List of Indicators for Recognising Grounds for Suspicion of Financing the Proliferation of Weapons of Mass Destruction for Obligors within the Jurisdiction of the National Bank of Serbia

1 Pursuant to Article 68, paragraph 1 and Article 109 of the Law on the Prevention of Money Laundering and the Financing of Terrorism (RS Official Gazette, Nos 113/2017, 91/2019, 153/2020, 92/2023, 94/2024 and 19/2025), Article 18, paragraph 1, item 3) of the Law on the National Bank of Serbia (RS Official Gazette, Nos 72/2003, 55/2004, 85/2005 – other law, 44/2010, 76/2012, 106/2012, 14/2015, 40/2015 ‒ CC decision, 44/2018 and 19/2025), the Governor of the National Bank of Serbia adopts the following LIST OF INDICATORS FOR RECOGNISING GROUNDS FOR SUSPICION OF FINANCING THE PROLIFERATION OF WEAPONS OF MASS DESTRUCTION FOR OBLIGORS SUPERVISED BY THE NATIONAL BANK OF SERBIA

1. This List of Indicators lays down the indicators for identifying persons and transactions where there are grounds to suspect that the proliferation of weapons of mass destruction is being financed by obligors supervised by the National Bank of Serbia who are obliged to apply the Law on the Prevention of Money Laundering and the Financing of Terrorism (hereinafter: Law), and also to include these indicators in their lists of indicators in accordance with Article 69, paragraph 1 of the Law. The obligor supervised by the National Bank of Serbia (hereinafter: obligor) is a bank, financial lessor, insurance undertaking licensed to carry out life insurance, insurance brokerage undertakings carrying out life insurance brokerage activities, an insurance agency undertaking and an insurance agent licensed to carry out life insurance activities – except an insurance agency undertaking and insurance agent for whose work the insurance undertaking is accountable in accordance with law (hereinafter: life insurance obligor), a voluntary pension fund management company, an electronic money institution, a payment institution, the public postal operator with its head office in the Republic of Serbia established in accordance with the law regulating postal services, which provides payment services in accordance with the law regulating the provision of payment services, digital asset service provider in the part pertaining to virtual currencies (hereinafter: virtual currency service provider), an authorised exchange dealer and a business entity performing exchange operations pursuant to a separate law governing its activity. The General Part of this List of Indicators shall be applied by all obligors, while the Special Part shall be applied by the obligors to which that part pertains, bearing in mind the specificities of their operations, reflected in the specificities of clients whom they serve, the manner in which the business relationship is established and maintained, the services and products offered by foreigners, as well as the geographic areas which apply only to those obligors. GENERAL PART
2. When establishing whether there are grounds for suspicion of financing the proliferation of weapons of mass destruction (hereinafter: WMD), an obligor shall apply at least the following indicators:

1. data about the client, natural and/or legal persons associated with the client or their address are similar to data about an entity included in the list of designated persons of the UN Security

2 Council or other international organisations of which Serbia is a member; 2) the client provides vague/incomplete information required for CDD actions and measures, and refuses to provide additional information to the obligor when asked, especially information needed to determine the end user of the goods or services; 3) the client − natural person is associated with a country that can be linked to the production and proliferation of WMD (e.g. the client has dual citizenship), and/or is engaged in activities associated with complex equipment for which he lacks the technical background (professional experience); 4) an entrepreneur or a small business entity, a broker or an agent is engaged in business activities that are not aligned with its activities; 5) a participant in a transaction is a natural or legal person from a foreign country that can be linked to the production and proliferation of WMD; 6) a participant in a transaction is a natural or legal person from a foreign country for which there is publicly available information that it participates in the diversion of items, materials, equipment, goods and technology associated with the introduced trade sanctions. SPECIAL PART 3. In addition to indicators from Section 2 of this List of Indicators, a bank shall also apply the following indicators:

1. the client’s activities are not in line with its business profile, especially if those activities are related to goods or services that can be linked to WMD, as well as if, based on the information obtained, it is suspected that the activities of the end user of those goods or services do not match its business profile;
2. the client is engaged in the supply, shipment and/or purchase and sale of dual-use goods within the meaning of the law regulating the export and import of dual-use goods (hereinafter: dual￾use goods), which can be used for the production and proliferation of WMD, and in particular if the origin of the goods can be associated with foreign countries that can be linked to the production and proliferation of WMD;
3. the client is engaged in activities associated with the military industry or research in that area, and is associated in its work with foreign countries that can be linked to the production, proliferation and/or financing the proliferation of WMD;
4. before establishing a business relationship, or while such establishment is in progress, the client requests or inquires about more complex financial payment instruments, such as letters of credit (with deferred payment, transferable, etc.), which is not in accordance with the purpose of the business relationship and/or the client’s assumed activity;
5. the client uses complex forms of payment and concealment of cash flows – complex payment instruments are used, such as letters of credit where the delivery and payment schemes involve shell companies usually registered in offshore destinations that act as intermediaries;
6. transactions related to payment/collection of dual-use goods if there is suspicion about the legality of the transactions related to those goods;
7. transactions carried out with payees from foreign countries where goods suspected of being dual-use or intended for the production or proliferation of WMD cannot be produced, exported

3 or imported; 8) based on the documents submitted as the basis for the transaction, it can be determined that the address of a legal person engaged in freight forwarding activities is listed as the final destination for the shipment of goods; 9) based on the documents submitted as the basis for the execution of the transaction, it can be determined that the purchase order for the goods is issued by a legal or natural person from a foreign country other than the country of the stated end user of those goods; 10) the transaction involves the shipment of goods incompatible with the level of technological development of the foreign country to which they are shipped (e.g. semiconductor production equipment is shipped to a country that does not have a developed electronics industry); 11) circuitous route of financial transactions that, for unknown reasons, are carried out through multiple intermediaries in the transfer of funds, or the transfer of funds involves legal or natural persons who are not direct participants in the transaction, as well as circuitous route of the shipment of goods (if there are available data) which includes multiple destinations without an evident commercial or business purpose; 12) the transaction involves natural or legal persons (especially companies engaged in trade) located in foreign countries that do not have strict export control regulations and/or adequate control over the application of those regulations; 13) the transaction involves the shipment of goods inconsistent with normal geographic trade patterns (the foreign country does not normally export/import that kind of goods); 14) the transaction involves financial institutions known to have deficiencies in their supervision systems in the area of preventing the financing of WMD proliferation and/or whose head office is located in a foreign country that does not have strict export control regulations and/or adequate control over the application of those regulations; 15) based on the documents obtained in connection with the initiated transaction, it can be determined that the invoiced value of the goods is obviously underestimated vis-a-vis the shipping cost; 16) the information contained in the attached trade documents does not match the data about the payer and/or payee, e.g. name and surname of the natural person, name of the legal entity, address of the payer or payee, etc.; 17) electronic transfers show an unusual pattern or have no apparent purpose; 18) instructions are given for electronic transfers by the payer, or to the payee, that are not specified on the original letter of credit or other documents underlying the payment; 19) based on the documents submitted in relation to the transaction it can be concluded that there was an exchange of industrial items for cash or precious metals (e.g. gold); 20) the client or its business partner is suspected of providing money remittance services even though it does not have a permit issued by the competent authority to provide such services; 21) transactions between legal persons that, according to the form of payment, correspond to settlement payments (through ledger arrangements) that obviate the need for international financial transactions; 22) there is a reasonable suspicion that the documents submitted as a basis for the transaction are fake or fraudulent (e.g. regarding shipping, customs or payment);

4 23) the client uses a personal account to make payments for the purchase of industrial items; 24) the transaction involves possible shell companies (companies that do not carry out business activities and do not have a high degree of capitalisation); 25) the transaction involves legal persons whose activities indicate high risk in accordance with the guidelines for the application of the provisions of the Law to obligors under the jurisdiction of the National Bank of Serbia which are connected by ownership or management structure, i.e. their owners or representatives are the same persons; 26) the client and the persons participating in the transaction are connected (e.g. they share a common address of permanent or temporary residence of a natural person, or registered head office of a legal person, IP address or telephone number, or their activities are coordinated). 4. In addition to indicators from Section 2 of this List, a financial lessor shall also apply the following indicators:

1. the client’s activities are not in line with its business profile, especially if those activities are related to goods or services that can be linked to WMD, as well as if, based on the information obtained, it is suspected that the activities of the end user of those goods or services do not match its business profile;
2. the client is engaged in the supply, shipment and/or purchase and sale of dual-use goods that can be used for the production and proliferation of WMD, especially if the origin of those goods can be associated with foreign countries that can be linked to the production and proliferation of WMD;
3. the client is engaged in activities associated with the military industry or research in that area, and is associated in its work with foreign countries that can be linked to the production, proliferation and/or financing the proliferation of WMD;
4. the client – lessee submits a request for financing a lease asset whose invoiced value is obviously under-valued vis-à-vis the shipping cost;
5. the client – lessee submits a request for financing a lease asset for which there is a reasonable assumption that the submitted documentation is fake or fraudulent;
6. in its request for financing the lease asset, the client – lessee submits to the lessor an offer in which the asset may be linked to the production and proliferation of WMD;
7. the client – the lessee has chosen a supplier of the lease asset from a foreign country that can be linked to the production, proliferation and/or financing of the proliferation of WMD, a foreign country that does not have strict export control regulations and/or adequate control over the application of those regulations;
8. the lessee or supplier of the lease asset can be assumed to be a shell company (companies that do not carry out business activities and do not have a high degree of capitalisation);
9. the lessee or supplier of the lease asset are legal persons that are connected by ownership or management structure, i.e. their owners or representatives are the same persons;
10. the lessee or supplier of the lease asset are connected (e.g. they share a common address of permanent or temporary residence of a natural person, or registered head office of a legal person, IP address or telephone number, or their activities are coordinated).

5. In addition to indicators from Section 2 of this List, a life insurance obligor shall also apply the following indicators:

5

1. the client’s activities are not aligned with its business profile, especially if those activities are associated with goods or services that can be linked to WMD, as well as if based on the obtained information it is suspected that the activities of the end user of those goods or services do not match its business profile;
2. the client is engaged in the supply, shipment and/or purchase and sale of dual-use goods that can be used for the production and proliferation of WMD, especially if the origin of those goods can be associated with foreign countries that can be linked to the production and proliferation of WMD;
3. the client is engaged in activities associated with the military industry or research in that area, and is associated in its work with foreign countries that can be linked to the production, proliferation and/or financing the proliferation of WMD;
4. it can be assumed that the policyholder is a shell company (a company that does not carry out business activities and does not have a high degree of capitalisation);
5. the media have linked the policyholder, the insured and/or insurance beneficiary to the production and proliferation of WMD;
6. the policyholder, the insured and/or insurance beneficiary are connected (e.g. they share a common address of permanent or temporary residence of a natural person, or registered head office of a legal person, IP address or telephone number, or their activities are coordinated).

6. In addition to indicators from Section 2 of this List, a voluntary pension fund management company shall also apply the following indicators:

1. the client’s activities are not aligned with its business profile, especially if those activities are associated with goods or services that can be linked to WMD, as well as if based on the obtained information it is suspected that the activities of the end user of those goods or services do not match its business profile;
2. the client is engaged in the supply, shipment and/or purchase and sale of dual-use goods that can be used for the production and proliferation of WMD, especially if the origin of those goods can be associated with foreign countries that can be linked to the production and proliferation of WMD;
3. the client is engaged in activities associated with the military industry or research in that area, and is associated in its work with foreign countries that can be linked to the production, proliferation and/or financing the proliferation of WMD;
4. contribution payments are made by entities that could be a shell company (a company that does not carry out business activities and does not have a high degree of capitalisation);
5. a client who is not a member of the fund – a resident or foreign natural person – pays contributions to the fund, in his name or in the name of other fund members, by transferring money from financial institutions that are known to have deficiencies in their supervision systems in the area of preventing the financing of WMD proliferation and/or have a head office in a foreign country that does not have strict export control regulations and/or adequate control over the application of those regulations;
6. investing contributions for the benefit of fund members who are connected (e.g. they share a common address of permanent or temporary residence of a natural person, or registered head office of a legal entity, IP address or telephone number, or their activities are coordinated).

6 7. In addition to indicators from Section 2 of this List, payment institutions, electronic money institutions and the public postal operator shall also apply the following indicators:

1. the client’s activities are not aligned with its business profile, especially if those activities are associated with goods or services that can be linked to WMD, as well as if based on the obtained information it is suspected that the activities of the end user of those goods or services do not match its business profile;
2. the client is engaged in the supply, shipment and/or purchase and sale of dual-use goods that can be used for the production and proliferation of WMD, especially if the origin of those goods can be associated with foreign countries that can be linked to the production and proliferation of WMD;
3. the client is engaged in activities associated with the military industry or research in that area, and is associated in its work with foreign countries that can be linked to the production, proliferation and/or financing the proliferation of WMD;
4. transactions are carried out with payees from foreign countries where goods suspected of being dual-use or intended for the production or proliferation of WMD cannot be produced, exported or imported;
5. the transaction involves natural or legal persons (especially companies engaged in trade) located in foreign countries that do not have strict export control regulations and/or adequate control over the application of those regulations;
6. the transaction involves financial institutions that are known to have deficiencies in their supervision systems in the area of preventing money laundering and terrorist financing and/or that have a head office in a foreign country that does not have strict export control regulations and/or adequate control over the application of those regulations;
7. electronic transfers show an unusual pattern or have no apparent purpose;
8. instructions are given for electronic transfers by the payer, or to the payee, that are not specified on the documents underlying the payment;
9. the client or its business partner is suspected of providing money remittance services even though it does not have a permit issued by the competent authority to provide such services;
10. the transaction involves possible shell companies (companies that do not carry out business activities and do not have a high degree of capitalisation);
11. the client and the persons participating in the transaction are connected (e.g. they share a common address of permanent or temporary residence of a natural person, or registered head office of a legal person, IP address or telephone number, or their activities are coordinated);
12. the client is affiliated with a university or research institution involved in trade in dual￾use goods or goods subject to export controls;
13. the client is a person or entity residing in a country of concern in terms of the production and proliferation of WMD (e.g. the DPRK or Iran);
14. the documents accompanying the transaction are fake or fraudulent.

8. In addition to indicators from Section 2 of this List, virtual currency service providers shall also apply the following indicators:

1. rapid movement of virtual currencies between different virtual currency service providers, in different jurisdictions, within a short period of time, without a clear reason, especially if those jurisdictions can be linked to WMD or are on the sanctions list of the UN, EU or other relevant

7 bodies; 2) the use of virtual currencies characterised by anonymity (e.g. monero and dash) or mixers and tumblers services that can contribute to concealing transaction details, in combination with other indicators such as links to designated persons or countries that can be linked to WMD; 3) sending virtual currencies to a few selected wallets on unregulated, organised digital asset trading platforms; 4) digital asset transactions involving parties, entities or addresses linked to the development, production or acquisition of materials, technologies or equipment that could be used for the proliferation of WMD; 5) transferring virtual currencies to or from addresses suspected of being associated with illegal activities on dark web; 6) transferring virtual currencies to or from addresses known to be involved in dual-use goods trade; 7) attempting to avoid regulatory reporting or monitoring by splitting large virtual currency transactions into smaller amounts that are below the reporting thresholds, where there are indications that these funds are being used to finance activities related to the acquisition of equipment, materials or technologies that could be used for the proliferation of WMD; 8) transferring virtual currencies to an organised digital asset trading platform followed by the conversion of virtual currencies into fiat, then withdrawing the funds from that platform in a relatively short period of time from jurisdictions or addresses suspected of being linked to WMD. 9. In addition to indicators from Section 2 of this List, an authorised exchange dealer and a business entity performing exchange operations pursuant to a separate law governing its activity shall also apply the following indicators:

1. the same party – a natural person – appears multiple times within transit/duty-free zones/border areas, without a valid reason for that (e.g. work engagement in the aforementioned zones).

10. Obligors are required to establish, through internal acts, the obligation to apply indicators from this list of indicators, namely: – banks – the indicators from Sections 2 and 3 of this List of Indicators; – financial lessors – the indicators from Sections 2 and 4 of this List of Indicators; – life insurance obligors – the indicators from Sections 2 and 5 of this List of Indicators; – voluntary pension fund management companies – the indicators from Sections 2 and 6 of this List of Indicators; – payment institutions, electronic money institutions and the public postal operator – the indicators from Sections 2 and 7 of this List of Indicators; – virtual currency service providers – the indicators from Sections 2 and 8 of this List of Indicators; – authorised exchange dealers and business entities performing exchange operations pursuant to a separate law governing their activity – the indicators from Sections 2 and 9 of this List of Indicators, as well as to define, through internal acts, the manner of implementing the law on the freezing of assets with the aim of preventing terrorism and the proliferation of WMD.

8 11. Obligors shall apply this List of Indicators as of 13 May 2025. 12. This List of Indicators is published on the website of the National Bank of Serbia and delivered to the Administration for the Prevention of Money Laundering for publication on its website. G. No 6039 G o v e r n o r 12 May 2025 National Bank of Serbia B e l g r a d e Dr Jorgovanka Tabaković, sgd.