Decision on Detailed Terms and Manner of Keeping the Single Register of Safe-deposit Boxes

RS Official Gazette, Nos 13/2020 and 41/2020 Pursuant to Article 103a, paragraph 7 of the Law on the Prevention of Money Laundering and Terrorism Financing (RS Official Gazette, Nos 113/2017 and 91/2019) and Article 18, paragraph 1, item 3) of the Law on the National Bank of Serbia (RS Official Gazette, Nos 72/2003, 55/2004, 85/2005 – other law, 44/2010, 76/2012, 106/2012, 14/2015, 40/2015 ‒ Constitutional Court decision and 44/2018), the Governor of the National Bank of Serbia hereby issues the following D E C I S I O N ON DETAILED TERMS AND MANNER OF KEEPING THE SINGLE REGISTER OF SAFE-DEPOSIT BOXES Basic provisions

1. This Decision sets forth detailed terms and manner in which the National Bank of Serbia keeps the Single Register of Safe-deposit Boxes, the manner of and deadlines for submitting the data kept in the Register and the manner of accessing these data.

2. The Single Register of Safe-deposit Boxes shall contain data on the holders of safe-deposit boxes kept by banks. Data on the contents of safe-deposit boxes shall not be kept in the Single Register of Safe-deposit Boxes.

3. A safe-deposit box holder shall, within the meaning of this Decision, mean a natural or legal person to which the bank has provided for use the safe-deposit box available to such bank, regardless of whether this person has permanent residence and/or head office in the territory of the Republic of Serbia, whether it is related with the bank and whether it pays a fee for using the safe-deposit box. A safe-deposit box holder which is a natural person shall, within the meaning of this Decision, have the meaning of a financial service consumer as defined by the law regulating the protection of financial services consumers. A safe-deposit box holder which is a legal person shall, within the meaning of this Decision, mean legal entities and other forms of organisation that are not considered a safe-deposit box holder referred to in paragraph 2 of this Section. A safe-deposit box shall, within the meaning of this Decision, not mean a safe￾deposit box which the bank uses exclusively for the purposes of its business operations and which it does not place at the disposal of other legal or natural persons. A safe-deposit box contract shall, within the meaning of this Decision, mean:

1. a safe-deposit box contract the meaning of which is defined by the law governing contracts and torts;
2. any other manner in which the bank factually provided the safe-deposit box for use by legal and natural persons.

4. The National Bank of Serbia shall keep the Single Register of Safe-deposit Boxes in electronic form, based on data submitted by banks.

2 Data kept in the Single Register of Safe-deposit Boxes 5. The Single Register of Safe-deposit Boxes shall contain the following data on a safe-deposit box holder – natural person:

1. date of conclusion and termination of the safe-deposit box contract, and period for which such contract is concluded;
2. name and surname of the safe-deposit box holder;
3. unique citizen identification number of the safe-deposit box holder and/or other appropriate identity designation for holders without the Republic of Serbia’s citizenship (e.g. passport number or register number designated by the competent state authority);
4. address of permanent residence and/or temporary residence of the safe￾deposit box holder (place, street and number), and for holders without the Republic of Serbia’s citizenship, also the name of the country;
5. name and surname of persons authorised to access the holder’s safe-deposit box;
6. unique citizen identification number of persons authorised to access the holder’s safe-deposit box and/or other appropriate identity designation of such persons if they do not have the Republic of Serbia’s citizenship (e.g. passport number or register number designated by the competent state authority);
7. address of permanent residence and/or temporary residence of persons authorised to access the holder’s safe-deposit box (place, street and number), and for authorised persons without the Republic of Serbia’s citizenship, also the name of the country;
8. status of the safe-deposit box: 0 – active, 1 – prohibition of disposal, 2 – termination of the safe-deposit box contract, and/or of factual use of the safe-deposit box;
9. type and description of change in the data referred to in indents 1) to 8) of this Section (e.g. change of address of permanent or temporary residence, period of duration of the safe-deposit box contract or person authorised to access the safe-deposit box);
10. date of the change referred to in indent 9) of this Section.

6. The Single Register of Safe-deposit Boxes shall contain the following data on a safe-deposit box holder– legal person:

1. date of conclusion and termination of the safe-deposit box contract, and period for which such contract is concluded;
2. business name or abbreviated business name of the safe-deposit box holder;
3. head office address of the safe-deposit box holder (place, street and number), and for holders which are foreign legal persons, also the name of the country;
4. identification number of the safe-deposit box holder and/or other appropriate identity designation of this person if the safe-deposit box holder is a foreign legal person (e.g. register number designated by the competent state authority);
5. tax identification number of the safe-deposit box holder;
6. name and surname of persons authorised to access the holder’s safe-deposit box;

3 7) unique citizen identification number of persons authorised to access the holder’s safe-deposit box and/or other appropriate identity designation of such persons if they do not have the Republic of Serbia’s citizenship (e.g. passport number or register number designated by the competent state authority); 8) address of permanent residence and/or temporary residence of persons authorised to access the holder’s safe-deposit box (place, street and number), and for authorised persons without the Republic of Serbia’s citizenship, also the name of the country; 9) status of the safe-deposit box: 0 – active, 1 – prohibition of disposal, 2 – termination of the safe-deposit box contract and/or of factual use of the safe-deposit box; 10) type and description of change in the data referred to in indents 1) to 9) of this Section (e.g. change of head office address of the safe-deposit box holder, and/or permanent or temporary residence of the person authorised to access the safe-deposit box, period of duration of the safe-deposit box contract or the person authorised to access the safe-deposit box); 11) date of the change referred to in indent 10) of this Section. Manner and deadlines for submitting data 7. Banks shall submit the data referred to in Sections 5 and 6 of this Decision to the National Bank of Serbia, including information on any change in these data. 8. The data from this Decision shall be submitted electronically in accordance with the technical guidelines of the National Bank of Serbia defining the manner of submitting data for the purpose of keeping the Single Register of Safe-deposit Boxes. 9. The data referred to in Sections 5 and 6 of this Decision shall be submitted immediately after the conclusion of a safe-deposit box contract or a change in these data, by no later than the end of the business day when the contract was concluded and/or when the change occurred. Data are submitted to the Single Register of Safe-deposit Boxes each business day from 10 am to 9 pm. If a safe-deposit box contract was concluded and/or the change in the data referred to in Sections 5 and 6 of this Decision occurred during a non-working day, the data referred to in these sections shall be submitted to the Single Register of Safe-deposit Boxes by no later than 12 noon on the first following business day. Non-working days referred to in paragraph 3 of this Section shall mean Saturdays, Sundays and official state and religious holidays observed and considered non-working days in the Republic of Serbia. 10. A bank shall be responsible for the accuracy of data submitted in accordance with this Decision, and the National Bank of Serbia shall be responsible for ensuring that the data from the Single Register of Safe-deposit Boxes are identical to the submitted data. Accessing data from the Single Register of Safe-deposit Boxes

4 11. The data from the Single Register of Safe-deposit Boxes shall not be publicly available and regulations governing banking secret and personal data protection shall apply to such data. The authorities and persons authorised pursuant to the regulations referred to in paragraph 1 of this Section to have access to data from the Single Register of Safe￾deposit Boxes shall be allowed such access by the National Bank of Serbia exclusively via a special applicative solution, based on the received request signed by a qualified electronic signature. Apart from the special applicative solution, in the case of courts and other competent authorities, these data may also be provided based on a written request, in accordance with law. By way of exception to paragraph 2 of this Section, authorised persons in competent authorities in a criminal procedure, organisational unit of the Ministry of the Interior in charge of financial investigation, Administration for the Prevention of Money Laundering and organisational units in the National Bank of Serbia whose remit includes the supervision of financial institutions may also be allowed direct access to the data from the Single Register of Safe-deposit Boxes via a special applicative solution, in accordance with technical capabilities that do not threaten the security of the National Bank of Serbia’s information system. The National Bank of Serbia may issue technical guidelines to define in more detail the manner of gaining access to the data from the Single Register of Safe-deposit Boxes via the applicative solution referred to in paragraphs 2 and 3 of this Section. The persons provided access to the data referred to in paragraph 1 of this Section may use these data exclusively for the purpose for which they were obtained and may not communicate or supply the data to third persons, nor may they give access to these data to third persons, except in the cases determined by law. The data referred to in paragraph 1 of this Section which relate to a particular safe-deposit box may be supplied to the holder of such safe-deposit box and/or the person authorised to access such safe-deposit box, based on such person’s request submitted in written or another appropriate form, along with a copy and/or reading of the ID card, or a copy of the passport. Transitional and closing provisions 12. A bank shall, by 15 June 2020, submit the data from Sections 5 and 6 of this Decision for all safe-deposit box holders with which it concluded a safe-deposit box contract within the meaning of this Decision, in particular:

1. for all safe-deposit box holders using the safe-deposit box as at 1 June 2020, regardless of when they concluded a safe-deposit box contract;
2. for all safe-deposit box holders who concluded a safe-deposit box contract after the entry into force of this Decision, whose safe-deposit box contract and/or factual use of the safe-deposit box ceased before 1 June 2020.

5 13. This Decision shall enter into force on the eighth day from the day of its publication in the RS Official Gazette and shall apply as of 1 June 2020. D. No. 2 G o v e r n o r 10 February 2020 National Bank of Serbia B e l g r a d e Dr Jorgovanka Tabaković, sign.