Custodial wallet / SaaS in Slovenia

Current Regime (ZPPML-1): Registration. Slovenia currently requires VASPs to register with FURS before they can operate. This is a registration for AML/CTF purposes, focusing on preventing illicit financial activities, rather than a full operational license that would typically cover aspects like prudential requirements, consumer protection, or market integrity comprehensively.

Requirement: Registration with FURS under ZPPML-1.

VASP Registration: Entities providing services of safeguarding private cryptographic keys on behalf of clients, or holding, storing, and transferring virtual currencies, are classified as "virtual asset service providers" (VASPs) under ZPPDFT-2.

Obligation to Register: VASPs must register with the Office for Money Laundering Prevention (UPPD). This is a registration requirement, not a full prudential licensing regime akin to banks or investment firms, but it entails strict AML/CFT compliance obligations.

Implementation of robust internal AML/CFT policies, procedures, and controls.

Risk assessment frameworks (customer, product, geographical risks).

Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) measures.

Record-keeping of transactions and customer data.

Reporting of suspicious transactions to UPPD.

Appointment of an AML officer.

Training for relevant employees.

Fit and proper assessment for management and beneficial owners (though not as extensive as for licensed financial institutions).

Activities Covered: Services that hold or administer virtual currencies on behalf of third parties, or provide safekeeping services for private cryptographic keys on behalf of clients to hold, store, and transfer virtual currencies.

If processing fiat payments for crypto transactions (e.g., enabling users to deposit/withdraw EUR to/from an exchange account):

This could require a Payment Institution (PI) license or Electronic Money Institution (EMI) license from the Bank of Slovenia (Banka Slovenije). This is separate from VASP registration and is generally a more robust licensing process.

Future Regime (MiCA): Licensing. The EU's Markets in Crypto-Assets (MiCA) Regulation (Regulation (EU) 2023/1114) will introduce a comprehensive, harmonized licensing framework for crypto-asset service providers (CASPs) across all EU member states. MiCA will come into full effect for most crypto-assets by December 30, 2024 (stablecoin rules apply from June 30, 2024). Once MiCA is fully implemented, it will largely supersede the national AML-driven registration requirements for the activities it covers, introducing a full licensing regime with passporting rights across the EU.

Authorization: CASPs offering custody services will require authorization from a national competent authority (e.g., ATVP in Slovenia). This is a much more stringent licensing process than the current AML registration.

Legal form: CASPs must be legal persons established in the EU.

Initial capital: Requirement for minimum initial capital or professional indemnity insurance (see below).

Currently (Pre-MiCA): ZPPDFT-2 primarily focuses on AML/CFT compliance, ensuring the identification of asset ownership and preventing illicit finance. It does not explicitly mandate insolvency-remote segregation of client crypto assets from the custodian's own assets in the same way traditional financial regulations (e.g., MiFID II for investment firms, CRD for banks) do.

Currently (Pre-MiCA): There are no specific statutory requirements under ZPPDFT-2 for VASPs (including custodians) to hold professional indemnity insurance or maintain a minimum level of own funds for asset protection, unlike for traditional financial institutions.

Currently (Pre-MiCA): Slovenian law does not explicitly mandate the use of cold storage for crypto assets. However, VASPs are expected to implement robust technical and organizational security measures to protect client assets from loss, theft, or unauthorized access. Good practice dictates that a significant portion of client assets should be held in cold storage. Regulators would assess the overall security framework rather than dictating specific technological solutions.

Currently (Pre-MiCA): Slovenian law (ZPPDFT-2) defines the service of safeguarding private cryptographic keys and the provider as a VASP. There isn't a separate legal definition of a "qualified custodian" that implies a higher prudential standard beyond AML compliance for pure crypto firms. Any VASP registered with UPPD and adhering to AML/CFT rules is currently considered a legitimate provider.

AML/CFT Supervisory Activities (General):

Entity Targeted: Virtual Asset Service Providers (VASPs) operating in Slovenia. Violation Type: Non-compliance with AML/CFT obligations (e.g., inadequate customer due diligence, suspicious transaction reporting failures, internal control deficiencies). Penalty Amount: Details are not typically made public for individual administrative measures, but can range from warnings to fines.