Decision on the Contents and Form of Records Kept by Virtual Currency Service Providers Holding User Funds

RS Official Gazette, No 49/2021 Pursuant to Article 10, paragraph 1, and Article 78, paragraph 5 of the Law on Digital Assets (RS Official Gazette, No 153/2020) and Article 18, paragraph 1, item 3 of the Law on the National Bank of Serbia (RS Official Gazette, Nos 72/2003, 55/2004, 85/2005 – other law, 44/2010, 76/2012, 106/2012, 14/2015, 40/2015 ‒ CC decision and 44/2018), the Governor of the National Bank of Serbia hereby issues D E C I S I O N ON THE CONTENTS AND FORM OF RECORDS KEPT BY THE VIRTUAL CURRENCY SERVICE PROVIDER WHICH HOLDS USER MONEY AND/OR VIRTUAL CURRENCIES Introductory provision 1 This Decision regulates in more detail the contents and form of records kept by a provider of digital asset services in the part of operations pertaining to virtual currencies, which holds the money and/or virtual currencies of virtual currency users (hereinafter: service provider). Meaning of terms 2. For the purposes of this Decision, the following definitions shall apply:

1. records means a single, systematised dataset which can be easily accessed and reviewed at any time, kept by the service provider who, in accordance with the Law on Digital Assets (hereinafter: Law) and the licence granted by the National Bank of Serbia for the provision of virtual currency services and/or approval of the National Bank of Serbia regarding the provision of virtual currency services in a foreign country, holds the money and/or virtual currencies of virtual currency users;
2. virtual currency user means a natural person, entrepreneur or a legal person who is using or has used a virtual currency service with the service provider (hereinafter: user);
3. virtual currency transaction means purchase, sale, acceptance or transfer of virtual currencies or exchange of a virtual currency for another virtual currency and/or other digital assets;
4. virtual currency service means one or more services from Article 3, paragraph 1 of the Law;
5. virtual currency address means a unique identifier of a virtual spot containing information on a specific virtual currency. Rules on holding user money and/or

2 virtual currencies 3. A service provider shall keep user money in account with the bank separate from the money account of that service provider, and no special consent by the user or authorisation for opening that account shall be necessary. The service provider may keep the user’s money in one or more accounts. By way of exception from paragraph 2 hereof, the service provider may keep the money of the user who is a natural person in an omnibus account. The service provider may use the user’s money it holds only for the payment of liabilities related to virtual currency services for which it is licensed by the National Bank of Serbia. 4. The service provider who holds the users’ virtual currencies may keep the data on such virtual currencies in one or more virtual currency addresses, as well as in the omnibus address of virtual currencies. The omnibus address of virtual currencies referred to in this paragraph means a virtual currency address that contains data on virtual currencies of more than one user. Contents of the records 5. The service provider shall keep in the records the following data about each individual user whose money and/or virtual currencies it holds:

1. the user’s basic identification data (depending on whether the user is a natural person, and/or a legal person or entrepreneur, the user’s identification data are the data which are submitted to and contained in the single register of current and other accounts of legal and natural persons kept by the National Bank of Serbia based on the law governing payment services and decisions of the National Bank of Serbia which govern detailed conditions and manner of keeping the single account register);
2. data about the type of a virtual currency service in relation to which the user’s money and/or virtual currencies are held;
3. number of the account with the bank in which the user’s money is kept, with the designation of whether it is an individual or an omnibus account, if in accordance with Section 3, paragraph 3 of this Decision the users’ money may be kept in the omnibus account, as well as the business name of the bank in which that account is kept, and/or the virtual currency address containing the data on the user’s virtual currencies held by that

3 service provider, with the designation showing if it is an individual or an omnibus address and if the money is kept in several accounts, and/or if the data on virtual currencies are in several virtual currency addresses – numbers of all accounts and business names of all banks, and/or all virtual currency addresses; 4) data about the balance of user money and/or virtual currencies which that service provider holds, for each individual user account, including omnibus accounts, if in accordance with Section 3, paragraph 3 of this Decision the users’ money may be kept in an omnibus account, for which the exact portion of the user’s assets kept in that omnibus account is specified, and/or for each individual virtual currency address, including omnibus addresses for which the exact portion of the users’ virtual currencies which are kept in that address is specified; 5) legal grounds authorising the service provider to hold the user’s money and/or virtual currencies (contract, with the contract date and number); 6) data about the user’s orders related to money and/or virtual currencies held by that service provider (the time of submission and records number of such order, rejected orders with reasons for rejection, etc.), which are automatically (electronically) connected with orders from the book of users’ orders which the service provider keeps in accordance with the Law; 7) all changes of data from items 1) to 6) hereof, with the description of the change and date of change (e.g. change of the address of the user’s permanent residence and/or head office, change of the type of a virtual currency service in relation to which the money is kept, change of the account in which the user’s money is kept); 8) service provider’s notes in relation to the user’s money and/or virtual currencies it holds (e.g. delay in the settlement of user’s monetary liabilities). 6. If in accordance with Section 3, paragraph 3 of this Decision the user’s money is held in the omnibus account, the service provider shall keep in the records the data about the total money balance in that account and about the balance of money of each individual user held in that account. Paragraph 1 hereof shall also accordingly apply to the omnibus address of virtual currencies. 7. After the execution of a virtual currency transaction, and/or provision of a virtual currency service by using the user’s money and/or virtual currencies it holds, the service provider shall immediately enter into records the following data about such user:

4

1. data about the executed virtual currency transaction, and/or virtual currency service (type, date and time, value of the transaction and/or service);
2. data about all other participants in the execution of a virtual currency transaction, and/or provision of a virtual currency service (e.g. about another service provider who participated in the execution of that transaction and/or provision of that service and the person on whose behalf the user from this paragraph initiates the execution of that transaction and/or provision of that service), which the service provider collects on all persons participating in the transaction based on the law governing the prevention of money laundering and terrorism financing. If more than one person participated in the execution of the transaction, and/or provision of the service from paragraph 1 hereof, the service provider shall enter the data from that paragraph into records separately for each of those persons (e.g. a portion of the total value of the transaction pertaining to such participant). Immediately upon executing a virtual currency transaction and/or provision of a virtual currency service, the service provider shall update the data in the records about the balance of the user’s money and/or virtual currencies it holds, as well as all other data which are being changed due to the execution of that transaction and/or provision of that service.

8. The records shall also contain contractual and other documents concluded between the service provider and the user, regulating the rights and obligations of those persons, as well as the conditions under which the service provider provides services to its users, and the contracts on opening the account with the bank in which the user’s money and other documents related to that user are kept. Form and manner of keeping records
9. The service provider shall keep the records electronically in accordance with Article 84 of the Law.
10. The service provider shall keep the records accurate, up-to-date and transparent, so as to enable at any time and without delay insight into the balance and movement of the user’s money and/or virtual currencies in relation to the execution of virtual currency transactions and/or provision of virtual currency services, as well as separation of the money and/or virtual currencies of one user from those of another user, as well as from own money and/or virtual currencies.

5 The service provider shall keep the documents on one user separately from the documents on another user and from the documents about the transactions executed for its own account. The service provider shall regularly reconcile its internal accounts with the records and accounts of users within the meaning of this Decision so as to ensure accurate and up-to-date records at all times. 11. The access to data from the records, as well as the communication and submission of those data, shall be subject to the provisions of the law governing business secret, as well as Article 84, paragraph 2 of the Law. Personal data which are entered in the records are collected, processed, kept and used in accordance with the law governing personal data protection. Keeping records in branches abroad 12. The service provider shall ensure that the records in its branches abroad are also kept in accordance with this Decision. Closing provision 13. This decision shall enter into force on the eighth day following its publication in the RS Official Gazette and shall apply as of 29 June 2021. D. No 10 G o v e r n o r 13 May 2021 National Bank of Serbia B e l g r a d e Dr Jorgovanka Tabaković, sign.