Crypto-funded debit card in Slovenia

Requirement: Registration with FURS under ZPPML-1.

Activities Covered: Providing platforms or services where users can buy/sell virtual currencies with fiat currencies (e.g., EUR, USD) or exchange one virtual currency for another (e.g., BTC for ETH).

If processing fiat payments for crypto transactions (e.g., enabling users to deposit/withdraw EUR to/from an exchange account):

Depending on the exact business model (e.g., holding client funds, initiating payments), such entities might fall under the scope of the Payment Services Act (Zakon o plačilnih storitvah in sistemih – ZPlaS-1), which transposes PSD2.

This could require a Payment Institution (PI) license or Electronic Money Institution (EMI) license from the Bank of Slovenia (Banka Slovenije). This is separate from VASP registration and is generally a more robust licensing process.

Current Regime (ZPPML-1): Registration. Slovenia currently requires VASPs to register with FURS before they can operate. This is a registration for AML/CTF purposes, focusing on preventing illicit financial activities, rather than a full operational license that would typically cover aspects like prudential requirements, consumer protection, or market integrity comprehensively.

Future Regime (MiCA): Licensing. The EU's Markets in Crypto-Assets (MiCA) Regulation (Regulation (EU) 2023/1114) will introduce a comprehensive, harmonized licensing framework for crypto-asset service providers (CASPs) across all EU member states. MiCA will come into full effect for most crypto-assets by December 30, 2024 (stablecoin rules apply from June 30, 2024). Once MiCA is fully implemented, it will largely supersede the national AML-driven registration requirements for the activities it covers, introducing a full licensing regime with passporting rights across the EU.

VASP Registration: Entities providing services of safeguarding private cryptographic keys on behalf of clients, or holding, storing, and transferring virtual currencies, are classified as "virtual asset service providers" (VASPs) under ZPPDFT-2.

Obligation to Register: VASPs must register with the Office for Money Laundering Prevention (UPPD). This is a registration requirement, not a full prudential licensing regime akin to banks or investment firms, but it entails strict AML/CFT compliance obligations.

Requirements for Registration:

Implementation of robust internal AML/CFT policies, procedures, and controls.

Risk assessment frameworks (customer, product, geographical risks).

Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) measures.

Record-keeping of transactions and customer data.

Reporting of suspicious transactions to UPPD.

Appointment of an AML officer.

Training for relevant employees.

Fit and proper assessment for management and beneficial owners (though not as extensive as for licensed financial institutions).

Declaration of Accounts Held Abroad: This is a crucial requirement. Individuals must report to FURS any foreign bank accounts, payment accounts, or financial accounts (including accounts on foreign cryptocurrency exchanges) if the balance exceeds a certain threshold (often EUR 10,000 equivalent at any point during the year). This is done via the form "Poročilo o stanju sredstev na računih v tujini" (Report on the status of funds in accounts abroad).

Issuing warnings and guidance: Educating the public about risks and informing businesses about compliance requirements, especially in anticipation of EU-wide regulations like MiCA (Markets in Crypto-Assets).

Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) supervision: The Office for Money Laundering Prevention (UPPD - Urad RS za preprečevanje pranja denarja) is the primary authority here. While they conduct supervision and impose measures, details of individual enforcement actions against specific companies (with fine amounts and outcomes) are not usually made public in the same way as in some other jurisdictions.