Decision on Implementation of Provisions of the Law on Payment Services Relating to Issuing of Licenses and Approvals of the National Bank of Serbia

RS Official Gazette, Nos 102/2024 and 95/2025 Pursuant to Article 80, paragraphs 3 and 10, Article 81, paragraphs 2 and 4, Article 82, paragraph 6, Article 82a, paragraph 6, Article 104, paragraph 6, Article 119, paragraph 2, Article 127, paragraph 8 and Article 135, paragraph 7 of the Law on Payment Services (RS Official Gazette, Nos 139/2014, 44/2018 and 64/2024), and Article 15, paragraph 1 of the Law on the National Bank of Serbia (RS Official Gazette, Nos 72/2003, 55/2004, 85/2005 - other law, 44/2010, 76/2012, 106/2012, 14/2015 and 40/2015 - CC decision and 44/2018), the Executive Board of the National Bank of Serbia hereby issues DECISION ON IMPLEMENTATION OF PROVISIONS OF THE LAW ON PAYMENT SERVICES RELATING TO ISSUING OF LICENSES AND APPROVALS OF THE NATIONAL BANK OF SERBIA I. INTRODUCTORY PROVISIONS

1. This Decision governs:

1. the manner of implementing provisions of the Law on Payment Services (hereinafter: the Law) on the basis of which the National Bank of Serbia issues licenses for the provision of payment services and for the issuance of electronic money, registers the account information service providers in the register of payment institutions, and issues and withdraws approval to/from a payment institution and electronic money institution with the head office in the Republic of Serbia for the establishment of a branch for the provision of payment services and/or electronic money issuance in a third country,
2. conditions which a member of a managing body of a payment institution must fulfil and/or detailed conditions which a director of a payment institution and electronic money institution must fulfil, as well as evidence to be submitted to the National Bank of Serbia along with the notification on the appointment of these persons,
3. detailed eligibility criteria that must be met by a person with a qualifying holding in a payment institution, as well as detailed conditions for acquisition and/or increase of a qualifying holding in an electronic money institution,
4. criteria and indicators for determining the minimum liability insurance amount in the form of an insurance contract concluded with an insurance undertaking (hereinafter: insurance contract) or other appropriate means of liability coverage, which the applicant must have when submitting an application for the license to provide payment initiation service and/or when submitting an application for the registration to provide account information

service, as well as the formula for calculating the minimum amount of the insurance contract or other appropriate means of liability coverage. 2. When assessing applications and/or fulfilment of conditions under this Decision, the National Bank of Serbia shall particularly assess whether there are indications that a payment institution and/or electronic money institution is being established, and/or holding therein is acquired for the purpose of money laundering, financing of terrorism, or financing of proliferation of weapons of mass destruction, particularly considering whether the origin of capital of the applicant and/or the origin of funds for the acquisition of the qualifying holding can be identified, and whether these persons or persons related to them have been associated with money laundering, financing of terrorism or proliferation of weapons of mass destruction – based on the information submitted by the authority competent for the prevention of money laundering and financing of terrorism and other available information. The following circumstances may point to the existence of the indication referred to in paragraph 1 hereof:

• a person that is to have a qualifying holding and/or a person for whose account the holding is acquired, has a permanent or temporary residence and/or head office or is operating in a foreign country with strategic deficiencies in the system for the prevention of money laundering and financing of terrorism and/or funds for carrying out the transaction originate from that country;
• a person that is to have a qualifying holding and/or a person for whose account the holding is acquired, is an off-shore legal person within the meaning of the law governing the prevention of money laundering and financing of terrorism or is a person with a holding in an off-shore legal person;
• a person that is to have a qualifying holding and/or a person for whose account the holding is acquired, has a business relationship or carries out transactions through a shell bank within the meaning of the law regulating the prevention of money laundering and financing of terrorism, or through other similar institution for which it can be reasonably assumed that it could allow the use of its accounts by a shell bank;
• whether a person that is to have a qualifying holding and/or a person for whose account the holding is acquired, is obliged, under the regulations of the country of temporary or permanent residence, and/or the country of head office or country of operation, to have internal acts, keep records and apply internal control procedures regarding the detection and prevention of money laundering, financing of terrorism and financing of weapons of mass destruction or in connection with that, and whether it is under the supervision of the competent authority in the country or abroad.

The National Bank of Serbia shall particularly assess whether a person that is to have a qualifying holding is a public official, close family member of the public official and close associate of the public official within the meaning of the law governing the prevention of money laundering and financing of terrorism. II. ISSUING OF A LICENSE TO PROVIDE PAYMENT SERVICES Application for the license to provide payment services 3. A company intending to provide payment services as a payment institution shall submit to the National Bank of Serbia an application for the license to provide payment services in the form provided in Annex 1, listing payment services and other operations that the payment institution intends to provide and/or engage in. The applicant referred to in paragraph 1 hereof (hereinafter: applicant) shall enclose to its application the documents and evidence referred to in Sections 4 to 21 hereof and/or in Sections 4 to 8 and 12 to 22 hereof if the applicant intends to provide the payment service referred to in Article 4, paragraph 1, item 7) of the Law – payment initiation service, as well as the documents and evidence which, in accordance with Section 32, paragraphs 2 to 4 thereof prove good business reputation. If it is not possible to establish all facts relevant for deciding on the application referred to in paragraph 1 hereof on the basis of the documentation and evidence referred to in paragraph 2 hereof, the National Bank of Serbia may request from the applicant to submit other documentation which it finds necessary. Documentation to be submitted with the application for the license to provide payment services Decision on entry of the applicant in the register of business entities 4. The decision on entry of the applicant in the register of business entities implies a document on the registration of the applicant as a company with the head office in the Republic of Serbia with the agency in charge of maintaining the register of business entities (hereinafter: the Agency), including the data on the business name, head office address and registered prevalent business activity of the applicant, its legal form and members, persons authorised to represent it, its agents and procurators, as well as on the registered capital. If any changes of data that are subject to registration occurred since the entry in the register of business entities, an excerpt on registered

data referred to in paragraph 1 hereof not older than five days shall be submitted with the act of registration referred to in the same paragraph. Articles of incorporation and/or articles of association of the applicant 5. Along with the application referred to in Section 3, paragraph 1 of this Decision, the applicant shall submit the articles of incorporation (decision on incorporation or memorandum of association) and articles of association (if the applicant is a joint-stock company), drawn up in accordance with the law governing companies, dated and duly certified. If the articles of incorporation and/or articles of association do not cover the operations that a company would perform after obtaining the license to provide payment services, the applicant shall submit draft amendments to the articles of incorporation and/or articles of association that it will adopt and register after obtaining that license. Proposals for amendments of acts referred to in paragraph 2 hereof shall reflect changes that would occur if the applicant would be granted а license to provide payment services, and shall particularly contain data on a possible change of prevalent business activity, payment services and other operations which the applicant intends to provide and engage in, provided initial capital of the payment institution in required amount, managing bodies, management and internal controls systems, storing of data and documents, keeping of books, preparation of financial statements of a payment institution and auditing of such statements, as well as the provision of payment services through branches, agents in the Republic of Serbia and by outsourcing certain operations to another person. Assessment of risks to which the payment institution will be exposed 6. Assessment of risks to which the payment institution will be exposed shall imply a summary analysis of risk exposures (review of the types of risks and measures for risk management) for each of payment services that the applicant intends to provide. If the applicant intends to provide payment services as a hybrid payment institution, the analysis referred to in paragraph 1 hereof shall also include the risk assessment relating to payment system management, i.e. assessment of the impact of changes in the performance of these operations on the provision of payment services, and particularly the analysis of the impact of business activities not related to the provision of payment services on the safety and soundness of operation of the payment institution.

If the applicant intends to operate through a branch and/or agent or to outsource the operational activities to another person, particular attention in the analysis referred to in paragraph 1 hereof shall be devoted to the assessment of risks arising from such performance of operations. Programme of activities and business plan of a payment institution 7. The programme of activities of the payment institution for each of the payment services covered by the application referred to in Section 3, paragraph 1 hereof shall regulate and specify the manner and conditions of performance in all phases of service provision (providing information in the pre-contractual phase, concluding the payment services contract, initiating a payment transaction, executing a payment transaction, protecting the payment service users’ funds, cash flows, etc.), and describe the manner and conditions for performing operational and auxiliary activities that are directly related to the provision of these services (ensuring the execution of the payment transaction, data storage and processing, currency exchange, granting of loans, etc.), as well as management of the payment system (hybrid payment institution) and performance of other business activities that are unrelated to the provision of payment services. The business plan of the payment institution shall provide an overview of planned activities for the first three years of operation, with the projection of revenues and expenditures for this period. The business plan referred to in paragraph 2 hereof shall contain a short presentation of initial planning elements (data on past business operation of the applicant, available resources (business premises, hardware components, software components, etc.) and number of employees, data from the programme of activities), planned upgrading of organisational, personnel and technical conditions for the operation of the payment institution, expected sources of funds, target group of clients and possible expansion of the business and organisational network. To assess whether the applicant will be able to ensure the fulfilment of relevant organisational, personnel, technical and other requirements for safe and sound operation of a payment institution, the following evidence shall be attached to the business plan referred to in paragraph 2 hereof:

1. the internal organisation plan of a payment institution and a job classification system, including qualifications and experience required for each post, as well as planned schedule for filling vacant posts, which must be in line with the planned expansion of the business and organisational network of the payment institution;

2. an excerpt from the land register, lease contract or another document evidencing that the applicant has appropriate business premises at its disposal;

3. an excerpt from business books or another document evidencing that the applicant has appropriate information system resources at its disposal in accordance with the decision regulating the minimum standards for managing a financial institution’s information system. Evidence that the applicant holds the prescribed amount of initial capital

8. Evidence that the applicant holds the prescribed amount of initial capital implies the statement of applicant’s current account or another relevant account or other appropriate evidence (e.g. excerpt from the register of business entities, etc.). The applicant shall give a written authorisation to the bank in which it holds its funds and/or through which it transacts its business to provide to the National Bank of Serbia, upon its request, all data referring to its business activity and/or balance of its assets with such banks. Projection of the capital requirements amount for the first year of operation of a payment institution
9. Projection of the capital requirements amount for the first year of operation of a payment institution shall be a projection of the amount of these requirements calculated using the method specified in Article 90 of the Law which uniformly applies to all payment institutions, in accordance with the National Bank of Serbia’s decision regulating capital and capital adequacy of payment and electronic money institutions. Description of the processes established for monitoring, resolving, and acting after security incidents
10. The applicant submits a description of the established procedure for monitoring, resolving, and acting after security incidents or complaints, and/or complaints of payment service users (hereinafter: users) related to security, which includes:

1. organisational measures and tools for preventing fraudulent activities;

2. data on person(s) and organisational units responsible for supporting users in cases of fraud, suspected fraud, or security threats, technical issues of users, and/or handling user requests;

3. reporting lines in cases of fraud, suspected fraud, or security threats;

4. contact point for users, including the name and surname and e-mail address of a contact person;

5. procedures for incident reporting, including notifying and reporting to the National Bank of Serbia about significant incidents in accordance with Article 75b of the Law;

6. tools used for monitoring and the established accompanying measures and procedures for mitigating security risks. The description of the processes established for monitoring, resolving, and acting after security incidents related to the resources of the information-communication system (hereinafter: ICT) shall be submitted in accordance with the decision regulating the minimum standards for managing a financial institution’s ICT system. Description of planned measures for safeguarding of users’ funds

11. If the applicant, as a payment institution and in order to ensure the fulfilment of its monetary obligations to users, plans to conclude an insurance contract with an insurance undertaking or to obtain a relevant bank guarantee, it shall specify the particulars about this insurance undertaking and/or bank in the description of measures that the applicant plans to undertake for the safeguarding of users’ funds. The applicant which does not plan to conclude an insurance contract or obtain a guarantee referred to in paragraph 1 hereof, shall specify in the description of planned measures for the safeguarding of users’ funds the data about a bank in which it will open an escrow account for depositing of these funds, or types of assets in which it intends to invest. If it intends to provide payment services as a hybrid payment institution, the applicant shall also submit the methodology referred to in Article 94, paragraph 2 of the Law where it can be expected that in the future operation of this institution within received funds it would not always be possible to determine in advance the amount intended for the execution of payment transactions or this amount would be variable. Description of the management system, internal controls and internal audit systems, with a description of the organisational structure including measures put in place in order to comply with requirements arising from regulations governing the prevention of money laundering and terrorism financing
12. The applicant shall submit a description of the management system and internal control system with data, assessment, and reasoning from which it can be concluded that these systems are proportionate to the nature, scope, and complexity of the payment services that the applicant intends to provide, which specifically includes:

1. an organisational chart with a description of the organisational structure from which one can clearly establish division and separation of tasks, as well as duties and responsibilities relating to the provision of payment services, including the information on whether it is planned, and in which timeframe, to provide certain payment services through branches or agents or to outsource certain operational activities relating to payment service provision to another person;
2. a description of the risk management system, as well as the procedures for identifying, measuring, and monitoring the risks that the applicant will or could be exposed to, together with the procedures for managing these risks and reporting on them;
3. a description of internal controls and plans for their implementation, along with a description of the applicant’s internal audit, accounting procedures, a description of the internal control measures established to fulfil the obligations set by the regulations governing the prevention of money laundering and financing of terrorism, including the procedures for assessing the compliance with those regulations;
4. data on member(s) of the payment institution’s managing body who will be responsible for establishing the procedures for managing the risks to which the payment institution is or could be exposed, for establishing internal controls and internal audit, for establishing appropriate accounting procedures, and for establishing procedures for assessing compliance with the regulations governing the prevention of money laundering and financing of terrorism;
5. data on the number of employees who will be directly engaged in the tasks referred to in items 2), 3), and 4) of this paragraph;
6. other data in accordance with the decision regulating the manner and conditions for establishing, maintaining, and improving the governance and internal controls systems of payment and electronic money institutions. If the applicant intends to provide certain payment services through branches or agents, the description referred to in paragraph 1 hereof shall also include a plan for off-site and on-site checks of these persons that the applicant will carry out at least once a year, as well as a policy that further regulates the conditions that must be met for establishing cooperation with an agent to provide payment services, as well as the procedures for training and supervision of that person. If the applicant intends to outsource certain operational tasks related to payment service provision to another person, the description referred to in paragraph 1 hereof shall also include a description of the planned outsourcing of operational tasks, and/or evidence and documentation in accordance with Article 103 of the Law.

If the applicant intends to provide payment services as a hybrid payment institution, the description referred to in paragraph 1 hereof shall also include the procedures which would ensure that management of the payment system and performance of other business activities does not threaten the safety and soundness of the segment of the payment institution’s operations relating to payment service provision and does not impede supervision over the payment institution. The description of the procedures and mechanisms of internal controls and internal audit referred to in this Section must specifically include the procedures and mechanisms established to protect the interests of users and ensure the continuous, safe and sound payment service provision in relation to Article 82, paragraph 1, items 8) to 12) of the Law and Sections 10, 11 and 12 of this Decision. Description of participation in payment systems 13. If the applicant intends, upon obtaining the license for the provision of payment services, to participate in payment systems, it shall enclose with the application referred to in Section 3, paragraph 1 of this Decision a brief description of the manner in which it intends to participate in these systems, including data on participants in these systems, main risks the applicant would be exposed to as a result of such participation and measures for management of such risks, as well as a short presentation of the rules of operation of such systems. Data on persons who are members of managing bodies and directors of payment institutions 14. Data on members of the managing bodies of the applicant and the director-to-be of the payment institution, as well as documentation evidencing good business reputation and adequate professional qualifications and experience of such persons shall imply data and documentation referred to in Sections 26 and 27 hereof. Data on persons having a qualifying holding 15. Data and documentation referred to in Section 30 hereof shall be considered data on persons having a qualifying holding in the applicant, the size of their holding and documentation evidencing the ability of these persons to ensure safe and sound management of a payment institution. Data on external auditor 16. If the audit of financial statements is mandatory for the applicant according to the law governing auditing, the applicant shall submit data

on the business name, company registration number and head office address of the external auditor who audits its financial statements in the year in which the application referred to in Section 3, paragraph 1 hereof is submitted, as well as the contact data of this auditor. Data on persons having close links with the applicant and description of such links 17. The applicant shall submit a list of persons having close links with it within the meaning of the Law, with the name and surname and contact data (for natural persons) and business name, head office address, company registration number and contact data (for legal persons), as well as description of the nature of these links. Description of the process established for the protection of sensitive payment data 18. The applicant shall submit a description of the management system for sensitive payment transaction data, which specifically regulates the following:

1. a description of the process for storing sensitive payment transaction data;
2. established procedures for granting access to sensitive payment transaction data;
3. a description of monitoring tools;
4. a description of the manner of storing collected data, unless the applicant intends to provide only the payment initiation service;
5. expected internal and/or external uses of the collected data, including by other contractual parties, unless the applicant intends to provide only the payment initiation service;
6. identification of persons with access to sensitive payment transaction data;
7. a description of the methods for detecting and resolving unauthorised access. The description of the process established for the protection of sensitive payment transaction data in relation to the ICT system shall be submitted in accordance with the decision regulating the minimum standards for managing the ICT system of a financial institution. Description of established procedures and mechanisms for business continuity maintenance

19. The applicant shall submit a description of the established procedures and mechanisms for maintaining business continuity, including a clear identification of key business processes, effective

contingency plans, and procedures for regularly testing and reviewing the adequacy and efficiency of such plans, consisting of the following information:

1. business impact analysis, including business processes and recovery objectives, such as targeted recovery times, targeted data recovery points, and protected assets;
2. explanation of how the applicant will address significant events and disruptions that affect business continuity, such as the failure of key systems, loss of key data, unavailability of premises, and loss of key personnel;
3. the frequency with which the applicant intends to test business continuity and crisis recovery plans, including how the results of the tests will be documented;
4. a description of the mitigation measures the applicant will adopt in cases of discontinuation of a certain or multiple payment services provided, ensuring the execution of initiated payment transactions and/or payment transactions related to payment orders received from users and termination of existing contracts. The description of the established procedures and mechanisms for maintaining business continuity in relation to the ICT infrastructure shall be submitted in accordance with the decision regulating the minimum standards for managing the ICT system of a financial institution. Description of principles and definitions applied for collecting statistical data on executed transactions

20. The applicant shall submit a description of the management system for collecting statistical data on executed transactions, as well as on abuses and fraudulent actions related to these transactions, which specifically includes the following:

1. types of data collected, depending on the type of user, type of payment service, type of payment instrument, and currency of the payment transaction;
2. scope of data collection, depending on the activities and subjects to which the data pertains, including branches and agents of payment institutions;
3. methods of data collection and processing of such data;
4. purposes of data collection;
5. frequency of data collection;
6. accompanying documents, such as a manual describing how the data collection system functions. Security policy document

21. The applicant shall submit a security policy document containing the following information:

1. a detailed risk assessment regarding the payment service(s) the applicant intends to provide, which includes risks of fraud, security control measures, and measures taken to mitigate and adequately protect users from identified risks;
2. the type of relationship established with persons to which the service provider has outsourced the execution of specific operational tasks related to payment service provision;
3. a description of the applicant’s data centre;
4. information about payment process security, which includes: – the user authentication process in accordance with the provisions of the decision regulating technical standards for strong customer authentication and common and secure open standards of communication; – a description of the manner of providing secure delivery of payment instruments and personalised security elements to the user; – a description of the system and procedures established by the applicant for transaction analysis and identification of suspicious or unusual transactions;
5. a detailed risk assessment regarding the payment services the applicant intends to provide, including fraud risks, with reference to control measures and risk mitigation measures described in the application, ensuring that the risks pertinent to payment service provision are addressed. The part of the document referred to in paragraph 1 hereof related to the applicant’s ICT system must contain the data prescribed by the decision governing the minimum standards for managing the ICT system of a financial institution. Minimum amount of liability insurance in the form of an insurance contract with an insurance undertaking or other appropriate means of liability coverage

22. The applicant submitting an application for the license to provide payment initiation service is obliged to enclose with the application a liability insurance contract or another appropriate means of liability coverage (hereinafter: liability coverage), which meets the following conditions:

1. covers liability for obligations under Articles 50, 53, and 57 of the Law;
2. covers obligations to account servicing payment service providers or obligations to users resulting from unauthorised access to payment account information or access to such information for

fraudulent purposes, or from unauthorised use of this information or its use for fraudulent purposes, in the case of providing the account information service; 3) covers costs and expenses borne by payment service users and account servicing payment service providers, who require from the applicant the reimbursement of losses arising from one or more obligations under Articles 50, 53, and 57 of the Law; 4) covers the applicant’s obligations regarding its activities, i.e. there are no deductible items or thresholds that could question the payments arising from claims for reimbursement of funds from payment service users and account servicing payment service providers, and the liability coverage is valid at the time the obligation arises; 5) covers the territories where the applicant provides the relevant services. The minimum liability coverage amount is calculated according to the formula provided in Annex 5. The applicant is required to review and recalculate the minimum amount of the liability insurance contract or other appropriate liability coverage at least once a year. Modification of the license to provide payment services 23. If, after obtaining the license to provide payment services, a payment institution intends to provide payment services that are not specified in the decision granting the license, it shall submit to the National Bank of Serbia an application to modify the license. Provisions of this Decision relating to the application for the license to provide payment services shall apply accordingly to the application to modify the license. The license issued in accordance with the application referred to in paragraph 1 hereof shall be considered an integral part of the license to provide payment services. III. SPECIAL RULES FOR PROVIDERS OF ACCOUNT INFORMATION SERVICE 24. A company or entrepreneur intending to provide only the payment services referred to in Article 4, paragraph 1, item 8) of the Law shall submit to the National Bank of Serbia an application for the registration to provide these services using the form provided in Annex 3, along with documentation and evidence proving, in accordance with

Section 32, paragraphs 2 to 4 of this Decision, that they have a good business reputation. The provisions of Sections 4, 5, 7, 12, 14, and 22 of this Decision shall apply accordingly to the documentation and evidence submitted along with the application referred to in paragraph 1 hereof. If, based on the documentation and evidence from paragraphs 1 and 2 hereof, it is not possible to determine all facts significant for deciding on the application referred to in paragraph 1 hereof, the National Bank of Serbia may ask the applicant to submit additional documentation that it deems necessary. IV. ISSUING OF THE LICENSE TO ISSUE ELECTRONIC MONEY 25. A company intending to issue electronic money shall submit to the National Bank of Serbia an application for the license to issue electronic money in the form provided in Annex 4, listing payment services and other operations that an electronic money institution intends to provide and/or engage in, as well as the documentation and evidence which, in accordance with Section 32, paragraphs 2 to 4 hereof prove good business reputation. Provisions set out in Sections 4 through 17 of this Decision shall apply accordingly to documentation and evidence to be submitted with the application referred to in paragraph 1 hereof, including documentation and evidence related to the intention to carry out the distribution and redemption of electronic money through a third natural or legal person with which the contract on the performance of these activities has been concluded. If a company from paragraph 1 hereof intends to provide one or more payment services from Article 4 of the Law, other than electronic money issuance, apart from the application from paragraph 1 hereof, it shall also submit the documentation and evidence that are submitted, in accordance with this Decision, along with the application for the license to provide appropriate payment service, and/or application for the registration to provide the account information service. If it is not possible to establish all facts relevant for deciding on the application referred to in paragraph 1 hereof on the basis of the documentation and evidence referred to in paragraphs 2 and 3 hereof, the National Bank of Serbia may request from the applicant to submit other documentation which it finds necessary.

V. NOTIFICATION AND EVIDENCE CONCERNING THE APPOINTMENT OF A MEMBER OF THE MANAGING BODY OR DIRECTOR OF A PAYMENT AND/OR ELECTRONIC MONEY INSTITUTION Members of managing bodies and the director of a payment institution 26. A payment institution shall notify the National Bank of Serbia of the appointment and dismissal or resignation of the managing body member and/or the director of the payment institution not later than the day following their appointment, dismissal or resignation. Along with the notification on the appointment from paragraph 1 hereof, a payment institution shall provide the following evidence and documentation for the appointed member of the managing body:

1. decision of the competent body of a payment institution on the appointment of the member of the managing body;
2. a copy or a print-out of a valid identification document of that person;
3. an act of the competent authority certifying that the appointed person has not been convicted by a final judgement of a criminal offence to an unconditional sentence of imprisonment, or of other criminal offence making him unfit for discharging this office;
4. a list of associates of the appointed person, with evidence proving that they have not been convicted;
5. an act of the competent authority certifying that an enforceable measure has not been imposed against the appointed person prohibiting him from pursuing professional activities making him unfit for discharging this office;
6. statement of the appointed person in the form provided in Annex 2 and professional CV of that person. In addition to evidence referred to in paragraph 2 hereof, for the person who is directly managing the provision of payment services, a copy of diploma or of the certificate of graduation or another document evidencing that this person has completed at least the first level of higher education at academic studies in the duration of at least four years, as well as the certificate of former employer or another document evidencing that this person has at least three years of experience in management positions in a financial sector entity or in a company whose business activity is similar to that of a payment institution. By way of exception to paragraph 3 of this Section, if, considering the complexity of payment services which a payment

institution intends to provide, a person performing the job is not required to have a level of education and experience referred to in that paragraph for quality management of the provision of services, adequate professional qualifications and experience of that person may be evidenced by submitting other appropriate evidence (certificate, and/or diploma of university, certificates of further education and training, professional development or training, work experience and alike). In the case referred to in paragraph 4 of this Section, adequate professional qualifications and experience shall not be evidenced for a person without at least the first level of higher education and at least one year of experience in management positions in a financial sector entity or in a company whose business activity is similar to that of a payment institution. If managing bodies of a payment institution were to be composed solely of foreign natural persons, the payment institution shall also submit a certificate on fluency in the Serbian language for at least one of these persons and a certificate of his permanent residence in the territory of the Republic of Serbia. Fluency in the Serbian language implies such level of knowledge that enables a person to maintain correspondence and discharge the tasks for which the person is appointed, which shall be evidenced by a certificate of a language learning institution or of a competent higher education institution certifying that the person concerned has passed an examination (in accordance with the curriculum) for acquiring that level of knowledge. 27. The National Bank of Serbia shall assess whether the appointed person has good business reputation based on the documentation and evidence referred to in Section 26, paragraph 2 hereof, and other available data, and it may request from the payment institution referred to in paragraph 1 of that Section to submit other documentation which it finds necessary (e.g. references from persons with whom the appointed person cooperated, evidence of due settlement of tax and other obligations by the company that this person managed before, etc.). When making the assessment referred to in paragraph 1 of this Section, the National Bank of Serbia may also take into account the data on measures undertaken in the process of supervision in respect of the appointed person or his associates or closely related persons, and/or the person in which, at the moment of undertaking these measures, the appointed person had a qualifying holding or was a member of the managing or supervisory body or a manager. A person shall be considered to have good business reputation if in the past work they demonstrated to possess personal,

moral and professional integrity and ability to manage affairs and business risks and achieved good performance and earned reputation in the areas in which they worked. An appointed person shall be considered not to have good business reputation in the following cases: – if they have been convicted by a final judgement of a criminal offence against economy, property, legal transactions, public order, official duty or judiciary or a criminal offence of money laundering or terrorism financing or of a criminal offence to an unconditional sentence of imprisonment or similar or comparable criminal offences in accordance with the regulations of a foreign country; ‒ if an associate of that person has been convicted by a final judgement of criminal offences referred to in indent 1 hereof; – if they have committed, in the last ten years, a grave violation and/or repeated violations of regulations governing the prevention of money laundering and terrorism financing. If for justifiable reasons it cannot obtain the evidence of non￾conviction referred to in Section 26, paragraph 2, item 4) of this Decision, the appointed person may also submit a statement given under financial and criminal liability confirming that his associates have not been convicted. The National Bank of Serbia may at any time request that the appointed person submit evidence of non-conviction of those associates or request such evidence directly from the competent authority. According to this Decision, an associate shall mean:

1. any natural person who is a member of a managing body or other responsible person in the legal person in which the appointed person is in a managing position or is the beneficial owner of that person;
2. any natural person who is a beneficial owner of a legal person in which the appointed person is in a managing position;
3. any natural person who – jointly with the appointed person holds beneficial ownership in the same legal person. Members of managing bodies and directors of an electronic money institution

28. Provisions of Sections 26 and 27 hereof shall apply accordingly to members of managing bodies and directors of an electronic money institution. Members of managing bodies and directors of agents of a payment institution and electronic money institution

29. Provisions of Sections 26 and 27 hereof shall apply accordingly to members of managing bodies and directors of agents of a payment institution and an electronic money institution. By way of exception to paragraph 1 of this Section, if, considering the complexity of payment services which a payment institution or electronic money institution intends to provide through its agent, a person performing the job is not required to have a level of education and experience referred to in paragraph 26 of this Decision for quality management of the provision of services, adequate professional qualifications and experience of that person may be evidenced by submitting other appropriate proofs (certificate, and/or diploma of secondary education, certificates of further education and training, professional development or training, work experience and alike). In the case referred to in paragraph 2 of this Section, adequate professional qualifications and experience shall not be evidenced for a person without at least secondary education and at least one year of experience in a financial sector entity or in activities similar to those of a payment institution or electronic money institution. VI. REQUIREMENTS FOR ACQUISITION AND/OR INCREASE IN QUALIFYING HOLDING IN A PAYMENT INSTITUTION AND ELECTRONIC MONEY INSTITUTION Requirements for acquisition and/or increase in qualifying holding in a payment institution

30. A person that intends to acquire a qualifying holding in a payment institution or to increase its qualifying holding so as to gain from 20% to 30%, more than 30% to 50% or over 50% of voting rights or capital in that institution, and/or to become its parent undertaking, shall submit an application for prior approval of the National Bank of Serbia for this acquisition and/or increase. If the qualifying holder is a natural person, the following documentation and evidence shall be submitted along with the application from paragraph 1 hereof:

1. the name and surname, contact information and a copy or a printout of a valid identification document of that person;

2. professional CV of the qualifying holder, including a list of all companies in which they are employed or a member of managing or supervisory body, or in which they used to work or were a member of such bodies, with their contact information;

3. data on financial standing, i.e. on own assets (immovable property, stake in the capital in other legal persons with percentage of its holding, cash deposits in banks including the name and head office of the bank and the number of bank account, etc.) with appropriate evidence about the ownership of such assets and proof of their origin;

4. statement on indebtedness of the qualifying holder with domestic and foreign legal and natural persons, with the list of such persons and debt contracts and amounts;

5. acts referred to in Section 26, paragraph 2, items 3), 4) and 5) hereof;

6. decision of the competent authority on tax obligations assessed on all grounds and proof of the competent authority that all due tax has been settled;

7. proof of the origin of assets (source of assets) used to acquire a qualifying holding. If a qualifying holder is a legal person, the following documentation and evidence shall be submitted along with the application referred to in paragraph 1 hereof:

8. an excerpt from the register of business entities and/or an act of registration with the competent body issued not more than five days earlier;

9. an excerpt from the book of shareholders or book of stakes with a list of persons who are ultimate owners of that legal person all the way down to natural persons, including the following data: personal/business name, address of permanent residence/registered head office and other identification data, as well as absolute amount and percentage interest in the qualifying holder;

10. for members of governing and managing bodies and supervisory bodies in a qualifying holder and any of its closely related persons – information and documentation referred to in paragraph 1, items

11. and 5) of this Section;

12. financial statements of the qualifying holder with the opinion of a certified auditor for the last two business years, as well as the financial statement of this person for a specified period of the current year;

13. a brief overview of business activities of the qualifying holder over the past two years and activity plan for the current and/or the following year;

14. data on whether the qualifying holder has a holding and/or a stake in any other legal person as follows: date and grounds for acquisition of holding, percentage of its holding and/or stake in the capital of another legal person, as at the date preceding the date when the application referred to in paragraph 1 hereof is sent, and information

whether that other legal person made any profit in the past two years and if so, its amount; 7) the statement on total indebtedness of the qualifying holder in domestic and foreign legal and natural persons, with the list of those persons and debt amounts; 8) most recent decisions of the competent authority on tax obligations of the qualifying holder assessed on all grounds and proof of the competent authority that all due tax has been settled; 9) evidence proving that a legal person has not been convicted; 10) proof of the origin of assets (source of assets) used to acquire a qualifying holding. If the qualifying holder is a member of a group of companies, that person, and/or a payment institution shall submit to the National Bank of Serbia, in addition to the documentation referred to in paragraph 3 hereof:

1. information on the composition of that group;
2. information on persons having a controlling holding in that group;
3. report on audit of consolidated financial statements of the group for the previous two years prepared by the certified auditor;
4. data on the types of business performed by the group and its members;
5. analysis of the expected interaction between the payment institution in which the qualifying holder acquired the qualifying holding, group of companies in which the holder concerned is a member, as well as its members;
6. procedures of a group of companies establishing a governance system and internal controls system. By way of exception to paragraph 3 hereof, if the qualifying holder is a foreign legal person whose securities are listed in OECD countries, that person and/or the payment institution shall submit to the National Bank of Serbia:
7. a list of persons with qualifying holding in the qualifying holder, with main data about these persons;
8. evidence that the qualifying holder is listed on the stock exchange;
9. documentation prescribed in paragraph 3, items 3) to 10) of this Section.

If the qualifying holding is acquired by the Republic of Serbia, the Decision of the Government of the Republic of Serbia concerning the acquisition of a stake, specifying the amount to be paid shall be submitted to the National Bank of Serbia. If the qualifying holding is acquired by a local self-government unit or a legal person established by the Republic of Serbia, documentation referred to in paragraph 3, items 4) to 10) of this Section shall be submitted to the National Bank of Serbia. If it is not possible to establish all facts relevant for deciding whether the qualifying holder meets eligibility requirements to ensure safe and sound management of a payment institution on the basis of the documentation and evidence referred to in this Section, the National Bank may request from the qualifying holder and/or from the payment institution to submit other documentation which it finds necessary. If the person intends to acquire more than 30% of voting rights and/or stake in the capital of a payment institution or to increase its qualifying holding so as to acquire more than that percentage, the plan of activities referred to in paragraph 3, item 5) hereof must contain a clearly defined business strategy for the following two years. A person intending to acquire a controlling holding or to increase its qualifying holding so as to acquire a controlling holding in the capital of a payment institution shall submit, in addition to documentation referred to in paragraph 2, and/or paragraph 3 hereof, the following documentation for the payment institution in which it is acquiring controlling holding:

1. a business strategy of the payment institution;
2. a business plan of the payment institution for the following five business years, which includes the projection of financial statements;
3. planned changes in the organisational, managerial or personnel structure of the payment institution, including data on new members of the management or directors;
4. plan of activities to draw up new or amend the existing internal acts of the payment institution;
5. plan of activities relating to the change of existing or introduction of new information technology in the payment institution.

31. When assessing the documentation from Section 30 of this Decision, with regard to the fulfilment of eligibility requirements for qualifying holders, the National Bank of Serbia shall particularly take into account the circumstance whether the activities of the person intending to acquire a qualifying holding in the payment institution may pose risk to safe and sound management of the payment institution, and/or negatively affect the ability of the payment institution to ensure operational compliance with law, regulations and acts of the National Bank of Serbia. When making such assessment, the National Bank of Serbia shall particularly take into account whether the business and other activities of that person, and/or his associates and closely related persons are, in their nature, such that risks in their performance may negatively affect the operation of the payment institution, and/or that the person intending to acquire a qualifying holding in the payment institution could not positively affect the operation of the payment institution in the long run. The activities referred to in paragraph 1 of this Section may particularly include the activities involving high-risk investment, activities in relation to which there is a higher risk of high indebtedness and/or default, activities due to which the person’s account was blocked in an enforced collection procedure, or which have led to a legal person not holding any current or other payment account with a bank, activities associated with a high risk of money laundering, terrorist financing, or the financing of the proliferation of weapons of mass destruction – such as trade in and production of arms, trade in and production of military equipment, trade in dual-use goods, re￾export operations, trade in secondary raw materials, pawnbroking operations, or the provision of financial services by a parent company in a state that does not apply standards in the field of the prevention of money laundering, terrorist financing, and the financing of the proliferation of weapons of mass destruction – as well as other activities which, by their nature and the circumstances associated with them, would be considered high-risk activities within the meaning of paragraph 1 of this Section. The National Bank of Serbia shall consider in particular whether the activities or actions of the person intending to acquire a qualifying holding in the payment institution may violate competition by aiming at or resulting in significant restriction, jeopardy or prevention of competition, and/or whether the acquisition of the holding may result in the concentration of participants in the payment services market or a dominant position of the person in that market. When making such assessment, the National Bank of Serbia – by taking into account the payment institution’s market share in the provision of payment services and all other features of those services (e.g. the types of payment services, cooperation with an international money transfer company if those are remittance services, the network of intermediaries if payment

services are provided via intermediaries) – shall consider in particular whether the acquisition of a qualifying holding in the payment institution may result in the concentration of participants in the payment services market or a dominant position in the market, which may negatively affect that market or smooth functioning of the payment system and stability of the financial system. The National Bank of Serbia shall assess business reputation and financial standing in the procedure undertaken upon the application from paragraph 1 hereof in the manner described in paragraphs 1 to 3 and Section 32 hereof. For persons referred to in paragraphs 9 and 10 of Section 30 hereof, the National Bank of Serbia shall assess whether the investment in shares and/or stakes of a payment institution and management of these shares and/or stakes is its strategic goal, visible from its policy acts or business practice. 32. Business reputation of the qualifying holder – natural person and/or members of the managing body of the qualifying holder – legal person and persons closely related to that legal person shall be assessed by the National Bank of Serbia in the manner laid down in Section 27 hereof. The National Bank of Serbia shall assess whether the qualifying holder – legal person has good business reputation on the basis of documents and evidence referred to in Section 30, paragraphs 3 to 10 hereof, and other available data (e.g. data on measures undertaken in the procedure of supervision in respect of this person or the person closely related to him, and/or the person in which, at the moment of undertaking these measures, this person had a qualifying holding), and it may request from the qualifying holder and/or from the payment institution to submit other documentation which it finds necessary. A legal person which has demonstrated throughout its past business performance its ability to manage risks, achieved good business results and earned reputation in the area of its business activity shall be considered to possess good business reputation. A legal person shall be considered not to have good business reputation in the following cases: ‒ if they have been convicted by a final judgement of criminal offences against economy, property, legal transactions, public order, official duty or judiciary or criminal offences of money laundering or terrorism

financing, or similar or comparable criminal offences in accordance with the regulations of a foreign country; – if they have committed, in the last ten years, a grave violation and/or repeated violations of regulations governing the prevention of money laundering and terrorism financing. When assessing the financial standing of a qualifying holder - natural person, the National Bank of Serbia shall assess the ability of that person to finance from their own resources (disregarding borrowed funds), their participation in the capital of the payment institution and, where appropriate, to provide additional capital. When assessing the financial standing of a qualifying holder - legal person, the National Bank of Serbia shall assess the ability of that person to finance its participation in the capital of the payment institution and, where appropriate, to provide additional capital, particularly on the basis of data from financial statements of that person. 33. A payment institution shall at least once a year and at the request of the National Bank of Serbia, notify the National Bank of Serbia of the identity of all persons with qualifying holdings in the institution and of the size of their respective holdings. Requirements for acquisition or increase of a qualifying holding in an electronic money institution 34. A person that intends to acquire a qualifying holding in an electronic money institution or to increase its qualifying holding so as to gain from 20% to 30%, more than 30% to 50% or over 50% of voting rights or capital in that institution, and/or so as to become its parent company, shall submit an application for prior approval of the National Bank of Serbia for this acquisition and/or increase. The provisions of Section 30 of this Decision shall apply accordingly to the documentation and evidence to be submitted with the application referred to in paragraph 1 hereof. If a person intends to acquire more than 30% of voting rights and/or stake in the capital of an electronic money institution or to increase its qualifying holding so as to acquire more than that percentage, the plan of activities referred to in Section 30, paragraph 3, item 5) hereof must contain a clearly defined business strategy for the following two years.

A person intending to acquire a controlling holding or to increase its qualifying holding so as to acquire controlling holding in the capital of an electronic money institution shall submit, in addition to documentation referred to in paragraph 2 hereof:

1. a business strategy of the electronic money institution in which it is acquiring a qualifying holding;
2. a business plan for the following five years, which includes the projection of financial statements;
3. planned changes in the organisational, managerial or personnel structure of the electronic money institution, including data on new members of the management or directors;
4. plan of activities to draw up new or amend the existing internal acts of the electronic money institution;
5. plan of activities relating to the change of existing or introduction of new information technology in the electronic money institution. The National Bank of Serbia shall assess business reputation and financial standing in the procedure undertaken upon the application from paragraph 1 hereof in the manner described in Section 31, paragraphs 1 to 3 and Section 32 hereof. For persons referred to in paragraphs 3 and 4 hereof, the National Bank of Serbia shall assess whether the investment in shares and/or stakes of an electronic money institution and management of these shares and/or stakes is their strategic goal, visible from their policy acts or business practice.

35. An electronic money institution shall at least once a year and at the request of the National Bank of Serbia, notify the National Bank of Serbia of the identity of all persons with qualifying holdings in the institution and of the size of their respective holdings. VII. PROVISION OF PAYMENT SERVICES AND ISSUANCE OF ELECTRONIC MONEY THROUGH A BRANCH
36. A payment institution may provide payment services in a third country solely through a branch. To establish each individual branch in a third country, a payment institution shall submit to the National Bank of Serbia an application for issuing the approval in the form provided in Annex 6, listing payment services

and other operations that the payment institution intends to provide and/or engage in through a branch. Along with the application from paragraph 2 of this Section, the payment institution shall submit the following documents:

1. organisational chart with a brief description of the organisational structure of the branch from which one can clearly establish division and separation of tasks, as well as duties and responsibilities relating to the provision of payment services through a branch;

2. business plan of the branch for the first three business years, with the description of payment services that it intends to provide through the branch;

3. documentation referred to in Section 26, paragraph 2, items

4. to 6) and paragraph 4 of this Decision for persons who will manage the affairs of the branch and persons who will directly manage the provision of payment services in the branch. If it is not possible to establish all facts relevant for deciding on the application referred to in paragraph 1 hereof on the basis of the documentation and evidence referred to in paragraph 3 hereof, the National Bank may request from the payment institution to submit other documentation which it finds necessary. The National Bank of Serbia shall reject the application for approval of the establishment of a branch if on the basis of submitted documents and other available information it concludes:

5. that the payment institution which intends to establish a branch does not have adequate organisational, technical and personnel structure or adequate financial standing to be able to provide planned payment services in a third country or it is likely, having in view such structure and financial standing, that its operation through a branch would have adverse effect on the safety and soundness of the segment of its operation in the Republic of Serbia;

6. that given the regulations of that third country or practice in the implementation of these regulations, it is likely that supervision will be hampered or prevented; or

7. that the payment institution which intends to establish a branch is actually trying to flout regulations and rules in force in the Republic of Serbia. The National Bank of Serbia shall withdraw an approval issued to a payment institution for the establishment of a branch in a third country:

8. if the competent authority in a third country has prohibited the payment institution from providing payment services in its territory;

9. if the branch does not begin to operate within 12 months from the date the approval was received;

10. if the branch fails to perform activities covered by the approval for a period of over six months;

11. if the payment institution obtained the approval for the establishment of a branch based on false or incorrect data which are material for the issuance of the approval for the establishment of a branch;

12. if a payment institution notifies the National Bank of Serbia in writing that its branch in a third country ceased to operate;

13. if the activities of the branch are connected to money laundering or terrorism financing. The National Bank of Serbia may withdraw an approval issued to a payment institution for the establishment of a branch in a third country:

14. if it has been established that the payment institution no longer possesses organizational, technical and personnel capacities for the services it provides;

15. if it has been established that the operation of the payment institution through a branch has an adverse effect on the safety and soundness of the segment of its operation in the Republic of Serbia;

16. if in the operation of its branch the payment institution does not comply with the third country’s regulations;

17. if from the territorial distribution of payment services provided it follows that the payment institution thus avoids stricter regulations and rules in force in the Republic of Serbia.

37. An electronic money institution may issue electronic money and provide payment services in a third country only through a branch. To establish a branch in a third country, an electronic money institution shall submit to the National Bank of Serbia an application for issuing the approval in the form provided in Annex 6, listing payment services and other operations that the payment institution intends to provide and/or engage in through a branch. The issuance/withdrawal of approval to/from an electronic money institution to issue electronic money and provide payment services through a branch shall be subject to the provisions of Section 36 hereof. VIII. SUBMISSION OF THE PRESCRIBED DOCUMENTATION AND EVIDENCE OF PAID FEES

38. The documentation prescribed by this Decision shall be submitted in original or in certified copies and shall not be older than six months. The documentation referred to in paragraph 1 hereof shall be in Serbian, and if it is prepared in a foreign language, the original and/or a certified copy of the document shall be accompanied by the translation into the Serbian language, certified by a court interpreter (certified translator), unless these are financial statements and reports on audit of financial statements of legal persons in the English language. If the original document referred to in paragraph 2 hereof is not in the Serbian or English language and it is not possible to obtain the translation from the language in which it is made, its translations into the English and Serbian language, certified by a court interpreter, shall be submitted.

39. The applicants referred to in this Decision shall, along with the prescribed documentation, submit to the National Bank of Serbia the evidence of payment of the fee determined by the decision governing uniform fees charged for services provided by the National Bank of Serbia.

40. The payment and electronic money institution shall submit to the Agency the application for registration of all changes in respect of which the approval of the National Bank of Serbia is required, in accordance with the Law and this Decision, and shall submit evidence thereof to the National Bank of Serbia within five days from receiving the act of the Agency on the registration of such changes. In the case referred to in Section 5, paragraph 2 of this Decision, the company which obtained the license for the provision of payment services or the license for issuing electronic money or which was registered to provide the account information service shall submit to the National Bank of Serbia within the time limit referred to in paragraph 1 of this Section a consolidated version of the articles of incorporation and/or articles of association. A payment institution and an electronic money institution shall submit to the National Bank of Serbia information on the telephone number, e-mail address and website of a payment or electronic money institution within 30 days from receipt of the decision of the National Bank of Serbia granting the license for the provision of payment services and/or for issuing electronic money, respectively, and the e-mail address of the branch within 15 days from the receipt of the decision of the National Bank of Serbia granting approval for the provision of payment services and issuing of electronic money through a branch.

41. The Annexes to this Decision are integral thereto.

IX. TRANSITIONAL AND FINAL PROVISIONS 42. Procedures initiated until the start of application of this Decision shall be completed in accordance with the Decision on Implementation of Provisions of the Law on Payment Services Relating to Issuing of Licenses and Approvals of the National Bank of Serbia (RS Official Gazette, Nos 55/2015, 82/2015, 29/2018, 15/2019, 58/2022 and 111/2022). 43. This Decision repeals the Decision on Implementation of Provisions of the Law on Payment Services Relating to Issuing of Licenses and Approvals of the National Bank of Serbia (RS Official Gazette, Nos 55/2015, 82/2015, 29/2018, 15/2019, 58/2022 and 111/2022). 44. This Decision shall enter into force on the eighth day following its publication in the RS Official Gazette and shall apply as of 6 May 2025. NBS Executive Board No 80 Chair 20 December 2024 of the Executive Board of the National Bank of Serbia B e l g r a d e G o v e r n o r of the National Bank of Serbia Dr Jorgovanka Tabaković, sgd.