Decision on Implementation of Provisions of the Law on Digital Assets Relating to Issuing of Licence to Provide Virtual Currency Services and Consents of the National Bank of Serbia

RS Official Gazette, No 49/2021 Pursuant to Article 10, paragraph 1, Article 56, paragraph 5, Article 60, paragraph 6, Article 63, paragraph 4, Article 65, paragraph 2 and Article 66, paragraph 8 of the Law on Digital Assets (RS Official Gazette, No 153/2020) and Article 18, paragraph 1, item 3) of the Law on the National Bank of Serbia (RS Official Gazette, Nos 72/2003, 55/2004, 85/2005 – other law, 44/2010, 76/2012, 106/2012, 14/2015, 40/2015 ‒ CC Decision and 44/2018), the Governor of the National Bank of Serbia hereby issues D E C I S I O N ON IMPLEMENTATION OF PROVISIONS OF THE LAW ON DIGITAL ASSETS RELATING TO ISSUING OF LICENCE TO PROVIDE VIRTUAL CURRENCY SERVICES AND CONSENTS OF THE NATIONAL BANK OF SERBIA I. INTRODUCTORY PROVISIONS

1. This Decision governs:

1. the manner of implementing the provisions of the Law on Digital Assets (hereinafter: the Law) on the basis of which the National Bank of Serbia issues the licence to provide digital asset services in the part relating to virtual currencies (hereinafter: licence), as well as evidence to be submitted to the National Bank of Serbia along with the application for licence;
2. detailed requirements to be fulfilled by a member of management of a virtual currency service provider (hereinafter: service provider) and the person who will directly manage the provision of virtual currency services in a service provider (hereinafter: director of the service provider), as well as evidence to be submitted to the National Bank of Serbia along with the application for consent to the appointment of a member of management and the director of the service provider;
3. detailed requirements relating to personnel and organisational capacity, as well as technical and information capacity of the service provider, particularly taking into account concrete market circumstances, significant risks, potential conflict of interest, financial resources and the necessary professional, technical and information capacity, as well as evidence to be submitted to the National Bank of Serbia to enable assessment of the fulfilment of these requirements;
4. detailed eligibility criteria that must be fulfilled by persons with a qualifying holding in a service provider, as well as evidence to be submitted to the National Bank of Serbia along with the application for prior consent to the acquisition and/or increase of a qualifying holding in a service provider.

2 2. When assessing the applications and/or fulfilment of requirements under this Decision, the National Bank of Serbia shall particularly assess whether there are indications that a licence or consent is acquired and/or a holding in a service provider is acquired for the purpose of money laundering or financing of terrorism, considering in particular whether it is possible to identify the origin of the applicant’s capital and/or the source of funds used for acquiring a qualifying holding and whether these persons or persons related to them have been associated with money laundering and financing of terrorism – based on the information submitted to the National Bank of Serbia by the body competent for the prevention of money laundering and financing of terrorism and other data available to it. The following circumstances in particular may point to the existence of the indications referred to in paragraph 1 of this Section:

1. a person that is to have a qualifying holding, and/or a person for whose account the holding is acquired, has permanent or temporary residence and/or head office or is operating in a foreign country with strategic deficiencies in the system for the prevention of money laundering and financing of terrorism (hereinafter: AML/CFT) and/or the funds for carrying out the transaction originate from that country;
2. a person that is to have a qualifying holding and/or a person for whose account the holding is acquired, is an off-shore legal person within the meaning of the law governing the prevention of money laundering and the financing of terrorism or is a person with a holding in an off-shore legal person;
3. a person that is to have a qualifying holding and/or a person for whose account the holding is acquired has a business relationship with or performs transactions through a shell bank within the meaning of the law governing the prevention of money laundering and the financing of terrorism, or through any other similar institution for which it can reasonably be assumed that it may allow a shell bank to use its accounts;
4. whether a person that is to have a qualifying holding and/or a person for whose account the holding is acquired, is obliged, under the regulations of the country of temporary or permanent residence, and/or country of the head office or country of operation, to have internal enactments, keep records and apply internal control procedures which refer or relate to the detection and prevention of money laundering and financing of terrorism, and whether it is subject to supervision by a competent body in the country or abroad. The National Bank of Serbia shall assess in particular whether a person that is to have a qualifying holding is a public official, close family member of a public official and close associate of a public official within the

3 meaning of the law governing the prevention of money laundering and the financing of terrorism. II. ISSUING OF A LICENCE TO PROVIDE VIRTUAL CURRENCY SERVICES Application for licence 3. A company intending to provide virtual currency services shall submit to the National Bank of Serbia an application for licence in the form provided in Annex 1 of this Decision, listing the services referred to in Article 3, paragraph 1 of the Law which it intends to provide. Along with its application for licence, the applicant referred to in paragraph 1 of this Section (hereinafter: applicant) shall enclose the following evidence and documents:

1. decision on entry in the register of business entities;
2. general enactments of the applicant (articles of incorporation and/or articles of association and operating rules of the company);
3. programme of activities defining in more detail the manner and conditions of virtual currency service provision;
4. business plan with the revenue and expenditure projection for the period of the first three years of operation, based on which it is possible to conclude that the applicant will be capable of meeting adequate organisational, personnel, technical and other requirements for continuous, safe and sound operation, including the number and type of expected virtual currency users, and the expected volume and amount of virtual currency transactions, for each type of service it intends to provide;
5. description of planned measures for the protection of funds of virtual currency users in accordance with Article 78 of the Law;
6. description of the governance and internal controls systems in accordance with Article 92 of the Law;
7. description of internal control measures introduced to fulfil the obligations determined by AML/CFT regulations;
8. description of the planned staff training programme in connection with virtual currency transactions;
9. description of the organisational structure, including data on the planned outsourcing of some operational activities relating to virtual currency service provision;
10. description of planned measures for managing the security of the information and communications system;
11. data on persons who are members of the applicant’s management and the director of the service provider, with data and evidence proving that

4 these persons have a good business reputation in accordance with Article 60 of the Law; 12) data on persons with a qualifying holding in the applicant, level of their holding, and evidence on the eligibility of these persons in accordance with Article 65 of the Law; 13) data on the external auditor that performs the audit of financial statements of the applicant in the year when the application is submitted, if the applicant is subject to mandatory audit of financial statements in accordance with law; 14) data on persons closely linked with the applicant and the description of such close links; 15) evidence of holding minimum capital referred to in Article 54, paragraph 1 of the Law; 16) evidence that the applicant is not convicted by a final judgment of a criminal offence and that it is not subject to a criminal procedure, within the meaning of the law governing the responsibility of legal persons for criminal offences, and that it is not convicted by a final judgment of an economic offence which makes it unfit to provide virtual currency services, within the meaning of the law governing economic offences; 17) data on fee payment in accordance with the rules on fees of the National Bank of Serbia. The data on persons referred to in paragraph 2, items 11) to 14) of this Section shall include in particular:

1. for natural persons: – name and surname of the natural person, – address of permanent and/or temporary residence of the natural person (place, street and number), and the name of the country for a natural person without the citizenship of the Republic of Serbia, – unique citizen identification number, and/or other relevant identity designation for a natural person without the citizenship of the Republic of Serbia (e.g. passport number or identification number determined by the competent government authority);
2. for legal persons: – business name or abbreviated business name of the legal person, – address of the head office of the legal person (place, street and number), and the name of the country for a legal person without the head office in the Republic of Serbia, – registration number of the legal person, and/or other relevant identity designation for a legal person without the head office in the Republic of Serbia (e.g. record number determined by the competent government authority),

5 – tax identification number of the legal person. In addition to the data referred to in paragraph 3 of this Section, the data on persons shall also include other data and documents containing data on persons which shall be submitted in accordance with paragraph 2, items 11) to 14) of this Section (e.g. data and evidence that these persons have a good business reputation). If it is not possible to establish all facts relevant for deciding on the application for licence on the basis of the documents and evidence referred to in paragraph 2 of this Section, the National Bank of Serbia may request the applicant to submit other documents and/or data which it deems necessary. Decision on entry in the register of business entities 4. The decision on the applicant’s entry in the register of business entities means a document on the registration of the applicant as a company with the head office in the Republic of Serbia with the agency in charge of maintaining the register of business entities, including data on the business name, head office address and registered predominant activity of the applicant, its legal form and members, persons authorised to represent it, its proxies and procurators, as well as on the registered capital. If any changes of data that are subject to registration occur since the entry in the register of business entities, an excerpt on registered data referred to in paragraph 1 of this Section not older than five days shall be submitted with the document on registration referred to in the same paragraph. General enactments of the applicant 5. General enactments of an applicant shall include articles of association (if the applicant is a joint-stock company) and/or articles of incorporation (decision on incorporation or agreement on association), which must contain the elements laid down by the law governing companies, and operating rules of the company which ensure that the operations of the company, its management and director, as well as employees, are in compliance with the Law. The general enactments referred to in this paragraph must be dated and duly signed and recorded. The applicant shall be required to amend the articles of association and/or articles of incorporation, and operating rules of the company in such a way so as to include all virtual currency services it intends to provide, and the activities and services directly related to virtual currency services which it

6 intends to perform and/or provide considering that, in accordance with the Law, in addition to digital asset services the service provider shall be allowed to perform only the activities and services directly related to digital asset services, and it shall submit the proposal of such amendments to the National Bank of Serbia. Proposals of amendments to articles of association and/or articles of incorporation referred to in paragraph 2 of this Section shall reflect the changes which would occur if the applicant is granted the licence, and shall particularly contain data on a change of predominant activity, virtual currency services which the applicant intends to provide and other activities and services directly related to virtual currency services which it intends to perform and/or provide, as well as data on the minimum capital of the service provider in the required amount, management of the service provider, governance and internal controls systems, storing of data and documents, keeping of books, preparation of financial statements of the applicant and auditing of such statements, and data on potential outsourcing of some operational activities to a third party. Programme of activities and business plan of the applicant 6. For each of the services which are the subject matter of the application referred to in Section 3, paragraph 1 of this Decision, the programme of activities of the applicant shall specify the manner and conditions for the provision of such service, and describe the manner and conditions for performing other activities and services that are directly related to the provision of virtual currency services which the applicant intends to perform and/or provide, including potential outsourcing of operational activities. The business plan of the applicant shall provide an overview of the planned activities for the first three years of operation, with a projection of revenues and expenditures for this period, as well as data based on which it is possible to conclude that the applicant will be capable of meeting adequate organisational, personnel, technical and other requirements for continuous, safe and sound operation. The business plan referred to in paragraph 2 of this Section shall contain in particular:

1. data on the applicant’s operation to date;

7 2) data on organisational parts where activities related to virtual currency service provision will be carried out and the number of employees to be engaged in these activities; 3) specification of hardware and software components to be used in the performance of activities related to virtual currency service provision, stating the manner in which these components have been and/or will be provided; 4) data on business premises to be used for the operations of the service provider, including business premises where hardware and software components to be used in the performance of activities related to virtual currency service provision will be installed; 5) data on operational activities related to virtual currency service provision which the applicant intends to outsource to a third party, including the reasons for such outsourcing, and data on the person to which such activities are intended to be outsourced; 6) data on the type of virtual currency services which the applicant intends to provide and the number and type of expected virtual currency users, as well as the expected volume and amount of virtual currency transactions, for each type of service it intends to provide, by year; 7) data on other activities and services directly related to virtual currency services which it intends to perform and/or provide in accordance with the Law; 8) data on planned fees in connection with virtual currency service provision, planned revenues and expenditures of the applicant related to virtual currency service provision by year and planned sources of funding for the purpose of virtual currency service provision. To enable the assessment of its ability to fulfil appropriate organisational, personnel, technical and other requirements for safe and sound operation, the applicant must prove the following:

1. that it shall organise and/or divide its business activities in a manner which ensures successful and smooth performance of activities related to virtual currency service provision;
2. that, for the purpose of performance of the activities referred to in item 1 of this paragraph, it shall appoint a sufficient number of employees with the professional qualifications and experience adequate for their duties, responsibilities and the complexity of the activities they perform, ensuring that the employees engaged in the activities which must be performed smoothly and continuously have an appropriate substitute so as to avoid situations where such employees’ absence from work or termination of employment hinders safe and sound operation of the service provider;
3. that it shall use business premises adequate for the performance of the activities referred to in item 1) of this paragraph, including the premises

8 where hardware and software components used in the performance of activities related to virtual currency service provision are installed; the premises must be owned by the applicant or used based on a rental or leasing contract concluded for a period of minimum three years and must meet the requirements laid down in regulations governing occupational safety, fire protection and environmental protection; 4) that it shall use the hardware and software components which in their scope, functionality and performances correspond to the complexity and volume of activities related to virtual currency service provision and the number of employees engaged in such activities. To enable the assessment of fulfilment of the requirements referred to in paragraph 4 of this Section, along with the business plan referred to in paragraph 2 of this Section, the applicant shall also submit the following documentation:

1. proposed scope of activity of the applicant’s organisational parts in which activities related to virtual currency service provision will be performed and the proposed job classification by employee, with data on the type and level of qualifications and/or education and work experience required for each position;
2. evidence of the right to use business premises (e.g. excerpt from the real estate cadastre and/or real estate folio, rental or leasing contract), and evidence that the business premises meet the requirements laid out in regulations governing occupational safety, fire protection and environmental protection (e.g. decision of the competent authority issued in the inspection procedure, etc.);
3. documents proving the grounds for using and/or manner of acquiring the hardware and software components (e.g. excerpt from business books, pre-contract, contract, etc.) and a description of the functionalities of software components and the geographical location of hardware components that are directly related to virtual currency service provision;
4. pre-contract or contract on outsourcing operational activities to a third party, if such outsourcing is intended. Description of planned measures for the protection of funds of virtual currency users

7. In the description of planned measures for the protection of funds of virtual currency users, the applicant shall provide an overview of the measures it intends to take in order to protect the funds of its users in connection with the performance of a virtual currency transaction in accordance with the Law and shall specify the data about the bank (business name, head office) in which it will open a separate account for depositing the

9 funds it has received from a virtual currency user or its payment service provider in connection with the performance of a virtual currency transaction and/or the account of a user whose funds it manages in accordance with the Law. In the description referred to in paragraph 1 of this Section, the applicant shall specify the measures it intends to set up in order to mitigate the risk of loss or diminution of money, virtual currencies and other assets of virtual currency users and/or rights in connection with those assets as a result of misuse of the assets, fraud, poor governance, inadequate record-keeping or negligence. Description of the organisational structure, governance and internal controls systems, and internal control measures put in place in order to comply with the requirements arising from AML/CFT regulations and the measures for managing information-communication system security 8. The description of the organisational structure, governance and internal controls systems, and internal control measures put in place in order to comply with the requirements arising from AML/CFT regulations and the measures for managing information-communication system security, shall contain a brief description of the risk management system, internal controls and internal audit, and internal control measures put in place in order to comply with the requirements arising from AML/CFT regulations and the measures for managing information system security. The description referred to in this paragraph shall also contain data on the member(s) of management of the service provider who would be responsible for setting up procedures for managing the risks to which the service provider is or could be exposed, for the establishment of internal audit, for setting up relevant accounting procedures and for setting up procedures for the assessment of compliance with AML/CFT regulations, as well as data about the number of employees to be directly engaged in these activities. Along with the description referred to in paragraph 1 of this Section, the applicant shall also submit data on the proposed person authorised to perform some activities and measures to prevent and detect money laundering and terrorism financing in accordance with the law governing the prevention of money laundering and the financing of terrorism and on such person’s deputy (name and surname, position, rights, obligations and responsibilities, resume and other relevant data). Along with the description referred to in paragraph 1 of this Section, the applicant shall also submit:

10

1. the organisational chart of the applicant with a description of the organisational structure from which one can clearly establish the division and segregation of tasks, as well as duties and responsibilities relating to virtual currency service provision, with a note regarding whether the outsourcing of some operational activities related to virtual currency service provision to a third party has been planned and within what deadline;
2. proposed procedures for identifying, measuring and monitoring the risks to which the service provider is or might be exposed in its operations, especially the money laundering and terrorism financing risks, and for managing and/or reporting on such risks;
3. proposed accounting procedures and procedures for assessing compliance with AML/CFT regulations. Description of the planned staff training programme in connection with virtual currency transactions

9. The description of the planned staff training programme in connection with virtual currency transactions shall contain a description of the measures and activities which the applicant plans to undertake to make sure that the knowledge, expertise and professional experience of its staff are adequate given the nature, complexity and scope of activities related to virtual currency transactions. The description referred to in paragraph 1 of this Section shall also contain a plan and a framework staff training programme, data on planned training organisers and employees for which training is intended, including training relating to the implementation of AML/CFT regulations. Data on persons who are members of the applicant’s management and director of the service provider, and eligibility criteria for such persons
10. Data on the proposed member of management and director of the service provider, as well as the data and evidence that these persons have a good business reputation and appropriate professional qualifications and experience, shall mean the following documents:

1. draft decision on the appointment of a member of management and/or director of the service provider;
2. act of the competent authority certifying that such person has not been convicted by a final judgement of criminal offences against economy, property, legal transactions, public order, official duty or judiciary or criminal offences of money laundering or terrorism financing, or similar or comparable criminal offences in accordance with the regulations of a foreign country,

11 and/or of another criminal and/or punishable offence which makes the person unfit to perform this function; 3) act of the competent authority certifying that no final protective measure of prohibition of performing the business activity has been imposed on such person, making the person unfit to perform this function; 4) such person’s statement on the form provided in Annex 2 to this Decision; 5) such person’s professional resume, including information about his business engagement to date, with a recommendation containing a reasoned opinion about the business reputation, expertise and capacities of such person; 6) evidence of adequate professional qualifications and work experience based on which it can be determined that the person fulfils the requirements for exercising this function (diploma, certificate from a former employer with which the appointed person was employed or engaged, containing data on the position or function which this person performed with a description of activities, duties and authorizations, particularly for making appropriate decisions, and the period in which such tasks were performed) – for the director of the service provider; 7) a scan reading of the biometric ID card and/or photocopy of the ID card (for citizens of the Republic of Serbia), or photocopy of the passport (for foreign citizens); 8) the list of legal persons in which the person has a holding, including data on whether the person is an owner of a legal person, stating the absolute and percentage amount of his ownership in that legal person as at the business day preceding the day of submission of the licence application, as well as on whether the person is a member of management in a legal person and/or the person’s statement that he has no holding in any legal person based on management and/or ownership. Member of management and director of the service provider may not be members of such provider’s board which has supervisory functions in such provider, nor may they be members of managing bodies in a financial institution supervised by the National Bank of Serbia. It shall be deemed that a director of the service provider has appropriate professional qualifications if he/she has at least the first level of higher education at academic studies lasting minimum four years, within the meaning of regulations governing higher education, and that he/she has appropriate experience – if he/she has no less than three years of experience in occupying a managing position in a financial sector person or in a company and/or legal person whose business activity is similar to activities related to virtual currency service provision (i.e. provision of services in connection with other digital assets, IT activities, portfolio management).

12 By way of exception to paragraph 3 of this Section, if, considering the complexity of virtual currency services which the service provider intends to provide, a person performing the job is not required to have the level of education and experience referred to in that paragraph for quality management of service provision, the appropriate professional qualifications and experience of such person may be proved by submitting other appropriate evidence (certificate and/or university diploma, certificate of further education, training and development, certificate of work experience, etc.). In the case referred to in paragraph 4 of this Section, appropriate professional qualifications and experience may not be proven for a person without at least the first level of higher education and at least one year of experience in occupying a managing position in a financial sector person or a company whose business activity is similar to activities related to virtual currency service provision. At least one member of management of the service provider must have active knowledge of the Serbian language and have temporary residence in the territory of the Republic of Serbia. In addition to the documents referred to in paragraph 1 of this Section, the applicant shall also submit a list of associates of the proposed members of management and director of the service provider, along with the documents referred to in paragraph 1, item 2) of this Section for such associates. Within the meaning of this Decision, an associate shall mean:

1. any natural person who is a member of management or other responsible person in a legal person in which the beneficial owner, within the meaning of the law governing the prevention of money laundering and the financing of terrorism, is a person having and/or acquiring a qualifying holding in the service provider, proposed member of management and/or director of the service provider or in which such person is a member of management or occupying another managing position;
2. any natural person who is a beneficial owner of a legal person in which the person referred to in item 1) of this paragraph is a member of management or occupying another managing position;
3. any natural person who, together with the person referred to in item 1) of this paragraph, holds beneficial ownership in the same legal person.

13 The list of associates of the person referred to in paragraph 1 of this Section shall contain the following data on the identity of the associates:

1. name and surname, address of temporary and/or permanent residence, unique citizen identification number (for citizens of the Republic of Serbia), and/or passport number and country of issuance (for foreign citizens);
2. data on the grounds based on which, within the meaning of this Decision, these persons are considered associates of the person referred to in paragraph 1 of this Section. If, for justified reasons, the applicant is unable to obtain the documents referred to in paragraph 1, item 2) of this Section for the associates of the person referred to in that paragraph, the applicant may also submit a statement by that person given under financial and criminal liability confirming that his associates have not been convicted. The National Bank of Serbia may request the applicant to submit evidence of no conviction of such persons at any time or may request such evidence directly from the competent authority.

11. The National Bank of Serbia shall assess whether the person referred to in Section 10, paragraph 1 of this Decision has a good business reputation based on documents and evidence referred to in that Section, and other data at its disposal, and it may also request the applicant to submit other documentation it finds necessary (e.g. evidence of due settlement of tax and other liabilities of the company which this person previously managed, etc.). A person shall be deemed to have a good business reputation if he has demonstrated in his work so far that he has the personal, moral and professional integrity which will ensure management of virtual currency service provision in accordance with the rules on safe and sound operation. A person referred to in Section 10, paragraph 1 of this Decision shall be deemed not to have a good business reputation in the following cases in particular:

1. if he has been convicted by a final judgement of criminal offences against economy, property, legal transactions, public order and official duty or judiciary, or criminal offences of money laundering or terrorism financing or similar or comparable criminal offences in accordance with regulations of a foreign country and/or other criminal and/or punishable offences making the person unfit for exercising this function;
2. if an associate of that person is convicted by a final judgement of the criminal offences referred to in item 1 of this paragraph;

14 3) if such person is subject to a final protective measure of prohibition of performing the activity making the person unfit to perform this function; 4) if on the day of delicensing the legal person and/or the day of introduction of receivership or initiation of bankruptcy or forced liquidation procedure over the legal person, such person was authorised to represent this legal person or was a member of its management, apart from the receiver, unless more than two years elapsed from the initiation of the bankruptcy or forced liquidation procedure; 5) if they have committed, in the last ten years, a grave violation and/or repeated violations of AML/CFT regulations. When assessing the business reputation of the person referred to in Section 10, paragraph 1 of this Decision, the National Bank of Serbia may also take into account the circumstance that such person has failed to act in accordance with the decision of the National Bank of Serbia whereby such person was fined in the procedure of supervision of the service provider in accordance with the Law and regulations of the National Bank of Serbia, and/or the circumstance that the service provider paid the fine instead of such person. Data on persons with a qualifying holding in the service provider and eligibility criteria for such persons 12. Data on persons with a qualifying holding in the service provider and the amount of their holding shall mean a graphic scheme showing a detailed ownership structure of the applicant down to natural persons, and/or market￾recognised legal persons, including: name and surname and/or business name of each person with a qualifying holding in the applicant, the total number, type and nominal amount of shares and/or stake and the percentage of ownership in the capital, and/or voting rights, with a clear identification of persons having a direct and indirect qualifying holding (hereinafter: qualifying holder). Within the meaning of this Decision, a market-recognised legal person shall mean a foreign legal person whose securities are quoted on stock exchanges in OECD countries. Data and evidence on the ability of the qualifying holder – natural person to ensure safe and sound management of virtual currency services provision shall mean in particular:

1. a scan reading of the biometric ID card, and/or photocopy of the ID card (for citizens of the Republic of Serbia), or photocopy of the passport (for foreign citizens);

15 2) the person’s resume, including information on his business engagements and professional qualifications, and information on whether that person is or used to be a member of management of a legal person, including contact details of such legal person; 3) evidence of such person’s good business reputation referred to in Section 10, paragraph 1, items 2) and 3) of this Decision; 4) data on the asset position and/or own assets of that person – real estate, participation in the capital of other legal persons with absolute and percentage amount of ownership, cash deposits in banks etc. – along with appropriate evidence of such ownership and the origin of such assets (e.g. excerpt from the appropriate registry, bank statement, etc.); 5) list of associates of that person within the meaning of Section 10, paragraphs 7 to 9 of this Decision, together with the documents from Section 10, paragraph 1, item 2) of this Decision submitted for such associates; 6) statement on such person’s debt to domestic and foreign legal and natural persons, specifying those persons and the amounts of debt; 7) evidence on the settlement of tax liabilities issued by the competent authority; 8) proof of origin of assets (source of assets) used to acquire a qualifying holding. Data and evidence on the ability of a qualifying holder – legal person to ensure safe and sound management of virtual currency services provision shall mean in particular:

1. proof of such person’s registration in the register of business entities;
2. data on ultimate owners of the qualifying holder – down to natural persons and/or market-recognised legal persons with a holding in that person including: name and surname and/or business name of each person having a holding in a qualifying holder, address of permanent residence and/or head office and other identification data for those persons, as well as the absolute and percentage amounts of ownership with appropriate evidence (excerpt from the share register, transcript of shareholders from the book of shareholders, etc.);
3. for members of management of the qualifying holder and the persons closely linked with it – data and documents referred to in paragraph 3, items 2), 3) and 5) of this Section;
4. financial statements of the qualifying holder for the last two business years and the opinion of the certified auditor if the qualifying holder is the obligor of financial statement audit, in accordance with the law;
5. short overview of business activities of the qualifying holder in the past two years and the plan of activities for the current and/or next year;

16 6) data on whether the qualifying holder has ownership and/or holding in another legal person and the absolute and percentage amount of its ownership on the business day prior to submission of the application for licence, and on whether that other legal person generated profit in the last two years and if yes, in what amount; 7) statement on the total debt of the qualifying holder to domestic and foreign legal and natural persons, with a list of those persons and debt amounts; 8) act of the competent authority certifying that such qualifying holder has not been convicted by a final judgement of a criminal offence, within the meaning of the law governing the liability of legal persons for criminal offences, and that it has not been convicted by a final judgement of an economic offence which makes him unfit within the meaning of this Decision, within the meaning of the law governing economic offences; 9) evidence issued by the competent authority on the settlement of tax liabilities; 10) proof of origin of assets (source of assets) used to acquire the qualifying holding. If the qualifying holder belongs to a group of companies, the following shall also be submitted in addition to the documents referred to in paragraph 4 of this Section:

1. data on the group structure;
2. data on the type of activities carried out by the group and its members;
3. data on persons having a controlling holding in that group;
4. report on the audit of consolidated financial statements of the group for the past two years, prepared by the certified auditor;
5. procedures of the group of companies establishing the governance and internal controls systems. By way of exception to paragraph 4 of this Section, if the qualifying holder is a market-recognisable legal person, the following documents shall be submitted:
6. list of persons having a qualifying holding in the qualifying holder, with basic data on those persons;
7. evidence that the qualifying holder is quoted on a stock exchange;
8. documents from paragraph 4, items 3) to 10) of this Section.

13. The National Bank of Serbia shall assess the business reputation of a qualifying holder – natural person and/or members of management of a

17 qualifying holder – legal person and persons closely linked with such legal person in the manner specified in Sections 10 and 11 of this Decision. The National Bank of Serbia shall assess whether the qualifying holder – legal person has a good business reputation based on the documents and evidence referred to in Section 12, paragraphs 4 to 6 of this Decision and other data available to it, and it may also request the qualifying holder to submit other documents it finds necessary. A legal person shall be deemed to have a good business reputation if in its entire operation so far it has demonstrated risk management ability, achieved good results and gained a reputation in the field of its line of activity. A legal person shall be deemed not to have a good business reputation in the following cases in particular:

1. if it has been convicted by a final judgement of a criminal offence, within the meaning of the law governing the liability of legal persons for criminal offences, and if it has been convicted by a final judgement of an economic offence which makes him unfit within the meaning of this Decision, within the meaning of the law governing economic offences;
2. if members of management of such person and the persons closely linked with it have been convicted by a final judgement of the criminal offences referred to in Section 10, paragraph 1, item 2) of this Decision or an associate of such persons has been convicted by a final judgement of such criminal offences and/or a final protective measure of prohibition of performing the business activity has been imposed on such persons, making them unfit to perform this function;
3. if it has committed, in the last ten years, a grave violation and/or repeated violations of AML/CFT regulations. In assessing the financial status of a qualifying holder – natural person, the National Bank of Serbia shall assess that person’s ability to finance its contribution to the service provider’s capital from its own funds (excluding borrowings) and to ensure additional capital as needed. In assessing the financial status of a qualifying holder – legal person, the National Bank of Serbia shall assess that person’s ability to finance its contribution to the service provider’s capital and to ensure additional capital as needed, especially based on data from the financial statements of such person. Data on the external auditor

18 14. If the applicant is subject to mandatory audit of financial statements according to law, together with specification of data about the external auditor performing the audit of the applicant’s financial statements in the year of submission of the application, the applicant shall also submit the document on the appointment of such auditor. Data on persons closely linked with the applicant and the description of such close links 15. The applicant shall submit a list of persons closely linked with the applicant within the meaning of the Law, containing:

1. for natural persons: – name and surname of the natural person, – address of permanent residence and/or temporary residence of the natural person (place, street and number), and the name of the country for a natural person without the citizenship of the Republic of Serbia, – unique citizen identification number, and/or other relevant identity designation for a natural person without the citizenship of the Republic of Serbia (e.g. passport number or identification number determined by the competent government authority), – contact details;
2. for legal persons: – business name or abbreviated business name of the legal person, – address of the head office of the legal person (place, street and number), and the name of the country for a legal person without the head office in the Republic of Serbia, – registration number of the legal person and/or other relevant identity designation for a legal person without the head office in the Republic of Serbia (e.g. record number determined by the competent government authority), – tax identification number of the legal person, – contact details. Along with the list referred to in paragraph 1 of this Section, a description of the manner in which persons referred to in that paragraph are linked shall also be submitted. Evidence that the applicant holds the prescribed amount of minimum capital

19 16. Evidence that the applicant holds the amount of minimum capital prescribed by Article 54, paragraph 1 of the Law shall be the statement from a current account or other appropriate account of the applicant, financial statement for the previous business year, as well as the certified auditor’s opinion if the applicant is subject to financial statement audit according to law, and/or other documents proving that the applicant has the prescribed amount of minimum capital (e.g. excerpt from the register of business entities, etc.), taking into account the provisions of the decision governing the calculation of minimum capital of a service provider. Before the decision on granting the licence is delivered, the applicant shall submit appropriate evidence to the National Bank of Serbia that it has the prescribed amount of minimum capital on the day of receipt of the decision and evidence that at least one half of the prescribed amount of minimum capital has been paid in money (statement from a current account or another appropriate account with a bank with which it holds funds). The applicant shall issue a written authorisation to banks with which it holds its funds and/or through which it operates to submit to the National Bank of Serbia, at its request, all data relating to its operations and/or the balance of its funds held with such banks. Evidence that the applicant is not convicted by a final judgment of a criminal offence and/or economic offence and that it is not subject to a criminal procedure 17. Evidence that the applicant is not convicted by a final judgement of a criminal offence and that it is not subject to a criminal procedure, within the meaning of the law governing the liability of legal persons for criminal offences, and that it is not convicted by a final judgement of an economic offence which makes the applicant unfit for virtual currency service provision, within the meaning of the law on economic offences, shall mean certificates or other acts of competent authorities from records certifying that such persons have not been convicted of criminal offences and/or economic offences, as well as certificates or other acts of competent authorities that criminal procedure and/or economic offence procedure has not been instituted against such persons. Evidence of fee payment in accordance with the rules on fees of the National Bank of Serbia 18. The applicant shall submit data on the payment of fee prescribed by the decision on uniform fees charged for services provided by the National

20 Bank of Serbia (date of payment and business name of the payment service provider through which the payment was made). Licensing decision 19. The National Bank of Serbia shall decide on the application for licence within 60 days from the day of receiving a duly completed application. If the application referred to in paragraph 1 of this Section is not duly completed, within 20 days from receiving such application the National Bank of Serbia shall notify the applicant in what way to complete the application duly, in which case the deadline referred to in paragraph 1 of this Section shall start running from the day when the duly completed application was submitted, in accordance with the notification referred to in this paragraph. The National Bank of Serbia shall adopt the decision on granting the licence once it determines that all conditions have been met in accordance with the Law and this Decision. The National Bank of Serbia shall specify in the licensing decision the services referred to in Article 3, paragraph 1 of the Law which the service provider is authorised to provide. The National Bank of Serbia shall deny the application referred to in paragraph 1 of this Article if it determines the following:

1. one or more conditions for obtaining the licence referred to in the Law and this Decision have not been fulfilled;
2. the proposed members of the applicant’s management and the director of the service provider do not have a good business reputation;
3. due to close links between the applicant and other persons, the exercise of supervision of the service provider in accordance with the Law would be impossible or significantly hindered;
4. the applicant’s ownership structure is such that effective supervision over the applicant is impossible;
5. internal control measures introduced to fulfil the obligations determined by AML/CFT regulations are not appropriate;
6. the application contains incorrect or misleading data or significant omissions so that the assertions in the application cannot be verified. If the National Bank of Serbia denies the application referred to in paragraph 1 of this Section, the applicant may not re-apply for a licence within one year from the adoption of the decision of the National Bank of Serbia.

21 Licence supplement for the service provider 20. If it also intends to provide the services referred to in Article 3, paragraph 1 of the Law which are not specified in the decision on granting the licence to that service provider, such service provider shall submit to the National Bank of Serbia an application for licence supplement. The provisions of Sections 3 to 19 of this Decision shall apply accordingly to the procedure of deciding on the application referred to in paragraph 1 of this Section. Change to data in documentation 21. If, after the application for licence is submitted and before the National Bank of Serbia issues the licence, there is a change to the data in the documentation submitted along with the application, the applicant shall notify the National Bank of Serbia thereof without delay and immediately submit such changed documentation and data. If, upon the adoption of the decision on granting the licence, there are any changes to the facts or circumstances based on which such decision was made, the service provider shall notify the National Bank of Serbia thereof without delay, and at the same time submit such changed documentation and data. In the notification referred to in paragraph 2 of this Section, the service provider shall describe in more detail the nature and scope of such changes. III. GRANTING OF LICENCE TO BROKER-DEALER COMPANIES AND MARKET ORGANISERS 22. When applying for a licence using the form given in Annex 1 to this Decision, a broker-dealer company and market operator licensed by the Securities Commission in accordance with the law governing the capital market shall submit to the National Bank of Serbia the documentation referred to in Sections 4 to 18 of this Decision, other than the documentation referred to in these Sections which they have already submitted to the Securities Commission in accordance with the law governing the capital market and which does not change due to the filing of the application referred to in this paragraph. Along with the application referred to in paragraph 1 of this Section, a broker-dealer company and market operator shall submit to the National Bank of Serbia the data on the documentation referred to in Sections 4 to 18 of this

22 Decision which they have already submitted to the Securities Commission (e.g. decision on entry in the register of business entities, data on members of management, data on persons having a qualifying holding, evidence of holding minimum capital, etc.). The National Bank of Serbia shall obtain ex officio the documentation referred to in paragraph 2 of this Section from the Securities Commission. A broker-dealer company and market operator referred to in paragraph 1 of this Section shall submit the documentation referred to in Section 10 of this Decision only if the persons that will directly manage the provision of virtual currency services are not at the same time members of management. IV. NOTIFICATIONS AND EVIDENCE SUBMITTED BY THE BANK 23. A bank intending to provide the service of custody (safekeeping) and administration of virtual currencies for the account of a virtual currency user and the associated services in the part relating to the custody (safekeeping) of cryptographic keys shall, along with notification of its intention to start providing such service, also submit to the National Bank of Serbia the documentation referred to in Sections 6 to 9 and Section 18 of this Decision. The bank shall submit the notification referred to in paragraph 1 of this Section within no more than 30 days before the start of provision of the service referred to in that paragraph. The deadline referred to in paragraph 2 of this Section shall run from the day of submission of duly completed documentation referred to in paragraph 1 of this Section. V. GRANTING CONSENT TO THE APPOINTMENT OF MEMBER OF MANAGEMENT OR DIRECTOR OF THE SERVICE PROVIDER 24. The service provider shall submit to the National Bank of Serbia an application for granting consent to the appointment of proposed members of management and the director of the service provider. Along with the application referred to in paragraph 1 of this Section, the service provider shall also submit the documentation and evidence referred to in Section 10 of this Decision for the proposed person.

23 If it proposes re-appointment of the same person as member of management and/or director, along with the application for the consent referred to in paragraph 1 of this Section, the service provider shall also submit the following documentation:

1. draft decision of the service provider’s competent body on the re￾appointment of such person;
2. acts of the competent authority referred to in Section 10, paragraph 1, items 2) and 3) of this Decision;
3. other documentation requested by the National Bank of Serbia. Where based on the documents and evidence referred to in this Section it is not possible to establish all facts relevant for assessing good business reputation of the proposed person, the National Bank of Serbia may request the service provider to submit other documentation and/or data it deems necessary.

25. The National Bank of Serbia shall adopt a decision on granting consent to the appointment of proposed members of management and/or director of the service provider within 30 days following the receipt of a duly completed application for such consent. If the application referred to in paragraph 1 of this Section is not duly completed, within 15 days from receiving such application the National Bank of Serbia shall notify the applicant in what way to complete the application duly, in which case the deadline referred to in paragraph 1 of this Section shall start running from the day when the duly completed application was submitted, in accordance with the notification referred to in this paragraph. By the decision on granting the licence for the provision of virtual currency services, the National Bank of Serbia shall also grant consent to the appointment of the member of management and director of the service provider.
26. The service provider shall submit to the National Bank of Serbia a decision of such service provider’s competent body on the appointment of the person for which the consent referred to in Section 25, paragraph 1 of this Decision was granted within five days from the day of adopting such decision. VI. GRANTING PRIOR CONSENT TO ACQUISITION AND/OR INCREASE OF QUALIFYING HOLDING IN THE SERVICE PROVIDER
27. The service provider and/or person intending to acquire a qualifying holding in a service provider or to increase such holding so as to gain from

24 20% to 30%, more than 30% to 50% or more than 50% of voting rights or capital in that service provider, and/or so that it becomes its parent company, shall obtain prior consent of the National Bank of Serbia to such acquisition and/or increase. The application for consent referred to in paragraph 1 of this Section shall state the type, total number and nominal amount of shares and/or the stake and the percentage of the qualifying holder’s holding which it intends to acquire and/or increase in the service provider’s capital. The documentation and evidence referred to in Section 12 of this Decision shall be submitted along with the application for consent referred to in paragraph 1 of this Section. If a person intends to acquire more than 30% of voting rights and/or holding in the service provider’s capital or increase its qualifying holding so as to acquire more than this percent, the overview of activities referred to in Section 12, paragraph 4, item 5) of this Decision must also contain a clearly determined business strategy for the next two years. In addition to the documentation referred to in Section 12 of this Decision, a person intending to acquire a controlling holding or intending to increase a qualifying holding so as to acquire a controlling holding shall also submit the following:

1. business strategy of the service provider in which a qualifying holding is acquired;
2. business plan for the next five business years, including a projection of financial statements;
3. planned changes in the organisational, management and personnel structure of the service provider, with data on new members of management or directors;
4. plan of activities on drafting new or amending existing internal enactments of the service provider;
5. plan of activities relating to the change of existing or introduction of new information technology at the service provider. The National Bank of Serbia shall assess the business reputation and financial condition in the procedure with respect to the application for consent referred to in paragraph 1 of this Section in the manner set out in Section 13 of this Decision. For persons referred to in paragraphs 4 and 5 of this Section, the National Bank of Serbia shall assess whether investment in shares and/or

25 stake in the service provider and the management of such shares and/or stake is their strategic objective, visible in their business policy documents or business practice. Where based on the documents and evidence referred to in this Section and Section 12 of this Decision it is not possible to establish all facts relevant for assessing the capacity of the qualifying holder to ensure safe and sound management of virtual currency service provision, the National Bank of Serbia may request the service provider and/or qualifying holder to submit other documentation and/or data it deems necessary. 28. The National Bank of Serbia shall decide on the application for prior consent to the acquisition and/or increase of a qualifying holding in the service provider within 30 days following the receipt of a duly completed application. If the application referred to in paragraph 1 of this Section is not duly completed, within 15 days from receiving such application the National Bank of Serbia shall notify the applicant in what way to complete the application duly, in which case the deadline referred to in paragraph 1 of this Section shall start running from the day when the duly completed application was submitted, in accordance with the notification referred to in this paragraph. By the decision granting the consent referred to in paragraph 1 of this Section, the National Bank of Serbia shall determine that the person referred to in that paragraph shall acquire, and/or increase a qualifying holding in the service provider within no more than a year following the submission of the decision. The service provider and/or qualifying holder shall notify the National Bank of Serbia of the acquisition and/or increase of a qualifying holding in the service provider within no more than eight days from the day of such acquisition and/or increase. The notification referred to in paragraph 4 of this Section shall specify the type, total number and nominal amount of shares and/or stake and the percentage holding of the qualifying holder which he has acquired and/or increased in the capital of the service provider. VII. GRANTING CONSENT TO GENERAL ENACTMENTS AND AMENDMENTS AND/OR SUPPLEMENTS TO SUCH ENACTMENTS 29. The service provider shall obtain prior consent of the National Bank of Serbia to its general enactments referred to in Section 5, paragraph 1 of this

26 Decision, as well as to amendments and/or supplements to such general enactments. Along with the application for the consent referred to in paragraph 1 of this Section, the service provider shall also submit draft general enactments referred to in that paragraph and/or their amendments and/or supplements, and an explanation of such amendments and/or supplements. The general enactments referred to in paragraph 1 of this Section must meet the requirements set out in Section 5, paragraph 1 of this Decision. The service provider shall adopt and register draft general enactments referred to in paragraph 1 of this Section and/or amendments and/or supplements to such general enactments after being granted the consent referred to in that paragraph. By granting a licence to the service provider, the National Bank of Serbia shall be deemed to have granted consent to the general enactments referred to in paragraph 1 of this Section. VIII. SUBMISSION OF THE PRESCRIBED DOCUMENTS 30. The documents prescribed by this Decision shall be submitted in the form of original or certified copy and may not be older than six months. The documents referred to in paragraph 1 of this Section which are in electronic form shall be submitted in accordance with the law governing electronic document, electronic identification and trust services in electronic business. The documents referred to in paragraph 1 of this Section shall be filed through a special web portal operated by the competent service of the Government of the Republic of Serbia in accordance with the Law. By way of exception to paragraph 3 of this Section, the service provider licensed by the National Bank of Serbia to provide virtual currency services only may also submit the documents referred to in paragraph 1 of this Section directly to the National Bank of Serbia, independently from the special web portal referred to in that paragraph. The documents referred to in paragraph 1 hereof shall be in the Serbian language and if they are in a foreign language, the original or certified copy of such document shall be submitted along with its translation in

27 the Serbian language certified by a court-sworn translator, except in the case of financial statements and audit reports of legal persons in the English language. If the original documents referred to in paragraph 5 hereof are neither in Serbian nor English and it is not possible to obtain the translation from the language they were prepared in, their translations into English and Serbian shall be submitted, certified by a court-sworn translator. IX. ORGANISATIONAL, PERSONNEL AND TECHNICAL CONDITIONS 31. At the time of licensing and during operation, a service provider shall fulfil the conditions of personnel, organisational and technical capacity requirements prescribed by this Decision for the performance of activities in relation to virtual currency service provision, which are appropriate given the nature, complexity and scope of such activities, including possessing the data processing system and maintaining continuity and regularity in the provision of services and performance of activity. A service provider shall establish adequate rules and procedures ensuring that the operation of the company, its management, director and employees is compliant with the provisions of the Law and regulations of the National Bank of Serbia. A service provider performing the activity of a virtual currency trading platform operator shall, at the time of licensing and during operation:

1. have the systems for clear detection and removal of potential negative consequences on the functioning of the virtual currency trading platform and trading participants, which arise from the conflict of interest between the platform operator and its owners on the one hand, and stable functioning of the platform, on the other hand, particularly when such conflict of interest may be detrimental to the functions performed by the platform operator in accordance with the provisions of the Law and regulations of the National Bank of Serbia;
2. be adequately equipped in order to manage the risks it is exposed to, implement appropriate measures and systems for the identification of all significant risks to its operation, and shall have adopted effective measures to mitigate these risks;
3. have the procedures for stable management of the technical functioning of its systems, including the establishment of effective systems in the event of unforeseen circumstances, with the aim to counter risks of system failure;

28 4) have transparent and non-discretionary rules and procedures enabling fair and regular trading and establishing objective criteria for efficient execution of orders; 5) have effective procedures facilitating efficient and timely conclusion of transactions executed within these systems; 6) have sufficient financial resources to facilitate normal functioning of the virtual currency trading platform, given the nature and volume of transactions concluded on the platform, and the scope and degree of risks it is exposed to. 32. Organisational capacity of the service provider shall mean:

1. appropriate organisation of activities related to virtual currency service provision and/or such organisational structure which enables smooth performance of such activities to such service provider within one or more organisational parts;
2. business premises for the performance of activities related to virtual currency service provision which must be owned by the service provider or provided based on a rental or leasing concluded for a period of minimum three years, and which meet the legal requirements regarding technical capacity, occupational safety and environmental protection.

33. Personnel capacity of a service provider shall mean the number of employees sufficient for the performance of activities related to virtual currency service provision, efficient functioning of the governance and internal controls systems, as well as risk management, with professional qualifications and experience adequate to their duties, responsibilities and the complexity of the activities which they perform.
34. Technical capacity of the service provider shall mean the acquisition of hardware components (computer and communication equipment, data storage media, and other technical equipment supporting virtual currency service provision) and software components (system and application software necessary for service provision, bookkeeping/accounting operations and reporting) which in their scope, functionality and performance are adequate to the nature, scope and complexity of the services which are provided.
35. Depending on the legal form in which it operates and the services it provides, the service provider shall set up such organisational structure and/or internal organisation which enables a clear division of duties and responsibilities among managing bodies of the service provider, and among members of these bodies, director of the service provider and other employees, in a manner which prevents a concentration of mutually conflicting functions and ensures a clear line of responsibility, prevention of

29 conflict of interest, as well as an adequate system of internal controls and efficient risk control in the service provider’s operations. A service provider shall ensure:

1. that internal enactments of the service provider on the organisation of its operations unambiguously define the activities, duties and responsibilities of the employees;
2. that all employees are informed about their activities, duties and responsibilities;
3. efficient communication and cooperation at all levels of organisation, and timely and reliable reporting to the management and director of the service provider on all data necessary for decision-making;
4. that the process of making and implementing decisions is transparent, documented and based on the principles of safe and sound management of virtual currency service provision.

36. Depending on the legal form in which it operates and the services it provides, a service provider shall also determine and implement a business strategy containing clearly defined business objectives the achievement of which is easy to monitor, and shall define procedures for monitoring the achievement of such objectives.
37. Depending on the scope, type and complexity of the activities it performs, the service provider shall define and implement a human resources management policy based on principles ensuring employment of staff with appropriate knowledge, expertise and professional experience, and shall define a performance-based employee promotion and reward policy which encourages reasonable and prudent risk taking.
38. The service provider shall ensure adequate communication, exchange of information and cooperation at all levels of organisation, in order to implement its business strategy, its risk management strategy and policies and ensure smooth functioning of the internal controls system. The service provider shall ensure that members of management of the service provide have continuous access to all data and information relevant for the operations of the service provider, including in particular:

1. data and information on the balance of liquidity and capital of the service provider and/or on a potential deterioration of such balance;
2. data on compliance of the service provider’s operations with the rules set out in regulations and internal enactments and significant departures from such rules in practice.

30 39. At the request of the National Bank of Serbia, the service provider shall submit the documentation and/or data which the National Bank of Serbia deems necessary for assessing the fulfilment of the requirements set out in Section 31, paragraph 1 of this Decision. X. ANNEXES 40. The annexes printed along with this Decision form its integral part. XI. TRANSITIONAL AND FINAL PROVISIONS 41. Persons which on the day of entry into force of this Decision provide virtual currency services or begin providing such services after that date shall bring their operations and general enactments in compliance with the provisions of the Law, by-laws adopted on the basis of the Law and this Decision until the date of start of application of this Decision, and shall submit an application for licence in accordance with this Decision to the National Bank of Serbia. 42. This Decision shall enter into force on the eighth day from its publication in the RS Official Gazette, and shall apply as of 29 June 2021. D No 5 G o v e r n o r 13 May 2021 National Bank of Serbia B e l g r a d e Dr Jorgovanka Tabaković, sign.