travel-rule 60% confidence

Threshold Amounts: Serbia generally follows the FATF Recommendation 16 for the Travel Rule. This means:

travel-rule 60% confidence

For cross-border transfers of digital assets: The Travel Rule applies to transactions with a value of EUR 1,000 or more.

travel-rule 60% confidence

For domestic transfers of digital assets: The Travel Rule also applies to transactions with a value of EUR 1,000 or more.

travel-rule 60% confidence

Technical Implementation Requirements: The Serbian legal framework mandates that VASPs must:

travel-rule 60% confidence

Penalties for Non-Compliance: Non-compliance with AML/CFT obligations, including the Travel Rule, can result in significant penalties, as outlined in the Law on Digital Assets and the general Law on Prevention of Money Laundering and Financing of Terrorism (Zakon o sprečavanju pranja novca i finansiranja terorizma). These penalties can include:

enforcement 60% confidence

Entity Targeted: Various domestic entities and individuals operating crypto asset exchange or custody services without the required licenses. While specific names are not always publicly disclosed with detailed penalties, the NBS has consistently emphasized its licensing requirements and taken steps against non-compliant entities. Violation Type: Operating a virtual asset service provider (VASP) without obtaining the necessary operating license from the NBS, as mandated by the Digital Assets Law. This includes facilitating the exchange of virtual assets for fiat currency or other virtual assets, or providing custody services. Penalty Amount: Administrative fines, cessation of operations. The Digital Assets Law (Article 109, Paragraph 1, Point 1 and 2) prescribes fines ranging from RSD 100,000 to RSD 5,000,000 for legal entities and RSD 10,000 to RSD 500,000 for responsible persons within the legal entity, along with potential protective measures like a ban on conducting business. Outcome: Several entities have either ceased operations, come into compliance, or faced administrative proceedings. The NBS continues to monitor the market for unlicensed activity.

enforcement 60% confidence

Entity Targeted: Individuals and organized criminal groups involved in large-scale crypto Ponzi schemes, investment fraud, and money laundering using virtual assets. Examples include actions related to the "Infinity Economics" scheme and connections to other global crypto scams like "Finiko.". Violation Type: Fraud, money laundering, unauthorized organization of games of chance (depending on the nature of the scheme), cybercrime. These often fall under general criminal statutes rather than specific "crypto violations.". Penalty Amount: Arrests, pre-trial detention, asset freezes (including virtual assets), criminal charges leading to potential prison sentences if convicted. Specific final conviction penalties (amounts/sentences) are rarely publicly detailed for each individual case by Serbian authorities, especially if investigations are ongoing or multi-jurisdictional. Outcome: Numerous arrests have been made, leading to ongoing investigations, indictments, and trials. Assets, including cryptocurrencies, have been seized. These cases are often complex and lengthy.

enforcement 70% confidence

Outcome: Several entities have either ceased operations, come into compliance, or faced administrative proceedings. The NBS continues to monitor the market for unlicensed activity.

Verdict Attribution

Source:
AI-Generated · Unreviewed
AI synthesized:
2026-07-13 (deepseek-chat)
Last updated:
2026-07-13
Confidence:
high

This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.

Conditional — a foreign entity may not serve Serbian residents from abroad without a local license; a Serbian-incorporated VASP license is required, with full AML/CFT obligations including Travel Rule compliance, under NBS/SC supervision.

Questions this verdict aims to answer

  • May a non-resident provider serve residents from abroad?
  • Does cross-border service trigger licensing, registration, or AML obligations?
  • What enforcement risk exists for unlicensed remote operators?