Decision on Conditions and Manner of Establishing and Verifying Identity of a Natural Person through Means of Electronic Communication

RS Official Gazette, Nos 15/2019, 84/2020 and 49/2021 Pursuant to Article 18, paragraph 8 of the Law on the Prevention of Money Laundering and Terrorism Financing (RS Official Gazette, No 113/2017), and Article 15, paragraph 1 of the Law on the National Bank of Serbia (RS Official Gazette, Nos 72/2003, 55/2004, 85/2005 – other law, 44/2010, 76/2012, 106/2012, 14/2015, 40/2015 – CC decision and 44/2018), the Executive Board of the National Bank of Serbia adopts the following DECISION ON CONDITIONS AND MANNER OF ESTABLISHING AND VERIFYING IDENTITY OF A NATURAL PERSON THROUGH MEANS OF ELECTRONIC COMMUNICATION Introductory provisions

1. This Decision regulates the conditions and manner of establishing and verifying the identity of a customer who is a natural person, of a legal representative of that customer, of a customer who is an entrepreneur and of a natural person who is a representative of a customer that is a legal person through means of electronic communication without mandatory physical presence of the person who is being identified at the obliged entity (hereinafter: video identification).
2. For the purposes of this Decision, the terms below shall mean as follows:

1. оbliged entity means a person supervised by the National Bank of Serbia with regard to the implementation of the law governing the prevention of money laundering and terrorism financing, and includes а bank, voluntary pension fund management company, financial lessor, insurance undertaking, insurance brokerage undertaking, insurance agency undertaking and insurance agent with a licence to carry out life insurance business (except for agency undertakings and insurance agents for whose work the insurance undertaking is responsible in accordance with law), electronic money institution, payment institution, public postal operator and digital asset service provider in the part of operations relating to virtual currencies;
2. customer means a natural person and entrepreneur who, in accordance with the law governing the prevention of money laundering and terrorism financing, carries out a transaction or establishes a business relationship with the obliged entity, a legal representative of a natural person who carries out a transaction or establishes a business relationship with the obliged entity on behalf of that person, and a natural person who is a representative of a legal person and who carries out a transaction or establishes a business relationship with the obliged entity on behalf of that legal person;

2 3) personal document means a valid document with a photo issued by the competent authority (e.g. an identity card or a passport); 4) security elements mean elements of a personal document aimed at reducing the risk of counterfeiting or unauthorised changes to the document (e.g. microprint, optically variable ink, guilloche elements, diffractive optically variable element, relief elements, MLI zone). Conditions for carrying out video identification Organisational, staff and technical conditions 3. Video identification may be carried out only by an employee at the obliged entity who passed a special training for carrying out the video identification procedure (hereinafter: employee). The obliged entity shall define the programme for the training referred to in paragraph 1 hereof, including at least the following:

1. familiarisation with the provisions of the law governing the prevention of money laundering and terrorism financing and the relevant secondary legislation adopted based on that law, as well as with the provisions of the law governing personal data protection;
2. familiarisation with security elements and method of authentication of personal documents;
3. familiarisation with the manner of carrying out video identification procedure in accordance with this Decision.

4. The video identification procedure shall be carried out at a designated room at the obliged entity which is physically separated from other premises. Access to the video identification room shall be constantly controlled and restricted to employees with access permission, and there shall be mandatory video surveillance.
5. Video identification shall be carried out in real time, without interruption. The obliged entity shall ensure technical solutions which enable real￾time streaming of image and sound (live streaming) and total encryption of communication between the customer and obliged entity (еnd-to-end encryption). Technical solutions from paragraph 2 hereof shall also ensure high quality of image and sound streaming, connection with the accurate time

3 source and an uninterrupted recording of the entire video identification procedure (video sound recording). In the video identification procedure, the obliged entity may also use tried and tested technical solutions intended to help the employee authenticate the personal document, without prejudice to employee’s obligations from Sections 9 to 11 hereof. Personal documents 6. Only personal documents which contain security elements and a machine readable zone may be used in the video identification procedure. Categories of customer risk 7. An obliged entity may not establish and verify the identity of a customer and/or person in a video identification procedure in the following cases:

1. if the obliged entity previously classified the natural person, entrepreneur or legal person into the category of high money laundering and terrorism financing risk (hereinafter: ML/TF risk), based on the ML/TF risk analysis developed in accordance with the regulations governing the prevention of money laundering and terrorism financing;
2. if the legal person establishing a business relationship or carrying out a transaction is an off-shore legal person;
3. if there is an off-shore legal person in the ownership structure of a legal person establishing a business relationship or carrying out a transaction;
4. if a person establishing a business relationship or carrying out a transaction comes from a country with strategic deficiencies in its system for the prevention of money laundering and terrorism financing. Customer’s consent

8. Prior to initiating a video identification procedure, the obliged entity shall obtain the customer’s express consent to the entire video identification procedure and particularly to the recording of image and sound and keeping the recorded material (video sound recording) in accordance with law. The consent from paragraph 1 hereof shall be recorded (video sound recording). The employee shall inform the customer in advance about the

4 obligation to obtain the consent from paragraph 1 hereof and that the granting of consent shall also be video and sound recorded. Video identification procedure Personal document authentication 9. The employee shall authenticate a personal document by checking security elements which can be visually recognised under light, and/or when moving the document (e.g. optically variable ink, diffractive optically variable element, MLI zone) and which such type of personal document should contain. For that purpose, the employee may ask the customer to show the personal document before camera in a certain direction, to move the personal document and/or to cover a specific part of it by hand. 10. The employee shall establish if the personal document contains the data that such type of personal document should contain, namely:

1. customer data: name, surname, date and place of birth and citizen’s unique personal number for Serbian nationals;
2. biometric customer data: a photo, fingerprint and/or signature;
3. personal document data: the number of the personal document, date of issuance with the validity period, place of issuance and the name of the issuer of the personal document;
4. data on permanent and/or temporary residence of the customer, unless such data can be established by an immediate (visual) inspection of the personal document, in which case such data shall be established in accordance with Section 19 hereof. The employee shall establish whether the layout of data from paragraph 1 hereof in a personal document, as well as the number, size and font of the characters correspond to that type of personal document. The employee shall check in particular if the personal document number is correct (type, number and layout of characters, as well as the position in the personal document). The validity period of the personal document must correspond to the date of issuance and be determined in accordance with regulations.

11. The employee shall check if the personal document has been damaged and/or changed and if the photo has been added subsequently (e.g. glued, fastened). Customer identification

5 12. A customer shall be identified by comparing his physical appearance with the photo in the personal document. The employee shall compare the customer’s physical appearance and the photo in the personal document with the customer’s date of birth specified in the personal document, in order to assure himself of the customer’s age. 13. The employee shall also compare the data from the personal document with the information provided by the customer during conversation. For that purpose, the employee may ask the customer to disclose some of the data contained in the personal document, which the customer must be unambiguously cognizant of (e.g. his date of birth). The employee shall assess if the customer’s responses to the questions posed are convincing, sensible and consistent. 14. The employee shall interview the customer in Serbian. By way of exception, the interview may be in English, provided that the employee holds a certificate proving an advanced knowledge of English (at least C1 level according to the Common European Framework of Reference for Languages) issued by a certified foreign language teaching institution, a certificate of an accredited faculty of philology or an internationally recognised certificate. The obliged entity shall establish, by its internal regulations, employee guidelines for customer interview, in accordance with this Decision. 15. If a business relationship is established or a transaction carried out by a legal representative on behalf of a natural person, the employee shall also identify the represented person, in accordance with the regulations governing the prevention of money laundering and terrorism financing. In the case referred to in paragraph 1 hereof, the employee shall ask the customer – legal representative of the natural person to also show before the camera а personal document of the represented person, and/or other official document identifying thе person, as well as a public document which proves the status of the person’s legal representative. The personal document referred to in paragraph 2 hereof shall meet the conditions from Section 6 of this Decision and the employee shall authenticate it in accordance with Sections 9 to 11 of this Decision.

6 16. If the obliged entity already possesses some customer data, the employee shall compare those data with the ones obtained in the video identification procedure. Authentication of customer identity 17. The obliged entity shall ensure the authentication of customer identity during a video identification procedure using a one-time password – ОТP. The obliged entity shall submit the one-time password from paragraph 1 hereof to the customer using the phone number which the customer will use for communication with the obliged entity in connection with the business relationship established and/or transaction performed with that entity in accordance with this Decision, and which the customer provided in the interview with the employee. The obliged entity shall submit the one-time password to the customer – representative of a legal person using the phone number which the representative will use for communication with the obliged entity in connection with the business relationship established and/or transaction performed with that entity on behalf of the legal person it represents in accordance with this Decision, and which the representative provided in the interview with the employee. The obliged entity shall ensure that the time validity of the one-time password is limited to a period required to authenticate customer identity. The obliged entity shall ensure that the authentication of customer identity from this Section is recorded and that the recording is kept in accordance with the decision governing minimum standards of managing the information system of a financial institution and this Decision. 18. The video identification procedure may be completed only if the customer identity is authenticated in accordance with Section 17 hereof. Obtaining documents 19. Prior to establishing a business relationship, and/or carrying out a transaction with the customer who was identified in accordance with this Decision, the obliged entity shall also obtain a photocopy of the personal document which the customer used in the procedure and photocopies of the documents from Section 15, paragraph 2 hereof, which it shall keep in accordance with law. If it is not possible, based on the photocopy of the customer’s personal document referred to in paragraph 1 hereof, to obtain a piece of data on the customer’s permanent and/or temporary residence or other data

7 prescribed by the law governing the prevention of money laundering and terrorism financing, the obliged entity shall also obtain a scan reading of the customer’s personal document and/or a photocopy of other official document containing that piece of data (e.g. a driver’s licence or property tax assessment decision), and if for objective reasons the missing piece of data cannot be obtained that way either, such piece of data shall be obtained directly from the customer. Direct obtaining referred to in paragraph 2 hereof shall mean obtaining the piece of data referred to in that paragraph orally, in the video identification procedure, along with the submission of the copy of the document or other proof confirming such piece of data prior to establishing a business relationship and/or carrying out a transaction from paragraph 1 hereof (e.g. phone or utility bill containing such piece of data or a statement given by the customer under full criminal and financial liability). A photocopy and/or a scan reading referred to in paragraphs 1 to 3 hereof shall also mean a digitised (e.g. scanned or photographed) document referred to in that paragraph. Recording the procedure and keeping the recording 20. The obliged entity shall ensure an uninterrupted recording of the entire video identification procedure (video sound recording), including the customer’s consent from Section 8 hereof. Faces of the customer and the employee carrying out the video identification procedure shall be visible throughout the recording, as well as the date and time of the recording. The recording from paragraph 1 hereof shall be a part of the customer file and the obliged entity shall keep it in the manner and within the deadlines prescribed by the laws governing the prevention of money laundering and terrorism financing and personal data protection. Procedure termination 21. A video identification procedure shall be terminated in the following cases:

1. if it is not possible to ensure uninterrupted image and sound streaming (e.g. due to a brief loss of image and/or sound or freezing of image) or high quality streaming (e.g. the image is not sharp and clear, colours are missing, lines appear on the screen and/or noise);
2. if there is poor light or noise in the room in which the customer stays during the procedure, which prevents authentication of the personal

8 document or customer identification or if the customer and employee’s voices in the video identification procedure cannot be clearly heard; 3) if during the procedure there is any doubt as to the authenticity of the personal document and/or identity of the customer; 4) if, due to other barriers in communication, image and/or sound streaming or other circumstances, the employee is unable to authenticate the personal document or identify the customer. Identity of the customer who participated in the procedure that was terminated in accordance with paragraph 1 hereof shall be established by inspection of the customer’s personal document, with mandatory physical presence of the customer on the obliged entity’s premises in accordance with the law governing the prevention of money laundering and terrorism financing. By way of exception from paragraph 2 hereof, identity of the customer referred to in that paragraph may also be established in a new video identification procedure, except in the case from paragraph 1, item 3) hereof, but only if the previous procedure was terminated due to a circumstance which may be removed (e.g. technical issues) and only upon the removal of that circumstance. A new procedure shall be carried out as if the previous procedure did not take place, so the obliged entity shall again obtain the customer’s consent in accordance with Section 8 hereof. In accordance with the ML/TF risk assessment, the obliged entity shall determine in its internal regulations the maximum number of failed attempts of carrying out the video identification procedure after which the customer shall be identified in accordance with paragraph 2 hereof. Outsourcing video identification to a third party 22. If the obliged entity outsources the establishment and verification of customer identity to a third party, in accordance with the provisions of the law governing the prevention of money laundering and terrorism financing pertaining to reliance on a third party to perform certain customer due diligence actions and measures, such third party may establish and verify customer identity in a video identification procedure in accordance with this Decision, but only on condition that the definition of obliged entity referred to in Section 2, item 1) of this Decision applies to that third party as well. The outsourcing referred to in paragraph 1 hereof shall also be subject to appropriate regulations governing operations of the obliged entity from that paragraph which pertain to reliance on third parties for the performance of activities.

9 Reporting to and supervision by the National Bank of Serbia 23. The obliged entity intending to offer to customers video identification option in accordance with this Decision shall notify the National Bank of Serbia thereof at least 30 days before implementing that option and shall submit, along with that notification, the documents proving that the conditions for carrying out the video identification procedure laid down by this Decision are met, as follows:

1. evidence that the obliged entity’s employees who will carry out the video identification procedure are trained in accordance with Section 3 hereof;
2. the list of all countries (including the Republic of Serbia) – issuers of personal documents for whose authentication the obliged entity's employees passed a special training, along with an appropriate proof thereof issued by the ministry in charge of internal affairs or other acceptable training organiser (for personal documents of the Republic of Serbia) and/or competent foreign authority;
3. the certificate referred to in Section 14, paragraph 1 hereof – if the video identification procedure at the obliged entity is to be carried out in English as well;
4. evidence that the obliged entity has appropriate premises for carrying out the video identification procedure, in accordance with Section 4 hereof;
5. evidence that the obliged entity has technical solutions referred to in Section 5 hereof;
6. internal regulations referred to in Section 24 hereof. If the obliged entity outsources video identification activities to a third party in accordance with Section 22 hereof, it shall also submit to the National Bank of Serbia the decision on outsourcing those activities to a third party, comprising the data on the business name and head office of the obliged entity to which those activities are outsourced. In the notification from paragraph 1 hereof, the obliged entity shall specify whether it intends to offer the video identification option to all customers within the meaning of this Decision or to a specific category of persons only (e.g. to offer the video identification option to a customer who is a natural person, but not to entrepreneurs and legal persons). The deadline referred to in paragraph 1 hereof shall run from the date of submission of the duly completed documentation from that paragraph.

10 The National Bank of Serbia shall publish on its website the list of obliged entities which submitted the notification and duly completed documentation referred to in paragraphs 1 and 2 hereof. 24. The obliged entity referred to in Section 23, paragraph 1 hereof shall regulate by its internal regulations the carrying out of the video identification procedure and implementation of other provisions of this Decision, by the date of submission of the notification from that paragraph. 25. If it finds irregularities in the performance of the video identification procedure at the obliged entity, the National Bank of Serbia may – apart from other measures laid down by the law governing the prevention of money laundering and terrorism financing – order the obliged entity to discontinue the carrying out of video identification procedures. Final provision 26. This Decision shall come into effect on the eighth day following its publication in the RS Official Gazette. NBS Executive Board No 33 Chairperson 7 March 2019 NBS Executive Board B e l g r a d e G o v e r n o r National Bank of Serbia Dr Jorgovanka Tabaković