Decision on Detailed Conditions and Manner of Supervision over Virtual Currency Service Providers and Virtual Currency Issuers and Holders

RS Official Gazette, No 49/2021 Pursuant to Article 10, paragraph 1, Article 124, paragraph 5 and Article 125, paragraph 4 of the Law on Digital Assets (RS Official Gazette, No 153/2020) and Article 18, paragraph 1, item 3) of the Law on the National Bank of Serbia (RS Official Gazette, Nos 72/2003, 55/2004, 85/2005 – other law, 44/2010, 76/2012, 106/2012, 14/2015, 40/2015 ‒ CC decision and 44/2018), the Governor of the National Bank of Serbia hereby issues D E C I S I O N ON DETAILED CONDITIONS AND MANNER OF SUPERVISION OVER VIRTUAL CURRENCY SERVICE PROVIDERS AND VIRTUAL CURRENCY ISSUERS AND HOLDERS Basic provisions 1 This Decision sets out the detailed conditions and manner of supervision which the National Bank of Serbia in accordance with the Law on Digital Assets (hereinafter: the Law) shall conduct over:

1. the operations of service providers;
2. virtual currency issuers;
3. present or past virtual currency holders. This Decision also sets out the detailed conditions and manner of undertaking measures in respect of supervised entities from paragraph 1, items 1) to 3) of this Decision (hereinafter: supervised entities) in the supervision procedure in accordance with the Law (hereinafter: supervision).

2. For the purposes of this Decision, the following definitions shall apply:

1. service provider means a digital asset service provider in the part of its operations pertaining to virtual currencies that is a company licensed by the National Bank of Serbia to provide virtual currency services;
2. virtual currency issuer means a domestic or foreign legal person, entrepreneur or natural person that has issued a virtual currency in the Republic of Serbia;
3. virtual currency holder means: – a legal person, entrepreneur or natural person that uses or has used a virtual currency service with a service provider, – a legal person or entrepreneur with its head office in the Republic of Serbia or doing business in the Republic of Serbia (e.g. through a branch office), or a natural person with a permanent or temporary residence in the Republic of Serbia – that have acquired a virtual currency, regardless of the manner of acquisition, and are not included in indent one of this

2 2 provision (e.g. a person that has acquired a virtual currency by participating in the provision of the service of computer verification of transactions in information systems pertaining to a certain virtual currency or based on direct purchase from a virtual currency seller, independently of the service provider ‒ OTC trading). A virtual currency holder, within the meaning of this Decision, shall also be a service provider that has acquired virtual currency for its own account, or is a virtual currency holder using virtual currencies in its own name or for its own account. 3. The provisions of this Decision shall apply accordingly to supervised entities who are entrepreneurs or natural persons – in the manner and to the extent in which such application is possible. 4. The National Bank of Serbia shall conduct supervision in each segment of a service provider’s operations. The National Bank of Serbia shall also conduct supervision in each segment of operations of a virtual currency issuer and holder that is directly and/or indirectly connected with virtual currencies. 5. The aim of supervision shall be to verify the compliance of the operations of supervised entities with the Law and regulations based on the Law, in the part of their operations pertaining to virtual currencies. The aim of supervision shall also be to verify the compliance of the operations of service providers and virtual currency issuers with the law and other regulations governing the prevention of money laundering and the financing of terrorism, the law governing the freezing of assets for preventing terrorism and the proliferation of weapons of mass destruction, regulations governing foreign exchange operations, regulations governing accounting, regulations governing information system management and other relevant regulations in the part of their operations pertaining to virtual currencies. Manner of conducting supervision and the supervision procedure 6. The National Bank of Serbia shall conduct supervision directly (on￾site) and indirectly (off-site). Indirect or off-site supervision shall be conducted by collecting, monitoring, verifying and analysing reports and other documents and data which the supervised entity provides to the National Bank of Serbia in accordance with the Law and regulations based on the Law, as well as other

3 3 documents, and/or other data about the supervised entity’s operations which the National Bank of Serbia has at its disposal. Direct or on-site supervision shall be conducted by the National Bank of Serbia on the premises of the supervised entity or persons having property, management or business links with the supervised entity – by insight into business books and other documents and data of the supervised entity or that person. Authorised persons shall compile a report on the conducted on-site supervision. The National Bank of Serbia shall make a report on the completed off￾site supervision if the supervision established that the supervised entity has committed illegalities and/or irregularities in the performance of operations in connection with virtual currencies. The follow-up procedure on the report on off-site supervision shall be subject to the provisions of this Decision referring to on-site supervision. 7. On-site supervision shall be conducted by National Bank of Serbia employees designated for this task by the decision of the Governor of the National Bank of Serbia (hereinafter: Governor) or by a person authorised by the Governor. The decision referred to in paragraph 1 of this Section shall particularly specify: the supervised entity or other persons that are being supervised, as well as the subject of such supervision. The Governor or a person authorised by the Governor may supplement or amend the decision from paragraph 1 of this Section in the course of on-site supervision. On-site supervision of an entity shall commence with the issuance of the decision from paragraph 1 of this Section. A supervised entity shall enable the authorised persons to conduct on￾site supervision of its operations and/or specific activities at its head office, branches and other organisational units. A supervised entity shall enable unhindered supervision to authorised persons and shall cooperate with those persons.

4 4 A supervised entity shall appoint a representative to provide all the necessary assistance to the authorised persons, enabling unimpeded conduct of on-site supervision. A supervised entity shall provide the necessary technical assistance to authorised persons in order to access data or business books and documents kept in an electronic form. The National Bank of Serbia may hire other persons to attend on-site supervision for the purposes of providing adequate expert support to authorised persons conducting supervision. 8. Authorised persons shall conduct on-site supervision on business days, during the regular working hours of the supervised entity, and when necessary due to the scope or nature of such supervision – the supervised entity shall enable the authorised persons to conduct such supervision even on non-business days and/or outside working hours. In the course of on-site supervision, authorised persons have the right to:

1. access all premises of the supervised entity;
2. request to be granted a separate room in which to perform on-site supervision tasks;
3. request to be given data, or copies of documents relating to the subject of on-site supervision, as well as to be granted access to information system resources of the supervised entity;
4. directly communicate with members of management, directors and responsible employees of the supervised entity in order to obtain the necessary clarifications. A supervised entity shall provide for inspection the business books, documents and data required by the authorised person in paper or electronically, and shall enable those persons unhindered and full access to equipment, data bases, computer programmes used and/or other information system resources. Data and documents from paragraph 3 of this Section may be copied, and conversations with members of management, directors and responsible employees of the supervised entity may be voice recorded. Conversations from paragraph 4 of this Section shall be voice recorded with a previous written consent of persons from that paragraph participating in the conversation.

5 5 If a person from paragraph 4 of this Section refuses voice recording without a justified reason, the National Bank of Serbia may take this into account when assessing the conduct of the supervised entity in the supervision procedure within the meaning of Section 20 of this Decision, as well as within the assessment of the criteria for undertaking measures set out in Article 138 of the Law. Pursuant to this Decision, members of management and directors of the supervised entity shall also provide to the authorised persons, at their request, answers to the questions asked, in writing and within the deadline set in the request and they shall also provide evidence corroborating those answers. 9. During supervision, the National Bank of Serbia may also, as set out in Sections 6 to 8 of this Decision, conduct supervision of a person to whom the supervised entity has outsourced some operational activities in accordance with the Law and regulations based on the Law, as well as of other persons having property, management or business links with the supervised entity. 10. At the National Bank of Serbia’s request, a supervised entity, just as persons from Section 9 of this Decision, shall provide all requested data and documents within the deadline stipulated in that request. If data and documents from paragraph 1 of this Section are compiled in a language other than Serbian, the National Bank of Serbia may request that the persons from that paragraph provide translations of those data and documents into Serbian at their expense. The National Bank of Serbia collects, processes and analyses data from paragraph 1 of this Section in accordance with Article 125 of the Law. The National Bank of Serbia may also act in accordance with paragraph 1 of this Section in order to collect, process and analyse data for statistical purposes in accordance with Article 125 of the Law. 11. The National Bank of Serbia shall submit to the supervised entity the report on the completed on-site supervision (hereinafter: report on supervision), to which the supervised entity may file objections within 15 business days from the receipt of the report. The National Bank of Serbia shall not consider the supervised entity’s objections from paragraph 1 of this Section relating to a change in the factual

6 6 situation that occurred after the completion of supervision (cut-off date), but may consider them when pronouncing measures in accordance with the Law. A supplement to the report on supervision shall be made in cases where, upon verification of the allegations stated in objections from paragraph 1 of this Section, the factual state is determined to be materially different from the one described in the report. The supplement to the report on supervision shall be delivered to the supervised entity within 15 business days following the submission of objections to the report. Objections within the meaning of paragraph 1 of this Section shall imply collective objections and allegations of members of management and director of the supervised entity, i.e. objections and allegations of the supervised entity. If a verification of allegations in the objections to the report on supervision determines that the supervised entity’s objections are unfounded or that they do not materially influence the established factual state – the National Bank of Serbia shall make an official note thereof and deliver it to the supervised entity. 12. The National Bank of Serbia shall adopt a decision on the termination of the supervision procedure if no irregularities or deficiencies in the operations of the supervised entity have been established in the report on supervision, or if the supervised entity, in its objections submitted within the deadline from Section 11, paragraph 1 of this Decision, has successfully disputed all findings from the report on supervision. The National Bank of Serbia may terminate the supervision procedure by a decision, if the supervised entity, within the deadline from Section 11, paragraph 1 of this Decision, provides evidence that the identified irregularities or deficiencies have been removed. The decision from paragraphs 1 and 2 of this Section shall be delivered to the supervised entity. Undertaking measures 13. If deficiencies or irregularities in the operations of the supervised entity are identified based on the factual state established in the report on supervision, or if it is determined that the supervised entity has acted in contravention of the Law or the regulation from Section 5 of this Decision –

7 7 the National Bank of Serbia shall take one of the measures from Article 132 of the Law with respect to that supervised entity. The measures from paragraph 1 of this Section shall be taken by the National Bank of Serbia with respect to the supervised entity based on the criteria for undertaking measures set out in Article 138 of the Law. 14. The recommendation from Article 133 of the Law (hereinafter: recommendation) shall be sent to the supervised entity in whose operations minor irregularities or deficiencies have been identified, which do not pose a significant risk. The recommendation shall include a deadline for the removal of irregularities or deficiencies from paragraph 1 of this Section, as well as the deadline within which the supervised entity is required to deliver to the National Bank of Serbia a report about the removed irregularities or deficiencies, with appropriate evidence. The National Bank of Serbia shall verify whether the supervised entity has removed the identified irregularities or deficiencies after the expiry of the deadline from paragraph 2 of this Section, or before the expiry of this deadline if it receives a notification from the supervised entity that the irregularities or deficiencies have been removed, and if it determines that the irregularities or deficiencies have indeed been removed within the deadline – it shall pass a decision terminating the supervision procedure, or if it determines that the irregularities or deficiencies have been removed to a great extent – it may pass a decision terminating the supervision procedure. 15. The letter of warning from Article 134 of the Law (hereinafter: letter of warning) shall be sent to the supervised entity in whose operations irregularities have been identified which do not have a significant and direct impact on the entity’s operations, but might have such impact unless eliminated, or if the entity failed to act in compliance with the recommendation. The letter of warning shall include a deadline for removing the irregularities from paragraph 1 of this Section, as well as the deadline within which the supervised entity is required to deliver to the National Bank of Serbia a report about the removed irregularities, with appropriate evidence. The National Bank of Serbia shall verify whether the supervised entity has removed the identified irregularities after the expiry of the deadline from paragraph 2 of this Section, or before the expiry of this deadline if it receives a notification from the supervised entity that the irregularities have been

8 8 removed, and if it determines that the irregularities have indeed been removed within the deadline – it shall pass a decision terminating the supervision procedure, or if it determines that the irregularities have been removed to a great extent – it may pass a decision terminating the supervision procedure. 16. The National Bank of Serbia shall pass a decision ordering the supervised entity to implement one or more activities from Article 135, paragraph 2 of the Law, which includes a deadline for the implementation of those activities that may not be longer than 60 days following the receipt of the decision, as well as a deadline for submitting a report about the removed irregularities, with appropriate evidence. The National Bank of Serbia shall inspect the implementation of activities from the decision referred to in paragraph 1 of this Section after the expiry of the deadline for their implementation, or before the expiry of this deadline if it receives a notification from the supervised entity that the activities have been implemented, and if it determines that the identified irregularities have indeed been removed within the deadline – it shall pass a decision terminating the supervision procedure, or if it determines that the irregularities have been removed to a great extent – it may pass a decision terminating the supervision procedure. 17. If new deficiencies or new irregularities are identified with the supervised entity that was imposed one of the measures from Article 132, paragraph 1, items 1) to 3) of the Law – the National Bank of Serbia may take a new measure from Article 132, paragraph 1 of the Law with respect to that supervised entity, in accordance with the criteria laid out in Article 138 of the Law. 18. The National Bank of Serbia shall pass a decision on revoking the licence for the provision of virtual currency services in cases stipulated in Article 137, paragraph 1 of the Law, and it may pass a decision on revoking such licence in cases stipulated in Article 137, paragraph 2 of the Law. 19. By the decision from Section 16, paragraph 1 of this Decision, the National Bank of Serbia may also impose a fine on the supervised entity, as well as on members of management or director of the supervised entity, in accordance with Article 136 of the Law. By the decision from Section 16, paragraph 1 of this Decision, the National Bank of Serbia may also impose a fine on natural persons who, at the time when the fine is pronounced, no longer have the capacity of members of management or director of the supervised entity – for failure to

9 9 act or a violation from Article 136, paragraph 1 of the Law, committed while these persons performed these functions within the supervised entity, in accordance with Article 136 of the Law. The decision from Section 16, paragraph 1 of this Decision shall become enforceable upon delivery to the person from paragraph 1 of this Section. For the purpose of imposing a fine on a member of management or a director of the supervised entity, in accordance with Article 136 of the Law, the supervised entity shall provide appropriate data to the National Bank of Serbia. If a member of management or director of the supervised entity, including persons who used to perform these functions within the supervised entity, fail to pay the fine within the deadline defined in the decision on imposing a fine – the supervised entity shall pay the fine within eight days after the expiry of the deadline set out in that decision. The fines from this Section shall be paid to the account of the National Bank of Serbia. The supervised entity shall submit to the National Bank of Serbia data about the payment of the fines from this Section to the National Bank of Serbia’s account (payment date and the business name of the payment service provider through which the payment was made), no later than within the deadline set out in the decision on imposing a fine, or within eight days after the expiry of that deadline if the supervised entity is paying the fine instead of the person from paragraph 5 of this Section. If the obligation under the fine is not paid within the deadline set out in the decision on imposing a fine, the National Bank of Serbia shall be entitled to calculate default interest on the amount of such debt. Enforceable decisions on imposing a fine from this Section shall constitute grounds for enforced collection from the account of the supervised entity in accordance with the law governing payment transactions. Conduct of the supervised entity during supervision 20. It shall be deemed that the supervised entity has not enabled the National Bank of Serbia to conduct supervision particularly in the following cases:

10 10

1. if it does not act in accordance with Sections 7 to 10 of this Decision;
2. if it fails to deliver all requested data and documents, or fails to deliver them within the deadline set out in the National Bank of Serbia’s request;
3. if it delivers incorrect or incomplete data intentionally or by gross negligence;
4. if it fails to provide conditions required for conducting on-site supervision to authorised persons, including conditions that ensure that authorised persons are not distracted in their work by the supervised entity’s employees or third persons;
5. if the supervised entity cannot be found at the address registered with the competent authority. If the service provider fails to enable the National Bank of Serbia to conduct supervision of its operations in accordance with this Decision, the National Bank of Serbia shall pass a decision on revoking the licence for the provision of virtual currency services.

21. The decisions, reports, notifications, requests and other supervision￾related acts of the National Bank of Serbia delivered to the supervised entity shall be deemed to have also been delivered to members of management and director of the supervised entity and no proof to the contrary shall be admissible. Final provision
22. This Decision shall enter into force on the eighth day following its publication in the RS Official Gazette and shall apply as of 29 June 2021. D. No 7 G o v e r n o r 13 May 2021 National Bank of Serbia B e l g r a d e Dr Jorgovanka Tabaković